From: Russ Combs Date: Tue, 10 Jun 2014 19:25:09 +0000 (-0400) Subject: added examples source (extra/) and autotools foo X-Git-Tag: 3.0.0-233~1497 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=99b44e7f9e8d372a6f3dcc4ba5ed01c424d9e16c;p=thirdparty%2Fsnort3.git added examples source (extra/) and autotools foo --- diff --git a/extra/Makefile.am b/extra/Makefile.am new file mode 100644 index 000000000..2269e4c49 --- /dev/null +++ b/extra/Makefile.am @@ -0,0 +1,6 @@ +AUTOMAKE_OPTIONS=foreign no-dependencies + +SUBDIRS = \ +src + +AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/extra/configure.ac b/extra/configure.ac new file mode 100644 index 000000000..6a2df6511 --- /dev/null +++ b/extra/configure.ac @@ -0,0 +1,79 @@ +# Process this file with autoconf to produce a configure script. + +AC_INIT([snort_examples], [1.0], [snort-team@sourcefire.com]) +AC_PREREQ(2.69) + +AC_CONFIG_SRCDIR([config.h.in]) +AC_CONFIG_MACRO_DIR([m4]) +AC_CONFIG_HEADERS([config.h]) + +AM_INIT_AUTOMAKE + +# Checks for programs. +AC_PROG_CXX +AC_PROG_LIBTOOL + +# Use the same defines Snort used +# (absolutely critical to ensure struct definitions match) +CXXFLAGS=`pkg-config --cflags snort` + +AM_CXXFLAGS="-std=c++11" +AX_CXX_COMPILE_STDCXX_11 + +# not sure why this is borked +#AC_ENABLE_VISIBILITY() +# +# so we do like snort: +# modified from gnulib/m4/visibility.m4 +AC_DEFUN([CC_VISIBILITY], +[ + AC_REQUIRE([AC_PROG_CC]) + AC_MSG_CHECKING([for visibility support]) + AC_CACHE_VAL(gl_cv_cc_visibility, [ + gl_save_CFLAGS="$CFLAGS" + # Add -Werror flag since some compilers, e.g. icc 7.1, don't support it, + # but only warn about it instead of compilation failing + CFLAGS="$CFLAGS -Werror -fvisibility=hidden" + AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ + extern __attribute__((__visibility__("hidden"))) int hiddenvar; + extern __attribute__((__visibility__("default"))) int exportedvar; + extern __attribute__((__visibility__("hidden"))) int hiddenfunc (void); + extern __attribute__((__visibility__("default"))) int exportedfunc (void);]], + [[]])], + [gl_cv_cc_visibility="yes"], + [gl_cv_cc_visibility="no"]) + ]) + AC_MSG_RESULT([$gl_cv_cc_visibility]) + CFLAGS="$gl_save_CFLAGS" + if test "x$gl_cv_cc_visibility" = "xyes"; then + AM_CXXFLAGS="$AM_CXXFLAGS -fvisibility=default" + AC_DEFINE([HAVE_VISIBILITY],[1], + [Define if the compiler supports visibility declarations.]) + fi +]) +CC_VISIBILITY() + +# Checks for libraries. +AC_ARG_WITH(snort-includes, + [ --with-snort-includes=DIR snort include directory], + [with_snort_includes="$withval"], [with_snort_includes="no"]) + +if test "x$with_snort_includes" != "xno"; then + AM_CPPFLAGS="${AM_CPPFLAGS} -I${with_snort_includes}" +fi + +AC_SUBST(AM_CXXFLAGS) +AC_SUBST(AM_CPPFLAGS) + +AC_CONFIG_FILES([ \ + Makefile \ + src/Makefile \ + src/inspectors/Makefile \ + src/ips_options/Makefile \ + src/loggers/Makefile \ + src/search_engines/Makefile \ + src/so_rules/Makefile \ +]) + +AC_OUTPUT + diff --git a/extra/src/.deps/libalert_ex_la-alert_ex.Plo b/extra/src/.deps/libalert_ex_la-alert_ex.Plo new file mode 100644 index 000000000..267497032 --- /dev/null +++ b/extra/src/.deps/libalert_ex_la-alert_ex.Plo @@ -0,0 +1,631 @@ +libalert_ex_la-alert_ex.lo: alert_ex.cc ../config.h /usr/include/ctype.h \ + /usr/include/runetype.h /usr/include/_types.h /usr/include/sys/_types.h \ + /usr/include/sys/cdefs.h /usr/include/sys/_symbol_aliasing.h \ + /usr/include/sys/_posix_availability.h /usr/include/machine/_types.h \ + /usr/include/i386/_types.h /usr/include/string.h \ + /usr/include/Availability.h /usr/include/AvailabilityInternal.h \ + /usr/include/strings.h /opt/local/include/gcc49/c++/algorithm \ + /opt/local/include/gcc49/c++/utility \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++config.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/os_defines.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/cpu_defines.h \ + /opt/local/include/gcc49/c++/bits/stl_relops.h \ + /opt/local/include/gcc49/c++/bits/stl_pair.h \ + /opt/local/include/gcc49/c++/bits/move.h \ + /opt/local/include/gcc49/c++/bits/concept_check.h \ + /opt/local/include/gcc49/c++/type_traits \ + /opt/local/include/gcc49/c++/initializer_list \ + /opt/local/include/gcc49/c++/bits/stl_algobase.h \ + /opt/local/include/gcc49/c++/bits/functexcept.h \ + /opt/local/include/gcc49/c++/bits/exception_defines.h \ + /opt/local/include/gcc49/c++/bits/cpp_type_traits.h \ + /opt/local/include/gcc49/c++/ext/type_traits.h \ + /opt/local/include/gcc49/c++/ext/numeric_traits.h \ + /opt/local/include/gcc49/c++/bits/stl_iterator_base_types.h \ + /opt/local/include/gcc49/c++/bits/stl_iterator_base_funcs.h \ + /opt/local/include/gcc49/c++/debug/debug.h \ + /opt/local/include/gcc49/c++/bits/stl_iterator.h \ + /opt/local/include/gcc49/c++/bits/ptr_traits.h \ + /opt/local/include/gcc49/c++/bits/predefined_ops.h \ + /opt/local/include/gcc49/c++/bits/stl_algo.h \ + /opt/local/include/gcc49/c++/cstdlib /usr/include/stdlib.h \ + /usr/include/sys/wait.h /usr/include/sys/signal.h \ + /usr/include/sys/appleapiopts.h /usr/include/machine/signal.h \ + /usr/include/i386/signal.h /usr/include/i386/_structs.h \ + /usr/include/sys/_structs.h /usr/include/machine/_structs.h \ + /usr/include/mach/i386/_structs.h /usr/include/sys/resource.h \ + /usr/include/machine/endian.h /usr/include/i386/endian.h \ + /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \ + /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \ + /usr/include/machine/types.h /usr/include/i386/types.h \ + /opt/local/include/gcc49/c++/bits/algorithmfwd.h \ + /opt/local/include/gcc49/c++/bits/stl_heap.h \ + /opt/local/include/gcc49/c++/bits/stl_tempbuf.h \ + /opt/local/include/gcc49/c++/bits/stl_construct.h \ + /opt/local/include/gcc49/c++/new /opt/local/include/gcc49/c++/exception \ + /opt/local/include/gcc49/c++/bits/atomic_lockfree_defines.h \ + /opt/local/include/gcc49/c++/bits/exception_ptr.h \ + /opt/local/include/gcc49/c++/bits/nested_exception.h \ + /opt/local/include/gcc49/c++/ext/alloc_traits.h \ + /opt/local/include/gcc49/c++/bits/alloc_traits.h \ + /opt/local/include/gcc49/c++/bits/memoryfwd.h \ + /opt/local/include/gcc49/c++/random /opt/local/include/gcc49/c++/cmath \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/math.h \ + /opt/local/include/gcc49/c++/string \ + /opt/local/include/gcc49/c++/bits/stringfwd.h \ + /opt/local/include/gcc49/c++/bits/char_traits.h \ + /opt/local/include/gcc49/c++/bits/postypes.h \ + /opt/local/include/gcc49/c++/cwchar /usr/include/wchar.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h \ + /usr/include/stdio.h /usr/include/time.h /usr/include/_structs.h \ + /usr/include/_wctype.h /opt/local/include/gcc49/c++/cstdint \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h \ + /opt/local/include/gcc49/c++/bits/allocator.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++allocator.h \ + /opt/local/include/gcc49/c++/ext/new_allocator.h \ + /opt/local/include/gcc49/c++/bits/localefwd.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++locale.h \ + /opt/local/include/gcc49/c++/clocale /usr/include/locale.h \ + /usr/include/_locale.h /opt/local/include/gcc49/c++/iosfwd \ + /opt/local/include/gcc49/c++/cctype \ + /opt/local/include/gcc49/c++/bits/ostream_insert.h \ + /opt/local/include/gcc49/c++/bits/cxxabi_forced.h \ + /opt/local/include/gcc49/c++/bits/stl_function.h \ + /opt/local/include/gcc49/c++/backward/binders.h \ + /opt/local/include/gcc49/c++/bits/range_access.h \ + /opt/local/include/gcc49/c++/bits/basic_string.h \ + /opt/local/include/gcc49/c++/ext/atomicity.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/gthr.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/gthr-default.h \ + /usr/include/pthread.h /usr/include/pthread_impl.h /usr/include/sched.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/atomic_word.h \ + /opt/local/include/gcc49/c++/ext/string_conversions.h \ + /opt/local/include/gcc49/c++/cstdio /opt/local/include/gcc49/c++/cerrno \ + /usr/include/errno.h /usr/include/sys/errno.h \ + /opt/local/include/gcc49/c++/bits/functional_hash.h \ + /opt/local/include/gcc49/c++/bits/hash_bytes.h \ + /opt/local/include/gcc49/c++/bits/basic_string.tcc \ + /opt/local/include/gcc49/c++/limits \ + /opt/local/include/gcc49/c++/bits/random.h \ + /opt/local/include/gcc49/c++/vector \ + /opt/local/include/gcc49/c++/bits/stl_uninitialized.h \ + /opt/local/include/gcc49/c++/bits/stl_vector.h \ + /opt/local/include/gcc49/c++/bits/stl_bvector.h \ + /opt/local/include/gcc49/c++/bits/vector.tcc \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/opt_random.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/x86intrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/ia32intrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xmmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mm_malloc.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/emmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/pmmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/tmmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/ammintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/smmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/popcntintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/wmmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/immintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avxintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx2intrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512fintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512erintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512pfintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512cdintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/shaintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/lzcntintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/bmiintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/bmi2intrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fmaintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/f16cintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/rtmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xtestintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mm3dnow.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/prfchwintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fma4intrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xopintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/lwpintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/tbmintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/rdseedintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fxsrintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xsaveintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xsaveoptintrin.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/adxintrin.h \ + /opt/local/include/gcc49/c++/bits/random.tcc \ + /opt/local/include/gcc49/c++/numeric \ + /opt/local/include/gcc49/c++/bits/stl_numeric.h \ + /opt/local/include/gcc49/c++/iostream \ + /opt/local/include/gcc49/c++/ostream /opt/local/include/gcc49/c++/ios \ + /opt/local/include/gcc49/c++/bits/ios_base.h \ + /opt/local/include/gcc49/c++/bits/locale_classes.h \ + /opt/local/include/gcc49/c++/bits/locale_classes.tcc \ + /opt/local/include/gcc49/c++/streambuf \ + /opt/local/include/gcc49/c++/bits/streambuf.tcc \ + /opt/local/include/gcc49/c++/bits/basic_ios.h \ + /opt/local/include/gcc49/c++/bits/locale_facets.h \ + /opt/local/include/gcc49/c++/cwctype /usr/include/wctype.