From: Russ Combs Date: Tue, 4 Aug 2015 22:01:40 +0000 (-0400) Subject: Squashed commit of the following: X-Git-Tag: 3.0.0-233~891 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9a5fb143cc3f0bf34fd49733f3d9db76262675bb;p=thirdparty%2Fsnort3.git Squashed commit of the following: commit 96ac198ed31c439e75e6ac5eb8e4ad1dbb1b3944 Author: Russ Combs Date: Tue Aug 4 17:44:36 2015 -0400 add make targets for dev_guide.html and snort_online.html cleanup debug macros --- diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt index e3fb08a2e..209d213f3 100644 --- a/doc/CMakeLists.txt +++ b/doc/CMakeLists.txt @@ -195,6 +195,19 @@ if ( MAKE_HTML_DOC OR MAKE_TEXT_DOC OR MAKE_PDF_DOC ) "${CMAKE_CURRENT_BINARY_DIR}/snort_manual.html" "${CMAKE_CURRENT_BINARY_DIR}/snort_manual.chunked" ) + + add_custom_target ( + snort_online.html + COMMAND ${CMAKE_SOURCE_DIR}/doc/online_manual.sh + DEPENDS all_built_sources + ) + + add_custom_target ( + dev_guide.html + COMMAND ${CMAKE_SOURCE_DIR}/doc/dev_guide.sh ${CMAKE_SOURCE_DIR} + DEPENDS all_built_sources + ) + endif ( MAKE_HTML_DOC ) if ( MAKE_TEXT_DOC ) diff --git a/doc/Makefile.am b/doc/Makefile.am index d7aabc38a..e81ee02b9 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -205,6 +205,12 @@ install-data-hook: uninstall-hook: rm -rf $(DESTDIR)$(docdir)/snort_manual.chunked + +snort_online.html: $(all_sources) + $(srcdir)/online_manual.sh + +dev_guide.html: $(snort) + $(srcdir)/dev_guide.sh $(top_srcdir) endif delete_unbuilt = $(if $(and $(findstring $(builddir),$(srcdir)),$(findstring $(srcdir),$(builddir))), ,$(unbuilt_sources)) @@ -215,5 +221,5 @@ clean-local: rm -f $(doc_DATA) rm -f snort_manual.{fo,xml} rm -rf snort_manual.chunked - rm -f *.css *.tgz + rm -f *.css *.tgz *.html diff --git a/doc/dev_guide.sh b/doc/dev_guide.sh index b235ea931..5b1db7666 100755 --- a/doc/dev_guide.sh +++ b/doc/dev_guide.sh @@ -8,6 +8,12 @@ # -- remove header guards? (outermost #ifndef, #define, #endif) # -- use css source instead of the sed fixups? +if [ "$1" ] ; then + pushd . + cd $1 || exit -1 + echo "cd $1" +fi + tmp=/tmp/dev_guide/ out=$tmp/dev_guide.txt html=$tmp/dev_guide.html @@ -160,9 +166,9 @@ echo "translating snort includes into links" sed -i.sed -f sed_cmds.txt $html echo "clean up" -mv dev_guide.* ../ -cd .. +popd +mv $html ./ rm -rf $tmp -echo "done; see /tmp/dev_guide.html" +echo "done; see ./dev_guide.html" diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index 12459da8d..6d2fca8ee 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -178,8 +178,8 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) if (hlen < ip::IP4_HEADER_LEN) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "Bogus IP header length of %i bytes\n", hlen); ); + DebugFormat(DEBUG_DECODE, + "Bogus IP header length of %i bytes\n", hlen); codec_event(codec, DECODE_IPV4_INVALID_HEADER_LEN); return false; @@ -187,10 +187,10 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) if (ip_len > raw.len) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, + DebugFormat(DEBUG_DECODE, "IP Len field is %d bytes bigger than captured length.\n" " (ip.len: %lu, cap.len: %lu)\n", - ip_len - raw.len, ip_len, raw.len); ); + ip_len - raw.len, ip_len, raw.len); codec_event(codec, DECODE_IPV4_DGRAM_GT_CAPLEN); return false; @@ -212,9 +212,9 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) if (ip_len < hlen) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, + DebugFormat(DEBUG_DECODE, "IP dgm len (%d bytes) < IP hdr " - "len (%d bytes), packet discarded\n", ip_len, hlen); ); + "len (%d bytes), packet discarded\n", ip_len, hlen); codec_event(codec, DECODE_IPV4_DGRAM_LT_IPHDR); return false; diff --git a/src/codecs/link/cd_ppp_encap.cc b/src/codecs/link/cd_ppp_encap.cc index d9525efa8..262ed6320 100644 --- a/src/codecs/link/cd_ppp_encap.cc +++ b/src/codecs/link/cd_ppp_encap.cc @@ -57,13 +57,13 @@ bool PppEncap::decode(const RawData& raw, CodecData& codec, DecodeData&) static THREAD_LOCAL bool had_vj = false; uint16_t protocol; - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "PPP Packet!\n"); ); + DebugMessage(DEBUG_DECODE, "PPP Packet!\n"); #ifdef WORDS_MUSTALIGN - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Packet with PPP header. " + DebugMessage(DEBUG_DECODE, "Packet with PPP header. " "PPP is only 1 or 2 bytes and will throw off " "alignment on this architecture when decoding IP, " - "causing a bus error - stop decoding packet.\n"); ); + "causing a bus error - stop decoding packet.\n"); return true; #endif /* WORDS_MUSTALIGN */ diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc index 3a61c8e1c..d4fb16a22 100644 --- a/src/codecs/link/cd_pppoe.cc +++ b/src/codecs/link/cd_pppoe.cc @@ -129,11 +129,11 @@ bool PPPoECodec::decode(const RawData& raw, switch (ppp_type) { case PppoepktType::DISCOVERY: - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "(PPPOE Discovery) "); ); + DebugMessage(DEBUG_DECODE, "(PPPOE Discovery) "); break; case PppoepktType::SESSION: - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "(PPPOE Session) "); ); + DebugMessage(DEBUG_DECODE, "(PPPOE Session) "); break; } @@ -251,7 +251,7 @@ bool PPPoECodec::decode(const RawData& raw, if (ppp_type == PppoepktType::DISCOVERY) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Returning early on PPPOE discovery packet\n"); ); + DebugMessage(DEBUG_DECODE, "Returning early on PPPOE discovery packet\n"); return true; } diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index 26452c4b8..f322ca04e 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -108,7 +108,7 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) switch (version) { case 0: /*GTP v0*/ - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "GTP v0 packets.\n"); ); + DebugMessage(DEBUG_DECODE, "GTP v0 packets.\n"); len = GTP_V0_HEADER_LEN; if (raw.len < len) @@ -119,15 +119,15 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) if (raw.len != ((unsigned int)ntohs(hdr->length) + len)) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n", - raw.len - len, ntohs(hdr->length)); ); + DebugFormat(DEBUG_DECODE, "Calculated length %d != %d in header.\n", + raw.len - len, ntohs(hdr->length)); codec_event(codec, DECODE_GTP_BAD_LEN); return false; } break; case 1: /*GTP v1*/ - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "GTP v1 packets.\n"); ); + DebugMessage(DEBUG_DECODE, "GTP v1 packets.\n"); /*Check the length based on optional fields and extension header*/ if (hdr->flag & 0x07) @@ -178,15 +178,15 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) if (raw.len != ((unsigned int)ntohs(hdr->length) + GTP_MIN_LEN)) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Calculated length %d != %d in header.\n", - raw.len - GTP_MIN_LEN, ntohs(hdr->length)); ); + DebugFormat(DEBUG_DECODE, "Calculated length %d != %d in header.\n", + raw.len - GTP_MIN_LEN, ntohs(hdr->length)); codec_event(codec, DECODE_GTP_BAD_LEN); return false; } break; default: - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Unknown protocol version.\n"); ); + DebugMessage(DEBUG_DECODE, "Unknown protocol version.\n"); return false; } diff --git a/src/detection/detect.cc b/src/detection/detect.cc index d2926faf2..458353924 100644 --- a/src/detection/detect.cc +++ b/src/detection/detect.cc @@ -95,8 +95,9 @@ void snort_inspect(Packet* p) pktcnt = PPM_INC_PKT_CNT(); PPM_GET_TIME(); PPM_INIT_PKT_TIMER(); + #ifdef DEBUG_MSGS - if ( DebugThis(DEBUG_PPM) ) + if ( Debug::enabled(DEBUG_PPM) ) { /* for debugging, info gathering, so don't worry about * (unsigned) casting of pktcnt, were not likely to debug @@ -114,15 +115,14 @@ void snort_inspect(Packet* p) // If the packet has errors, we won't analyze it. if ( p->ptrs.decode_flags & DECODE_ERR_FLAGS ) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, + DebugFormat(DEBUG_DETECT, "Packet errors = 0x%x, ignoring traffic!\n", - (p->ptrs.decode_flags & DECODE_ERR_FLAGS)); ); + (p->ptrs.decode_flags & DECODE_ERR_FLAGS)); if ( SnortConfig::inline_mode() and SnortConfig::checksum_drop(p->ptrs.decode_flags & DECODE_ERR_CKSUM_ALL) ) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "Dropping bad packet\n"); ); + DebugMessage(DEBUG_DECODE, "Dropping bad packet\n"); Active::drop_packet(p); } } @@ -178,15 +178,16 @@ void snort_inspect(Packet* p) PPM_GET_TIME(); PPM_TOTAL_PKT_TIME(); PPM_ACCUM_PKT_TIME(); + #ifdef DEBUG_MSGS - if ( DebugThis(DEBUG_PPM) ) + if ( Debug::enabled(DEBUG_PPM) ) { + // FIXIT-L logs should be debugs LogMessage("PPM: Pkt[%u] Used= ",(unsigned)pktcnt); PPM_PRINT_PKT_TIME("%g usecs\n"); LogMessage("PPM: Process-EndPkt[%u]\n\n",(unsigned)pktcnt); } #endif - PPM_PKT_LOG(p); } if ( PPM_RULES_ENABLED() ) @@ -281,12 +282,12 @@ int CheckTagging(Packet* p) if (check_tags_flag == 1 && !(p->packet_flags & PKT_REBUILT_STREAM)) { void* listhead = NULL; - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "calling CheckTagList\n"); ); + DebugMessage(DEBUG_FLOW, "calling CheckTagList\n"); if (CheckTagList(p, &event, &listhead)) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "Matching tag node found, " - "calling log functions\n"); ); + DebugMessage(DEBUG_FLOW, "Matching tag node found, " + "calling log functions\n"); /* if we find a match, we want to send the packet to the * logging mechanism @@ -384,14 +385,14 @@ static int CheckAddrPort( int except_port_flag = 0; /* port exception flag set */ int ip_match = 0; /* flag to indicate addr match made */ - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "CheckAddrPort: "); ); + DebugMessage(DEBUG_DETECT, "CheckAddrPort: "); /* set up the packet particulars */ if (mode & CHECK_SRC_IP) { pkt_addr = p->ptrs.ip_api.get_src(); pkt_port = p->ptrs.sp; - DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"SRC "); ); + DebugMessage(DEBUG_DETECT,"SRC "); if (mode & INVERSE) { @@ -411,7 +412,7 @@ static int CheckAddrPort( pkt_addr = p->ptrs.ip_api.get_dst(); pkt_port = p->ptrs.dp; - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "DST "); ); + DebugMessage(DEBUG_DETECT, "DST "); if (mode & INVERSE) { @@ -427,8 +428,7 @@ static int CheckAddrPort( } } - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "addr %lx, port %d ", pkt_addr, - pkt_port); ); + DebugFormat(DEBUG_DETECT, "addr %lx, port %d ", pkt_addr, pkt_port); if (!rule_addr) goto bail; @@ -440,7 +440,7 @@ static int CheckAddrPort( } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", global exception flag set"); ); + DebugMessage(DEBUG_DETECT, ", global exception flag set"); /* global exception flag is up, we can't match on *any* * of the source addresses */ @@ -454,18 +454,18 @@ static int CheckAddrPort( bail: if (!ip_match) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", no address match, " - "packet rejected\n"); ); + DebugMessage(DEBUG_DETECT, ", no address match, " + "packet rejected\n"); return 0; } - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", addresses accepted"); ); + DebugMessage(DEBUG_DETECT, ", addresses accepted"); /* if the any port flag is up, we're all done (success) */ if (any_port_flag) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", any port match, " - "packet accepted\n"); ); + DebugMessage(DEBUG_DETECT, ", any port match, " + "packet accepted\n"); return 1; } @@ -480,26 +480,26 @@ bail: /* if the exception flag isn't up, fail */ if (!except_port_flag) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", port mismatch, " - "packet rejected\n"); ); + DebugMessage(DEBUG_DETECT, ", port mismatch, " + "packet rejected\n"); return 0; } - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", port mismatch exception"); ); + DebugMessage(DEBUG_DETECT, ", port mismatch exception"); } else { /* if the exception flag is up, fail */ if (except_port_flag) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - ", port match exception, packet rejected\n"); ); + DebugMessage(DEBUG_DETECT, + ", port match exception, packet rejected\n"); return 0; } - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", ports match"); ); + DebugMessage(DEBUG_DETECT, ", ports match"); } /* ports and address match */ - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, ", packet accepted!\n"); ); + DebugMessage(DEBUG_DETECT, ", packet accepted!\n"); return 1; } @@ -509,79 +509,78 @@ bail: int CheckBidirectional(Packet* p, RuleTreeNode* rtn_idx, RuleFpList*, int check_ports) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "Checking bidirectional rule...\n"); ); + DebugMessage(DEBUG_DETECT, "Checking bidirectional rule...\n"); if (CheckAddrPort(rtn_idx->sip, CHECK_ADDR_SRC_ARGS(rtn_idx), p, rtn_idx->flags, CHECK_SRC_IP | (check_ports ? CHECK_SRC_PORT : 0))) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " Src->Src check passed\n"); ); + DebugMessage(DEBUG_DETECT, " Src->Src check passed\n"); if (!CheckAddrPort(rtn_idx->dip, CHECK_ADDR_DST_ARGS(rtn_idx), p, rtn_idx->flags, CHECK_DST_IP | (check_ports ? CHECK_DST_PORT : 0))) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - " Dst->Dst check failed," - " checking inverse combination\n"); ); + DebugMessage(DEBUG_DETECT, + " Dst->Dst check failed, checking inverse combination\n"); if (CheckAddrPort(rtn_idx->dip, CHECK_ADDR_DST_ARGS(rtn_idx), p, rtn_idx->flags, (CHECK_SRC_IP | INVERSE | (check_ports ? CHECK_SRC_PORT : 0)))) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - " Inverse Dst->Src check passed\n"); ); + DebugMessage(DEBUG_DETECT, + " Inverse Dst->Src check passed\n"); if (!CheckAddrPort(rtn_idx->sip, CHECK_ADDR_SRC_ARGS(rtn_idx), p, rtn_idx->flags, (CHECK_DST_IP | INVERSE | (check_ports ? CHECK_DST_PORT : 0)))) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - " Inverse Src->Dst check failed\n"); ); + DebugMessage(DEBUG_DETECT, + " Inverse Src->Dst check failed\n"); return 0; } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "Inverse addr/port match\n"); ); + DebugMessage(DEBUG_DETECT, "Inverse addr/port match\n"); } } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " Inverse Dst->Src check failed," - " trying next rule\n"); ); + DebugMessage(DEBUG_DETECT, " Inverse Dst->Src check failed," + " trying next rule\n"); return 0; } } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "dest IP/port match\n"); ); + DebugMessage(DEBUG_DETECT, "dest IP/port match\n"); } } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - " Src->Src check failed, trying inverse test\n"); ); + DebugMessage(DEBUG_DETECT, + " Src->Src check failed, trying inverse test\n"); if (CheckAddrPort(rtn_idx->dip, CHECK_ADDR_DST_ARGS(rtn_idx), p, rtn_idx->flags, CHECK_SRC_IP | INVERSE | (check_ports ? CHECK_SRC_PORT : 0))) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - " Dst->Src check passed\n"); ); + DebugMessage(DEBUG_DETECT, + " Dst->Src check passed\n"); if (!CheckAddrPort(rtn_idx->sip, CHECK_ADDR_SRC_ARGS(rtn_idx), p, rtn_idx->flags, CHECK_DST_IP | INVERSE | (check_ports ? CHECK_DST_PORT : 0))) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - " Src->Dst check failed\n"); ); + DebugMessage(DEBUG_DETECT, + " Src->Dst check failed\n"); return 0; } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - "Inverse addr/port match\n"); ); + DebugMessage(DEBUG_DETECT, + "Inverse addr/port match\n"); } } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT," Inverse test failed, " - "testing next rule...\n"); ); + DebugMessage(DEBUG_DETECT," Inverse test failed, " + "testing next rule...\n"); return 0; } } - DEBUG_WRAP(DebugMessage(DEBUG_DETECT," Bidirectional success!\n"); ); + DebugMessage(DEBUG_DETECT," Bidirectional success!\n"); return 1; } @@ -600,7 +599,7 @@ int CheckBidirectional(Packet* p, RuleTreeNode* rtn_idx, ***************************************************************************/ int CheckSrcIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ports) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckSrcIPEqual: "); ); + DebugMessage(DEBUG_DETECT,"CheckSrcIPEqual: "); if (!