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/ctype_base.h \ + /opt/local/include/gcc49/c++/bits/streambuf_iterator.h \ + /opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/ctype_inline.h \ + /opt/local/include/gcc49/c++/bits/locale_facets.tcc \ + /opt/local/include/gcc49/c++/bits/basic_ios.tcc \ + /opt/local/include/gcc49/c++/bits/ostream.tcc \ + /opt/local/include/gcc49/c++/istream \ + /opt/local/include/gcc49/c++/bits/istream.tcc \ + /Users/rucombs/install/include/snort/snort_types.h \ + /usr/include/sys/types.h /usr/include/inttypes.h \ + /Users/rucombs/install/include/snort/framework/event_handler.h \ + /Users/rucombs/install/include/snort/events/event.h \ + /Users/rucombs/install/include/snort/thread.h \ + /Users/rucombs/install/include/snort/framework/api_base.h \ + /Users/rucombs/install/include/snort/protocols/packet.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h \ + /usr/include/sys/socket.h /usr/include/machine/_param.h \ + /usr/include/i386/_param.h /usr/include/netinet/in.h \ + /usr/include/netinet6/in6.h /usr/include/net/if.h \ + /usr/include/net/if_var.h /usr/include/sys/time.h \ + /usr/include/sys/_select.h /usr/include/sys/queue.h \ + /usr/local/include/daq.h /usr/local/include/daq_common.h \ + /usr/include/unistd.h /usr/include/sys/unistd.h \ + /usr/include/sys/select.h /usr/local/include/sfbpf_dlt.h \ + /Users/rucombs/install/include/snort/protocols/sf_protocols.h \ + /Users/rucombs/install/include/snort/sfip/ipv6_port.h \ + /Users/rucombs/install/include/snort/sfip/sf_ip.h \ + /usr/include/arpa/inet.h \ + /Users/rucombs/install/include/snort/sfip/sfip_t.h \ + /Users/rucombs/install/include/snort/snort_debug.h \ + /Users/rucombs/install/include/snort/snort_types.h \ + /Users/rucombs/install/include/snort/sfip/sf_ipvar.h \ + /Users/rucombs/install/include/snort/sfip/sf_iph.h \ + /Users/rucombs/install/include/snort/detection/signature.h \ + /Users/rucombs/install/include/snort/hash/sfghash.h \ + /Users/rucombs/install/include/snort/hash/sfhashfcn.h + +../config.h: + +/usr/include/ctype.h: + +/usr/include/runetype.h: + +/usr/include/_types.h: + +/usr/include/sys/_types.h: + +/usr/include/sys/cdefs.h: + +/usr/include/sys/_symbol_aliasing.h: + +/usr/include/sys/_posix_availability.h: + +/usr/include/machine/_types.h: + +/usr/include/i386/_types.h: + +/usr/include/string.h: + +/usr/include/Availability.h: + +/usr/include/AvailabilityInternal.h: + +/usr/include/strings.h: + +/opt/local/include/gcc49/c++/algorithm: + +/opt/local/include/gcc49/c++/utility: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++config.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/os_defines.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/cpu_defines.h: + +/opt/local/include/gcc49/c++/bits/stl_relops.h: + +/opt/local/include/gcc49/c++/bits/stl_pair.h: + +/opt/local/include/gcc49/c++/bits/move.h: + +/opt/local/include/gcc49/c++/bits/concept_check.h: + +/opt/local/include/gcc49/c++/type_traits: + +/opt/local/include/gcc49/c++/initializer_list: + +/opt/local/include/gcc49/c++/bits/stl_algobase.h: + +/opt/local/include/gcc49/c++/bits/functexcept.h: + +/opt/local/include/gcc49/c++/bits/exception_defines.h: + +/opt/local/include/gcc49/c++/bits/cpp_type_traits.h: + +/opt/local/include/gcc49/c++/ext/type_traits.h: + +/opt/local/include/gcc49/c++/ext/numeric_traits.h: + +/opt/local/include/gcc49/c++/bits/stl_iterator_base_types.h: + +/opt/local/include/gcc49/c++/bits/stl_iterator_base_funcs.h: + +/opt/local/include/gcc49/c++/debug/debug.h: + +/opt/local/include/gcc49/c++/bits/stl_iterator.h: + +/opt/local/include/gcc49/c++/bits/ptr_traits.h: + +/opt/local/include/gcc49/c++/bits/predefined_ops.h: + +/opt/local/include/gcc49/c++/bits/stl_algo.h: + +/opt/local/include/gcc49/c++/cstdlib: + +/usr/include/stdlib.h: + +/usr/include/sys/wait.h: + +/usr/include/sys/signal.h: + +/usr/include/sys/appleapiopts.h: + +/usr/include/machine/signal.h: + +/usr/include/i386/signal.h: + +/usr/include/i386/_structs.h: + +/usr/include/sys/_structs.h: + +/usr/include/machine/_structs.h: + +/usr/include/mach/i386/_structs.h: + +/usr/include/sys/resource.h: + +/usr/include/machine/endian.h: + +/usr/include/i386/endian.h: + +/usr/include/sys/_endian.h: + +/usr/include/libkern/_OSByteOrder.h: + +/usr/include/libkern/i386/_OSByteOrder.h: + +/usr/include/alloca.h: + +/usr/include/machine/types.h: + +/usr/include/i386/types.h: + +/opt/local/include/gcc49/c++/bits/algorithmfwd.h: + +/opt/local/include/gcc49/c++/bits/stl_heap.h: + +/opt/local/include/gcc49/c++/bits/stl_tempbuf.h: + +/opt/local/include/gcc49/c++/bits/stl_construct.h: + +/opt/local/include/gcc49/c++/new: + +/opt/local/include/gcc49/c++/exception: + +/opt/local/include/gcc49/c++/bits/atomic_lockfree_defines.h: + +/opt/local/include/gcc49/c++/bits/exception_ptr.h: + +/opt/local/include/gcc49/c++/bits/nested_exception.h: + +/opt/local/include/gcc49/c++/ext/alloc_traits.h: + +/opt/local/include/gcc49/c++/bits/alloc_traits.h: + +/opt/local/include/gcc49/c++/bits/memoryfwd.h: + +/opt/local/include/gcc49/c++/random: + +/opt/local/include/gcc49/c++/cmath: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/math.h: + +/opt/local/include/gcc49/c++/string: + +/opt/local/include/gcc49/c++/bits/stringfwd.h: + +/opt/local/include/gcc49/c++/bits/char_traits.h: + +/opt/local/include/gcc49/c++/bits/postypes.h: + +/opt/local/include/gcc49/c++/cwchar: + +/usr/include/wchar.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h: + +/usr/include/stdio.h: + +/usr/include/time.h: + +/usr/include/_structs.h: + +/usr/include/_wctype.h: + +/opt/local/include/gcc49/c++/cstdint: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h: + +/opt/local/include/gcc49/c++/bits/allocator.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++allocator.h: + +/opt/local/include/gcc49/c++/ext/new_allocator.h: + +/opt/local/include/gcc49/c++/bits/localefwd.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/c++locale.h: + +/opt/local/include/gcc49/c++/clocale: + +/usr/include/locale.h: + +/usr/include/_locale.h: + +/opt/local/include/gcc49/c++/iosfwd: + +/opt/local/include/gcc49/c++/cctype: + +/opt/local/include/gcc49/c++/bits/ostream_insert.h: + +/opt/local/include/gcc49/c++/bits/cxxabi_forced.h: + +/opt/local/include/gcc49/c++/bits/stl_function.h: + +/opt/local/include/gcc49/c++/backward/binders.h: + +/opt/local/include/gcc49/c++/bits/range_access.h: + +/opt/local/include/gcc49/c++/bits/basic_string.h: + +/opt/local/include/gcc49/c++/ext/atomicity.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/gthr.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/gthr-default.h: + +/usr/include/pthread.h: + +/usr/include/pthread_impl.h: + +/usr/include/sched.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/atomic_word.h: + +/opt/local/include/gcc49/c++/ext/string_conversions.h: + +/opt/local/include/gcc49/c++/cstdio: + +/opt/local/include/gcc49/c++/cerrno: + +/usr/include/errno.h: + +/usr/include/sys/errno.h: + +/opt/local/include/gcc49/c++/bits/functional_hash.h: + +/opt/local/include/gcc49/c++/bits/hash_bytes.h: + +/opt/local/include/gcc49/c++/bits/basic_string.tcc: + +/opt/local/include/gcc49/c++/limits: + +/opt/local/include/gcc49/c++/bits/random.h: + +/opt/local/include/gcc49/c++/vector: + +/opt/local/include/gcc49/c++/bits/stl_uninitialized.h: + +/opt/local/include/gcc49/c++/bits/stl_vector.h: + +/opt/local/include/gcc49/c++/bits/stl_bvector.h: + +/opt/local/include/gcc49/c++/bits/vector.tcc: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/opt_random.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/x86intrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/ia32intrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xmmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mm_malloc.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/emmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/pmmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/tmmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/ammintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/smmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/popcntintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/wmmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/immintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avxintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx2intrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512fintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512erintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512pfintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/avx512cdintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/shaintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/lzcntintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/bmiintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/bmi2intrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fmaintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/f16cintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/rtmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xtestintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/mm3dnow.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/prfchwintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fma4intrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xopintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/lwpintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/tbmintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/rdseedintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/fxsrintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xsaveintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/xsaveoptintrin.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/adxintrin.h: + +/opt/local/include/gcc49/c++/bits/random.tcc: + +/opt/local/include/gcc49/c++/numeric: + +/opt/local/include/gcc49/c++/bits/stl_numeric.h: + +/opt/local/include/gcc49/c++/iostream: + +/opt/local/include/gcc49/c++/ostream: + +/opt/local/include/gcc49/c++/ios: + +/opt/local/include/gcc49/c++/bits/ios_base.h: + +/opt/local/include/gcc49/c++/bits/locale_classes.h: + +/opt/local/include/gcc49/c++/bits/locale_classes.tcc: + +/opt/local/include/gcc49/c++/streambuf: + +/opt/local/include/gcc49/c++/bits/streambuf.tcc: + +/opt/local/include/gcc49/c++/bits/basic_ios.h: + +/opt/local/include/gcc49/c++/bits/locale_facets.h: + +/opt/local/include/gcc49/c++/cwctype: + +/usr/include/wctype.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/ctype_base.h: + +/opt/local/include/gcc49/c++/bits/streambuf_iterator.h: + +/opt/local/include/gcc49/c++/x86_64-apple-darwin12/bits/ctype_inline.h: + +/opt/local/include/gcc49/c++/bits/locale_facets.tcc: + +/opt/local/include/gcc49/c++/bits/basic_ios.tcc: + +/opt/local/include/gcc49/c++/bits/ostream.tcc: + +/opt/local/include/gcc49/c++/istream: + +/opt/local/include/gcc49/c++/bits/istream.tcc: + +/Users/rucombs/install/include/snort/snort_types.h: + +/usr/include/sys/types.h: + +/usr/include/inttypes.h: + +/Users/rucombs/install/include/snort/framework/event_handler.h: + +/Users/rucombs/install/include/snort/events/event.h: + +/Users/rucombs/install/include/snort/thread.h: + +/Users/rucombs/install/include/snort/framework/api_base.h: + +/Users/rucombs/install/include/snort/protocols/packet.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h: + +/usr/include/sys/socket.h: + +/usr/include/machine/_param.h: + +/usr/include/i386/_param.h: + +/usr/include/netinet/in.h: + +/usr/include/netinet6/in6.h: + +/usr/include/net/if.h: + +/usr/include/net/if_var.h: + +/usr/include/sys/time.h: + +/usr/include/sys/_select.h: + +/usr/include/sys/queue.h: + +/usr/local/include/daq.h: + +/usr/local/include/daq_common.h: + +/usr/include/unistd.h: + +/usr/include/sys/unistd.h: + +/usr/include/sys/select.h: + +/usr/local/include/sfbpf_dlt.h: + +/Users/rucombs/install/include/snort/protocols/sf_protocols.h: + +/Users/rucombs/install/include/snort/sfip/ipv6_port.h: + +/Users/rucombs/install/include/snort/sfip/sf_ip.h: + +/usr/include/arpa/inet.h: + +/Users/rucombs/install/include/snort/sfip/sfip_t.h: + +/Users/rucombs/install/include/snort/snort_debug.h: + +/Users/rucombs/install/include/snort/snort_types.h: + +/Users/rucombs/install/include/snort/sfip/sf_ipvar.h: + +/Users/rucombs/install/include/snort/sfip/sf_iph.h: + +/Users/rucombs/install/include/snort/detection/signature.h: + +/Users/rucombs/install/include/snort/hash/sfghash.h: + +/Users/rucombs/install/include/snort/hash/sfhashfcn.h: diff --git a/extra/src/.deps/libdpx_la-dpx.Plo b/extra/src/.deps/libdpx_la-dpx.Plo new file mode 100644 index 000000000..22cc0c3f0 --- /dev/null +++ b/extra/src/.deps/libdpx_la-dpx.Plo @@ -0,0 +1,220 @@ +libdpx_la-dpx.lo: dpx.cc /usr/include/assert.h /usr/include/sys/cdefs.h \ + /usr/include/sys/_symbol_aliasing.h \ + /usr/include/sys/_posix_availability.h /usr/include/stdlib.h \ + /usr/include/Availability.h /usr/include/AvailabilityInternal.h \ + /usr/include/_types.h /usr/include/sys/_types.h \ + /usr/include/machine/_types.h /usr/include/i386/_types.h \ + /usr/include/sys/wait.h /usr/include/sys/signal.h \ + /usr/include/sys/appleapiopts.h /usr/include/machine/signal.h \ + /usr/include/i386/signal.h /usr/include/i386/_structs.h \ + /usr/include/sys/_structs.h /usr/include/machine/_structs.h \ + /usr/include/mach/i386/_structs.h /usr/include/sys/resource.h \ + /usr/include/machine/endian.h /usr/include/i386/endian.h \ + /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \ + /usr/include/libkern/i386/_OSByteOrder.h /usr/include/alloca.h \ + /usr/include/machine/types.h /usr/include/i386/types.h \ + /usr/include/sys/types.h /usr/include/ctype.h /usr/include/runetype.h \ + /usr/include/string.h /usr/include/strings.h ../config.h \ + /Users/rucombs/install/include/snort/snort_debug.h /usr/include/wchar.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h \ + /usr/include/stdio.h /usr/include/time.h /usr/include/_structs.h \ + /usr/include/_wctype.h \ + /Users/rucombs/install/include/snort/snort_types.h \ + /usr/include/inttypes.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h \ + /Users/rucombs/install/include/snort/snort_types.h \ + /Users/rucombs/install/include/snort/events/event_queue.h \ + /Users/rucombs/install/include/snort/framework/packet_handler.h \ + /Users/rucombs/install/include/snort/thread.h \ + /Users/rucombs/install/include/snort/framework/api_base.h \ + /Users/rucombs/install/include/snort/log/messages.h \ + /Users/rucombs/install/include/snort/sfip/sf_ipvar.h \ + /Users/rucombs/install/include/snort/sfip/sf_ip.h \ + /usr/include/netinet/in.h /usr/include/sys/socket.h \ + /usr/include/machine/_param.h /usr/include/i386/_param.h \ + /usr/include/netinet6/in6.h /usr/include/arpa/inet.h \ + /Users/rucombs/install/include/snort/sfip/sfip_t.h \ + /Users/rucombs/install/include/snort/sfip/ipv6_port.h \ + /Users/rucombs/install/include/snort/protocols/packet.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h \ + /usr/include/net/if.h /usr/include/net/if_var.h /usr/include/sys/time.h \ + /usr/include/sys/_select.h /usr/include/sys/queue.h \ + /usr/local/include/daq.h /usr/local/include/daq_common.h \ + /usr/include/unistd.h /usr/include/sys/unistd.h \ + /usr/include/sys/select.h /usr/local/include/sfbpf_dlt.h \ + /Users/rucombs/install/include/snort/protocols/sf_protocols.h \ + /Users/rucombs/install/include/snort/sfip/sf_iph.h \ + /Users/rucombs/install/include/snort/time/profiler.h \ + /Users/rucombs/install/include/snort/time/cpuclock.h \ + /Users/rucombs/install/include/snort/utils/stats.h /usr/include/errno.h \ + /usr/include/sys/errno.h /usr/include/strings.h \ + /Users/rucombs/install/include/snort/utils/sflsq.h + +/usr/include/assert.h: + +/usr/include/sys/cdefs.h: + +/usr/include/sys/_symbol_aliasing.h: + +/usr/include/sys/_posix_availability.h: + +/usr/include/stdlib.h: + +/usr/include/Availability.h: + +/usr/include/AvailabilityInternal.h: + +/usr/include/_types.h: + +/usr/include/sys/_types.h: + +/usr/include/machine/_types.h: + +/usr/include/i386/_types.h: + +/usr/include/sys/wait.h: + +/usr/include/sys/signal.h: + +/usr/include/sys/appleapiopts.h: + +/usr/include/machine/signal.h: + +/usr/include/i386/signal.h: + +/usr/include/i386/_structs.h: + +/usr/include/sys/_structs.h: + +/usr/include/machine/_structs.h: + +/usr/include/mach/i386/_structs.h: + +/usr/include/sys/resource.h: + +/usr/include/machine/endian.h: + +/usr/include/i386/endian.h: + +/usr/include/sys/_endian.h: + +/usr/include/libkern/_OSByteOrder.h: + +/usr/include/libkern/i386/_OSByteOrder.h: + +/usr/include/alloca.h: + +/usr/include/machine/types.h: + +/usr/include/i386/types.h: + +/usr/include/sys/types.h: + +/usr/include/ctype.h: + +/usr/include/runetype.h: + +/usr/include/string.h: + +/usr/include/strings.h: + +../config.h: + +/Users/rucombs/install/include/snort/snort_debug.h: + +/usr/include/wchar.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h: + +/usr/include/stdio.h: + +/usr/include/time.h: + +/usr/include/_structs.h: + +/usr/include/_wctype.h: + +/Users/rucombs/install/include/snort/snort_types.h: + +/usr/include/inttypes.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h: + +/Users/rucombs/install/include/snort/snort_types.h: + +/Users/rucombs/install/include/snort/events/event_queue.h: + +/Users/rucombs/install/include/snort/framework/packet_handler.h: + +/Users/rucombs/install/include/snort/thread.h: + +/Users/rucombs/install/include/snort/framework/api_base.h: + +/Users/rucombs/install/include/snort/log/messages.h: + +/Users/rucombs/install/include/snort/sfip/sf_ipvar.h: + +/Users/rucombs/install/include/snort/sfip/sf_ip.h: + +/usr/include/netinet/in.h: + +/usr/include/sys/socket.h: + +/usr/include/machine/_param.h: + +/usr/include/i386/_param.h: + +/usr/include/netinet6/in6.h: + +/usr/include/arpa/inet.h: + +/Users/rucombs/install/include/snort/sfip/sfip_t.h: + +/Users/rucombs/install/include/snort/sfip/ipv6_port.h: + +/Users/rucombs/install/include/snort/protocols/packet.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h: + +/usr/include/net/if.h: + +/usr/include/net/if_var.h: + +/usr/include/sys/time.h: + +/usr/include/sys/_select.h: + +/usr/include/sys/queue.h: + +/usr/local/include/daq.h: + +/usr/local/include/daq_common.h: + +/usr/include/unistd.h: + +/usr/include/sys/unistd.h: + +/usr/include/sys/select.h: + +/usr/local/include/sfbpf_dlt.h: + +/Users/rucombs/install/include/snort/protocols/sf_protocols.h: + +/Users/rucombs/install/include/snort/sfip/sf_iph.h: + +/Users/rucombs/install/include/snort/time/profiler.h: + +/Users/rucombs/install/include/snort/time/cpuclock.h: + +/Users/rucombs/install/include/snort/utils/stats.h: + +/usr/include/errno.h: + +/usr/include/sys/errno.h: + +/usr/include/strings.h: + +/Users/rucombs/install/include/snort/utils/sflsq.h: diff --git a/extra/src/.deps/libips_urg_la-ips_urg.Plo b/extra/src/.deps/libips_urg_la-ips_urg.Plo new file mode 100644 index 000000000..495de9767 --- /dev/null +++ b/extra/src/.deps/libips_urg_la-ips_urg.Plo @@ -0,0 +1,226 @@ +libips_urg_la-ips_urg.lo: ips_urg.cc ../config.h /usr/include/sys/types.h \ + /usr/include/sys/appleapiopts.h /usr/include/sys/cdefs.h \ + /usr/include/sys/_symbol_aliasing.h \ + /usr/include/sys/_posix_availability.h /usr/include/machine/types.h \ + /usr/include/i386/types.h /usr/include/i386/_types.h \ + /usr/include/sys/_types.h /usr/include/machine/_types.h \ + /usr/include/machine/endian.h /usr/include/i386/endian.h \ + /usr/include/sys/_endian.h /usr/include/libkern/_OSByteOrder.h \ + /usr/include/libkern/i386/_OSByteOrder.h /usr/include/sys/_structs.h \ + /usr/include/stdlib.h /usr/include/Availability.h \ + /usr/include/AvailabilityInternal.h /usr/include/_types.h \ + /usr/include/sys/wait.h /usr/include/sys/signal.h \ + /usr/include/machine/signal.h /usr/include/i386/signal.h \ + /usr/include/i386/_structs.h /usr/include/machine/_structs.h \ + /usr/include/mach/i386/_structs.h /usr/include/sys/resource.h \ + /usr/include/alloca.h /usr/include/ctype.h /usr/include/runetype.h \ + /Users/rucombs/install/include/snort/snort_types.h \ + /usr/include/inttypes.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h \ + /Users/rucombs/install/include/snort/thread.h \ + /Users/rucombs/install/include/snort/detection/detection_defines.h \ + /Users/rucombs/install/include/snort/detection/treenodes.h \ + /Users/rucombs/install/include/snort/sfip/ipv6_port.h \ + /Users/rucombs/install/include/snort/sfip/sf_ip.h \ + /usr/include/netinet/in.h /usr/include/sys/socket.h \ + /usr/include/machine/_param.h /usr/include/i386/_param.h \ + /usr/include/netinet6/in6.h /usr/include/arpa/inet.h \ + /Users/rucombs/install/include/snort/sfip/sfip_t.h \ + /Users/rucombs/install/include/snort/snort_debug.h /usr/include/wchar.