(rtn_idx->flags & EXCEPT_SRC_IP)) { @@ -615,7 +614,7 @@ int CheckSrcIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ /* global exception flag is up, we can't match on *any* * of the source addresses */ - DEBUG_WRAP(DebugMessage(DEBUG_DETECT," global exception flag, \n"); ); + DebugMessage(DEBUG_DETECT," global exception flag, \n"); if ( sfvar_ip_in(rtn_idx->sip, p->ptrs.ip_api.get_src()) ) return 0; @@ -623,7 +622,7 @@ int CheckSrcIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports); } - DEBUG_WRAP(DebugMessage(DEBUG_DETECT," Mismatch on SIP\n"); ); + DebugMessage(DEBUG_DETECT," Mismatch on SIP\n"); return 0; @@ -646,7 +645,7 @@ int CheckSrcIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ ***************************************************************************/ int CheckDstIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ports) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "CheckDstIPEqual: "); ) + DebugMessage(DEBUG_DETECT, "CheckDstIPEqual: "); if (!(rtn_idx->flags & EXCEPT_DST_IP)) { @@ -660,7 +659,7 @@ int CheckDstIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ { /* global exception flag is up, we can't match on *any* * of the source addresses */ - DEBUG_WRAP(DebugMessage(DEBUG_DETECT," global exception flag, \n"); ); + DebugMessage(DEBUG_DETECT," global exception flag, \n"); if ( sfvar_ip_in(rtn_idx->dip, p->ptrs.ip_api.get_dst()) ) return 0; @@ -674,7 +673,7 @@ int CheckDstIP(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ int CheckSrcPortEqual(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ports) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckSrcPortEqual: "); ); + DebugMessage(DEBUG_DETECT,"CheckSrcPortEqual: "); /* Check if attributes provided match earlier */ if (check_ports == 0) @@ -683,12 +682,12 @@ int CheckSrcPortEqual(Packet* p, RuleTreeNode* rtn_idx, } if ( PortObjectHasPort(rtn_idx->src_portobject,p->ptrs.sp) ) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " SP match!\n"); ); + DebugMessage(DEBUG_DETECT, " SP match!\n"); return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports); } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " SP mismatch!\n"); ); + DebugMessage(DEBUG_DETECT, " SP mismatch!\n"); } return 0; @@ -697,7 +696,7 @@ int CheckSrcPortEqual(Packet* p, RuleTreeNode* rtn_idx, int CheckSrcPortNotEq(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ports) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckSrcPortNotEq: "); ); + DebugMessage(DEBUG_DETECT,"CheckSrcPortNotEq: "); /* Check if attributes provided match earlier */ if (check_ports == 0) @@ -706,12 +705,12 @@ int CheckSrcPortNotEq(Packet* p, RuleTreeNode* rtn_idx, } if ( !PortObjectHasPort(rtn_idx->src_portobject,p->ptrs.sp) ) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !SP match!\n"); ); + DebugMessage(DEBUG_DETECT, " !SP match!\n"); return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports); } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !SP mismatch!\n"); ); + DebugMessage(DEBUG_DETECT, " !SP mismatch!\n"); } return 0; @@ -720,7 +719,7 @@ int CheckSrcPortNotEq(Packet* p, RuleTreeNode* rtn_idx, int CheckDstPortEqual(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ports) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckDstPortEqual: "); ); + DebugMessage(DEBUG_DETECT,"CheckDstPortEqual: "); /* Check if attributes provided match earlier */ if (check_ports == 0) @@ -729,12 +728,12 @@ int CheckDstPortEqual(Packet* p, RuleTreeNode* rtn_idx, } if ( PortObjectHasPort(rtn_idx->dst_portobject,p->ptrs.dp) ) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " DP match!\n"); ); + DebugMessage(DEBUG_DETECT, " DP match!\n"); return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports); } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT," DP mismatch!\n"); ); + DebugMessage(DEBUG_DETECT," DP mismatch!\n"); } return 0; } @@ -742,7 +741,7 @@ int CheckDstPortEqual(Packet* p, RuleTreeNode* rtn_idx, int CheckDstPortNotEq(Packet* p, RuleTreeNode* rtn_idx, RuleFpList* fp_list, int check_ports) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"CheckDstPortNotEq: "); ); + DebugMessage(DEBUG_DETECT,"CheckDstPortNotEq: "); /* Check if attributes provided match earlier */ if (check_ports == 0) @@ -751,12 +750,12 @@ int CheckDstPortNotEq(Packet* p, RuleTreeNode* rtn_idx, } if ( !PortObjectHasPort(rtn_idx->dst_portobject,p->ptrs.dp) ) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " !DP match!\n"); ); + DebugMessage(DEBUG_DETECT, " !DP match!\n"); return fp_list->next->RuleHeadFunc(p, rtn_idx, fp_list->next, check_ports); } else { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT," !DP mismatch!\n"); ); + DebugMessage(DEBUG_DETECT," !DP mismatch!\n"); } return 0; diff --git a/src/detection/detection_options.cc b/src/detection/detection_options.cc index 67c87af16..526b21c6c 100644 --- a/src/detection/detection_options.cc +++ b/src/detection/detection_options.cc @@ -329,10 +329,10 @@ void print_option_tree(detection_option_tree_node_t* node, int level) offset++; DEBUG_WRAP( - DebugMessage(DEBUG_DETECT, "%d%*s%*d 0x%x\n", - level, indent - offset, option_type_str[node->option_type], - 54 - indent, node->num_children, - node->option_data); + DebugFormat(DEBUG_DETECT, "%d%*s%*d 0x%x\n", + level, indent - offset, option_type_str[node->option_type], + 54 - indent, node->num_children, node->option_data); + for (i=0; inum_children; i++) print_option_tree(node->children[i], level+1); ); @@ -474,11 +474,11 @@ int detection_option_node_evaluate( if (otn->sigInfo.num_services && check_ports) { /* none of the services match */ - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, + DebugFormat(DEBUG_DETECT, "[**] SID %d not matched because of service mismatch (%d!=%d [**]\n", otn->sigInfo.id, eval_data->p->application_protocol_ordinal, - otn->sigInfo.services[0].service_ordinal); ); + otn->sigInfo.services[0].service_ordinal); break; /* out of case */ } } diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc index b9375c6ab..d098a9c31 100644 --- a/src/detection/fp_detect.cc +++ b/src/detection/fp_detect.cc @@ -380,23 +380,23 @@ int fpEvalRTN(RuleTreeNode* rtn, Packet* p, int check_ports) /* FIXIT: maybe add a port test here ... */ - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "[*] Rule Head %p\n", rtn); ) + DebugFormat(DEBUG_DETECT, "[*] Rule Head %p\n", rtn); if (!rtn->rule_func->RuleHeadFunc(p, rtn, rtn->rule_func, check_ports)) { - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - " => Header check failed, checking next node\n"); ); - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - " => returned from next node check\n"); ); + DebugMessage(DEBUG_DETECT, + " => Header check failed, checking next node\n"); + DebugMessage(DEBUG_DETECT, + " => returned from next node check\n"); MODULE_PROFILE_END(ruleRTNEvalPerfStats); return 0; } - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - "^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n"); ); - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, " => RTN %p Matched!\n", rtn); ); - DEBUG_WRAP(DebugMessage(DEBUG_DETECT, - "vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv\n"); ); + DebugMessage(DEBUG_DETECT, + "^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n"); + DebugFormat(DEBUG_DETECT, " => RTN %p Matched!\n", rtn); + DebugMessage(DEBUG_DETECT, + "vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv\n"); /* ** Return that there is a rule match and log the event outside ** of this routine. @@ -1122,9 +1122,9 @@ static inline void fpEvalHeaderTcp(Packet* p, OTNX_MATCH_DATA* omd) if ( !prmFindRuleGroupTcp(snort_conf->prmTcpRTNX, p->ptrs.dp, p->ptrs.sp, &src, &dst, &any) ) return; - DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, - "fpEvalHeaderTcp: sport=%d, " - "dport=%d, src:%x, dst:%x, any:%x\n",p->ptrs.sp,p->ptrs.dp,src,dst,any); ); + DebugFormat(DEBUG_ATTRIBUTE, + "fpEvalHeaderTcp: sport=%d, dport=%d, src:%x, dst:%x, any:%x\n", + p->ptrs.sp,p->ptrs.dp,src,dst,any); if ( dst ) fpEvalHeaderSW(dst, p, 1, 0, 0, omd); @@ -1143,9 +1143,9 @@ static inline void fpEvalHeaderUdp(Packet* p, OTNX_MATCH_DATA* omd) if ( !prmFindRuleGroupUdp(snort_conf->prmUdpRTNX, p->ptrs.dp, p->ptrs.sp, &src, &dst, &any) ) return; - DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, - "fpEvalHeaderUdp: sport=%d, dport=%d, " - "src:%x, dst:%x, any:%x\n",p->ptrs.sp,p->ptrs.dp,src,dst,any); ); + DebugFormat(DEBUG_ATTRIBUTE, + "fpEvalHeaderUdp: sport=%d, dport=%d, src:%x, dst:%x, any:%x\n", + p->ptrs.sp,p->ptrs.dp,src,dst,any); if ( dst ) fpEvalHeaderSW(dst, p, 1, 0, 0, omd) ; @@ -1163,13 +1163,13 @@ static inline void fpEvalHeaderSvc(Packet* p, OTNX_MATCH_DATA* omd, int proto) int16_t proto_ordinal = p->flow ? p->flow->ssn_state.application_protocol : 0; - DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "proto_ordinal=%d\n", proto_ordinal); ); + DebugFormat(DEBUG_ATTRIBUTE, "proto_ordinal=%d\n", proto_ordinal); if (proto_ordinal > 0) { if (p->packet_flags & PKT_FROM_SERVER) /* to cli */ { - DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_server\n"); ); + DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_server\n"); svc = snort_conf->sopgTable->get_port_group(proto, false, proto_ordinal); file = snort_conf->sopgTable->get_port_group(proto, false, SNORT_PROTO_FILE); @@ -1177,16 +1177,16 @@ static inline void fpEvalHeaderSvc(Packet* p, OTNX_MATCH_DATA* omd, int proto) if (p->packet_flags & PKT_FROM_CLIENT) /* to srv */ { - DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_client\n"); ); + DebugMessage(DEBUG_ATTRIBUTE, "pkt_from_client\n"); svc = snort_conf->sopgTable->get_port_group(proto, true, proto_ordinal); file = snort_conf->sopgTable->get_port_group(proto, true, SNORT_PROTO_FILE); } - DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, + DebugFormat(DEBUG_ATTRIBUTE, "fpEvalHeaderSvc:targetbased-ordinal-lookup: " "sport=%d, dport=%d, proto_ordinal=%d, proto=%d, src:%x, " - "file:%x\n",p->ptrs.sp,p->ptrs.dp,proto_ordinal,proto,svc,file); ); + "file:%x\n",p->ptrs.sp,p->ptrs.dp,proto_ordinal,proto,svc,file); } // FIXIT-P put alert service rules with file data fp in alert file group and // verfiy ports and service during rule eval to avoid searching file data 2x. diff --git a/src/detection/tag.cc b/src/detection/tag.cc index bcd84a446..2e9638992 100644 --- a/src/detection/tag.cc +++ b/src/detection/tag.cc @@ -312,7 +312,7 @@ void CleanupTag(void) static void TagSession(Packet* p, TagData* tag, uint32_t time, uint16_t event_id, void* log_list) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "TAGGING SESSION\n"); ); + DebugMessage(DEBUG_FLOW, "TAGGING SESSION\n"); AddTagNode(p, tag, TAG_SESSION, time, event_id, log_list); } @@ -321,7 +321,7 @@ static void TagHost(Packet* p, TagData* tag, uint32_t time, uint16_t event_id, v { int mode; - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "TAGGING HOST\n"); ); + DebugMessage(DEBUG_FLOW, "TAGGING HOST\n"); switch (tag->tag_direction) { @@ -346,7 +346,7 @@ static void AddTagNode(Packet* p, TagData* tag, int mode, uint32_t now, TagNode* returned; SFXHASH* tag_cache_ptr = NULL; - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "Adding new Tag Head\n"); ); + DebugMessage(DEBUG_FLOW, "Adding new Tag Head\n"); if ( tag->tag_metric & TAG_METRIC_SESSION ) { @@ -361,12 +361,12 @@ static void AddTagNode(Packet* p, TagData* tag, int mode, uint32_t now, } if (mode == TAG_SESSION) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Session Tag!\n"); ); + DebugMessage(DEBUG_FLOW,"Session Tag!\n"); tag_cache_ptr = ssn_tag_cache_ptr; } else { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Host Tag!\n"); ); + DebugMessage(DEBUG_FLOW,"Host Tag!\n"); tag_cache_ptr = host_tag_cache_ptr; } idx = TagAlloc(tag_cache_ptr); @@ -416,7 +416,7 @@ static void AddTagNode(Packet* p, TagData* tag, int mode, uint32_t now, if (returned == NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Looking the other way!!\n"); ); + DebugMessage(DEBUG_FLOW,"Looking the other way!!\n"); SwapTag(idx); returned = (TagNode*)sfxhash_find(tag_cache_ptr, idx); SwapTag(idx); @@ -424,7 +424,7 @@ static void AddTagNode(Packet* p, TagData* tag, int mode, uint32_t now, if (returned == NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Inserting a New Tag!\n"); ); + DebugMessage(DEBUG_FLOW,"Inserting a New Tag!\n"); /* if we're supposed to be tagging the other side, swap it around -- Lawrence Reed */ @@ -435,16 +435,16 @@ static void AddTagNode(Packet* p, TagData* tag, int mode, uint32_t now, if (sfxhash_add(tag_cache_ptr, idx, idx) != SFXHASH_OK) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, + DebugMessage(DEBUG_FLOW, "sfxhash_add failed, that's going to " - "make life difficult\n"); ); + "make life difficult\n"); TagFree(tag_cache_ptr, idx); return; } } else { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Existing Tag found!\n"); ); + DebugMessage(DEBUG_FLOW,"Existing Tag found!\n"); if (idx->metric & TAG_METRIC_SECONDS) returned->seconds = idx->seconds; @@ -471,14 +471,14 @@ int CheckTagList(Packet* p, Event* event, void** log_list) if(p == NULL || !p->ptrs.ip_api.is_ip()) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "bailing from CheckTagList, p->iph == NULL\n"); ); + DebugMessage(DEBUG_FLOW, "bailing from CheckTagList, p->iph == NULL\n"); return 0; } - DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Host Tags Active: %d Session Tags Active: %d\n", - sfxhash_count(host_tag_cache_ptr), sfxhash_count(ssn_tag_cache_ptr)); ); + DebugFormat(DEBUG_FLOW,"Host Tags Active: %d Session Tags Active: %d\n", + sfxhash_count(host_tag_cache_ptr), sfxhash_count(ssn_tag_cache_ptr)); - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "[*] Checking session tag list (forward)...\n"); ); + DebugMessage(DEBUG_FLOW, "[*] Checking session tag list (forward)...\n"); sfip_copy(idx.key.sip, p->ptrs.ip_api.get_src()); sfip_copy(idx.key.dip, p->ptrs.ip_api.get_dst()); @@ -495,13 +495,13 @@ int CheckTagList(Packet* p, Event* event, void** log_list) idx.key.dp = p->ptrs.sp; idx.key.sp = p->ptrs.dp; - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, " Checking session tag list (reverse)...\n"); ); + DebugMessage(DEBUG_FLOW, " Checking session tag list (reverse)...\n"); returned = (TagNode*)sfxhash_find(ssn_tag_cache_ptr, &idx); if (returned == NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, " Checking host tag list " - "(forward)...\n"); ); + DebugMessage(DEBUG_FLOW, " Checking host tag list " + "(forward)...\n"); returned = (TagNode*)sfxhash_find(host_tag_cache_ptr, &idx); @@ -518,25 +518,25 @@ int CheckTagList(Packet* p, Event* event, void** log_list) if (returned != NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW," [*!*] Found host node\n"); ); + DebugMessage(DEBUG_FLOW," [*!*] Found host node\n"); taglist = host_tag_cache_ptr; } } else { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW," [*!*] Found session node\n"); ); + DebugMessage(DEBUG_FLOW," [*!*] Found session node\n"); taglist = ssn_tag_cache_ptr; } } else { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW," [*!*] Found session node\n"); ); + DebugMessage(DEBUG_FLOW," [*!*] Found session node\n"); taglist = ssn_tag_cache_ptr; } if (returned != NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, " ! Found tag node !\n"); ); + DebugMessage(DEBUG_FLOW, " ! Found tag node !