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h \ + /usr/include/stdio.h /usr/include/time.h /usr/include/_structs.h \ + /usr/include/_wctype.h \ + /Users/rucombs/install/include/snort/snort_types.h \ + /Users/rucombs/install/include/snort/sfip/sf_ipvar.h \ + /Users/rucombs/install/include/snort/detection/rule_option_types.h \ + /Users/rucombs/install/include/snort/detection/rules.h \ + /Users/rucombs/install/include/snort/detection/signature.h \ + /Users/rucombs/install/include/snort/hash/sfghash.h \ + /usr/include/string.h /usr/include/strings.h \ + /Users/rucombs/install/include/snort/hash/sfhashfcn.h \ + /Users/rucombs/install/include/snort/utils/sfportobject.h \ + /Users/rucombs/install/include/snort/utils/bitop_funcs.h \ + /Users/rucombs/install/include/snort/utils/bitop.h \ + /Users/rucombs/install/include/snort/utils/sflsq.h \ + /Users/rucombs/install/include/snort/framework/ips_option.h \ + /Users/rucombs/install/include/snort/framework/api_base.h \ + /Users/rucombs/install/include/snort/protocols/packet.h \ + /opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h \ + /usr/include/net/if.h /usr/include/net/if_var.h /usr/include/sys/time.h \ + /usr/include/sys/_select.h /usr/include/sys/queue.h \ + /usr/local/include/daq.h /usr/local/include/daq_common.h \ + /usr/include/unistd.h /usr/include/sys/unistd.h \ + /usr/include/sys/select.h /usr/local/include/sfbpf_dlt.h \ + /Users/rucombs/install/include/snort/protocols/sf_protocols.h \ + /Users/rucombs/install/include/snort/sfip/sf_iph.h + +../config.h: + +/usr/include/sys/types.h: + +/usr/include/sys/appleapiopts.h: + +/usr/include/sys/cdefs.h: + +/usr/include/sys/_symbol_aliasing.h: + +/usr/include/sys/_posix_availability.h: + +/usr/include/machine/types.h: + +/usr/include/i386/types.h: + +/usr/include/i386/_types.h: + +/usr/include/sys/_types.h: + +/usr/include/machine/_types.h: + +/usr/include/machine/endian.h: + +/usr/include/i386/endian.h: + +/usr/include/sys/_endian.h: + +/usr/include/libkern/_OSByteOrder.h: + +/usr/include/libkern/i386/_OSByteOrder.h: + +/usr/include/sys/_structs.h: + +/usr/include/stdlib.h: + +/usr/include/Availability.h: + +/usr/include/AvailabilityInternal.h: + +/usr/include/_types.h: + +/usr/include/sys/wait.h: + +/usr/include/sys/signal.h: + +/usr/include/machine/signal.h: + +/usr/include/i386/signal.h: + +/usr/include/i386/_structs.h: + +/usr/include/machine/_structs.h: + +/usr/include/mach/i386/_structs.h: + +/usr/include/sys/resource.h: + +/usr/include/alloca.h: + +/usr/include/ctype.h: + +/usr/include/runetype.h: + +/Users/rucombs/install/include/snort/snort_types.h: + +/usr/include/inttypes.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdint.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include-fixed/stdint.h: + +/Users/rucombs/install/include/snort/thread.h: + +/Users/rucombs/install/include/snort/detection/detection_defines.h: + +/Users/rucombs/install/include/snort/detection/treenodes.h: + +/Users/rucombs/install/include/snort/sfip/ipv6_port.h: + +/Users/rucombs/install/include/snort/sfip/sf_ip.h: + +/usr/include/netinet/in.h: + +/usr/include/sys/socket.h: + +/usr/include/machine/_param.h: + +/usr/include/i386/_param.h: + +/usr/include/netinet6/in6.h: + +/usr/include/arpa/inet.h: + +/Users/rucombs/install/include/snort/sfip/sfip_t.h: + +/Users/rucombs/install/include/snort/snort_debug.h: + +/usr/include/wchar.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stdarg.h: + +/usr/include/stdio.h: + +/usr/include/time.h: + +/usr/include/_structs.h: + +/usr/include/_wctype.h: + +/Users/rucombs/install/include/snort/snort_types.h: + +/Users/rucombs/install/include/snort/sfip/sf_ipvar.h: + +/Users/rucombs/install/include/snort/detection/rule_option_types.h: + +/Users/rucombs/install/include/snort/detection/rules.h: + +/Users/rucombs/install/include/snort/detection/signature.h: + +/Users/rucombs/install/include/snort/hash/sfghash.h: + +/usr/include/string.h: + +/usr/include/strings.h: + +/Users/rucombs/install/include/snort/hash/sfhashfcn.h: + +/Users/rucombs/install/include/snort/utils/sfportobject.h: + +/Users/rucombs/install/include/snort/utils/bitop_funcs.h: + +/Users/rucombs/install/include/snort/utils/bitop.h: + +/Users/rucombs/install/include/snort/utils/sflsq.h: + +/Users/rucombs/install/include/snort/framework/ips_option.h: + +/Users/rucombs/install/include/snort/framework/api_base.h: + +/Users/rucombs/install/include/snort/protocols/packet.h: + +/opt/local/lib/gcc49/gcc/x86_64-apple-darwin12/4.9.0/include/stddef.h: + +/usr/include/net/if.h: + +/usr/include/net/if_var.h: + +/usr/include/sys/time.h: + +/usr/include/sys/_select.h: + +/usr/include/sys/queue.h: + +/usr/local/include/daq.h: + +/usr/local/include/daq_common.h: + +/usr/include/unistd.h: + +/usr/include/sys/unistd.h: + +/usr/include/sys/select.h: + +/usr/local/include/sfbpf_dlt.h: + +/Users/rucombs/install/include/snort/protocols/sf_protocols.h: + +/Users/rucombs/install/include/snort/sfip/sf_iph.h: diff --git a/extra/src/Makefile.am b/extra/src/Makefile.am new file mode 100644 index 000000000..65874e9cb --- /dev/null +++ b/extra/src/Makefile.am @@ -0,0 +1,11 @@ +AUTOMAKE_OPTIONS=foreign + +SUBDIRS = \ +inspectors \ +ips_options \ +loggers \ +search_engines \ +so_rules + +AM_CXXFLAGS = @AM_CXXFLAGS@ + diff --git a/extra/src/inspectors/Makefile.am b/extra/src/inspectors/Makefile.am new file mode 100644 index 000000000..54a614340 --- /dev/null +++ b/extra/src/inspectors/Makefile.am @@ -0,0 +1,10 @@ +AUTOMAKE_OPTIONS=foreign + +dpxlibdir = $(pkglibdir)/inspectors +dpxlib_LTLIBRARIES = libdpx.la +libdpx_la_CXXFLAGS = $(AM_CXXFLAGS) +libdpx_la_LDFLAGS = -export-dynamic -shared +libdpx_la_SOURCES = dpx.cc + +AM_CXXFLAGS = @AM_CXXFLAGS@ + diff --git a/extra/src/inspectors/dpx.cc b/extra/src/inspectors/dpx.cc new file mode 100644 index 000000000..780a9560e --- /dev/null +++ b/extra/src/inspectors/dpx.cc @@ -0,0 +1,182 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2013-2013 Sourcefire, Inc. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// dpx.cc author Russ Combs + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include +#include +#include +#include + +#include "main/snort_debug.h" +#include "main/snort_types.h" +#include "events/event_queue.h" +#include "framework/inspector.h" +#include "log/messages.h" +#include "protocols/packet.h" +#include "time/profiler.h" +#include "utils/stats.h" + +#define DPX_GID 256 +#define DPX_SID 1 +#define DPX_REV 1 +#define DPX_PRI 1 +#define DPX_MSG "too much data sent to port" + +#if 0 +#define PP_DPX 10000 + +#ifdef DEBUG +#define DEBUG_DPX DEBUG_PP_EXP +#endif +#endif + +static const char* s_name = "dpx"; + +#ifdef PERF_PROFILING +static THREAD_LOCAL PreprocStats dpxPerfStats; + +static PreprocStats* dpx_get_profile(const char* key) +{ + if ( !strcmp(key, s_name) ) + return &dpxPerfStats; + + return nullptr; +} +#endif + +static THREAD_LOCAL SimpleStats dpxstats; +static SimpleStats gdpxstats; + +//------------------------------------------------------------------------- +// class stuff +//------------------------------------------------------------------------- + +class DpxPH : public Inspector { +public: + DpxPH(); + + void show(SnortConfig*); + void eval(Packet*); + +private: + uint16_t port; + uint16_t max; +}; + +DpxPH::DpxPH() +{ + port = 68; + max = 300; +} + +void DpxPH::show(SnortConfig*) +{ + LogMessage("%s config:\n", s_name); + LogMessage(" port = %d\n", port); + LogMessage(" max = %d\n", max); +} + +void DpxPH::eval(Packet* p) +{ + // precondition - what we registered for + assert(IsUDP(p)); + + if ( p->dp == port && p->dsize > max ) + SnortEventqAdd(DPX_GID, DPX_SID); + + ++dpxstats.total_packets; +} + +//------------------------------------------------------------------------- +// api stuff +//------------------------------------------------------------------------- + +void dpx_init() +{ +#ifdef PERF_PROFILING + RegisterPreprocessorProfile( + s_name, &dpxPerfStats, 0, &totalPerfStats, dpx_get_profile); +#endif +} + +static Inspector* dpx_ctor(Module*) +{ + return new DpxPH; +} + +static void dpx_dtor(Inspector* p) +{ + delete p; +} + +static void dpx_sum() +{ + sum_stats(&gdpxstats, &dpxstats); +} + +static void dpx_stats() +{ + show_stats(&gdpxstats, s_name); +} + +static void dpx_reset() +{ + memset(&gdpxstats, 0, sizeof(gdpxstats)); +} + +static const InspectApi dpx_api +{ + { + PT_INSPECTOR, + s_name, + INSAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + IT_PROTOCOL, + PROTO_BIT__UDP, + nullptr, // service + nullptr, // contents + dpx_init, + nullptr, // term + dpx_ctor, + dpx_dtor, + nullptr, // pinit + nullptr, // pterm + nullptr, // ssn + dpx_sum, + dpx_stats, + dpx_reset, + nullptr // getbuf +}; + +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &dpx_api.base, + nullptr +}; + diff --git a/extra/src/inspectors/dpx_module.cc b/extra/src/inspectors/dpx_module.cc new file mode 100644 index 000000000..8fdb6d537 --- /dev/null +++ b/extra/src/inspectors/dpx_module.cc @@ -0,0 +1,86 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// udp_module.cc author Russ Combs + +#include "udp_module.h" + +#include +using namespace std; + +#include "stream_udp.h" +#include "main/snort_config.h" + +//------------------------------------------------------------------------- +// stream_udp module +//------------------------------------------------------------------------- + +static const Parameter stream_udp_params[] = +{ + { "session_timeout", Parameter::PT_INT, "1:86400", "30", + "session tracking timeout" }, + + { "ignore_any_rules", Parameter::PT_BOOL, nullptr, "false", + "process udp content rules w/o ports only if rules with ports are present" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + +static const RuleMap stream_udp_rules[] = +{ + { 0, nullptr } +}; + +StreamUdpModule::StreamUdpModule() : + Module(MOD_NAME, stream_udp_params, stream_udp_rules) { } + +StreamUdpConfig* StreamUdpModule::get_data() +{ + StreamUdpConfig* temp = config; + config = nullptr; + return temp; +} + +bool StreamUdpModule::set(const char*, Value& v, SnortConfig*) +{ + if ( v.is("session_timeout") ) + config->session_timeout = v.get_long(); + + else if ( v.is("ignore_any_rules") ) + config->ignore_any = v.get_bool(); + + else + return false; + + return true; +} + +bool StreamUdpModule::begin(const char*, int, SnortConfig*) +{ + if ( !config ) + config = new StreamUdpConfig; + + return true; +} + +bool StreamUdpModule::end(const char*, int, SnortConfig*) +{ + return true; +} + diff --git a/extra/src/inspectors/dpx_module.h b/extra/src/inspectors/dpx_module.h new file mode 100644 index 000000000..bda1b427d --- /dev/null +++ b/extra/src/inspectors/dpx_module.h @@ -0,0 +1,54 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// udp_module.h author Russ Combs + +#ifndef UDP_MODULE_H +#define UDP_MODULE_H + +#include +#include + +#include "main/snort_types.h" +#include "framework/module.h" + +struct SnortConfig; + +//------------------------------------------------------------------------- +// dpx module +//------------------------------------------------------------------------- + +#define MOD_NAME "dpx" + +class DpxModule : public Module +{ +public: + DpxModule(); + bool set(const char*, Value&, SnortConfig*); + bool begin(const char*, int, SnortConfig*); + bool end(const char*, int, SnortConfig*); + + StreamUdpConfig* get_data(); + +private: + StreamUdpConfig* config; +}; + +#endif + diff --git a/extra/src/ips_options/Makefile.am b/extra/src/ips_options/Makefile.am new file mode 100644 index 000000000..daa7ca488 --- /dev/null +++ b/extra/src/ips_options/Makefile.am @@ -0,0 +1,12 @@ +AUTOMAKE_OPTIONS=foreign + +optlibdir = $(pkglibdir)/ips_options +optlib_LTLIBRARIES = libips_urg.la +libips_urg_la_CXXFLAGS = $(AM_CXXFLAGS) +libips_urg_la_LDFLAGS = -export-dynamic -shared +libips_urg_la_SOURCES = ips_urg.cc + +dist_optlib_SCRIPTS = find.lua + +AM_CXXFLAGS = @AM_CXXFLAGS@ + diff --git a/extra/src/ips_options/find.lua b/extra/src/ips_options/find.lua new file mode 100755 index 000000000..14ecc6e68 --- /dev/null +++ b/extra/src/ips_options/find.lua @@ -0,0 +1,77 @@ +-- ---------------------------------------------------------- +-- ips_option example: +-- +-- define keyword find +-- +-- configure snort with +-- +-- ./configure --prefix my/prefix +-- +-- then set up the path as follows: +-- +-- export LUA_PATH=my/prefix/include/snort/lua/?.lua\;\; +-- +-- write a rule as follows: +-- +-- alert tcp any any -> any 80 ( \ +-- msg:"luajit example"; sid:1; \ +-- content:"GET /"; \ +-- find:buf='payload', pat='GET .