\n"); returned->last_access = p->pkth->ts.tv_sec; returned->pkt_count++; @@ -596,8 +596,8 @@ int CheckTagList(Packet* p, Event* event, void** log_list) if ( !returned->metric ) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, - " Prune condition met for tag, removing from list\n"); ); + DebugMessage(DEBUG_FLOW, + " Prune condition met for tag, removing from list\n"); if (sfxhash_remove(taglist, returned) != SFXHASH_OK) { @@ -608,8 +608,8 @@ int CheckTagList(Packet* p, Event* event, void** log_list) if ( (u_int)(p->pkth->ts.tv_sec) > last_prune_time + TAG_PRUNE_QUANTUM ) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, - "Exceeded Prune Quantum, pruning tag trees\n"); ); + DebugMessage(DEBUG_FLOW, + "Exceeded Prune Quantum, pruning tag trees\n"); PruneTagCache(p->pkth->ts.tv_sec, 0); last_prune_time = p->pkth->ts.tv_sec; } @@ -691,7 +691,7 @@ static int PruneTime(SFXHASH* tree, uint32_t thetime) void SetTags(Packet* p, OptTreeNode* otn, uint16_t event_id) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "Setting tags\n"); ); + DebugMessage(DEBUG_FLOW, "Setting tags\n"); if (otn != NULL && otn->tag != NULL) { @@ -703,19 +703,19 @@ void SetTags(Packet* p, OptTreeNode* otn, uint16_t event_id) switch (otn->tag->tag_type) { case TAG_SESSION: - DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Setting session tag:\n"); - DebugMessage(DEBUG_FLOW,"SIP: %s SP: %d ", + DebugMessage(DEBUG_FLOW,"Setting session tag:\n"); + DebugFormat(DEBUG_FLOW,"SIP: %s SP: %d ", sfip_ntoa(p->ptrs.ip_api.get_src()), p->ptrs.sp); - DebugMessage(DEBUG_FLOW,"DIP: %s DP: %d\n", - sfip_ntoa(p->ptrs.ip_api.get_dst()),p->ptrs.dp); ); + DebugFormat(DEBUG_FLOW,"DIP: %s DP: %d\n", + sfip_ntoa(p->ptrs.ip_api.get_dst()),p->ptrs.dp); TagSession(p, otn->tag, p->pkth->ts.tv_sec, event_id, log_list); break; case TAG_HOST: - DEBUG_WRAP(DebugMessage(DEBUG_FLOW,"Setting host tag:\n"); - DebugMessage(DEBUG_FLOW,"SIP: %s SP: %d ", + DebugMessage(DEBUG_FLOW,"Setting host tag:\n"); + DebugFormat(DEBUG_FLOW,"SIP: %s SP: %d ", sfip_ntoa(p->ptrs.ip_api.get_src()),p->ptrs.sp); - DebugMessage(DEBUG_FLOW, "DIP: %s DP: %d\n", - sfip_ntoa(p->ptrs.ip_api.get_dst()),p->ptrs.dp); ); + DebugFormat(DEBUG_FLOW, "DIP: %s DP: %d\n", + sfip_ntoa(p->ptrs.ip_api.get_dst()),p->ptrs.dp); TagHost(p, otn->tag, p->pkth->ts.tv_sec, event_id, log_list); break; diff --git a/src/detection/treenodes.cc b/src/detection/treenodes.cc index b434a3039..fe5cd8b5b 100644 --- a/src/detection/treenodes.cc +++ b/src/detection/treenodes.cc @@ -52,7 +52,7 @@ OptFpList* AddOptFuncToList(RuleOptEvalFunc ro_eval_func, OptTreeNode* otn) { OptFpList* ofp = (OptFpList*)SnortAlloc(sizeof(OptFpList)); - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n"); ); + DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n"); /* if there are no nodes on the function list... */ if (otn->opt_func == NULL) @@ -70,7 +70,7 @@ OptFpList* AddOptFuncToList(RuleOptEvalFunc ro_eval_func, OptTreeNode* otn) tmp->next = ofp; } - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Set OptTestFunc to %p\n", ro_eval_func); ); + DebugFormat(DEBUG_CONFIGRULES,"Set OptTestFunc to %p\n", ro_eval_func); ofp->OptTestFunc = ro_eval_func; diff --git a/src/file_api/file_capture.cc b/src/file_api/file_capture.cc index 333e120bf..916c18f18 100644 --- a/src/file_api/file_capture.cc +++ b/src/file_api/file_capture.cc @@ -57,14 +57,11 @@ FileMemPool* file_mempool = NULL; File_Capture_Stats file_capture_stats; -/* - * Verify file capture information and file context information matched - * This is used for debug purpose - */ +#ifdef DEBUG_MSGS +// verify file capture information and file context information matched -#ifdef DEBUG -static void verify_file_capture_info(FileContext* context, - FileCaptureInfo* fileInfo) +static void verify_file_capture_info( + FileContext* context, FileCaptureInfo* fileInfo) { /* file capture length should be one of two possible values */ if (context->processed_bytes) @@ -87,8 +84,8 @@ static void verify_file_capture_info(FileContext* context, } } -static void verifiy_file_capture(FileContext* context, - FileCaptureInfo* fileInfo) +static void verifiy_file_capture( + FileContext* context, FileCaptureInfo* fileInfo) { SHA256CONTEXT sha_ctx; uint8_t* buff; @@ -119,7 +116,6 @@ static void verifiy_file_capture(FileContext* context, } } } - #endif /* @@ -349,7 +345,7 @@ static inline int _save_to_file_buffer(FileMemPool* file_mempool, fileInfo->file_size += data_size; - DEBUG_WRAP(verify_file_capture_info(context, fileInfo); ) + DEBUG_WRAP(verify_file_capture_info(context, fileInfo); ); return 0; } diff --git a/src/file_api/file_mempool.cc b/src/file_api/file_mempool.cc index 2c131db78..5a13afa91 100644 --- a/src/file_api/file_mempool.cc +++ b/src/file_api/file_mempool.cc @@ -37,8 +37,8 @@ #define FREE_MAGIC 0x2525252525252525 typedef uint64_t MagicType; -#ifdef DEBUG +#ifdef DEBUG_MSGS static inline void file_mempool_verify(FileMemPool* mempool) { uint64_t free_size; @@ -68,7 +68,6 @@ static inline void file_mempool_verify(FileMemPool* mempool) __FILE__, __LINE__); } } - #endif static inline void file_mempool_free_pools(FileMemPool* mempool) diff --git a/src/file_api/file_mime_process.cc b/src/file_api/file_mime_process.cc index 7b7db8922..b16b49086 100644 --- a/src/file_api/file_mime_process.cc +++ b/src/file_api/file_mime_process.cc @@ -812,11 +812,11 @@ const uint8_t* process_mime_data_paf(Flow* flow, const uint8_t* start, const uin #ifdef DEBUG_MSGS if (mime_ssn->data_state == STATE_DATA_HEADER) { - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "DATA HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_FILE, "DATA HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n"); } else { - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "DATA UNKNOWN STATE ~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_FILE, "DATA UNKNOWN STATE ~~~~~~~~~~~~~~~~~~~~~\n"); } #endif @@ -838,11 +838,11 @@ const uint8_t* process_mime_data_paf(Flow* flow, const uint8_t* start, const uin switch (mime_ssn->data_state) { case STATE_MIME_HEADER: - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "MIME HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_FILE, "MIME HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n"); start = process_mime_header(start, end, mime_ssn); break; case STATE_DATA_BODY: - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "DATA BODY STATE ~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_FILE, "DATA BODY STATE ~~~~~~~~~~~~~~~~~~~~~~~~\n"); start = process_mime_body(start, end, mime_ssn, isFileEnd(position) ); break; } @@ -1136,8 +1136,8 @@ bool process_mime_paf_data(MimeDataPafInfo* data_info, uint8_t data) if (store_boundary(data_info, data)) { /* End of boundary, move to MIME_PAF_FOUND_BOUNDARY_STATE*/ - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "Create boudary string: %s\n", - data_info->boundary); ); + DebugFormat(DEBUG_FILE, "Create boudary string: %s\n", + data_info->boundary); data_info->data_state = MIME_PAF_FOUND_BOUNDARY_STATE; } @@ -1146,8 +1146,8 @@ bool process_mime_paf_data(MimeDataPafInfo* data_info, uint8_t data) if (check_boundary(data_info, data)) { /* End of boundary, move to MIME_PAF_FOUND_BOUNDARY_STATE*/ - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "Found Boudary string: %s\n", - data_info->boundary); ); + DebugFormat(DEBUG_FILE, "Found Boudary string: %s\n", + data_info->boundary); return 1; } break; diff --git a/src/file_api/file_resume_block.cc b/src/file_api/file_resume_block.cc index c36347eb9..6fa244ffa 100644 --- a/src/file_api/file_resume_block.cc +++ b/src/file_api/file_resume_block.cc @@ -132,7 +132,7 @@ int file_resume_block_add_file(Packet* pkt, uint32_t file_sig, uint32_t timeout, } else { - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "Adding file node\n"); ); + DebugMessage(DEBUG_FILE, "Adding file node\n"); updateFileNode(&new_node, verdict, file_type_id, signature); @@ -152,8 +152,8 @@ int file_resume_block_add_file(Packet* pkt, uint32_t file_sig, uint32_t timeout, * for key. This means bigger problems, but fail * gracefully. */ - DEBUG_WRAP(DebugMessage(DEBUG_FILE, - "Failed to add file node to hash table\n"); ); + DebugMessage(DEBUG_FILE, + "Failed to add file node to hash table\n"); return -1; } } @@ -247,7 +247,7 @@ File_Verdict file_resume_block_check(Packet* pkt, uint32_t file_sig) /* No hash table, or its empty? Get out of dodge. */ if ((!fileHash) || (!sfxhash_count(fileHash))) { - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "No expected sessions\n"); ); + DebugMessage(DEBUG_FILE, "No expected sessions\n"); return verdict; } srcIP = p->ptrs.ip_api.get_src(); @@ -268,10 +268,10 @@ File_Verdict file_resume_block_check(Packet* pkt, uint32_t file_sig) if (node) { - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "Found resumed file\n"); ); + DebugMessage(DEBUG_FILE, "Found resumed file\n"); if (node->expires && p->pkth->ts.tv_sec > node->expires) { - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "File expired\n"); ); + DebugMessage(DEBUG_FILE, "File expired\n"); sfxhash_free_node(fileHash, hash_node); return verdict; } diff --git a/src/file_api/file_service.cc b/src/file_api/file_service.cc index 5c1cd3c7f..c78ca5836 100644 --- a/src/file_api/file_service.cc +++ b/src/file_api/file_service.cc @@ -1083,14 +1083,14 @@ static bool check_paf_abort(Flow* ssn) uint32_t flags = stream.get_session_flags((Flow*)ssn); if (flags & SSNFLAG_MIDSTREAM) { - DEBUG_WRAP(DebugMessage(DEBUG_FILE, - "Aborting PAF because of midstream pickup.\n")); + DebugMessage(DEBUG_FILE, + "Aborting PAF because of midstream pickup.\n"); return true; } else if (!(flags & SSNFLAG_ESTABLISHED)) { - DEBUG_WRAP(DebugMessage(DEBUG_FILE, - "Aborting PAF because of unestablished session.\n")); + DebugMessage(DEBUG_FILE, + "Aborting PAF because of unestablished session.\n"); return true; } return false; diff --git a/src/file_api/file_stats.h b/src/file_api/file_stats.h index e7c56f9e9..ff73fddb6 100644 --- a/src/file_api/file_stats.h +++ b/src/file_api/file_stats.h @@ -52,7 +52,7 @@ typedef struct _File_Stats extern FileStats file_stats; -#define FILE_DEBUG_MSGS(msg) DEBUG_WRAP(DebugMessage(DEBUG_FILE, msg); ) +#define FILE_DEBUG_MSGS(msg) DebugMessage(DEBUG_FILE, msg) void printFileContext(FileContext* context); diff --git a/src/flow/flow_cache.cc b/src/flow/flow_cache.cc index 1e366e3bb..9a652ce7f 100644 --- a/src/flow/flow_cache.cc +++ b/src/flow/flow_cache.cc @@ -183,7 +183,7 @@ uint32_t FlowCache::prune_stale(uint32_t thetime, Flow* save_me) else if ((flow->last_data_seen + config.pruning_timeout) < thetime) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "pruning stale flow\n"); ); + DebugMessage(DEBUG_STREAM, "pruning stale flow\n"); flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT; release(flow, "stale/timeout"); pruned++; @@ -294,7 +294,7 @@ void FlowCache::timeout(uint32_t flowCount, time_t cur_time) flowExaminedCount++; - DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "retiring stale flow\n"); ); + DebugMessage(DEBUG_STREAM, "retiring stale flow\n"); flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT; release(flow, "stale/timeout"); diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc index 226e12fba..eea18b1fe 100644 --- a/src/flow/flow_control.cc +++ b/src/flow/flow_control.cc @@ -789,9 +789,9 @@ char FlowControl::expected_flow(Flow* flow, Packet* p) if ( ignore ) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Stream: Ignoring packet from %d. Marking flow marked as ignore.\n", - p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder"); ); + p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder"); flow->ssn_state.ignore_direction = ignore; DisableInspection(p); diff --git a/src/hash/sha2.c b/src/hash/sha2.c index 2d8028261..f4a116c91 100644 --- a/src/hash/sha2.c +++ b/src/hash/sha2.c @@ -1,7 +1,7 @@ /* * FILE: sha2.c * AUTHOR: Aaron D. Gifford - http://www.aarongifford.com/ - * + * * Copyright (c) 2000-2001, Aaron D. Gifford * All rights reserved. * @@ -16,7 +16,7 @@ * 3. Neither the name of the copyright holder nor the names of contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTOR(S) ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE @@ -73,7 +73,7 @@ * * And for little-endian machines, add: * - * #define BYTE_ORDER LITTLE_ENDIAN + * #define BYTE_ORDER LITTLE_ENDIAN * * Or for big-endian machines: * @@ -485,7 +485,7 @@ void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) { s1 = sigma1_256(s1); /* Apply the SHA-256 compression function to update a..h */ - T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + + T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); T2 = Sigma0_256(a) + Maj(a, b, c); h = g; diff --git a/src/ips_options/asn1_detect.cc b/src/ips_options/asn1_detect.cc index e943c8ff6..d15d41b69 100644 --- a/src/ips_options/asn1_detect.cc +++ b/src/ips_options/asn1_detect.cc @@ -347,8 +347,8 @@ int Asn1DoDetect(const uint8_t* data, uint16_t dsize, ASN1_CTXT* ctxt, const uin case REL_OFFSET: if (!rel_ptr) { - DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] No rel_ptr for " - "relative offset, so we are bailing.\n"); ); + DebugMessage(DEBUG_ASN1, "[*] No rel_ptr for " + "relative offset, so we are bailing.\n"); return 0; } @@ -360,8 +360,8 @@ int Asn1DoDetect(const uint8_t* data, uint16_t dsize, ASN1_CTXT* ctxt, const uin */ if (!inBounds(start, end + 1, rel_ptr)) { - DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds " - "check failed for rel_ptr.\n"); ); + DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds " + "check failed for rel_ptr.\n"); return 0; } @@ -369,8 +369,8 @@ int Asn1DoDetect(const uint8_t* data, uint16_t dsize, ASN1_CTXT* ctxt, const uin if (!inBounds(start, end, offset)) { - DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds " - "check failed rel_ptr+offset.\n"); ); + DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds " + "check failed rel_ptr+offset.\n"); return 0; } @@ -382,8 +382,8 @@ int Asn1DoDetect(const uint8_t* data, uint16_t dsize, ASN1_CTXT* ctxt, const uin if (!inBounds(start, end, offset)) { - DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds " - "check failed.\n"); ); + DebugMessage(DEBUG_ASN1, "[*] ASN.1 bounds " + "check failed.\n"); return 0; } @@ -399,8 +399,8 @@ int Asn1DoDetect(const uint8_t* data, uint16_t dsize, ASN1_CTXT* ctxt, const uin iRet = asn1_decode(offset, size, &asn1); if (iRet && !asn1) { - DEBUG_WRAP(DebugMessage(DEBUG_ASN1, "[*] ASN.1 decode failed " - "miserably.\n"); ); + DebugMessage(DEBUG_ASN1, "[*] ASN.1 decode failed " + "miserably.\n"); return 0; } diff --git a/src/ips_options/ips_byte_test.cc b/src/ips_options/ips_byte_test.cc index e138b19c6..e5ebfaf42 100644 --- a/src/ips_options/ips_byte_test.cc +++ b/src/ips_options/ips_byte_test.cc @@ -295,17 +295,17 @@ int ByteTestOption::eval(Cursor& c, Packet*) if ( payload_bytes_grabbed < 0 ) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, - "String Extraction Failed\n"); ); + DebugMessage(DEBUG_PATTERN_MATCH, + "String Extraction Failed\n"); MODULE_PROFILE_END(byteTestPerfStats); return rval; } } - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, + DebugFormat(DEBUG_PATTERN_MATCH, "Grabbed %d bytes at offset %d, value = 0x%08X(%u)\n", - payload_bytes_grabbed, btd->offset, value, value); ); + payload_bytes_grabbed, btd->offset, value, value); switch (btd->opcode) { @@ -352,8 +352,8 @@ int ByteTestOption::eval(Cursor& c, Packet*) if (btd->not_flag) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, - "checking for not success...flag\n"); ); + DebugMessage(DEBUG_PATTERN_MATCH, + "checking for not success...flag\n"); if (!success) { rval = DETECTION_OPTION_MATCH; diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc index cee55e8e8..3dc16e66b 100644 --- a/src/ips_options/ips_content.cc +++ b/src/ips_options/ips_content.cc @@ -407,7 +407,7 @@ static int CheckANDPatternMatch(PatternMatchData* idx, Cursor& c) PROFILE_VARS; MODULE_PROFILE_START(contentPerfStats); - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "CheckPatternANDMatch: "); ); + DebugMessage(DEBUG_PATTERN_MATCH, "CheckPatternANDMatch: "); found = uniSearchReal(idx, c); @@ -427,11 +427,11 @@ static int CheckANDPatternMatch(PatternMatchData* idx, Cursor& c) if ( found ) { rval = DETECTION_OPTION_MATCH; - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Pattern match found\n"); ); + DebugMessage(DEBUG_PATTERN_MATCH, "Pattern match found\n"); } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Pattern match failed\n"); ); + DebugMessage(DEBUG_PATTERN_MATCH, "Pattern match failed\n"); } MODULE_PROFILE_END(contentPerfStats); @@ -530,8 +530,7 @@ static void parse_offset(PatternMatchData* pmd, const char* data) } } - DEBUG_WRAP(DebugMessage(DEBUG_PARSER, "Pattern offset = %d\n", - pmd->offset); ); + DebugFormat(DEBUG_PARSER, "Pattern offset = %d\n", pmd->offset); } static void parse_depth(PatternMatchData* pmd, const char* data) @@ -571,8 +570,7 @@ static void parse_depth(PatternMatchData* pmd, const char* data) } } - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "Pattern depth = %d\n", - pmd->depth); ); + DebugFormat(DEBUG_PATTERN_MATCH, "Pattern depth = %d\n", pmd->depth); } static void parse_distance(PatternMatchData* pmd, const char* data) @@ -642,8 +640,7 @@ static void parse_within(PatternMatchData* pmd, const char* data) } } - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "Pattern within = %d\n", - pmd->depth); ); + DebugFormat(DEBUG_PATTERN_MATCH, "Pattern within = %d\n", pmd->depth); pmd->relative = 1; } diff --git a/src/ips_options/ips_cvs.cc b/src/ips_options/ips_cvs.cc index fb23adc5a..d6404e921 100644 --- a/src/ips_options/ips_cvs.cc +++ b/src/ips_options/ips_cvs.cc @@ -167,7 +167,7 @@ int CvsOption::eval(Cursor&, Packet* p) return rval; } - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "CVS begin detection\n"); ); + DebugMessage(DEBUG_IPS_OPTION, "CVS begin detection\n"); int ret = CvsDecode(p->data, p->dsize, cvs_rule_option); @@ -207,12 +207,12 @@ static int CvsDecode(const uint8_t* data, uint16_t data_len, if (command.cmd_str == NULL) return CVS_NO_ALERT; - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "CVS command\n" + DebugFormat(DEBUG_IPS_OPTION, "CVS command\n" " comand: %.*s\n" "argument: %.*s\n", command.cmd_str_len, (char*)command.cmd_str, command.cmd_arg == NULL ? 4 : command.cmd_arg_len, - command.cmd_arg == NULL ? "none" : (char*)command.cmd_arg); ); + command.cmd_arg == NULL ? "none" : (char*)command.cmd_arg); switch (cvs_rule_option->type) { diff --git a/src/ips_options/ips_flags.cc b/src/ips_options/ips_flags.cc index 9bc03e437..c097897af 100644 --- a/src/ips_options/ips_flags.cc +++ b/src/ips_options/ips_flags.cc @@ -142,19 +142,19 @@ int TcpFlagOption::eval(Cursor&, Packet* p) tcp_flags = p->ptrs.tcph->th_flags & (0xFF ^ flagptr->tcp_mask); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, " CheckTcpFlags: "); ); + DebugMessage(DEBUG_IPS_OPTION, " CheckTcpFlags: "); switch ((flagptr->mode)) { case M_NORMAL: if (flagptr->tcp_flags == tcp_flags) /* only these set */ { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got TCP [default] flag match!\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Got TCP [default] flag match!\n"); rval = DETECTION_OPTION_MATCH; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"No match\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"No match\n"); } break; @@ -162,42 +162,42 @@ int TcpFlagOption::eval(Cursor&, Packet* p) /* all set */ if ((flagptr->tcp_flags & tcp_flags) == flagptr->tcp_flags) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Got TCP [ALL] flag match!\n"); ); + DebugMessage(DEBUG_IPS_OPTION, "Got TCP [ALL] flag match!\n"); rval = DETECTION_OPTION_MATCH; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"No match\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"No match\n"); } break; case M_NOT: if ((flagptr->tcp_flags & tcp_flags) == 0) /* none set */ { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got TCP [NOT] flag match!\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Got TCP [NOT] flag match!\n"); rval = DETECTION_OPTION_MATCH; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "No match\n"); ); + DebugMessage(DEBUG_IPS_OPTION, "No match\n"); } break; case M_ANY: if ((flagptr->tcp_flags & tcp_flags) != 0) /* something set */ { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got TCP [ANY] flag match!\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Got TCP [ANY] flag match!\n"); rval = DETECTION_OPTION_MATCH; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"No match\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"No match\n"); } break; default: /* Should never see this */ - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "TCP flag check went to default case" - " for some silly reason\n"); ); + DebugMessage(DEBUG_IPS_OPTION, "TCP flag check went to default case" + " for some silly reason\n"); break; } diff --git a/src/ips_options/ips_flowbits.cc b/src/ips_options/ips_flowbits.cc index b83effabd..a070df12e 100644 --- a/src/ips_options/ips_flowbits.cc +++ b/src/ips_options/ips_flowbits.cc @@ -411,7 +411,7 @@ static int check_flowbits( bitop = stream.get_flow_bitop(p); if (!bitop) { - DEBUG_WRAP(DebugMessage(DEBUG_FLOWBITS, "No FLOWBITS_DATA"); ); + DebugMessage(DEBUG_FLOWBITS, "No FLOWBITS_DATA"); return rval; } @@ -664,7 +664,7 @@ static void processFlowbits( return; } - DEBUG_WRAP(DebugMessage(DEBUG_FLOWBITS, "flowbits tag id parsing %s\n",flowbits_names); ); + DebugFormat(DEBUG_FLOWBITS, "flowbits tag id parsing %s\n",flowbits_names); flowbits_name = SnortStrdup(flowbits_names); @@ -834,15 +834,15 @@ static void printOutFlowbits(FLOWBITS_OP* flowbits) { int i; - DebugMessage(DEBUG_FLOWBITS,"flowbits: type = %d\n",flowbits->type); - DebugMessage(DEBUG_FLOWBITS,"flowbits: name = %s\n",flowbits->name); - DebugMessage(DEBUG_FLOWBITS,"flowbits: eval = %d\n",flowbits->eval); - DebugMessage(DEBUG_FLOWBITS,"flowbits: num_ids = %d\n",flowbits->num_ids); - DebugMessage(DEBUG_FLOWBITS,"flowbits: grp_id = %d\n",flowbits->group_id); - DebugMessage(DEBUG_FLOWBITS,"flowbits: group_name = %s\n",flowbits->group); + DebugFormat(DEBUG_FLOWBITS,"flowbits: type = %d\n",flowbits->type); + DebugFormat(DEBUG_FLOWBITS,"flowbits: name = %s\n",flowbits->name); + DebugFormat(DEBUG_FLOWBITS,"flowbits: eval = %d\n",flowbits->eval); + DebugFormat(DEBUG_FLOWBITS,"flowbits: num_ids = %d\n",flowbits->num_ids); + DebugFormat(DEBUG_FLOWBITS,"flowbits: grp_id = %d\n",flowbits->group_id); + DebugFormat(DEBUG_FLOWBITS,"flowbits: group_name = %s\n",flowbits->group); for (i = 0; i < flowbits->num_ids; i++) { - DebugMessage(DEBUG_FLOWBITS,"flowbits: value = %d\n",flowbits->ids[i]); + DebugFormat(DEBUG_FLOWBITS,"flowbits: value = %d\n",flowbits->ids[i]); } } diff --git a/src/ips_options/ips_fragbits.cc b/src/ips_options/ips_fragbits.cc index 1c73aea98..0ce0b8a16 100644 --- a/src/ips_options/ips_fragbits.cc +++ b/src/ips_options/ips_fragbits.cc @@ -155,9 +155,9 @@ int FragBitsOption::eval(Cursor&, Packet* p) const uint16_t frag_offset = p->ptrs.ip_api.off_w_flags(); MODULE_PROFILE_START(fragBitsPerfStats); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, " CheckFragBits: "); - DebugMessage(DEBUG_PLUGIN, "[rule: 0x%X:%d pkt: 0x%X] ", - fb->frag_bits, fb->mode, frag_offset & bitmask); ); + DebugMessage(DEBUG_IPS_OPTION, " CheckFragBits: "); + DebugFormat(DEBUG_IPS_OPTION, "[rule: 0x%X:%d pkt: 0x%X] ", + fb->frag_bits, fb->mode, frag_offset & bitmask); switch (fb->mode) { @@ -165,12 +165,12 @@ int FragBitsOption::eval(Cursor&, Packet* p) /* check if the rule bits match the bits in the packet */ if (fb->frag_bits == (frag_offset & bitmask)) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got Normal bits match\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Got Normal bits match\n"); rval = DETECTION_OPTION_MATCH; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Normal test failed\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Normal test failed\n"); } break; @@ -178,12 +178,12 @@ int FragBitsOption::eval(Cursor&, Packet* p) /* check if the rule bits don't match the bits in the packet */ if ((fb->frag_bits & (frag_offset & bitmask)) == 0) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got NOT bits match\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Got NOT bits match\n"); rval = DETECTION_OPTION_MATCH; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"NOT test failed\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"NOT test failed\n"); } break; @@ -191,12 +191,12 @@ int FragBitsOption::eval(Cursor&, Packet* p) /* check if the rule bits are present in the packet */ if ((fb->frag_bits & (frag_offset & bitmask)) == fb->frag_bits) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got ALL bits match\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Got ALL bits match\n"); rval = DETECTION_OPTION_MATCH; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"ALL test failed\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"ALL test failed\n"); } break; @@ -204,12 +204,12 @@ int FragBitsOption::eval(Cursor&, Packet* p) /* check if any of the rule bits match the bits in the packet */ if ((fb->frag_bits & (frag_offset & bitmask)) != 0) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Got ANY bits match\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Got ANY bits match\n"); rval = DETECTION_OPTION_MATCH; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"ANY test failed\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"ANY test failed\n"); } break; default: diff --git a/src/ips_options/ips_ip_proto.cc b/src/ips_options/ips_ip_proto.cc index cfc8d2a1a..56ec72048 100644 --- a/src/ips_options/ips_ip_proto.cc +++ b/src/ips_options/ips_ip_proto.cc @@ -118,7 +118,7 @@ int IpProtoOption::eval(Cursor&, Packet* p) if (!p->has_ip()) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Not IP\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"Not IP\n"); return rval; } diff --git a/src/ips_options/ips_ipopts.cc b/src/ips_options/ips_ipopts.cc index 6c429b4f8..9db32f1bc 100644 --- a/src/ips_options/ips_ipopts.cc +++ b/src/ips_options/ips_ipopts.cc @@ -114,7 +114,7 @@ int IpOptOption::eval(Cursor&, Packet* p) int rval = DETECTION_OPTION_NO_MATCH; PROFILE_VARS; - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "CheckIpOptions:"); ); + DebugMessage(DEBUG_IPS_OPTION, "CheckIpOptions:"); if (!p->ptrs.ip_api.is_ip4()) return rval; /* if error occured while ip header * was processed, return 0 automatically. */ @@ -126,7 +126,7 @@ int IpOptOption::eval(Cursor&, Packet* p) if ((ipOptionData->any_flag == 1) && (option_len > 0)) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Matched any ip options!\n"); ); + DebugMessage(DEBUG_IPS_OPTION, "Matched any ip options!\n"); rval = DETECTION_OPTION_MATCH; MODULE_PROFILE_END(ipOptionPerfStats); return rval; @@ -135,9 +135,9 @@ int IpOptOption::eval(Cursor&, Packet* p) ip::IpOptionIterator iter(ip4h, p); for ( const ip::IpOptions& opt : iter) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "testing pkt(%d):rule(%d)\n", + DebugFormat(DEBUG_IPS_OPTION, "testing pkt(%d):rule(%d)\n", ipOptionData->ip_option, - static_cast(opt.code)); ); + static_cast(opt.code)); if (ipOptionData->ip_option == opt.code) { diff --git a/src/ips_options/ips_isdataat.cc b/src/ips_options/ips_isdataat.cc index c61bd966f..1deb130e3 100644 --- a/src/ips_options/ips_isdataat.cc +++ b/src/ips_options/ips_isdataat.cc @@ -167,8 +167,8 @@ int IsDataAtOption::eval(Cursor& c, Packet*) if (inBounds(c.buffer(), c.endo(), start_ptr)) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, - "[*] IsDataAt succeeded! there is data...\n"); ); + DebugMessage(DEBUG_PATTERN_MATCH, + "[*] IsDataAt succeeded! there is data...\n"); rval = DETECTION_OPTION_MATCH; } diff --git a/src/ips_options/ips_pcre.cc b/src/ips_options/ips_pcre.cc index 448ac2ee6..75a6583c1 100644 --- a/src/ips_options/ips_pcre.cc +++ b/src/ips_options/ips_pcre.cc @@ -254,7 +254,7 @@ static void pcre_parse(const char* data, PcreData* pcre_data) } /* now compile the re */ - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "pcre: compiling %s\n", re); ); + DebugFormat(DEBUG_PATTERN_MATCH, "pcre: compiling %s\n", re); pcre_data->re = pcre_compile(re, compile_flags, &error, &erroffset, NULL); if (pcre_data->re == NULL) @@ -374,8 +374,8 @@ static bool pcre_search( || len <= 0 || found_offset == NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, - "Returning 0 because we didn't have the required parameters!\n"); ); + DebugMessage(DEBUG_PATTERN_MATCH, + "Returning 0 because we didn't have the required parameters!\n"); return false; } @@ -425,7 +425,7 @@ static bool pcre_search( } else { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "pcre_exec error : %d \n", result); ); + DebugFormat(DEBUG_PATTERN_MATCH, "pcre_exec error : %d \n", result); return false; } diff --git a/src/ips_options/ips_rpc.cc b/src/ips_options/ips_rpc.cc index 97addaedb..8a024dec4 100644 --- a/src/ips_options/ips_rpc.cc +++ b/src/ips_options/ips_rpc.cc @@ -144,7 +144,7 @@ int RpcOption::eval(Cursor&, Packet* p) /* Fail if the packet is too short to match */ if (p->dsize<28) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "RPC packet too small"); ); + DebugMessage(DEBUG_IPS_OPTION, "RPC packet too small"); MODULE_PROFILE_END(rpcCheckPerfStats); return rval; } @@ -154,20 +154,20 @@ int RpcOption::eval(Cursor&, Packet* p) Fail if the packet is too short to match */ if (p->dsize<24) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "RPC packet too small"); ); + DebugMessage(DEBUG_IPS_OPTION, "RPC packet too small"); MODULE_PROFILE_END(rpcCheckPerfStats); return rval; } } #ifdef DEBUG_MSGS - DebugMessage(DEBUG_PLUGIN,"<---xid---> <---dir---> <---rpc--->" + DebugMessage(DEBUG_IPS_OPTION,"<---xid---> <---dir---> <---rpc--->" " <---prog--> <---vers--> <---proc-->\n"); for (i=0; i<24; i++) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "%02X ",c[i]); ); + DebugFormat(DEBUG_IPS_OPTION, "%02X ",c[i]); } - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"\n"); #endif /* Read xid */ @@ -179,7 +179,7 @@ int RpcOption::eval(Cursor&, Packet* p) /* We only look at calls */ if (direction != CALL) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "RPC packet not a call"); ); + DebugMessage(DEBUG_IPS_OPTION, "RPC packet not a call"); MODULE_PROFILE_END(rpcCheckPerfStats); return rval; } @@ -190,7 +190,7 @@ int RpcOption::eval(Cursor&, Packet* p) /* Fail if it is not right */ if (rpcvers != RPC_MSG_VERSION) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC msg version invalid"); ); + DebugMessage(DEBUG_IPS_OPTION,"RPC msg version invalid"); MODULE_PROFILE_END(rpcCheckPerfStats); return rval; } @@ -200,26 +200,26 @@ int RpcOption::eval(Cursor&, Packet* p) vers = IXDR_GET_LONG (c); proc = IXDR_GET_LONG (c); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC decoded to: %lu %lu %lu\n", - prog,vers,proc); ); + DebugFormat(DEBUG_IPS_OPTION,"RPC decoded to: %lu %lu %lu\n", + prog,vers,proc); - DEBUG_WRAP( - DebugMessage(DEBUG_PLUGIN, "RPC matching on: %d %d %d\n", + DebugFormat(DEBUG_IPS_OPTION, "RPC matching on: %d %d %d\n", ds_ptr->flags & RPC_CHECK_PROG,ds_ptr->flags & RPC_CHECK_VERS, - ds_ptr->flags & RPC_CHECK_PROC); ); + ds_ptr->flags & RPC_CHECK_PROC); + if (!(ds_ptr->flags & RPC_CHECK_PROG) || ds_ptr->program == prog) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC program matches"); ); + DebugMessage(DEBUG_IPS_OPTION,"RPC program matches"); if (!