+ HTTP/1.1'; ) +-- +-- the arg string is (in general) optional +-- if present, it will be put in a table named args, eg: +-- +-- args { buf='payload', pat='GET .+ HTTP/1.1' } +-- +-- this table is defined before init is called +-- ---------------------------------------------------------- + +-- this pulls in snort bindings with ffi +require("snort_plugin") + +-- init() is optional +-- if present, called once when script is loaded +-- here we return bool indicating args ok +function init () + args.bt = get_buffer_type(args.buf) + + if ( args.bt < 0 ) then + return 'bad buf' + end + + if ( args.pat == nil ) then + return 'missing pat' + end + + if ( type(args.pat) ~= 'string' ) then + return 'pat must be string' + end + + return true +end + +-- eval() is required +-- eval must return a bool (match == true) +function eval () + -- you can access a snort buffer as follows + -- see snort.lua for available buffers + + -- buf is a luajit cdata + local buf = ffi.C.get_buffer(args.bt) + + -- str is a lua string + local str = ffi.string(buf.data, buf.len) + + local i,j = string.find(str, args.pat) + + return (i and (i > 0)) +end + +-- plugin table is required +plugin = +{ + type = "ips_option", -- only available type currently + name = "find", -- rule option keyword + version = 0 -- optional, defaults to zero +} + diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc new file mode 100644 index 000000000..bcb9b45c3 --- /dev/null +++ b/extra/src/ips_options/ips_urg.cc @@ -0,0 +1,175 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// ips_urg.cc author Russ Combs + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include +#include + +#include "main/snort_types.h" +#include "main/thread.h" +#include "detection/detection_defines.h" +#include "detection/treenodes.h" +#include "framework/ips_option.h" +#include "hash/sfhashfcn.h" +#include "protocols/packet.h" +#include "time/profiler.h" + +static const char* s_name = "urg"; + +// FIXIT profiling is desirable but must be refactored to +// avoid dependence on snort_config.h which snowballs +#undef PERF_PROFILING + +#ifdef PERF_PROFILING +static THREAD_LOCAL PreprocStats tcpUrgPerfStats; + +static PreprocStats* urg_get_profile(const char* key) +{ + if ( !strcmp(key, s_name) ) + return &tcpUrgPerfStats; + + return nullptr; +} +#endif + +class TcpUrgOption : public IpsOption +{ +public: + TcpUrgOption(uint16_t up) : IpsOption(s_name) + { urg_ptr = htons(up); }; + + uint32_t hash() const; + bool operator==(const IpsOption&) const; + + int eval(Packet*); + +private: + uint16_t urg_ptr; +}; + +//------------------------------------------------------------------------- +// option methods +//------------------------------------------------------------------------- + +uint32_t TcpUrgOption::hash() const +{ + uint32_t a = urg_ptr, b = 0, c = 0; + mix_str(a,b,c,get_name()); + final(a,b,c); + return c; +} + +bool TcpUrgOption::operator==(const IpsOption& ips) const +{ + if ( strcmp(s_name, ips.get_name()) ) + return false; + + TcpUrgOption& rhs = (TcpUrgOption&)ips; + + if ( urg_ptr == rhs.urg_ptr) + { + return true; + } + + return false; +} + +int TcpUrgOption::eval(Packet *p) +{ + //PROFILE_VARS; + //PREPROC_PROFILE_START(tcpUrgPerfStats); + int result = DETECTION_OPTION_NO_MATCH; + + if ( !p->tcph ) + return result; + + if ( (p->tcph->th_flags & 0x20) && + (urg_ptr == p->tcph->th_urp) ) + { + result = DETECTION_OPTION_MATCH; + } + + //PREPROC_PROFILE_END(tcpUrgPerfStats); + return result; +} + +//------------------------------------------------------------------------- +// api methods +//------------------------------------------------------------------------- + +static IpsOption* urg_ctor( + SnortConfig*, char* arg, OptTreeNode*) +{ + char* end; + long up = strtol(arg, &end, 0); + + if ( !*arg || *end || up < 0 || up > 0xFFFF ) + up = 0; + + return new TcpUrgOption((uint16_t)up); +} + +static void urg_dtor(IpsOption* p) +{ + delete p; +} + +static void urg_ginit(SnortConfig*) +{ +#ifdef PERF_PROFILING + RegisterPreprocessorProfile( + s_name, &tcpUrgPerfStats, 3, &ruleOTNEvalPerfStats, urg_get_profile); +#endif +} + +static const IpsApi urg_api = +{ + { + PT_IPS_OPTION, + s_name, + IPSAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + OPT_TYPE_DETECTION, + 1, PROTO_BIT__TCP, + urg_ginit, + nullptr, + nullptr, + nullptr, + urg_ctor, + urg_dtor, + nullptr +}; + +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &urg_api.base, + nullptr +}; + diff --git a/extra/src/loggers/Makefile.am b/extra/src/loggers/Makefile.am new file mode 100644 index 000000000..0ad69bb32 --- /dev/null +++ b/extra/src/loggers/Makefile.am @@ -0,0 +1,10 @@ +AUTOMAKE_OPTIONS=foreign + +ehlibdir = $(pkglibdir)/loggers +ehlib_LTLIBRARIES = libalert_ex.la +libalert_ex_la_CXXFLAGS = $(AM_CXXFLAGS) +libalert_ex_la_LDFLAGS = -export-dynamic -shared +libalert_ex_la_SOURCES = alert_ex.cc + +AM_CXXFLAGS = @AM_CXXFLAGS@ + diff --git a/extra/src/loggers/alert_ex.cc b/extra/src/loggers/alert_ex.cc new file mode 100644 index 000000000..82e27a026 --- /dev/null +++ b/extra/src/loggers/alert_ex.cc @@ -0,0 +1,148 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2013-2013 Sourcefire, Inc. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// alert_ex.cc author Russ Combs + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include + +#include +#include +using namespace std; + +#include "main/snort_types.h" +#include "framework/logger.h" +#include "framework/module.h" +#include "protocols/packet.h" +#include "detection/signature.h" + +//------------------------------------------------------------------------- +// module stuff +//------------------------------------------------------------------------- + +static const Parameter ex_params[] = +{ + { "upper", Parameter::PT_BOOL, nullptr, "false", + "true/false -> convert to upper/lower case" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + +class ExModule : public Module +{ +public: + ExModule() : Module("alert_ex", ex_params) { }; + bool set(const char*, Value&, SnortConfig*); + bool begin(const char*, int, SnortConfig*); + +public: + bool upper; +}; + +bool ExModule::set(const char*, Value& v, SnortConfig*) +{ + if ( v.is("packet") ) + upper = v.get_bool(); + + else + return false; + + return true; +} + +bool ExModule::begin(const char*, int, SnortConfig*) +{ + upper = true; + return true; +} + +//------------------------------------------------------------------------- +// logger stuff +//------------------------------------------------------------------------- + +class ExLogger : public Logger { +public: + ExLogger(ExModule* m) + { upper = m->upper; }; + + void alert(Packet*, const char* msg, Event*); + +private: + bool upper; +}; + +void ExLogger::alert(Packet*, const char* msg, Event* e) +{ + string s = msg; + + if ( upper ) + transform(s.begin(), s.end(), s.begin(), ::toupper); + else + transform(s.begin(), s.end(), s.begin(), ::tolower); + + cout << e->sig_info->generator << ":"; + cout << e->sig_info->id << ":"; + cout << e->sig_info->rev << " "; + cout << s << endl; +} + +//------------------------------------------------------------------------- +// api stuff +//------------------------------------------------------------------------- + +static Module* mod_ctor() +{ return new ExModule; } + +static void mod_dtor(Module* m) +{ delete m; } + +static Logger* ex_ctor(SnortConfig*, Module* mod) +{ + return new ExLogger((ExModule*)mod); +} + +static void ex_dtor(Logger* p) +{ delete p; } + +static const LogApi ex_api = +{ + { + PT_LOGGER, + "alert_ex", + LOGAPI_PLUGIN_V0, + 0, + mod_ctor, + mod_dtor + }, + OUTPUT_TYPE_FLAG__ALERT, + ex_ctor, + ex_dtor +}; + +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &ex_api.base, + nullptr +}; + diff --git a/extra/src/search_engines/Makefile.am b/extra/src/search_engines/Makefile.am new file mode 100644 index 000000000..dd3564713 --- /dev/null +++ b/extra/src/search_engines/Makefile.am @@ -0,0 +1,17 @@ +AUTOMAKE_OPTIONS=foreign + +selibdir = $(pkglibdir)/search_engines +selib_LTLIBRARIES = liblowmem.la +liblowmem_la_CXXFLAGS = $(AM_CXXFLAGS) +liblowmem_la_LDFLAGS = -export-dynamic -shared + +liblowmem_la_SOURCES = \ +lowmem.cc \ +lowmem_q.cc \ +pat_stats.cc \ +sfksearch.cc \ +sfksearch.h \ +trie_api.cc + +AM_CXXFLAGS = @AM_CXXFLAGS@ + diff --git a/extra/src/search_engines/lowmem.cc b/extra/src/search_engines/lowmem.cc new file mode 100644 index 000000000..fd4787180 --- /dev/null +++ b/extra/src/search_engines/lowmem.cc @@ -0,0 +1,151 @@ +/* +* An abstracted interface to the Multi-Pattern Matching routines, +* thats why we're passing 'void *' objects around. +* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +* Copyright (C) 2002-2013 Sourcefire, Inc. +* Marc A Norton +* +* Updates: +* 3/06 - Added AC_BNFA search +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +** +*/ + +// lowmem.cc author Russ Combs + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include "sfksearch.h" +#include "main/snort_debug.h" +#include "main/snort_types.h" +#include "log/messages.h" +#include "framework/mpse.h" +#include "time/profiler.h" + +//------------------------------------------------------------------------- +// "lowmem" +//------------------------------------------------------------------------- + +class LowmemMpse : public Mpse +{ +private: + KTRIE_STRUCT* obj; + +public: + LowmemMpse( + SnortConfig*, + bool use_gc, + void (*user_free)(void*), + void (*tree_free)(void**), + void (*list_free)(void**)) + : Mpse("lowmem", use_gc) + { obj = KTrieNew(0,user_free, tree_free, list_free); }; + + ~LowmemMpse() + { KTrieDelete(obj); }; + + int add_pattern( + SnortConfig*, void* P, int m, + unsigned noCase, unsigned, unsigned, + unsigned negative, void* ID, int) + { + return KTrieAddPattern( + obj, (unsigned char *)P, m, noCase, negative, ID ); + }; + + int prep_patterns( + SnortConfig* sc, mpse_build_f build_tree, mpse_negate_f neg_list) + { + return KTrieCompileWithSnortConf(sc, obj, build_tree, neg_list ); + }; + + int _search( + const unsigned char* T, int n, mpse_action_f action, + void* data, int* current_state ) + { + *current_state = 0; + return KTrieSearch(obj, (unsigned char *)T, n, action, data); + }; + + int get_pattern_count() + { return KTriePatternCount(obj); }; +}; + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Mpse* lm_ctor( + SnortConfig* sc, + class Module*, + bool use_gc, + void (*user_free)(void*), + void (*tree_free)(void**), + void (*list_free)(void**)) +{ + return new LowmemMpse(sc, use_gc, user_free, tree_free, list_free); +} + +static void lm_dtor(Mpse* p) +{ + delete p; +} + +static void lm_init() +{ + KTrie_init_xlatcase(); + KTrieInitMemUsed(); +} + +static void lm_print() +{ + if ( !KTrieMemUsed() ) + return; + + double x = (double) KTrieMemUsed(); + + LogMessage("[ LowMem Search-Method Memory Used : %g %s ]\n", + (x > 1.e+6) ? x/1.e+6 : x/1.e+3, + (x > 1.e+6) ? "MBytes" : "KBytes" ); +} + +static const MpseApi lm_api = +{ + { + PT_SEARCH_ENGINE, + "lowmem", + SEAPI_PLUGIN_V0, + 0, + nullptr, + nullptr + }, + false, + nullptr, + nullptr, + nullptr, + nullptr, + lm_ctor, + lm_dtor, + lm_init, + lm_print, +}; + +const BaseApi* se_lowmem = &lm_api.base; + diff --git a/extra/src/search_engines/lowmem_q.cc b/extra/src/search_engines/lowmem_q.cc new file mode 100644 index 000000000..7d2c3688f --- /dev/null +++ b/extra/src/search_engines/lowmem_q.cc @@ -0,0 +1,215 @@ +/* +* An abstracted interface to the Multi-Pattern Matching routines, +* thats why we're passing 'void *' objects around. +* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +* Copyright (C) 2002-2013 Sourcefire, Inc. +* Marc A Norton +* +* Updates: +* 3/06 - Added AC_BNFA search +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +** +*/ + +// lowmem_q.cc author Russ Combs + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include + +#include "sfksearch.h" +#include "main/snort_debug.h" +#include "main/snort_types.h" +#include "framework/mpse.h" +#include "framework/module.h" +#include "log/messages.h" +#include "time/profiler.h" + +using namespace std; + +static string s_var; + +//------------------------------------------------------------------------- +// module stuff +//------------------------------------------------------------------------- + +static const Parameter lowmem_q_params[] = +{ + { "var", Parameter::PT_STRING, nullptr, nullptr, + "additional print text" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + +class LowmemQModule : public Module +{ +public: + LowmemQModule() : Module("lowmem_q", lowmem_q_params) { }; + bool set(const char*, Value&, SnortConfig*); + bool begin(const char*, int, SnortConfig*); + +public: + string var; +}; + +bool LowmemQModule::set(const char*, Value& v, SnortConfig*) +{ + if ( v.is("var") ) + var = v.get_string(); + + else + return false; + + return true; +} + +bool LowmemQModule::begin(const char*, int, SnortConfig*) +{ + var.clear(); + return true; +} + +//------------------------------------------------------------------------- +// "lowmem_q" +//------------------------------------------------------------------------- + +class LowmemQMpse : public Mpse +{ +private: + KTRIE_STRUCT* obj; + +public: + LowmemQMpse( + bool use_gc, + void (*user_free)(void*), + void (*tree_free)(void**), + void (*list_free)(void**)) + : Mpse("lowmem_q", use_gc) + { + obj = KTrieNew(1, user_free, tree_free, list_free); + }; + ~LowmemQMpse() + { + if (obj) + KTrieDelete(obj); + }; + + int add_pattern( + SnortConfig*, void* P, int m, + unsigned noCase, unsigned, unsigned, + unsigned negative, void* ID, int) + { + return KTrieAddPattern( + obj, (unsigned char *)P, m, + noCase, negative, ID ); + }; + + int prep_patterns( + SnortConfig* sc, mpse_build_f build_tree, mpse_negate_f neg_list) + { + return KTrieCompileWithSnortConf(sc, obj, build_tree, neg_list); + }; + + int _search( + const unsigned char* T, int n, mpse_action_f action, + void* data, int* current_state ) + { + *current_state = 0; + return KTrieSearchQ(obj, (unsigned char *)T, n, action, data); + }; + + int get_pattern_count() + { + return KTriePatternCount(obj); + }; +}; + +//------------------------------------------------------------------------- +// api +//------------------------------------------------------------------------- + +static Module* mod_ctor() +{ return new LowmemQModule; } + +static void mod_dtor(Module* m) +{ delete m; } + +static Mpse* lmq_ctor( + SnortConfig*, + class Module* mod, + bool use_gc, + void (*user_free)(void*), + void (*tree_free)(void**), + void (*list_free)(void**)) +{ + LowmemQModule* lmqm = (LowmemQModule*)mod; + s_var = lmqm->var; + return new LowmemQMpse(use_gc, user_free, tree_free, list_free); +} + +static void lmq_dtor(Mpse* p) +{ + delete p; +} + +static void lmq_init() +{ + KTrie_init_xlatcase(); + KTrieInitMemUsed(); +} + +static void lmq_print() +{ + if ( !KTrieMemUsed() ) + return; + + if ( !s_var.empty() ) + LogMessage("lowmemq.var = %s\n", s_var.c_str()); + + double x = (double) KTrieMemUsed(); + + LogMessage("[ LowMem Search-Method Memory Used : %g %s ]\n", + (x > 1.e+6) ? x/1.e+6 : x/1.e+3, + (x > 1.e+6) ? "MBytes" : "KBytes" ); +} + +static const MpseApi lmq_api = +{ + { + PT_SEARCH_ENGINE, + "lowmem_q", + SEAPI_PLUGIN_V0, + 0, + mod_ctor, + mod_dtor + }, + false, + nullptr, + nullptr, + nullptr, + nullptr, + lmq_ctor, + lmq_dtor, + lmq_init, + lmq_print, +}; + +const BaseApi* se_lowmem_q = &lmq_api.base; + diff --git a/extra/src/search_engines/pat_stats.cc b/extra/src/search_engines/pat_stats.cc new file mode 100644 index 000000000..34ebe4708 --- /dev/null +++ b/extra/src/search_engines/pat_stats.cc @@ -0,0 +1,39 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2013-2013 Sourcefire, Inc. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +// pat_stats.cc author Russ Combs + +#include "search_engines/pat_stats.h" +#include "log/messages.h" + +THREAD_LOCAL PatMatQStat pmqs; + +void print_pat_stats(const char* type, unsigned max) +{ + if ( !pmqs.max_inq ) + return; + + LogMessage("%s: queue max = " STDu64 "\n", type, pmqs.max_inq); + LogMessage("%s: queue limit = " STDu64 "\n", type, (PegCount)max); + LogMessage("%s: queue flushes = " STDu64 "\n", type, pmqs.tot_inq_flush); + LogMessage("%s: queue inserts = " STDu64 "\n", type, pmqs.tot_inq_inserts); + LogMessage("%s: queue uinserts = " STDu64 "\n", type, pmqs.tot_inq_uinserts); +} + diff --git a/extra/src/search_engines/sfksearch.cc b/extra/src/search_engines/sfksearch.cc new file mode 100644 index 000000000..71abb4efb --- /dev/null +++ b/extra/src/search_engines/sfksearch.cc @@ -0,0 +1,1016 @@ +/* +* ksearch.c +* +* Basic Keyword Search Trie - uses linked lists to build the finite automata +* +* Keyword-Match: Performs the equivalent of a multi-string strcmp() +* - use for token testing after parsing the language tokens using lex or the like. +* +* Keyword-Search: searches the input text for one of multiple keywords, +* and supports case sensitivite and case insensitive patterns. +* +* +** Copyright (C) 2001 Marc Norton +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2003-2013 Sourcefire, Inc. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +* +* +*/ +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include +#include +#include +#include + +#include "main/snort_types.h" +#include "main/snort_debug.h" +#include "utils/snort_bounds.h" +#include "sfksearch.h" +#include "search_engines/pat_stats.h" + +#define SFKSEARCH_TRACK_Q + +#ifdef SFKSEARCH_TRACK_Q +//# include "snort.h" +//# include "util.h" +#endif + +static void KTrieFree(KTRIENODE *n); + +static unsigned int mtot = 0; // FIXIT 1 / process + +unsigned int KTrieMemUsed(void) +{ + return mtot; +} + +void KTrieInitMemUsed(void) +{ + mtot = 0; +} + +/* +* Allocate Memory +*/ +static void * KTRIE_MALLOC(int n) +{ + void *p; + + if (n < 1) + return NULL; + + p = calloc(1, n); + + if (p) + mtot += n; + + return p; +} + +/* +* Free Memory +*/ +static void KTRIE_FREE(void *p) +{ + if (p == NULL) + return; + + free(p); +} + +/* +* Local/Tmp nocase array +*/ +static THREAD_LOCAL unsigned char Tnocase[65*1024]; + +/* +** Case Translation Table +*/ +static unsigned char xlatcase[256]; + +/* +* +*/ +void KTrie_init_xlatcase(void) +{ + for(int i=0; i<256; i++) { + xlatcase[ i ] = (unsigned char)tolower(i); + } +} + +/* +* +*/ +static inline void ConvertCaseEx( unsigned char * d, unsigned char *s, int m ) +{ + int i; + for( i=0; i < m; i++ ) { + d[i] = xlatcase[ s[i] ]; + } +} + + +/* +* +*/ +KTRIE_STRUCT * KTrieNew( + int method, void (*userfree)(void *p), + void (*optiontreefree)(void **p), + void (*neg_list_free)(void **p)) +{ + KTRIE_STRUCT * ts = (KTRIE_STRUCT*) KTRIE_MALLOC( sizeof(KTRIE_STRUCT) ); + + if( !ts ) return 0; + + memset(ts, 0, sizeof(KTRIE_STRUCT)); + + ts->memory = sizeof(KTRIE_STRUCT); + ts->nchars = 0; + ts->npats = 0; + ts->end_states = 0; + ts->method = method; /* - old method, 1 = queue */ + ts->userfree = userfree; + ts->optiontreefree = optiontreefree; + ts->neg_list_free = neg_list_free; + + return ts; +} + +int KTriePatternCount(KTRIE_STRUCT *k) +{ + return k->npats; +} + +/* + * Deletes memory that was used in creating trie + * and nodes + */ +void KTrieDelete(KTRIE_STRUCT *k) +{ + KTRIEPATTERN *p = NULL; + KTRIEPATTERN *pnext = NULL; + int i; + + if (k == NULL) + return; + + p = k->patrn; + + while (p != NULL) { + pnext = p->next; + + if (k->userfree && p->id) + k->userfree(p->id); + + if (k->optiontreefree) { + if (p && p->rule_option_tree) + k->optiontreefree(&p->rule_option_tree); + } + + if (k->neg_list_free) { + if (p && p->neg_list) + k->neg_list_free(&p->neg_list); + } + + KTRIE_FREE(p->P); + KTRIE_FREE(p->Pcase); + KTRIE_FREE(p); + + p = pnext; + } + + for (i = 0; i < KTRIE_ROOT_NODES; i++) + KTrieFree(k->root[i]); + + KTRIE_FREE(k); +} + +/* + * Recursively delete all nodes in trie + */ +static void KTrieFree(KTRIENODE *n) +{ + if (n == NULL) + return; + + KTrieFree(n->child); + KTrieFree(n->sibling); + + KTRIE_FREE(n); +} + +/* +* +*/ +static KTRIEPATTERN * KTrieNewPattern(unsigned char * P, int n) +{ + KTRIEPATTERN *p; + int ret; + + if (n < 1) + return NULL; + + p = (KTRIEPATTERN*) KTRIE_MALLOC( sizeof(KTRIEPATTERN) ); + + if (p == NULL) + return NULL; + + /* Save as a nocase string */ + p->P = (unsigned char*) KTRIE_MALLOC( n ); + if( !p->P ) { + KTRIE_FREE(p); + return NULL; + } + + ConvertCaseEx( p->P, P, n ); + + /* Save Case specific version */ + p->Pcase = (unsigned char*) KTRIE_MALLOC( n ); + if( !p->Pcase ) { + KTRIE_FREE(p->P); + KTRIE_FREE(p); + return NULL; + } + + ret = SafeMemcpy(p->Pcase, P, n, p->Pcase, p->Pcase + n); + if (ret != SAFEMEM_SUCCESS) { + KTRIE_FREE(p->Pcase); + KTRIE_FREE(p->P); + KTRIE_FREE(p); + return NULL; + } + + p->n = n; + p->next = NULL; + + return p; +} + +/* +* Add Pattern info to the list of patterns +*/ +int KTrieAddPattern( KTRIE_STRUCT * ts, unsigned char * P, int n, + int nocase, int negative, void * id ) +{ + KTRIEPATTERN *pnew; + + if( !ts->patrn ) { + pnew = ts->patrn = KTrieNewPattern( P, n ); + + if( !pnew ) return -1; + } else { + pnew = KTrieNewPattern(P, n ); + + if( !pnew ) return -1; + + pnew->next = ts->patrn; /* insert at head of list */ + + ts->patrn = pnew; + } + + pnew->nocase = nocase; + pnew->negative = negative; + pnew->id = id; + pnew->mnext = NULL; + + ts->npats++; + ts->memory += sizeof(KTRIEPATTERN) + 2 * n ; /* Case and nocase */ + + return 0; +} + + +/* +* +*/ +static KTRIENODE * KTrieCreateNode(KTRIE_STRUCT * ts) +{ + KTRIENODE * t=(KTRIENODE*)KTRIE_MALLOC( sizeof(KTRIENODE) ); + + if(!t) + return 0; + + memset(t,0,sizeof(KTRIENODE)); + + ts->memory += sizeof(KTRIENODE); + + return t; +} + + + +/* +* Insert a Pattern in the Trie +*/ +static int KTrieInsert( KTRIE_STRUCT *ts, KTRIEPATTERN * px ) +{ + int type = 0; + int n = px->n; + unsigned char *P = px->P; + KTRIENODE *root; + + /* Make sure we at least have a root character for the tree */ + if( !ts->root[*P] ) { + ts->root[*P] = root = KTrieCreateNode(ts); + if( !root ) return -1; + root->edge = *P; + + } else { + + root = ts->root[*P]; + } + + /* Walk existing Patterns */ + while( n ) { + if( root->edge == *P ) { + P++; + n--; + + if( n && root->child ) { + root=root->child; + } else { /* cannot continue */ + type = 0; /* Expand the tree via the child */ + break; + } + } else { + if( root->sibling ) { + root=root->sibling; + } else { /* cannot continue */ + type = 1; /* Expand the tree via the sibling */ + break; + } + } + } + + /* + * Add the next char of the Keyword, if any + */ + if( n ) { + if( type == 0 ) { + /* + * Start with a new child to finish this Keyword + */ + root->child= KTrieCreateNode( ts ); + if( ! root->child ) return -1; + root=root->child; + root->edge = *P; + P++; + n--; + ts->nchars++; + + } else { + /* + * Start a new sibling bracnch to finish this Keyword + */ + root->sibling= KTrieCreateNode( ts ); + if( ! root->sibling ) return -1; + root=root->sibling; + root->edge = *P; + P++; + n--; + ts->nchars++; + } + } + + /* + * Finish the keyword as child nodes + */ + while( n ) { + root->child = KTrieCreateNode(ts); + if( ! root->child ) return -1; + root=root->child; + root->edge = *P; + P++; + n--; + ts->nchars++; + } + + if( root->pkeyword ) { + px->mnext = root->pkeyword; /* insert duplicates at front of list */ + root->pkeyword = px; + ts->duplicates++; + } else { + root->pkeyword = px; + ts->end_states++; + } + + return 0; +} + + +/* +* +*/ +static void Build_Bad_Character_Shifts( KTRIE_STRUCT * kt ) +{ + int i,k; + KTRIEPATTERN *plist; + + /* Calc the min pattern size */ + kt->bcSize = 32000; + + for( plist=kt->patrn; plist!