(ds_ptr->flags & RPC_CHECK_VERS) || ds_ptr->vers == vers) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC version matches"); ); + DebugMessage(DEBUG_IPS_OPTION,"RPC version matches"); if (!(ds_ptr->flags & RPC_CHECK_PROC) || ds_ptr->proc == proc) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC proc matches"); ); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Yippee! Found one!"); ); + DebugMessage(DEBUG_IPS_OPTION,"RPC proc matches"); + DebugMessage(DEBUG_IPS_OPTION, "Yippee! Found one!"); rval = DETECTION_OPTION_MATCH; } } @@ -227,7 +227,7 @@ int RpcOption::eval(Cursor&, Packet* p) else { /* you can put debug comments here or not */ - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"RPC not equal\n"); ); + DebugMessage(DEBUG_IPS_OPTION,"RPC not equal\n"); } /* if the test isn't successful, return 0 */ diff --git a/src/log/log.cc b/src/log/log.cc index 751bb720d..908d30348 100644 --- a/src/log/log.cc +++ b/src/log/log.cc @@ -80,7 +80,7 @@ FILE* OpenAlertFile(const char* filearg) std::string name; const char* filename = get_instance_file(name, filearg); - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Opening alert file: %s\n", filename); ); + DebugFormat(DEBUG_INIT,"Opening alert file: %s\n", filename); if ((file = fopen(filename, "a")) == NULL) { @@ -117,7 +117,7 @@ int RollAlertFile(const char* filearg) SnortSnprintf(newname, sizeof(newname)-1, "%s.%lu", oldname, (unsigned long)now); - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Rolling alert file: %s\n", newname); ); + DebugFormat(DEBUG_INIT,"Rolling alert file: %s\n", newname); if ( rename(oldname, newname) ) { diff --git a/src/log/messages.cc b/src/log/messages.cc index 9ba5f9c6b..8ea03dd35 100644 --- a/src/log/messages.cc +++ b/src/log/messages.cc @@ -182,9 +182,9 @@ void ErrorMessageThrottled(ThrottleInfo* throttleInfo, const char* format,...) return; throttleInfo->count++; - DEBUG_WRAP(DebugMessage(DEBUG_INIT, + DebugFormat(DEBUG_INIT, "current_time: %d, throttle (%p): count " STDu64 ", last update: %d\n", - (int)current_time, throttleInfo, throttleInfo->count, (int)throttleInfo->lastUpdate); ) + (int)current_time, throttleInfo, throttleInfo->count, (int)throttleInfo->lastUpdate); /*Note: we only output the first error message, * and the statistics after at least duration_to_log seconds * when the same type of error message is printed out again */ diff --git a/src/loggers/alert_full.cc b/src/loggers/alert_full.cc index 942457566..fa66087c3 100644 --- a/src/loggers/alert_full.cc +++ b/src/loggers/alert_full.cc @@ -205,7 +205,7 @@ void FullLogger::alert(Packet* p, const char* msg, Event* event) LogPriorityData(full_log, event, true); } - DEBUG_WRAP(DebugMessage(DEBUG_LOG, "Logging Alert data!\n"); ); + DebugMessage(DEBUG_LOG, "Logging Alert data!\n"); LogTimeStamp(full_log, p); TextLog_Putc(full_log, ' '); diff --git a/src/loggers/alert_unixsock.cc b/src/loggers/alert_unixsock.cc index 7543e51e4..551527c81 100644 --- a/src/loggers/alert_unixsock.cc +++ b/src/loggers/alert_unixsock.cc @@ -122,7 +122,7 @@ public: static void get_alert_pkt( Packet* p, const char* msg, Event* event) { - DEBUG_WRAP(DebugMessage(DEBUG_LOG, "Logging Alert data!\n"); ); + DebugMessage(DEBUG_LOG, "Logging Alert data!\n"); // FIXIT-L ugh ... memset((char*)&us.alert,0,sizeof(us.alert)); diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index 5522f2c88..1e0b28ef4 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -550,7 +550,7 @@ static void _Unified2LogPacketAlert( logheader.event_id = htonl(event->event_reference); logheader.event_second = htonl(event->ref_time.tv_sec); - DEBUG_WRAP(DebugMessage(DEBUG_LOG, "------------\n")); + DebugMessage(DEBUG_LOG, "------------\n"); } else { @@ -1092,15 +1092,15 @@ void U2Logger::log(Packet* p, const char* msg, Event* event) { if ( (p->packet_flags & PKT_REBUILT_STREAM) and !p->is_data() ) { - DEBUG_WRAP(DebugMessage(DEBUG_LOG, - "[*] Reassembled packet, dumping stream packets\n"); ); + DebugMessage(DEBUG_LOG, + "[*] Reassembled packet, dumping stream packets\n"); // FIXIT-L replace with reassembled stream data and // optionally the first captured packet //_Unified2LogStreamAlert(p, msg, &config, event); } else { - DEBUG_WRAP(DebugMessage(DEBUG_LOG, "[*] Logging unified 2 packets...\n"); ); + DebugMessage(DEBUG_LOG, "[*] Logging unified 2 packets...\n"); _Unified2LogPacketAlert(p, msg, &config, event); } } diff --git a/src/lua/lua_arg.h b/src/lua/lua_arg.h index 5a0047d29..4de70a7bb 100644 --- a/src/lua/lua_arg.h +++ b/src/lua/lua_arg.h @@ -37,7 +37,7 @@ struct Arg { luaL_checktype(L, n, type); } // Types - inline bool is_type(int n, int type) + inline bool is_type(int n, int type) { return lua_type(L, n) == type; } inline bool is_number(int n) diff --git a/src/main/snort_debug.cc b/src/main/snort_debug.cc index 31bebc669..991c8a1fc 100644 --- a/src/main/snort_debug.cc +++ b/src/main/snort_debug.cc @@ -25,13 +25,6 @@ #endif #include -#ifndef __USE_ISOC95 -# define __USE_ISOC95 -# include -# undef __USE_ISOC95 -#else -# include -#endif #include #include #include @@ -40,54 +33,36 @@ #include "snort_config.h" #ifdef DEBUG_MSGS -const char* DebugMessageFile = NULL; // FIXIT-M use access methods -int DebugMessageLine = 0; // FIXIT-M use access methods - -int DebugThis(uint64_t level) -{ - if (!(level & GetDebugLevel())) - return 0; - return 1; -} +bool Debug::init = false; +uint64_t Debug::mask = 0; -uint64_t GetDebugLevel(void) +bool Debug::enabled(uint64_t flag) { - static int debug_init = 0; - static uint64_t debug_level = 0; - - const char* key; - - if ( debug_init ) - return debug_level; - - key = getenv(DEBUG_PP_VAR); - - if ( key ) - debug_level = strtoul(key, NULL, 0); - - debug_level <<= 32; - - key = getenv(DEBUG_VARIABLE); + if ( !init ) + { + const char* b = getenv(DEBUG_BUILTIN); + const char* p = getenv(DEBUG_PLUGIN); - if ( key ) - debug_level |= strtoul(key, NULL, 0); + mask = p ? (strtoul(p, nullptr, 0) << 32) : 0; + mask |= (b ? strtoul(b, NULL, 0) : 0); - debug_init = 1; + init = true; + } - return debug_level; + return (mask & flag) != 0; } -void DebugMessageFunc(uint64_t level, const char* fmt, ...) +void Debug::print( + const char* file, int line, uint64_t dbg, const char* fmt, ...) { - va_list ap; - - if (!(level & GetDebugLevel())) + if ( !enabled(dbg) ) return; + va_list ap; va_start(ap, fmt); - if ((snort_conf != NULL) && SnortConfig::daemon_mode()) + if ( snort_conf and SnortConfig::daemon_mode()) { char buf[STD_BUF]; int buf_len = sizeof(buf); @@ -96,10 +71,9 @@ void DebugMessageFunc(uint64_t level, const char* fmt, ...) buf[buf_len - 1] = '\0'; /* filename and line number information */ - if (DebugMessageFile != NULL) + if ( file ) { - snprintf(buf, buf_len - 1, "%s:%d: ", - DebugMessageFile, DebugMessageLine); + snprintf(buf, buf_len - 1, "%s:%d: ", file, line); buf_ptr += strlen(buf); buf_len -= strlen(buf); } @@ -109,60 +83,13 @@ void DebugMessageFunc(uint64_t level, const char* fmt, ...) } else { - if (DebugMessageFile != NULL) - printf("%s:%d: ", DebugMessageFile, DebugMessageLine); + if ( file ) + printf("%s:%d: ", file, line); vprintf(fmt, ap); } va_end(ap); } -#ifdef SF_WCHAR -void DebugWideMessageFunc(uint64_t level, const wchar_t* fmt, ...) -{ - va_list ap; - wchar_t buf[STD_BUF+1]; - - if (!(level & GetDebugLevel())) - { - return; - } - buf[STD_BUF]= (wchar_t)0; - - /* filename and line number information */ - if (DebugMessageFile != NULL) - printf("%s:%d: ", DebugMessageFile, DebugMessageLine); - - va_start(ap, fmt); - - if (SnortConfig::daemon_mode()) - { -#ifdef HAVE_VSWPRINTF - vswprintf(buf, STD_BUF, fmt, ap); -#endif - //syslog(LOG_DAEMON | LOG_DEBUG, "%s", buf); - } - else - { -#ifdef HAVE_WPRINTF - vwprintf(fmt, ap); -#endif - } - - va_end(ap); -} - -#endif -#else /* DEBUG_MSGS */ -void DebugMessageFunc(uint64_t /*level*/, const char* /*fmt*/, ...) -{ -} - -#ifdef SF_WCHAR -void DebugWideMessageFunc(uint64_t /*level*/, const wchar_t* /*fmt*/, ...) -{ -} - -#endif #endif /* DEBUG_MSGS */ diff --git a/src/main/snort_debug.h b/src/main/snort_debug.h index 8fcdb6437..195d94f02 100644 --- a/src/main/snort_debug.h +++ b/src/main/snort_debug.h @@ -33,92 +33,82 @@ #include #include -#ifdef SF_WCHAR -/* ISOC99 is defined to get required prototypes */ -#ifndef __USE_ISOC99 -#define __USE_ISOC99 -#endif -#include -#endif - #include "main/snort_types.h" // this env var uses the lower 32 bits of the flags: -#define DEBUG_VARIABLE "SNORT_DEBUG" +#define DEBUG_BUILTIN "SNORT_DEBUG" #define DEBUG_INIT 0x0000000000000001LL #define DEBUG_PARSER 0x0000000000000002LL -#define DEBUG_MSTRING 0x0000000000000004LL -#define DEBUG_PORTLISTS 0x0000000000000008LL -#define DEBUG_ATTRIBUTE 0x0000000000000010LL -#define DEBUG_PLUGIN 0x0000000000000020LL -#define DEBUG_PLUGBASE 0x0000000000000040LL -#define DEBUG_DECODE 0x0000000000000080LL -#define DEBUG_DATALINK 0x0000000000000100LL -#define DEBUG_CONFIGRULES 0x0000000000000200LL -#define DEBUG_RULES 0x0000000000000400LL -#define DEBUG_DETECT 0x0000000000000800LL -#define DEBUG_PATTERN_MATCH 0x0000000000001000LL -#define DEBUG_FLOW 0x0000000000002000LL -#define DEBUG_LOG 0x0000000000004000LL -#define DEBUG_FLOWBITS 0x0000000000008000LL -#define DEBUG_FILE 0x0000000000010000LL -#define DEBUG_CONTROL 0x0000000000020000LL -#define DEBUG_PPM 0x0000000000040000LL -#define DEBUG_EXP 0x0000000080000000LL +#define DEBUG_PORTLISTS 0x0000000000000004LL +#define DEBUG_ATTRIBUTE 0x0000000000000008LL +#define DEBUG_DECODE 0x0000000000000010LL +#define DEBUG_CONFIGRULES 0x0000000000000020LL +#define DEBUG_DETECT 0x0000000000000040LL +#define DEBUG_PATTERN_MATCH 0x0000000000000080LL +#define DEBUG_FLOW 0x0000000000000100LL +#define DEBUG_LOG 0x0000000000000200LL +#define DEBUG_FLOWBITS 0x0000000000000400LL +#define DEBUG_FILE 0x0000000000000800LL +#define DEBUG_PPM 0x0000000000001000LL // this env var uses the upper 32 bits of the flags: -#define DEBUG_PP_VAR "SNORT_PP_DEBUG" +#define DEBUG_PLUGIN "SNORT_PP_DEBUG" #define DEBUG_FRAG 0x0000000100000000LL #define DEBUG_STREAM 0x0000000200000000LL #define DEBUG_STREAM_STATE 0x0000000400000000LL #define DEBUG_STREAM_PAF 0x0000000800000000LL -#define DEBUG_HTTP_DECODE 0x0000001000000000LL -#define DEBUG_HTTPINSPECT 0x0000002000000000LL -#define DEBUG_ASN1 0x0000004000000000LL -#define DEBUG_DNS 0x0000008000000000LL -#define DEBUG_FTPTELNET 0x0000010000000000LL -#define DEBUG_GTP 0x0000020000000000LL -#define DEBUG_IMAP 0x0000040000000000LL -#define DEBUG_POP 0x0000080000000000LL -#define DEBUG_RPC 0x0000100000000000LL -#define DEBUG_SIP 0x0000200000000000LL -#define DEBUG_SKYPE 0x0000400000000000LL -#define DEBUG_SSL 0x0000800000000000LL -#define DEBUG_SMTP 0x0001000000000000LL -#define DEBUG_PP_EXP 0x8000000000000000LL - -#if 0 -// FIXIT delete duplicate declarations -SO_PUBLIC void DebugMessageFunc(uint64_t dbg, const char* fmt, ...); -#ifdef SF_WCHAR -void DebugWideMessageFunc(uint64_t dbg, const wchar_t* fmt, ...); -#endif +#define DEBUG_HTTPINSPECT 0x0000001000000000LL +#define DEBUG_ASN1 0x0000002000000000LL +#define DEBUG_DNS 0x0000004000000000LL +#define DEBUG_FTPTELNET 0x0000008000000000LL +#define DEBUG_GTP 0x0000010000000000LL +#define DEBUG_IMAP 0x0000020000000000LL +#define DEBUG_POP 0x0000040000000000LL +#define DEBUG_RPC 0x0000080000000000LL +#define DEBUG_SIP 0x0000100000000000LL +#define DEBUG_SSL 0x0000200000000000LL +#define DEBUG_SMTP 0x0000400000000000LL + +#define DEBUG_CODEC 0x0001000000000000LL +#define DEBUG_INSPECTOR 0x0002000000000000LL +#define DEBUG_IPS_ACTION 0x0004000000000000LL +#define DEBUG_IPS_OPTION 0x0008000000000000LL +#define DEBUG_MPSE 0x0010000000000000LL +#define DEBUG_SO_RULE 0x0020000000000000LL +#define DEBUG_LOGGER 0x0040000000000000LL + +#ifdef PIGLET +#define DEBUG_PIGLET 0x0080000000000000LL #endif #ifdef DEBUG_MSGS -SO_PUBLIC extern const char* DebugMessageFile; -SO_PUBLIC extern int DebugMessageLine; -#define DebugMessage DebugMessageFile = __FILE__; DebugMessageLine = __LINE__; DebugMessageFunc -#define DebugWideMessage \ - DebugMessageFile = __FILE__; DebugMessageLine = __LINE__; \ - DebugWideMessageFunc +class SO_PUBLIC Debug +{ +public: + static bool enabled(uint64_t flag); -uint64_t GetDebugLevel(void); -int DebugThis(uint64_t level); -#endif + static void print( + const char* file, int line, uint64_t dbg, const char* fmt, ...); + +private: + static bool init; + static uint64_t mask; +}; + +#define DebugFormat(dbg, fmt, ...) \ + Debug::print(__FILE__, __LINE__, dbg, fmt, __VA_ARGS__) + +#define DebugMessage(dbg, msg) DebugFormat(dbg, "%s", msg) -#ifdef DEBUG_MSGS #define DEBUG_WRAP(code) code -SO_PUBLIC void DebugMessageFunc(uint64_t dbg, const char* fmt, ...); -#ifdef SF_WCHAR -SO_PUBLIC void DebugWideMessageFunc(uint64_t dbg, const wchar_t* fmt, ...); -#endif + #else +#define DebugFormat(dbg, fmt, ...) +#define DebugMessage(dbg, msg) #define DEBUG_WRAP(code) -/* I would use DebugMessage(dbt,fmt...) but that only works with GCC */ #endif #endif diff --git a/src/managers/plugin_manager.cc b/src/managers/plugin_manager.cc index 8b914151c..ede30cd6f 100644 --- a/src/managers/plugin_manager.cc +++ b/src/managers/plugin_manager.cc @@ -434,7 +434,7 @@ void PluginManager::show_plugins() PlugMap::iterator it; for ( it = plug_map.begin(); it != plug_map.end(); ++it ) - { + { Plugin& p = it->second; cout << Markup::item(); diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc index f634bc285..86b1bf4c3 100644 --- a/src/network_inspectors/arp_spoof/arp_spoof.cc +++ b/src/network_inspectors/arp_spoof/arp_spoof.cc @@ -204,8 +204,8 @@ void ArpSpoof::eval(Packet* p) SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_UNICAST_ARP_REQUEST); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, - "MODNAME: Unicast request\n"); ); + DebugMessage(DEBUG_INSPECTOR, + "MODNAME: Unicast request\n"); } else if (memcmp((u_char*)eh->ether_src, (u_char*)ah->arp_sha, 6) != 0) @@ -213,8 +213,8 @@ void ArpSpoof::eval(Packet* p) SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, - "MODNAME: Ethernet/ARP mismatch request\n"); ); + DebugMessage(DEBUG_INSPECTOR, + "MODNAME: Ethernet/ARP mismatch request\n"); } break; case ARPOP_REPLY: @@ -224,8 +224,8 @@ void ArpSpoof::eval(Packet* p) SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, - "MODNAME: Ethernet/ARP mismatch reply src\n"); ); + DebugMessage(DEBUG_INSPECTOR, + "MODNAME: Ethernet/ARP mismatch reply src\n"); } else if (memcmp((u_char*)eh->ether_dst, (u_char*)ah->arp_tha, 6) != 0) @@ -233,8 +233,8 @@ void ArpSpoof::eval(Packet* p) SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_ETHERFRAME_ARP_MISMATCH_DST); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, - "MODNAME: Ethernet/ARP mismatch reply dst\n"); ); + DebugMessage(DEBUG_INSPECTOR, + "MODNAME: Ethernet/ARP mismatch reply dst\n"); } break; } @@ -247,14 +247,14 @@ void ArpSpoof::eval(Packet* p) if ((ipme = LookupIPMacEntryByIP(config->ipmel, ah->arp_spa32)) == NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, - "MODNAME: LookupIPMacEntryByIp returned NULL\n"); ); + DebugMessage(DEBUG_INSPECTOR, + "MODNAME: LookupIPMacEntryByIp returned NULL\n"); return; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, - "MODNAME: LookupIPMacEntryByIP returned %p\n", ipme); ); + DebugFormat(DEBUG_INSPECTOR, + "MODNAME: LookupIPMacEntryByIP returned %p\n", ipme); /* If the Ethernet source address or the ARP source hardware address * in p doesn't match the MAC address in ipme, then generate an alert @@ -267,8 +267,8 @@ void ArpSpoof::eval(Packet* p) SnortEventqAdd(GID_ARP_SPOOF, ARPSPOOF_ARP_CACHE_OVERWRITE_ATTACK); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, - "MODNAME: Attempted ARP cache overwrite attack\n"); ); + DebugMessage(DEBUG_INSPECTOR, + "MODNAME: Attempted ARP cache overwrite attack\n"); return; } diff --git a/src/network_inspectors/perf_monitor/perf_flow.cc b/src/network_inspectors/perf_monitor/perf_flow.cc index 1933c5ca6..f1ebe8378 100644 --- a/src/network_inspectors/perf_monitor/perf_flow.cc +++ b/src/network_inspectors/perf_monitor/perf_flow.cc @@ -306,9 +306,8 @@ static sfSFSValue* findFlowIPStats(SFFLOW* sfFlow, const sfip_t* src_addr, const node = sfxhash_get_node(sfFlow->ipMap, &key); if (!node) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM, + DebugMessage(DEBUG_STREAM, "Key/Value pair didn't exist in the flow stats table and we couldn't add it!\n"); - ); return NULL; } memset(node->data, 0, sizeof(sfSFSValue)); diff --git a/src/packet_io/intf.cc b/src/packet_io/intf.cc index 952bfcbdc..9fd883708 100644 --- a/src/packet_io/intf.cc +++ b/src/packet_io/intf.cc @@ -75,8 +75,8 @@ char* GetFirstInterface(void) char* iface = NULL; char errorbuf[PCAP_ERRBUF_SIZE]; - DEBUG_WRAP(DebugMessage( - DEBUG_INIT, "interface is NULL, looking up interface...."); ); + DebugMessage( + DEBUG_INIT, "interface is NULL, looking up interface...."); /* look up the device and get the handle */ iface = pcap_lookupdev(errorbuf); @@ -87,8 +87,7 @@ char* GetFirstInterface(void) "Please specify one with -i switch\n", errorbuf); } - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "found interface %s\n", - PRINT_INTERFACE(iface)); ); + DebugFormat(DEBUG_INIT, "found interface %s\n", PRINT_INTERFACE(iface)); iface = SnortStrdup(iface); return iface; diff --git a/src/parser/config_file.cc b/src/parser/config_file.cc index eed5d2a13..632d14ef6 100644 --- a/src/parser/config_file.cc +++ b/src/parser/config_file.cc @@ -232,34 +232,34 @@ void ConfigCreatePidFile(SnortConfig* sc, const char*) void ConfigDaemon(SnortConfig* sc, const char*) { - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Daemon mode flag set\n"); ); + DebugMessage(DEBUG_INIT, "Daemon mode flag set\n"); sc->run_flags |= RUN_FLAG__DAEMON; sc->logging_flags |= LOGGING_FLAG__QUIET; } void ConfigDecodeDataLink(SnortConfig* sc, const char*) { - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Decode DLL set\n"); ); + DebugMessage(DEBUG_INIT, "Decode DLL set\n"); sc->output_flags |= OUTPUT_FLAG__SHOW_DATA_LINK; } void ConfigDumpCharsOnly(SnortConfig* sc, const char*) { /* dump the application layer as text only */ - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Character payload dump set\n"); ); + DebugMessage(DEBUG_INIT, "Character payload dump set\n"); sc->output_flags |= OUTPUT_FLAG__CHAR_DATA; } void ConfigDumpPayload(SnortConfig* sc, const char*) { /* dump the application layer */ - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Payload dump set\n"); ); + DebugMessage(DEBUG_INIT, "Payload dump set\n"); sc->output_flags |= OUTPUT_FLAG__APP_DATA; } void ConfigDumpPayloadVerbose(SnortConfig* sc, const char*) { - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Verbose packet bytecode dumps enabled\n"); ); + DebugMessage(DEBUG_INIT, "Verbose packet bytecode dumps enabled\n"); sc->output_flags |= OUTPUT_FLAG__VERBOSE_DUMP; } @@ -361,7 +361,7 @@ void ConfigObfuscationMask(SnortConfig* sc, const char* args) if ( !args ) return; - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Got obfus data: %s\n", args); ); + DebugFormat(DEBUG_INIT, "Got obfus data: %s\n", args); sc->output_flags |= OUTPUT_FLAG__OBFUSCATE; @@ -471,14 +471,14 @@ void ConfigSetUid(SnortConfig* sc, const char* args) } } - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "UserID: %d GroupID: %d.\n", - sc->user_id, sc->group_id); ); + DebugFormat(DEBUG_INIT, "UserID: %d GroupID: %d.\n", + sc->user_id, sc->group_id); } void ConfigShowYear(SnortConfig* sc, const char*) { sc->output_flags |= OUTPUT_FLAG__INCLUDE_YEAR; - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Enabled year in timestamp\n"); ); + DebugMessage(DEBUG_INIT, "Enabled year in timestamp\n"); } void ConfigTreatDropAsAlert(SnortConfig* sc, const char*) @@ -529,7 +529,7 @@ void ConfigUtc(SnortConfig* sc, const char*) void ConfigVerbose(SnortConfig* sc, const char*) { sc->logging_flags |= LOGGING_FLAG__VERBOSE; - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Verbose Flag active\n"); ); + DebugMessage(DEBUG_INIT, "Verbose Flag active\n"); } void ConfigTunnelVerdicts(SnortConfig* sc, const char* args) diff --git a/src/parser/mstring.cc b/src/parser/mstring.cc index 7ef34813d..bbb8bb463 100644 --- a/src/parser/mstring.cc +++ b/src/parser/mstring.cc @@ -54,9 +54,9 @@ int main() /* shift=make_shift(find,sizeof(find)-1); skip=make_skip(find,sizeof(find)-1); */ - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,"%d\n", + DebugFormat(DEBUG_PATTERN_MATCH,"%d\n", mSearch(test, sizeof(test) - 1, find, - sizeof(find) - 1, shift, skip)); ); + sizeof(find) - 1, shift, skip)); return 0; } @@ -512,8 +512,8 @@ int mContainsSubstr(const char* buf, int b_len, const char* pat, int p_len) { if (m_cnt == (p_len - 1)) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, - "\n%ld compares for match\n", loopcnt); ); + DebugFormat(DEBUG_PATTERN_MATCH, + "\n%ld compares for match\n", loopcnt); return 1; } m_cnt++; diff --git a/src/parser/parse_ip.cc b/src/parser/parse_ip.cc index e0d23abc4..e69eeb24e 100644 --- a/src/parser/parse_ip.cc +++ b/src/parser/parse_ip.cc @@ -44,8 +44,7 @@ sfip_var_t* sfip_var_from_string(const char* addr) ip_vartable = get_ips_policy()->ip_vartable; - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Got address string: %s\n", - addr); ); + DebugFormat(DEBUG_CONFIGRULES,"Got address string: %s\n", addr); ret = (sfip_var_t*)SnortAlloc(sizeof(sfip_var_t)); diff --git a/src/parser/parse_ports.cc b/src/parser/parse_ports.cc index ad0512d06..e452c3c95 100644 --- a/src/parser/parse_ports.cc +++ b/src/parser/parse_ports.cc @@ -47,7 +47,7 @@ static int POPGetChar(POParser* pop) pop->slen--; pop->s++; pop->pos++; - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"GetChar: %c, %d bytes left\n",c, pop->slen); ); + DebugFormat(DEBUG_PORTLISTS,"GetChar: %c, %d bytes left\n",c, pop->slen); return c; } return 0; @@ -221,7 +221,7 @@ static char* POParserName(POParser* pop) } } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,">>> POParserName : %s\n",pop->token); ); + DebugFormat(DEBUG_PORTLISTS,">>> POParserName : %s\n",pop->token); return strdup(pop->token); } @@ -269,7 +269,7 @@ static uint16_t POParserGetShort(POParser* pop) return 0; } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"GetUNumber: %d\n",c); ); + DebugFormat(DEBUG_PORTLISTS,"GetUNumber: %d\n",c); return c; } @@ -539,7 +539,7 @@ PortObject* PortObjectParseString(PortVarTable* pvTable, POParser* pop, { PortObject* po, * potmp; - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortObjectParseString: %s\n",s); ); + DebugFormat(DEBUG_PORTLISTS,"PortObjectParseString: %s\n",s); POParserInit(pop, s, pvTable); diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc index 35fb93ee5..bee461b6d 100644 --- a/src/parser/parse_rule.cc +++ b/src/parser/parse_rule.cc @@ -179,10 +179,10 @@ static int FinishPortListRule( /* Count rules with both src and dst specific ports */ if (!(rtn->flags & ANY_DST_PORT) && !(rtn->flags & ANY_SRC_PORT)) { - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, + DebugFormat(DEBUG_PORTLISTS, "***\n***Info: src & dst ports are both specific" " >> gid=%u sid=%u\n***\n", - otn->sigInfo.generator, otn->sigInfo.id)); + otn->sigInfo.generator, otn->sigInfo.id); prc->both++; } @@ -245,9 +245,9 @@ static int FinishPortListRule( * to those protocols. All IP rules should have any-any port descriptors * and fall into this test. IP rules that are not tcp/udp/icmp go only into the * IP table */ - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, + DebugFormat(DEBUG_PORTLISTS, "Finishing IP any-any rule %u:%u\n", - otn->sigInfo.generator,otn->sigInfo.id); ); + otn->sigInfo.generator,otn->sigInfo.id); switch ( otn->proto ) { @@ -295,8 +295,8 @@ static int FinishPortListRule( prc->dst++; - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "Finishing rule: dst port rule\n"); ); + DebugMessage(DEBUG_PORTLISTS, + "Finishing rule: dst port rule\n"); /* find the proper port object */ pox = PortTableFindInputPortObjectPorts(dstTable, rtn->dst_portobject); @@ -562,14 +562,14 @@ static PortObject* ParsePortListTcpUdpPort( /*||isalpha(port_str[0])*/ /*TODO: interferes with protocol names for ports*/ const char* name = port_str + 1; - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortVarTableFind: finding '%s'\n", port_str); ); + DebugFormat(DEBUG_PORTLISTS,"PortVarTableFind: finding '%s'\n", port_str); /* look it up in the port var table */ portobject = PortVarTableFind(pvt, name); if (portobject == NULL) ParseAbort("***PortVar Lookup failed on '%s'.", port_str); - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortVarTableFind: '%s' found!\n", port_str); ); + DebugFormat(DEBUG_PORTLISTS,"PortVarTableFind: '%s' found!\n", port_str); } /* 3rd - and finally process a raw port list */ else @@ -577,13 +577,13 @@ static PortObject* ParsePortListTcpUdpPort( /* port list = [p,p,p:p,p,...] or p or p:p , no embedded spaces due to tokenizer */ PortObject* pox; - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "parser.c->PortObjectParseString: parsing '%s'\n",port_str); ); + DebugFormat(DEBUG_PORTLISTS, + "parser.c->PortObjectParseString: parsing '%s'\n",port_str); portobject = PortObjectParseString(pvt, &poparser, 0, port_str, 0); - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "parser.c->PortObjectParseString: '%s' done.\n",port_str); ); + DebugFormat(DEBUG_PORTLISTS, + "parser.c->PortObjectParseString: '%s' done.\n",port_str); if ( !portobject ) { @@ -596,16 +596,16 @@ static PortObject* ParsePortListTcpUdpPort( pox = PortTableFindInputPortObjectPorts(noname, portobject); if ( pox ) { - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, + DebugFormat(DEBUG_PORTLISTS, "parser.c: already have '%s' as a PortObject - " - "calling PortObjectFree(portbject) line=%d\n",port_str,__LINE__); ); + "calling PortObjectFree(portbject) line=%d\n",port_str,__LINE__); PortObjectFree(portobject); portobject = pox; } else { - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "parser.c: adding '%s' as a PortObject line=%d\n",port_str,__LINE__); ); + DebugFormat(DEBUG_PORTLISTS, + "parser.c: adding '%s' as a PortObject line=%d\n",port_str,__LINE__); /* Add to the un-named port var table */ if (PortTableAddObject(noname, portobject)) { @@ -657,7 +657,7 @@ static int ParsePortList( } } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"Rule-PortVar Parsed: %s \n",port_str); ); + DebugFormat(DEBUG_PORTLISTS,"Rule-PortVar Parsed: %s \n",port_str); /* !ports - port lists can be mixed 80:90,!82, * so the old NOT flag is depracated for port lists @@ -822,7 +822,7 @@ void AddRuleFuncToList( { RuleFpList* idx; - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n"); ); + DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n"); idx = rtn->rule_func; if (idx == NULL) @@ -867,7 +867,7 @@ static void AddrToFunc(RuleTreeNode* rtn, int mode) case SRC: if ((rtn->flags & ANY_SRC_IP) == 0) { - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckSrcIP -> "); ); + DebugMessage(DEBUG_CONFIGRULES,"CheckSrcIP -> "); AddRuleFuncToList(CheckSrcIP, rtn); } @@ -876,7 +876,7 @@ static void AddrToFunc(RuleTreeNode* rtn, int mode) case DST: if ((rtn->flags & ANY_DST_IP) == 0) { - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckDstIP -> "); ); + DebugMessage(DEBUG_CONFIGRULES,"CheckDstIP -> "); AddRuleFuncToList(CheckDstIP, rtn); } @@ -914,12 +914,12 @@ static void PortToFunc(RuleTreeNode* rtn, int any_flag, int except_flag, int mod switch (mode) { case SRC: - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckSrcPortNotEq -> "); ); + DebugMessage(DEBUG_CONFIGRULES,"CheckSrcPortNotEq -> "); AddRuleFuncToList(CheckSrcPortNotEq, rtn); break; case DST: - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckDstPortNotEq -> "); ); + DebugMessage(DEBUG_CONFIGRULES,"CheckDstPortNotEq -> "); AddRuleFuncToList(CheckDstPortNotEq, rtn); break; } @@ -930,12 +930,12 @@ static void PortToFunc(RuleTreeNode* rtn, int any_flag, int except_flag, int mod switch (mode) { case SRC: - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckSrcPortEqual -> "); ); + DebugMessage(DEBUG_CONFIGRULES,"CheckSrcPortEqual -> "); AddRuleFuncToList(CheckSrcPortEqual, rtn); break; case DST: - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckDstPortEqual -> "); ); + DebugMessage(DEBUG_CONFIGRULES,"CheckDstPortEqual -> "); AddRuleFuncToList(CheckDstPortEqual, rtn); break; } @@ -955,12 +955,12 @@ static void PortToFunc(RuleTreeNode* rtn, int any_flag, int except_flag, int mod ***************************************************************************/ static void SetupRTNFuncList(RuleTreeNode* rtn) { - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Initializing RTN function list!\n"); ); - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Functions: "); ); + DebugMessage(DEBUG_CONFIGRULES,"Initializing RTN function list!\n"); + DebugMessage(DEBUG_CONFIGRULES,"Functions: "); if (rtn->flags & BIDIRECTIONAL) { - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"CheckBidirectional->\n"); ); + DebugMessage(DEBUG_CONFIGRULES,"CheckBidirectional->\n"); AddRuleFuncToList(CheckBidirectional, rtn); } else @@ -985,7 +985,7 @@ static void SetupRTNFuncList(RuleTreeNode* rtn) AddrToFunc(rtn, DST); } - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"RuleListEnd\n"); ); + DebugMessage(DEBUG_CONFIGRULES,"RuleListEnd\n"); /* tack the end (success) function to the list */ AddRuleFuncToList(RuleListEnd, rtn); @@ -1015,7 +1015,7 @@ static RuleTreeNode* ProcessHeadNode( * stick it at the end of the list */ if (rtn == NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Building New Chain head node\n"); ); + DebugMessage(DEBUG_CONFIGRULES,"Building New Chain head node\n"); head_count++; rtn = (RuleTreeNode*)SnortAlloc(sizeof(RuleTreeNode)); @@ -1030,8 +1030,8 @@ static RuleTreeNode* ProcessHeadNode( /* add link to parent listhead */ rtn->listhead = list; - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES, - "New Chain head flags = 0x%X\n", rtn->flags); ); + DebugFormat(DEBUG_CONFIGRULES, + "New Chain head flags = 0x%X\n", rtn->flags); } else { diff --git a/src/parser/parser.cc b/src/parser/parser.cc index 176a8bc00..0f8758334 100644 --- a/src/parser/parser.cc +++ b/src/parser/parser.cc @@ -466,7 +466,7 @@ static void IntegrityCheckRules(SnortConfig* sc) while (ofl_idx != NULL) { opt_func_count++; - //DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "%p->",ofl_idx->OptTestFunc);); + //DebugFormat(DEBUG_DETECT, "%p->",ofl_idx->OptTestFunc); ofl_idx = ofl_idx->next; } @@ -474,12 +474,12 @@ static void IntegrityCheckRules(SnortConfig* sc) { ParseError("zero Length OTN List"); } - //DEBUG_WRAP(DebugMessage(DEBUG_DETECT,"\n");); + //DebugMessage(DEBUG_DETECT,"\n"); } } } - //DEBUG_WRAP(DebugMessage(DEBUG_DETECT, "OK\n");); + //DebugMessage(DEBUG_DETECT, "OK\n"); } static void parse_file(SnortConfig* sc, Shell* sh) diff --git a/src/parser/vars.cc b/src/parser/vars.cc index ab9afc087..99143c4bd 100644 --- a/src/parser/vars.cc +++ b/src/parser/vars.cc @@ -552,8 +552,8 @@ VarEntry* VarDefine( } } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "VarDefine: name=%s value=%s\n",name,value); ); + DebugFormat(DEBUG_PORTLISTS, + "VarDefine: name=%s value=%s\n",name,value); /* Check to see if this variable is just being aliased */ if (var_table != NULL) @@ -580,8 +580,8 @@ VarEntry* VarDefine( ParseAbort("could