=NULL; plist=plist->next ) { + if( plist->n < kt->bcSize ) { + kt->bcSize = plist->n; /* smallest pattern size */ + } + } + + /* + * Initialze the Bad Character shift table. + */ + for (i = 0; i < KTRIE_ROOT_NODES; i++) { + kt->bcShift[i] = (unsigned short)kt->bcSize; + } + + /* + * Finish the Bad character shift table + */ + for( plist=kt->patrn; plist!=NULL; plist=plist->next ) { + int shift, cindex; + + for( k=0; kbcSize; k++ ) { + shift = kt->bcSize - 1 - k; + + cindex = plist->P[ k ]; + + if( shift < kt->bcShift[ cindex ] ) { + kt->bcShift[ cindex ] = (unsigned short)shift; + } + } + } +} + +static int KTrieBuildMatchStateNode( + KTRIENODE *root, + int (*build_tree)(void * id, void **existing_tree), + int (*neg_list_func)(void *id, void **list)) +{ + int cnt = 0; + KTRIEPATTERN *p; + + if (!root) + return 0; + + /* each and every prefix match at this root*/ + if (root->pkeyword) { + for (p = root->pkeyword; p; p = p->mnext) { + if (p->id) { + if (p->negative) { + neg_list_func(p->id, &root->pkeyword->neg_list); + } else { + build_tree(p->id, &root->pkeyword->rule_option_tree); + } + } + + cnt++; + } + + /* Last call to finalize the tree for this root */ + build_tree(NULL, &root->pkeyword->rule_option_tree); + } + + /* for child of this root */ + if (root->child) { + cnt += KTrieBuildMatchStateNode(root->child, build_tree, neg_list_func); + } + + /* 1st sibling of this root -- other siblings will be processed from + * within the processing for root->sibling. */ + if (root->sibling) { + cnt += KTrieBuildMatchStateNode(root->sibling, build_tree, neg_list_func); + } + + return cnt; +} + +static int KTrieBuildMatchStateNodeWithSnortConf( + SnortConfig *sc, KTRIENODE *root, + int (*build_tree)(SnortConfig *, void * id, void **existing_tree), + int (*neg_list_func)(void *id, void **list)) +{ + int cnt = 0; + KTRIEPATTERN *p; + + if (!root) + return 0; + + /* each and every prefix match at this root*/ + if (root->pkeyword) { + for (p = root->pkeyword; p; p = p->mnext) { + if (p->id) { + if (p->negative) { + neg_list_func(p->id, &root->pkeyword->neg_list); + } else { + build_tree(sc, p->id, &root->pkeyword->rule_option_tree); + } + } + + cnt++; + } + + /* Last call to finalize the tree for this root */ + build_tree(sc, NULL, &root->pkeyword->rule_option_tree); + } + + /* for child of this root */ + if (root->child) { + cnt += KTrieBuildMatchStateNodeWithSnortConf(sc, root->child, build_tree, neg_list_func); + } + + /* 1st sibling of this root -- other siblings will be processed from + * within the processing for root->sibling. */ + if (root->sibling) { + cnt += KTrieBuildMatchStateNodeWithSnortConf(sc, root->sibling, build_tree, neg_list_func); + } + + return cnt; +} + +static int KTrieBuildMatchStateTrees( + KTRIE_STRUCT * ts, + int (*build_tree)(void * id, void **existing_tree), + int (*neg_list_func)(void *id, void **list)) +{ + int i, cnt = 0; + KTRIENODE * root; + + /* Find the states that have a MatchList */ + for (i = 0; i < KTRIE_ROOT_NODES; i++) { + root = ts->root[i]; + /* each and every prefix match at this root*/ + if (root) { + cnt += KTrieBuildMatchStateNode(root, build_tree, neg_list_func); + } + } + + return cnt; +} + +static int KTrieBuildMatchStateTreesWithSnortConf( + SnortConfig *sc, KTRIE_STRUCT * ts, + int (*build_tree)(SnortConfig *, void * id, void **existing_tree), + int (*neg_list_func)(void *id, void **list)) +{ + int i, cnt = 0; + KTRIENODE * root; + + /* Find the states that have a MatchList */ + for (i = 0; i < KTRIE_ROOT_NODES; i++) { + root = ts->root[i]; + /* each and every prefix match at this root*/ + if (root) { + cnt += KTrieBuildMatchStateNodeWithSnortConf(sc, root, build_tree, neg_list_func); + } + } + + return cnt; +} + +/* +* Build the Keyword TRIE +* +*/ +static inline int _KTrieCompile(KTRIE_STRUCT * ts) +{ + KTRIEPATTERN * p; + /* + static int tmem=0; // unused + */ + + /* + * Build the Keyword TRIE + */ + for( p=ts->patrn; p; p=p->next ) { + if( KTrieInsert( ts, p ) ) + return -1; + } + + /* + * Build A Setwise Bad Character Shift Table + */ + Build_Bad_Character_Shifts( ts ); + + /* + tmem += ts->memory; + printf(" Compile stats: %d patterns, %d chars, %d duplicate patterns, %d bytes, %d total-bytes\n",ts->npats,ts->nchars,ts->duplicates,ts->memory,tmem); + */ + + return 0; +} + +int KTrieCompile( + KTRIE_STRUCT * ts, + int (*build_tree)(void * id, void **existing_tree), + int (*neg_list_func)(void *id, void **list)) +{ + int rval; + + if ((rval = _KTrieCompile(ts))) + return rval; + + if (build_tree && neg_list_func) { + KTrieBuildMatchStateTrees(ts, build_tree, neg_list_func); + } + + return 0; +} + +int KTrieCompileWithSnortConf( + SnortConfig *sc, KTRIE_STRUCT * ts, + int (*build_tree)(SnortConfig *, void * id, void **existing_tree), + int (*neg_list_func)(void *id, void **list)) +{ + int rval; + + if ((rval = _KTrieCompile(ts))) + return rval; + + if (build_tree && neg_list_func) { + KTrieBuildMatchStateTreesWithSnortConf(sc, ts, build_tree, neg_list_func); + } + + return 0; +} + +void sfksearch_print_qinfo(void) +{ +#ifdef SFKSEARCH_TRACK_Q + print_pat_stats("sfksearch", SFK_MAX_INQ); +#endif +} +static inline void _init_queue( SFK_PMQ * b) +{ + b->inq=0; + b->inq_flush=0; +} + +/* uniquely insert into q */ +static inline int _add_queue(SFK_PMQ * b, void * p ) +{ + int i; + +#ifdef SFKSEARCH_TRACK_Q + pmqs.tot_inq_inserts++; +#endif + + for(i=(int)(b->inq)-1; i>=0; i--) + if( p == b->q[i] ) + return 0; + +#ifdef SFKSEARCH_TRACK_Q + pmqs.tot_inq_uinserts++; +#endif + + if( b->inq < SFK_MAX_INQ ) { + b->q[ b->inq++ ] = p; + } + + if( b->inq == SFK_MAX_INQ ) { +#ifdef SFKSEARCH_TRACK_Q + b->inq_flush++; +#endif + return 1; + } + return 0; +} + +static inline unsigned _process_queue( + SFK_PMQ * q, + int(*match)(void * id, void *tree, int index, void *data, void *neg_list), + void *data ) +{ + KTRIEPATTERN * pk; + unsigned int i; + +#ifdef SFKSEARCH_TRACK_Q + if( q->inq > pmqs.max_inq ) + pmqs.max_inq = q->inq; + pmqs.tot_inq_flush += q->inq_flush; +#endif + + for( i=0; iinq; i++ ) { + pk = (KTRIEPATTERN*)q->q[i]; + if (pk) { + if (match (pk->id, pk->rule_option_tree, 0, data, pk->neg_list) > 0) { + q->inq=0; + return 1; + } + } + } + q->inq=0; + return 0; +} + +static inline int KTriePrefixMatchQ( + KTRIE_STRUCT * kt, unsigned char * T, int n, + int(*match)(void * id, void *tree, int index, void *data, void *neg_list), + void * data ) +{ + KTRIENODE * root; + //KTRIEPATTERN * pk; + //int index ; + + root = kt->root[ xlatcase[*T] ]; + + if( !root ) + return 0; + + while( n ) { + if( root->edge == xlatcase[*T] ) { + T++; + n--; + + if( root->pkeyword ) { + if( _add_queue( &kt->q, root->pkeyword ) ) { + if( _process_queue( &kt->q,match,data) ) { + return 1; + } + } + } + + if( n && root->child ) { + root = root->child; + } else { /* cannot continue -- match is over */ + break; + } + } else { + if( root->sibling ) { + root = root->sibling; + } else { /* cannot continue */ + break; + } + } + } + + return 0; +} + +/* +* Search - Algorithm +* +* This routine will log any substring of T that matches a keyword, +* and processes all prefix matches. This is used for generic +* pattern searching with a set of keywords and a body of text. +* +* +* +* kt- Trie Structure +* T - nocase text +* Tc- case specific text +* n - text length +* +* returns: +* # pattern matches +*/ +static inline int KTriePrefixMatch( + KTRIE_STRUCT* kt, unsigned char* T, unsigned char*, unsigned char* bT, int n, + int(*match)(void* id, void* tree, int index, void* data, void* neg_list), + void * data ) +{ + KTRIENODE * root = kt->root[ *T ]; + int nfound = 0; + KTRIEPATTERN * pk; + int index ; + + /* Check if any keywords start with this character */ + if( !root ) return 0; + + while( n ) { + if( root->edge == *T ) { + T++; + n--; + + pk = root->pkeyword; + if (pk) { + index = (int)(T - bT - pk->n ); + nfound++; + if (match (pk->id, pk->rule_option_tree, index, data, pk->neg_list) > 0) { + return nfound; + } + } + + if( n && root->child ) { + root = root->child; + } else { /* cannot continue -- match is over */ + break; + } + } else { + if( root->sibling ) { + root = root->sibling; + } else { /* cannot continue */ + break; + } + } + } + + return nfound; +} + +int KTrieSearchQ( + KTRIE_STRUCT * ks, unsigned char * T, int n, + int(*match)(void * id, void *tree, int index, void *data, void *neg_list), + void * data ) +{ + _init_queue(&ks->q); + while( n > 0 ) { + if( KTriePrefixMatchQ( ks, T++, n--, match, data ) ) + return 0; + } + _process_queue(&ks->q,match,data); + + return 0; +} + +static inline int KTrieSearchQBC( + KTRIE_STRUCT * ks, unsigned char * T, int n, + int(*match)(void * id, void *tree, int index, void *data, void *neg_list), + void * data ) +{ + int tshift; + unsigned char *Tend; + short *bcShift = (short*)ks->bcShift; + int bcSize = ks->bcSize; + + _init_queue(&ks->q); + + Tend = T + n - bcSize; + + bcSize--; + + for( ; T <= Tend; n--, T++ ) { + while( (tshift = bcShift[ T[bcSize] ]) > 0 ) { + T += tshift; + if( T > Tend ) + return 0; + } + + if( KTriePrefixMatchQ( ks, T, n, match, data ) ) + return 0; + } + + _process_queue(&ks->q,match,data); + + return 0; +} + + +/* +* +*/ +static inline int KTrieSearchNoBC( + KTRIE_STRUCT * ks, unsigned char * Tx, int n, + int(*match)(void * id, void *tree, int index, void *data, void *neg_list), + void * data ) +{ + int nfound = 0; + unsigned char *T, *bT; + + ConvertCaseEx( Tnocase, Tx, n ); + + T = Tnocase; + bT = T; + + for( ; n>0 ; n--, T++, Tx++ ) { + nfound += KTriePrefixMatch( ks, T, Tx, bT, n, match, data ); + } + + return nfound; +} + +/* +* +*/ +static inline int KTrieSearchBC( + KTRIE_STRUCT * ks, unsigned char * Tx, int n, + int(*match)(void * id, void *tree, int index, void *data, void *neg_list), + void * data ) +{ + int tshift; + unsigned char *Tend; + unsigned char *T, *bT; + int nfound = 0; + short *bcShift = (short*)ks->bcShift; + int bcSize = ks->bcSize; + + ConvertCaseEx( Tnocase, Tx, n ); + + T = Tnocase; + bT = T; + + Tend = T + n - bcSize; + + bcSize--; + + for( ; T <= Tend; n--, T++, Tx++ ) { + while( (tshift = bcShift[ *( T + bcSize ) ]) > 0 ) { + T += tshift; + Tx += tshift; + if( T > Tend ) return nfound; + } + + nfound += KTriePrefixMatch( ks, T, Tx, bT, n, match, data ); + } + + return nfound; +} + +int KTrieSearch( + KTRIE_STRUCT * ks, unsigned char * T, int n, + int(*match)(void * id, void *tree, int index, void *data, void *neg_list), + void * data ) +{ + if ( ks->bcSize < 3 ) + return KTrieSearchNoBC( ks, T, n, match, data ); + else + return KTrieSearchBC( ks, T, n, match, data ); +} + +/* +* +* TEST DRIVER FOR KEYWORD TRIE +* +*/ +#ifdef KTRIE_MAIN + +char ** gargv; + +int trie_nmatches = 0; + +int match( unsigned id, int index, void * data ) +{ + trie_nmatches++; + data = data; + printf("id=%d found at index=%d, %s\n",id,index,gargv[id]); + return 0; +} + +/* +* +*/ +int main( int argc, char ** argv ) +{ + int i; + KTRIE_STRUCT * ts; + int nocase=1; // don't care about case + + gargv = argv; + + ts = KTrieNew(); + + if( argc < 3 ) { + printf("%s text pat1 pat2 ... patn [-c(ase-sensitive)\n",argv[0]); + printf("search for keywords-default, or match keywords\n"); + exit(0); + } + + for(i=1; i %d characters, %d patterns, %d bytes allocated\n",ts->nchars,ts->npats,ts->memory); + + printf("Searching...