not expand var('%s').", name); } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "VarDefine: name=%s value=%s (expanded)\n",name,value); ); + DebugFormat(DEBUG_PORTLISTS, + "VarDefine: name=%s value=%s (expanded)\n",name,value); DisallowCrossTableDuplicateVars(sc, name, VAR_TYPE__DEFAULT); @@ -792,7 +792,7 @@ const char* ExpandVars(SnortConfig* sc, const char* string) i = j = 0; l_string = strlen(string); - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES, "ExpandVars, Before: %s\n", string); ); + DebugFormat(DEBUG_CONFIGRULES, "ExpandVars, Before: %s\n", string); while (i < l_string && j < (int)sizeof(estring) - 1) { @@ -912,7 +912,7 @@ const char* ExpandVars(SnortConfig* sc, const char* string) } } - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES, "ExpandVars, After: %s\n", estring); ); + DebugFormat(DEBUG_CONFIGRULES, "ExpandVars, After: %s\n", estring); return estring; } @@ -922,7 +922,7 @@ void AddVarToTable(SnortConfig* sc, const char* name, const char* value) //TODO: snort.cfg and rules should use PortVar instead ...this allows compatability for now. if (strstr(name, "_PORT") || strstr(name, "PORT_")) { - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"PortVar\n"); ); + DebugMessage(DEBUG_CONFIGRULES,"PortVar\n"); PortVarDefine(sc, name, value); } else diff --git a/src/piglet/piglet.h b/src/piglet/piglet.h index a699d7816..e9cc08ee7 100644 --- a/src/piglet/piglet.h +++ b/src/piglet/piglet.h @@ -24,7 +24,7 @@ namespace Piglet { -int main(); +int main(); bool piglet_mode(); } diff --git a/src/piglet_plugins/pp_codec.cc b/src/piglet_plugins/pp_codec.cc index 99ebcfcc1..a93ef6287 100644 --- a/src/piglet_plugins/pp_codec.cc +++ b/src/piglet_plugins/pp_codec.cc @@ -86,7 +86,7 @@ static void dtor(Piglet::BasePlugin* p) { delete p; } static const struct Piglet::Api piglet_api = -{ +{ { PT_PIGLET, sizeof(Piglet::Api), diff --git a/src/piglet_plugins/pp_codec_iface.cc b/src/piglet_plugins/pp_codec_iface.cc index 069a8c0dd..fb63bc434 100644 --- a/src/piglet_plugins/pp_codec_iface.cc +++ b/src/piglet_plugins/pp_codec_iface.cc @@ -40,7 +40,7 @@ static std::vector data_link_types; static std::vector protocol_ids; static const ip::IpApi ip_api {}; - + struct TextLogWrapper { TextLog* text_log; diff --git a/src/piglet_plugins/pp_event_iface.cc b/src/piglet_plugins/pp_event_iface.cc index e01a95e77..7c15e864a 100644 --- a/src/piglet_plugins/pp_event_iface.cc +++ b/src/piglet_plugins/pp_event_iface.cc @@ -97,7 +97,7 @@ static const luaL_Reg methods[] = { Lua::ManageStack ms(L); Lua::Table si_table(L, lua_gettop(L)); - + si_table.get_field("generator", si->generator); si_table.get_field("id", si->id); si_table.get_field("rev", si->rev); diff --git a/src/piglet_plugins/pp_flow_iface.cc b/src/piglet_plugins/pp_flow_iface.cc index 976bc69c5..187148a52 100644 --- a/src/piglet_plugins/pp_flow_iface.cc +++ b/src/piglet_plugins/pp_flow_iface.cc @@ -59,7 +59,7 @@ static const luaL_Reg metamethods[] = { auto& self = FlowIface.get(L); lua_pushfstring(L, "%s@%p", FlowIface.name, &self); - + return 1; } }, diff --git a/src/piglet_plugins/pp_inspector_iface.cc b/src/piglet_plugins/pp_inspector_iface.cc index d0d462349..a4de784ba 100644 --- a/src/piglet_plugins/pp_inspector_iface.cc +++ b/src/piglet_plugins/pp_inspector_iface.cc @@ -63,7 +63,7 @@ static const luaL_Reg methods[] = { auto& p = PacketIface.get(L); auto& self = InspectorIface.get(L); - + self.clear(&p); return 0; diff --git a/src/piglet_plugins/pp_raw_buffer_iface.cc b/src/piglet_plugins/pp_raw_buffer_iface.cc index 59fd9a2ea..6790fa147 100644 --- a/src/piglet_plugins/pp_raw_buffer_iface.cc +++ b/src/piglet_plugins/pp_raw_buffer_iface.cc @@ -85,7 +85,7 @@ static const luaL_Reg methods[] = auto& self = RawBufferIface.get(L, 1); size_t new_size = arg.check_size(2); - + self.resize(new_size, '\0'); return 0; diff --git a/src/piglet_plugins/pp_test.cc b/src/piglet_plugins/pp_test.cc index 451724582..9924b2993 100644 --- a/src/piglet_plugins/pp_test.cc +++ b/src/piglet_plugins/pp_test.cc @@ -43,7 +43,7 @@ class TestPiglet : public Piglet::BasePlugin { public: - TestPiglet(Lua::State& state, std::string target) : + TestPiglet(Lua::State& state, std::string target) : BasePlugin(state, target) { } virtual bool setup() override; diff --git a/src/ports/port_object.cc b/src/ports/port_object.cc index 6a38f0d80..4e58f0f18 100644 --- a/src/ports/port_object.cc +++ b/src/ports/port_object.cc @@ -75,7 +75,7 @@ void PortObjectFree(void* pvoid) PortObject* po = (PortObject*)pvoid; DEBUG_WRAP(static int pof_cnt = 0; pof_cnt++; ); - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortObjectFree-Cnt: %d ptr=%p\n",pof_cnt,pvoid); ); + DebugFormat(DEBUG_PORTLISTS,"PortObjectFree-Cnt: %d ptr=%p\n",pof_cnt,pvoid); if ( !po ) return; diff --git a/src/ports/port_object2.cc b/src/ports/port_object2.cc index 95ebbf0b3..3083afa21 100644 --- a/src/ports/port_object2.cc +++ b/src/ports/port_object2.cc @@ -155,7 +155,7 @@ void PortObject2Free(void* pvoid) PortObject2* po = (PortObject2*)pvoid; DEBUG_WRAP(static int pof2_cnt = 0; pof2_cnt++; ); - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"PortObjectFree2-Cnt: %d ptr=%p\n",pof2_cnt,pvoid); ); + DebugFormat(DEBUG_PORTLISTS,"PortObjectFree2-Cnt: %d ptr=%p\n",pof2_cnt,pvoid); if ( !po ) return; diff --git a/src/ports/port_table.cc b/src/ports/port_table.cc index a26a73fae..2d5f13308 100644 --- a/src/ports/port_table.cc +++ b/src/ports/port_table.cc @@ -95,9 +95,9 @@ static void plx_print(plx_t* p) { DEBUG_WRAP( int i; - DebugMessage(DEBUG_PORTLISTS, "plx-n=%d\n", p->n); + DebugFormat(DEBUG_PORTLISTS, "plx-n=%d\n", p->n); for (i=0; in; i++) - DebugMessage(DEBUG_PORTLISTS, "plx[%d]=%lu\n", i, p->p[i]); + DebugFormat(DEBUG_PORTLISTS, "plx[%d]=%lu\n", i, p->p[i]); ); } @@ -271,17 +271,17 @@ static PortObject2* _merge_N_pol( /* * Check for the merged port object in the plx table */ - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "++++n=%d sfghash_find-mhashx\n",pol_cnt); ); + DebugFormat(DEBUG_PORTLISTS, + "++++n=%d sfghash_find-mhashx\n",pol_cnt); ponew = (PortObject2*)sfghash_find(mhashx, &plx); if ( ponew ) { - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "n=%d ponew found in mhashx\n",pol_cnt); ); + DebugFormat(DEBUG_PORTLISTS, + "n=%d ponew found in mhashx\n",pol_cnt); return ponew; } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "n=%d posnew not found in mhashx\n",pol_cnt); ); + DebugFormat(DEBUG_PORTLISTS, + "n=%d posnew not found in mhashx\n",pol_cnt); /* * Merge the port objects together - ports and rules @@ -299,46 +299,46 @@ static PortObject2* _merge_N_pol( { for (i=1; irule_list->count,i); ); + DebugFormat(DEBUG_PORTLISTS,"*** %d rules in object %d\n", + ((PortObject*)pol[i])->rule_list->count,i); PortObjectAppendEx2(ponew, (PortObject*)pol[i]); - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, + DebugFormat(DEBUG_PORTLISTS, "*** merged port-object[%d], %d rules\n", - i,ponew->rule_hash->count); ); + i,ponew->rule_hash->count); } PortObjectNormalize( (PortObject*)ponew); } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, + DebugFormat(DEBUG_PORTLISTS, "*** merged %d port objects, %d rules\n", - pol_cnt,ponew->rule_hash->count); ); - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** merged ponew - follows: \n"); ); + pol_cnt,ponew->rule_hash->count); + DebugMessage(DEBUG_PORTLISTS,"*** merged ponew - follows: \n"); // PortObjectPrint2(ponew); /* * Add the Merged PortObject2 to the PortObject2 hash table * keyed by ports. */ - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"n=%d sfghash_add-mhash\n",pol_cnt); ); + DebugFormat(DEBUG_PORTLISTS,"n=%d sfghash_add-mhash\n",pol_cnt); stat =sfghash_add(mhash, &ponew, ponew); if ( stat != SFGHASH_OK ) { /* This is possible since PLX hash on a different key */ if ( stat == SFGHASH_INTABLE ) { - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"n=%d sfghash_add-mhash ponew in table\n", - pol_cnt); ); - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"n=%d sfghash_find-mhash ponew\n",pol_cnt); ); + DebugFormat(DEBUG_PORTLISTS,"n=%d sfghash_add-mhash ponew in table\n", + pol_cnt); + DebugFormat(DEBUG_PORTLISTS,"n=%d sfghash_find-mhash ponew\n",pol_cnt); pox = (PortObject2*)sfghash_find(mhash,&ponew); if ( pox ) { PortObject2AppendPortObject2(pox,ponew); - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "sfportobject.c: merge_N_pol() line=%d SFGHASH_INTABLE\n",__LINE__); ); + DebugFormat(DEBUG_PORTLISTS, + "sfportobject.c: merge_N_pol() line=%d SFGHASH_INTABLE\n",__LINE__); PortObject2Free(ponew); ponew = pox; - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "n=%d sfghash_find-mhash ponew found, new rules merged\n",pol_cnt); ); + DebugFormat(DEBUG_PORTLISTS, + "n=%d sfghash_find-mhash ponew found, new rules merged\n",pol_cnt); } else { @@ -351,8 +351,8 @@ static PortObject2* _merge_N_pol( } } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"***%d ports merged object added to mhash table\n", - pol_cnt); ); + DebugFormat(DEBUG_PORTLISTS,"***%d ports merged object added to mhash table\n", + pol_cnt); /* * Create a plx node and add it to plx table @@ -368,7 +368,7 @@ static PortObject2* _merge_N_pol( /* * Add the plx node to the PLX hash table */ - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"n=%d sfghash_add-mhashx\n",pol_cnt); ); + DebugFormat(DEBUG_PORTLISTS,"n=%d sfghash_add-mhashx\n",pol_cnt); stat = sfghash_add(mhashx, &plx_tmp, ponew); if ( stat != SFGHASH_OK ) { @@ -382,8 +382,7 @@ static PortObject2* _merge_N_pol( } } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"Added-%d Merged Rule Groups to PLX HASH\n",pol_cnt); - ); + DebugFormat(DEBUG_PORTLISTS,"Added-%d Merged Rule Groups to PLX HASH\n",pol_cnt); /* * Validate hash table entry @@ -461,8 +460,8 @@ static PortObject2* PortTableCompileMergePortObjectList2( } } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** %d small rule groups, %d large rule groups\n", - nsmall,nlarge); ); + DebugFormat(DEBUG_PORTLISTS,"*** %d small rule groups, %d large rule groups\n", + nsmall,nlarge); /* * Sort the pointers to the input port objects so @@ -475,9 +474,9 @@ static PortObject2* PortTableCompileMergePortObjectList2( DEBUG_WRAP( for (i=0; iPortObjects2\n***\n"); ); + DebugMessage(DEBUG_PORTLISTS,"***\n***Merging PortObjects->PortObjects2\n***\n"); std::unique_ptr upA(new PortObject*[SFPO_MAX_LPORTS]); PortObject** pol = upA.get(); @@ -628,8 +627,8 @@ static int PortTableCompileMergePortObjects(PortTable* p) p->pt_mpxo_hash = mhashx; - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "***\n*** PortList-Merging, Large Rule groups must have %d rules\n",p->pt_lrc); ); + DebugFormat(DEBUG_PORTLISTS, + "***\n*** PortList-Merging, Large Rule groups must have %d rules\n",p->pt_lrc); plx_list = sflist_new(); sflist_init(plx_list); @@ -669,7 +668,7 @@ static int PortTableCompileMergePortObjects(PortTable* p) continue; } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"*** merging list for port[%d] \n",i); fflush( + DEBUG_WRAP(DebugFormat(DEBUG_PORTLISTS,"*** merging list for port[%d] \n",i); fflush( stdout); ); /* merge the rules into an optimal port object */ @@ -773,8 +772,8 @@ static int PortTableCompileMergePortObjects(PortTable* p) /* set the new list - this is a list of port items for this port object */ po->item_list = plist; - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"port-object id = %d, port cnt = %d\n",po->id, - po->port_cnt); ); + DebugFormat(DEBUG_PORTLISTS,"port-object id = %d, port cnt = %d\n",po->id, + po->port_cnt); } return 0; @@ -830,8 +829,8 @@ static int PortTableConsistencyCheck(PortTable* p) } } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "***\n***Port Table Compiler Consistency Check Phase-I Passed !\n"); ); + DebugMessage(DEBUG_PORTLISTS, + "***\n***Port Table Compiler Consistency Check Phase-I Passed !\n"); /* * This phase checks the Input port object rules/ports against @@ -874,9 +873,9 @@ static int PortTableConsistencyCheck(PortTable* p) } } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS, - "***\n***Port Table Compiler Consistency Check Phase-II Passed !!! - Good to go Houston\n****\n"); - ); + DebugMessage(DEBUG_PORTLISTS, + "***\n***Port Table Compiler Consistency Check Phase-II Passed !!!" + " - Good to go Houston\n****\n"); return 0; } @@ -1018,7 +1017,7 @@ int PortTableCompile(PortTable* p) return 0; } - DEBUG_WRAP(DebugMessage(DEBUG_PORTLISTS,"#PortTableCompile: Compiling Port Array Lists\n"); ); + DebugMessage(DEBUG_PORTLISTS,"#PortTableCompile: Compiling Port Array Lists\n"); if ( PortTableCompileMergePortObjects(p) ) { diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc index 68c6e01bf..0f8ab5ea7 100644 --- a/src/protocols/packet_manager.cc +++ b/src/protocols/packet_manager.cc @@ -211,10 +211,10 @@ void PacketManager::decode( // loop until the protocol id is no longer valid while (CodecManager::s_protocols[mapped_prot]->decode(raw, codec_data, p->ptrs)) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Codec %s (protocol_id: %u:" + DebugFormat(DEBUG_DECODE, "Codec %s (protocol_id: %u:" "ip header starts at: %p, length is %lu\n", CodecManager::s_protocols[mapped_prot]->get_name(), - codec_data.next_prot_id, pkt, codec_data.lyr_len); ); + codec_data.next_prot_id, pkt, codec_data.lyr_len); /* * We only want the layer immediately following SAVE_LAYER to have the @@ -278,10 +278,10 @@ void PacketManager::decode( codec_data.proto_bits = 0; } - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Codec %s (protocol_id: %hu: ip header" + DebugFormat(DEBUG_DECODE, "Codec %s (protocol_id: %hu: ip header" " starts at: %p, length is %lu\n", CodecManager::s_protocols[mapped_prot]->get_name(), - prev_prot_id, pkt, (unsigned long)codec_data.lyr_len); ); + prev_prot_id, pkt, (unsigned long)codec_data.lyr_len); s_stats[mapped_prot + stat_offset]++; diff --git a/src/service_inspectors/back_orifice/back_orifice.cc b/src/service_inspectors/back_orifice/back_orifice.cc index 2dcece372..cf302abbc 100644 --- a/src/service_inspectors/back_orifice/back_orifice.cc +++ b/src/service_inspectors/back_orifice/back_orifice.cc @@ -360,8 +360,8 @@ static int BoGetDirection(Packet* p, char* pkt_data) pkt_data++; } - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Data length = %lu\n", len); ); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "ID = %lu\n", id); ); + DebugFormat(DEBUG_INSPECTOR, "Data length = %lu\n", len); + DebugFormat(DEBUG_INSPECTOR, "ID = %lu\n", id); /* Do more len checking */ @@ -400,17 +400,17 @@ static int BoGetDirection(Packet* p, char* pkt_data) if ( type & 0x80 ) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Partial packet\n"); ); + DebugMessage(DEBUG_INSPECTOR, "Partial packet\n"); } if ( type & 0x40 ) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Continued packet\n"); ); + DebugMessage(DEBUG_INSPECTOR, "Continued packet\n"); } /* Extract type of BO packet */ type = type & 0x3F; - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Type = 0x%x\n", type); ); + DebugFormat(DEBUG_INSPECTOR, "Type = 0x%x\n", type); /* Only examine data if this is a ping request or response */ if ( type == BO_TYPE_PING ) @@ -528,9 +528,9 @@ void BackOrifice::eval(Packet* p) if (*magic_data != plaintext) { - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, + DebugFormat(DEBUG_INSPECTOR, "Failed check one on 0x%X : 0x%X\n", - *magic_data, plaintext); ); + *magic_data, plaintext); MODULE_PROFILE_END(boPerfStats); return; } @@ -540,21 +540,21 @@ void BackOrifice::eval(Packet* p) } /* if we fall thru there's a detect */ - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, + DebugMessage(DEBUG_INSPECTOR, "Detected Back Orifice Data!