\n"); + + KTrieSearch( ts, (unsigned char*)argv[1], strlen(argv[1]), match, 0 ); + + printf("%d matches found\n",trie_nmatches); + + printf("normal pgm finish.\n"); + + return 0; +} + +#endif diff --git a/extra/src/search_engines/sfksearch.h b/extra/src/search_engines/sfksearch.h new file mode 100644 index 000000000..82f2c4c5a --- /dev/null +++ b/extra/src/search_engines/sfksearch.h @@ -0,0 +1,150 @@ +/* +* ksearch.h +* +* Trie based multi-pattern matcher +* +* +* Copyright (C) 2001 Marc Norton +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2003-2013 Sourcefire, Inc. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ + +#ifndef SFKSEARCH_H +#define SFKSEARCH_H + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#define ALPHABET_SIZE 256 + +#define KTRIEMETHOD_STD 0 +#define KTRIEMETHOD_QUEUE 1 + +/* +* +*/ +typedef struct _ktriepattern { + + struct _ktriepattern* next; /* global list of all patterns*/ + struct _ktriepattern* mnext; /* matching list of duplicate keywords*/ + + unsigned char* P; /* no case*/ + unsigned char* Pcase; /* case sensitive*/ + int n; + int nocase; + int negative; + void * id; + void * rule_option_tree; + void * neg_list; + +} KTRIEPATTERN; + + +/* +* +*/ +typedef struct _ktrienode { + + int edge; /* character*/ + + struct _ktrienode* sibling; + struct _ktrienode* child; + + KTRIEPATTERN*pkeyword; + +} KTRIENODE; + + +#define KTRIE_ROOT_NODES 256 + +#define SFK_MAX_INQ 32 +typedef struct +{ + unsigned inq; + unsigned inq_flush; + void* q[SFK_MAX_INQ]; +} SFK_PMQ; + +/* +* +*/ +typedef struct { + + KTRIEPATTERN* patrn; /* List of patterns, built as they are added*/ + + + KTRIENODE * root[KTRIE_ROOT_NODES]; /* KTrie nodes*/ + + int memory; + int nchars; + int npats; + int duplicates; + int method; + int end_states; /* should equal npats - duplicates*/ + + int bcSize; + unsigned short bcShift[KTRIE_ROOT_NODES]; + void (*userfree)(void*p); + void (*optiontreefree)(void**p); + void (*neg_list_free)(void**p); + SFK_PMQ q; + +} KTRIE_STRUCT; + +void KTrie_init_xlatcase(); + +KTRIE_STRUCT* KTrieNew( + int method, void (*userfree)(void*p), + void (*optiontreefree)(void**p), + void (*neg_list_free)(void**p)); + +int KTrieAddPattern( + KTRIE_STRUCT*ts, unsigned char* P, int n, + int nocase, int negative, void* id ); + +int KTrieCompile( + KTRIE_STRUCT* ts, + int (*build_tree)(void* id, void**existing_tree), + int (*neg_list_func)(void*id, void**list)); + +struct SnortConfig; + +int KTrieCompileWithSnortConf( + SnortConfig*, KTRIE_STRUCT* ts, + int (*build_tree)(SnortConfig*, void* id, void**existing_tree), + int (*neg_list_func)(void*id, void**list)); + +int KTrieSearch( + KTRIE_STRUCT* ts, unsigned char* T, int n, + int(*match)(void* id, void*tree, int index, void*data, void*neg_list), + void*data ); + +int KTrieSearchQ( + KTRIE_STRUCT* ts, unsigned char* T, int n, + int(*match)(void* id, void*tree, int index, void*data, void*neg_list), + void*data ); + +unsigned int KTrieMemUsed(void); +void KTrieInitMemUsed(void); +void KTrieDelete(KTRIE_STRUCT*k); +int KTriePatternCount(KTRIE_STRUCT*k); + +void sfksearch_print_qinfo(void); + +#endif diff --git a/extra/src/search_engines/trie_api.cc b/extra/src/search_engines/trie_api.cc new file mode 100644 index 000000000..2206776da --- /dev/null +++ b/extra/src/search_engines/trie_api.cc @@ -0,0 +1,33 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2013-2013 Sourcefire, Inc. +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ +// trie_api.cc author Russ Combs + +#include "framework/mpse.h" + +extern const BaseApi* se_lowmem; +extern const BaseApi* se_lowmem_q; + +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + se_lowmem, + se_lowmem_q, + nullptr +}; + diff --git a/extra/src/so_rules/Makefile.am b/extra/src/so_rules/Makefile.am new file mode 100644 index 000000000..890c7e721 --- /dev/null +++ b/extra/src/so_rules/Makefile.am @@ -0,0 +1,19 @@ +AUTOMAKE_OPTIONS=foreign + +optlibdir = $(pkglibdir)/so_rules +optlib_LTLIBRARIES = lib18758.la +lib18758_la_CXXFLAGS = $(AM_CXXFLAGS) +lib18758_la_LDFLAGS = -export-dynamic -shared +lib18758_la_SOURCES = sid_18758.cc sid_18758.h + +BUILT_SOURCES = \ +sid_18758.h + +%.gz : %.txt + gzip --best --no-name --stdout $< > $@ + +%.h : %.gz + xxd -i $< > $@ + +AM_CXXFLAGS = @AM_CXXFLAGS@ + diff --git a/extra/src/so_rules/lib18758.0.dylib b/extra/src/so_rules/lib18758.0.dylib new file mode 100755 index 000000000..2237cdbc8 Binary files /dev/null and b/extra/src/so_rules/lib18758.0.dylib differ diff --git a/extra/src/so_rules/sid_18758.cc b/extra/src/so_rules/sid_18758.cc new file mode 100644 index 000000000..36c463044 --- /dev/null +++ b/extra/src/so_rules/sid_18758.cc @@ -0,0 +1,83 @@ +/* +** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. +** Copyright (C) 2002-2013 Sourcefire, Inc. +** Copyright (C) 1998-2002 Martin Roesch +** +** This program is free software; you can redistribute it and/or modify +** it under the terms of the GNU General Public License Version 2 as +** published by the Free Software Foundation. You may not use, modify or +** distribute this program under any other version of the GNU General +** Public License. +** +** This program is distributed in the hope that it will be useful, +** but WITHOUT ANY WARRANTY; without even the implied warranty of +** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +** GNU General Public License for more details. +** +** You should have received a copy of the GNU General Public License +** along with this program; if not, write to the Free Software +** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +*/ +// sid_18758.cc author Russ Combs + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include + +#include "main/snort_types.h" +#include "framework/so_rule.h" +#include "detection/detection_defines.h" +#include "sid_18758.h" + +static constexpr unsigned crash_test_dummy = 18758; + +static int eval(void* v, Packet* p) +{ + unsigned u = *((unsigned*)v); + assert(u == crash_test_dummy); + return p ? DETECTION_OPTION_MATCH : DETECTION_OPTION_NO_MATCH; +} + +static SoEvalFunc ctor(const char* so, void** pv) +{ + assert(!strcmp(so, "eval")); + *pv = new unsigned(crash_test_dummy); + return eval; +} + +static void dtor(void* v) +{ + unsigned* u = (unsigned*)v; + assert(*u == crash_test_dummy); + delete u; +} + +static const SoApi so_api = +{ + { + PT_SO_RULE, + "3|18758", + IPSAPI_PLUGIN_V0, + 8, + nullptr, + nullptr + }, + sid_18758_gz, + sid_18758_gz_len, + nullptr, + nullptr, + nullptr, + nullptr, + ctor, + dtor, +}; + +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &so_api.base, + nullptr +}; + diff --git a/extra/src/so_rules/sid_18758.h b/extra/src/so_rules/sid_18758.h new file mode 100644 index 000000000..8641aaedd --- /dev/null +++ b/extra/src/so_rules/sid_18758.h @@ -0,0 +1,30 @@ +unsigned char sid_18758_gz[] = { + 0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x03, 0x2d, 0x8e, + 0x5f, 0x4b, 0xc3, 0x40, 0x10, 0xc4, 0xdf, 0xfd, 0x14, 0x4b, 0xc8, 0x43, + 0x0b, 0xfd, 0x83, 0x8a, 0x58, 0x2e, 0xa0, 0x28, 0x46, 0x5a, 0xa8, 0xb5, + 0xd4, 0x58, 0x15, 0x2b, 0xe1, 0x7a, 0xd9, 0xb4, 0x8b, 0xd7, 0xbb, 0x78, + 0xbb, 0x4d, 0x5b, 0xe8, 0x87, 0x37, 0x15, 0x9f, 0x96, 0xf9, 0xed, 0x30, + 0x33, 0xda, 0x62, 0x10, 0x10, 0x53, 0x41, 0x3c, 0x7c, 0x7e, 0x4a, 0xf3, + 0x49, 0x9a, 0x81, 0x76, 0x07, 0xe8, 0xde, 0x40, 0x9c, 0xbe, 0x67, 0xe9, + 0x6c, 0x72, 0x37, 0xfe, 0x83, 0xf1, 0x30, 0xcb, 0xa6, 0xf9, 0xf4, 0x79, + 0x96, 0xbd, 0x40, 0x6b, 0xc3, 0x2b, 0x15, 0x3d, 0x8e, 0xc6, 0x69, 0x77, + 0xf4, 0x90, 0x4e, 0xb2, 0xd1, 0xe3, 0x07, 0x3c, 0x91, 0x09, 0x9e, 0x7d, + 0x29, 0xf0, 0x46, 0xae, 0xf0, 0x3b, 0x86, 0x39, 0xf1, 0x56, 0x5b, 0xb8, + 0xd7, 0x4c, 0x06, 0xd8, 0x04, 0xaa, 0x04, 0x4a, 0xb2, 0x08, 0xcd, 0xd7, + 0x59, 0xaf, 0x0b, 0x08, 0xf8, 0xb3, 0x45, 0x96, 0x28, 0x81, 0x0d, 0x8a, + 0x2e, 0xb4, 0x68, 0xc5, 0x18, 0x6a, 0x32, 0x08, 0x6b, 0x91, 0x2a, 0x69, + 0x0c, 0x25, 0x06, 0x74, 0x06, 0xd5, 0x36, 0xd8, 0x0e, 0xba, 0xde, 0x8e, + 0xbe, 0xa9, 0xc2, 0x82, 0x74, 0xcf, 0x87, 0x55, 0xff, 0xa4, 0xfa, 0xf3, + 0x25, 0x27, 0x60, 0xac, 0x66, 0x96, 0x43, 0x85, 0x6a, 0x43, 0x6c, 0xba, + 0xda, 0x08, 0xd5, 0x24, 0x87, 0x04, 0x98, 0x0a, 0x75, 0x3e, 0xb8, 0xbe, + 0x1a, 0x9c, 0xc2, 0x6a, 0xd5, 0x1c, 0xf6, 0x0d, 0xba, 0x3c, 0xfe, 0xc3, + 0xd2, 0xfa, 0x9d, 0x12, 0x9f, 0x9f, 0x7a, 0x31, 0x74, 0x9a, 0x35, 0x7a, + 0x69, 0x89, 0xd7, 0x58, 0x34, 0xa1, 0xde, 0x09, 0x3a, 0x51, 0x51, 0xaf, + 0x5e, 0x72, 0xd4, 0x81, 0x52, 0xb3, 0xe4, 0x95, 0x16, 0xc1, 0xe0, 0x94, + 0x77, 0xf6, 0xd0, 0xf9, 0x9b, 0x99, 0x6f, 0x03, 0x25, 0x50, 0x99, 0x80, + 0x2a, 0xea, 0x2f, 0xf6, 0x17, 0xd8, 0xb8, 0x5b, 0x9f, 0x8b, 0xdb, 0xc5, + 0xfe, 0xca, 0x34, 0xb2, 0xfc, 0x3a, 0xc6, 0xed, 0x3e, 0x6f, 0xe8, 0x35, + 0x3a, 0x95, 0x2b, 0xac, 0xb5, 0x4d, 0xa0, 0x7d, 0xf6, 0x0b, 0xe0, 0x25, + 0xec, 0x5e, 0x7a, 0x01, 0x00, 0x00 +}; +unsigned int sid_18758_gz_len = 318; diff --git a/extra/src/so_rules/sid_18758.txt b/extra/src/so_rules/sid_18758.txt new file mode 100644 index 000000000..ca8e213bf --- /dev/null +++ b/extra/src/so_rules/sid_18758.txt @@ -0,0 +1 @@ +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758; flow:to_server,established; content:".vbs", fast_pattern:only, http_uri; pcre:"/\x2evbs([\?\x5c\x2f]|$)/smiU"; so:eval; ) diff --git a/extra/src/so_rules/stubs.conf b/extra/src/so_rules/stubs.conf new file mode 100644 index 000000000..20239af54 --- /dev/null +++ b/extra/src/so_rules/stubs.conf @@ -0,0 +1 @@ +alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; metadata:service http; reference:url,en.wikipedia.org/wiki/Vbs; classtype:misc-activity; sid:18758; rev:8; soid:3|18758;)