\n"); - DebugMessage(DEBUG_PLUGIN, "hash value: %d\n", key); ); + DebugFormat(DEBUG_INSPECTOR, "hash value: %d\n", key); bo_direction = BoGetDirection(p, pkt_data); if ( bo_direction == BO_FROM_CLIENT ) { SnortEventqAdd(GID_BO, BO_CLIENT_TRAFFIC_DETECT); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Client packet\n"); ); + DebugMessage(DEBUG_INSPECTOR, "Client packet\n"); } else if ( bo_direction == BO_FROM_SERVER ) { SnortEventqAdd(GID_BO, BO_SERVER_TRAFFIC_DETECT); - DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Server packet\n"); ); + DebugMessage(DEBUG_INSPECTOR, "Server packet\n"); } else { diff --git a/src/service_inspectors/dns/dns.cc b/src/service_inspectors/dns/dns.cc index b372d8ce3..20776c881 100644 --- a/src/service_inspectors/dns/dns.cc +++ b/src/service_inspectors/dns/dns.cc @@ -778,8 +778,7 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData) if ((dnsSessionData->curr_rec_state == DNS_RESP_STATE_Q_NAME) && (dnsSessionData->curr_rec == 0)) { - DEBUG_WRAP( - DebugMessage(DEBUG_DNS, + DebugFormat(DEBUG_DNS, "DNS Header: length %d, id 0x%x, flags 0x%x, " "questions %d, answers %d, authorities %d, additionals %d\n", dnsSessionData->length, dnsSessionData->hdr.id, @@ -787,7 +786,6 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData) dnsSessionData->hdr.answers, dnsSessionData->hdr.authorities, dnsSessionData->hdr.additionals); - ); } if (!(dnsSessionData->hdr.flags & DNS_HDR_FLAG_RESPONSE)) @@ -806,12 +804,11 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData) if (dnsSessionData->curr_rec_state == DNS_RESP_STATE_Q_COMPLETE) { - DEBUG_WRAP( - DebugMessage(DEBUG_DNS, + DebugFormat(DEBUG_DNS, "DNS Question %d: type %d, class %d\n", i, dnsSessionData->curr_q.type, dnsSessionData->curr_q.dns_class); - ); + dnsSessionData->curr_rec_state = DNS_RESP_STATE_Q_NAME; dnsSessionData->curr_rec++; } @@ -847,15 +844,13 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData) switch (dnsSessionData->curr_rec_state) { case DNS_RESP_STATE_RR_RDATA_START: - DEBUG_WRAP( - DebugMessage(DEBUG_DNS, + DebugFormat(DEBUG_DNS, "DNS ANSWER RR %d: type %d, class %d, " "ttl %d rdlength %d\n", i, dnsSessionData->curr_rr.type, dnsSessionData->curr_rr.dns_class, dnsSessionData->curr_rr.ttl, dnsSessionData->curr_rr.length); - ); dnsSessionData->bytes_seen_curr_rec = 0; dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDATA_MID; @@ -902,15 +897,13 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData) switch (dnsSessionData->curr_rec_state) { case DNS_RESP_STATE_RR_RDATA_START: - DEBUG_WRAP( - DebugMessage(DEBUG_DNS, + DebugFormat(DEBUG_DNS, "DNS AUTH RR %d: type %d, class %d, " "ttl %d rdlength %d\n", i, dnsSessionData->curr_rr.type, dnsSessionData->curr_rr.dns_class, dnsSessionData->curr_rr.ttl, dnsSessionData->curr_rr.length); - ); dnsSessionData->bytes_seen_curr_rec = 0; dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDATA_MID; @@ -957,15 +950,13 @@ void ParseDNSResponseMessage(Packet* p, DNSData* dnsSessionData) switch (dnsSessionData->curr_rec_state) { case DNS_RESP_STATE_RR_RDATA_START: - DEBUG_WRAP( - DebugMessage(DEBUG_DNS, + DebugFormat(DEBUG_DNS, "DNS ADDITONAL RR %d: type %d, class %d, " "ttl %d rdlength %d\n", i, dnsSessionData->curr_rr.type, dnsSessionData->curr_rr.dns_class, dnsSessionData->curr_rr.ttl, dnsSessionData->curr_rr.length); - ); dnsSessionData->bytes_seen_curr_rec = 0; dnsSessionData->curr_rec_state = DNS_RESP_STATE_RR_RDATA_MID; diff --git a/src/service_inspectors/ftp_telnet/ftp.cc b/src/service_inspectors/ftp_telnet/ftp.cc index e6d9c4ce1..416835fb9 100644 --- a/src/service_inspectors/ftp_telnet/ftp.cc +++ b/src/service_inspectors/ftp_telnet/ftp.cc @@ -95,8 +95,8 @@ static int SnortFTP( if (iInspectMode == FTPP_SI_SERVER_MODE) { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "Server packet: %.*s\n", p->dsize, p->data)); + DebugFormat(DEBUG_FTPTELNET, + "Server packet: %.*s\n", p->dsize, p->data); // FIXIT-L breaks target-based non-standard ports //if ( !ScPafEnabled() ) @@ -107,17 +107,17 @@ static int SnortFTP( { if ( !InspectClientPacket(p) ) { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "Client packet will be reassembled\n")); + DebugMessage(DEBUG_FTPTELNET, + "Client packet will be reassembled\n"); MODULE_PROFILE_END(ftpPerfStats); return FTPP_SUCCESS; } else { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, + DebugFormat(DEBUG_FTPTELNET, "Client packet: rebuilt %s: %.*s\n", (p->packet_flags & PKT_REBUILT_STREAM) ? "yes" : "no", - p->dsize, p->data)); + p->dsize, p->data); } } diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc index 24e5458b6..a8d40d323 100644 --- a/src/service_inspectors/ftp_telnet/ftp_data.cc +++ b/src/service_inspectors/ftp_telnet/ftp_data.cc @@ -120,8 +120,8 @@ static int SnortFTPData(Packet* p) if (!PROTO_IS_FTP(ftp_ssn)) { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "FTP-DATA Invalid FTP_SESSION retrieved durring lookup\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "FTP-DATA Invalid FTP_SESSION retrieved durring lookup\n"); if (data_ssn->data_chan) stream.set_ignore_direction(p->flow, SSN_DIR_BOTH); diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc index f1c6eaa4e..bf5437d23 100644 --- a/src/service_inspectors/ftp_telnet/pp_ftp.cc +++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc @@ -1209,8 +1209,8 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p, /* Could check that response msg includes "TLS" */ session->encr_state = AUTH_TLS_ENCRYPTED; SnortEventqAdd(GID_FTP, FTP_ENCRYPTED); - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "FTP stream is now TLS encrypted\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "FTP stream is now TLS encrypted\n"); } break; case AUTH_SSL_CMD_ISSUED: @@ -1219,8 +1219,8 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p, /* Could check that response msg includes "SSL" */ session->encr_state = AUTH_SSL_ENCRYPTED; SnortEventqAdd(GID_FTP, FTP_ENCRYPTED); - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "FTP stream is now SSL encrypted\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "FTP stream is now SSL encrypted\n"); } break; case AUTH_UNKNOWN_CMD_ISSUED: @@ -1228,8 +1228,8 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p, { session->encr_state = AUTH_UNKNOWN_ENCRYPTED; SnortEventqAdd(GID_FTP, FTP_ENCRYPTED); - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "FTP stream is now encrypted\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "FTP stream is now encrypted\n"); } break; } @@ -1392,8 +1392,8 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) /* Mark this session & packet as one to ignore */ stream.stop_inspection(p->flow, p, SSN_DIR_BOTH, -1, 0); } - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "FTP client stream is now encrypted\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "FTP client stream is now encrypted\n"); } break; } @@ -1471,8 +1471,8 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) /* Mark this session & packet as one to ignore */ stream.stop_inspection(p->flow, p, SSN_DIR_BOTH, -1, 0); } - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "FTP server stream is now encrypted\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "FTP server stream is now encrypted\n"); } break; } @@ -1552,8 +1552,8 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) } else { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "invalid FTP response code."); ); + DebugMessage(DEBUG_FTPTELNET, + "invalid FTP response code."); ftpssn->server.response.state = FTP_RESPONSE_INV; } } @@ -1583,8 +1583,8 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) } else if (!space && ftpssn->server.response.state == 0) { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "Missing LF from end of FTP command\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "Missing LF from end of FTP command\n"); } else { @@ -1608,8 +1608,8 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) } else { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "Missing LF from end of FTP command with params\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "Missing LF from end of FTP command with params\n"); } } } @@ -1619,8 +1619,8 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) /* Nothing left --> no parameters/message. Not even an LF */ req->param_begin = NULL; req->param_end = NULL; - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "Missing LF from end of FTP command sans params\n"); ); + DebugMessage(DEBUG_FTPTELNET, + "Missing LF from end of FTP command sans params\n"); } /* Set the pointer for the next request/response @@ -1634,16 +1634,16 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) switch (state) { case FTP_CMD_INV: - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, + DebugFormat(DEBUG_FTPTELNET, "Illegal FTP command found: %.*s\n", - req->cmd_size, req->cmd_begin)); + req->cmd_size, req->cmd_begin); iRet = FTPP_ALERT; break; case FTP_RESPONSE: /* Response */ - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, + DebugFormat(DEBUG_FTPTELNET, "FTP response: code: %.*s : M len %d : M %.*s\n", req->cmd_size, req->cmd_begin, req->param_size, - req->param_size, req->param_begin)); + req->param_size, req->param_begin); if ((ftpssn->client_conf->max_resp_len > 0) && (req->param_size > ftpssn->client_conf->max_resp_len)) { @@ -1659,10 +1659,10 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) } break; case FTP_RESPONSE_CONT: /* Response continued */ - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, + DebugFormat(DEBUG_FTPTELNET, "FTP response: continuation of code: %d : M len %d : M %.*s\n", ftpssn->server.response.state, req->param_size, - req->param_size, req->param_begin)); + req->param_size, req->param_begin); if ((ftpssn->client_conf->max_resp_len > 0) && (req->param_size > ftpssn->client_conf->max_resp_len)) { @@ -1672,10 +1672,10 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) } break; case FTP_RESPONSE_ENDCONT: /* Continued response end */ - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, + DebugFormat(DEBUG_FTPTELNET, "FTP response: final continue of code: %.*s : M len %d : " "M %.*s\n", req->cmd_size, req->cmd_begin, - req->param_size, req->param_size, req->param_begin)); + req->param_size, req->param_size, req->param_begin); if ((ftpssn->client_conf->max_resp_len > 0) && (req->param_size > ftpssn->client_conf->max_resp_len)) { @@ -1685,9 +1685,9 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) } break; default: - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, "FTP command: CMD: %.*s : " + DebugFormat(DEBUG_FTPTELNET, "FTP command: CMD: %.*s : " "P len %d : P %.*s\n", req->cmd_size, req->cmd_begin, - req->param_size, req->param_size, req->param_begin)); + req->param_size, req->param_size, req->param_begin); if (CmdConf) { unsigned max = CmdConf->max_param_len; @@ -1698,9 +1698,9 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode) { /* Alert on param length overrun */ SnortEventqAdd(GID_FTP, FTP_PARAMETER_LENGTH_OVERFLOW); - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, "FTP command: %.*s" + DebugFormat(DEBUG_FTPTELNET, "FTP command: %.*s" "parameter length overrun %d > %d \n", - req->cmd_size, req->cmd_begin, req->param_size, max)); + req->cmd_size, req->cmd_begin, req->param_size, max); iRet = FTPP_ALERT; } diff --git a/src/service_inspectors/ftp_telnet/pp_telnet.cc b/src/service_inspectors/ftp_telnet/pp_telnet.cc index c70ae8d34..1ee23411c 100644 --- a/src/service_inspectors/ftp_telnet/pp_telnet.cc +++ b/src/service_inspectors/ftp_telnet/pp_telnet.cc @@ -168,7 +168,7 @@ int normalize_telnet( if (!normalization_required) { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, "Nothing to process!\n"); ); + DebugMessage(DEBUG_FTPTELNET, "Nothing to process!\n"); if (tnssn && iMode == FTPP_SI_CLIENT_MODE) tnssn->consec_ayt = 0; return FTPP_SUCCESS; @@ -405,10 +405,10 @@ int normalize_telnet( } else { - DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, + DebugFormat(DEBUG_FTPTELNET, "overwriting %2X(%c) with %2X(%c)\n", (unsigned char)(*write_ptr&0xFF), *write_ptr, - (unsigned char)(*read_ptr & 0xFF), *read_ptr); ); + (unsigned char)(*read_ptr & 0xFF), *read_ptr); /* overwrite the negotiation bytes with the follow-on bytes */ switch (*((unsigned char*)(read_ptr))) diff --git a/src/service_inspectors/http_inspect/hi_client_norm.cc b/src/service_inspectors/http_inspect/hi_client_norm.cc index b1b7ab359..df07a5e3c 100644 --- a/src/service_inspectors/http_inspect/hi_client_norm.cc +++ b/src/service_inspectors/http_inspect/hi_client_norm.cc @@ -105,9 +105,9 @@ int hi_split_header_cookie( } else { - DEBUG_WRAP(DebugMessage(DEBUG_HTTPINSPECT, + DebugFormat(DEBUG_HTTPINSPECT, "HttpInspect: no leading header: %d to %d\n", - this_header_end - this_header_start, this_header_len); ); + this_header_end - this_header_start, this_header_len); } /* Trim the cookie and only copy what we can store in the buf */ @@ -126,8 +126,8 @@ int hi_split_header_cookie( } else { - DEBUG_WRAP(DebugMessage(DEBUG_HTTPINSPECT, "HttpInspect: trimming cookie: %d to %d\n", - cookie->cookie_end - cookie->cookie, this_cookie_len); ); + DebugFormat(DEBUG_HTTPINSPECT, "HttpInspect: trimming cookie: %d to %d\n", + cookie->cookie_end - cookie->cookie, this_cookie_len); } /* update for the next one */ @@ -181,9 +181,9 @@ int hi_split_header_cookie( } else { - DEBUG_WRAP(DebugMessage(DEBUG_HTTPINSPECT, + DebugFormat(DEBUG_HTTPINSPECT, "HttpInspect: no leading header: %d to %d\n", - this_header_end - this_header_start, this_header_len); ); + this_header_end - this_header_start, this_header_len); } } diff --git a/src/service_inspectors/http_inspect/hi_stream_splitter.cc b/src/service_inspectors/http_inspect/hi_stream_splitter.cc index a0c58d61a..a5e499e11 100644 --- a/src/service_inspectors/http_inspect/hi_stream_splitter.cc +++ b/src/service_inspectors/http_inspect/hi_stream_splitter.cc @@ -600,7 +600,7 @@ static bool hi_fsm_compile(void) hi_fsm = (State*)malloc(hi_fsm_size*sizeof(*hi_fsm)); if ( hi_fsm == NULL ) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, "Unable to allocate memory for hi_fsm."); ); + DebugMessage(DEBUG_STREAM_PAF, "Unable to allocate memory for hi_fsm."); return false; } next = max; @@ -744,13 +744,13 @@ static inline StreamSplitter::Status hi_exec(Hi5State* s, Action a, int c) break; case ACT_LNB: s->flags |= HIF_LEN; - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: lnb=%u\n", __FUNCTION__, s->len); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s: lnb=%u\n", __FUNCTION__, s->len); break; case ACT_LNC: s->flags |= HIF_LEN; - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: lnc=%u\n", __FUNCTION__, s->len); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s: lnc=%u\n", __FUNCTION__, s->len); if ( s->len ) return StreamSplitter::SKIP; s->flags &= ~HIF_NOF; @@ -801,8 +801,8 @@ static void hi_pipe_push(Hi5State* s_req, Flow* ssn) uint32_t nreq = s_req->pipe & 0xFF; uint32_t pipe = s_req->pipe >> 8; - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: nreq=%d, pipe=0x%X\n", __FUNCTION__, nreq, pipe); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s: nreq=%d, pipe=0x%X\n", __FUNCTION__, nreq, pipe); if ( nreq == MAX_PIPELINE ) { @@ -830,8 +830,8 @@ static void hi_pipe_pop(Hi5State* s_rsp, Flow* ssn) uint32_t nreq = s_req->pipe & 0xFF; uint32_t pipe = s_req->pipe >> 8; - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: nreq=%d, pipe=0x%X\n", __FUNCTION__, nreq, pipe); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s: nreq=%d, pipe=0x%X\n", __FUNCTION__, nreq, pipe); // FIXIT-L valgrind: Conditional jump or move depends on uninitialised value(s) if ( nreq == 0 || nreq == PIPELINE_RUPTURED ) @@ -885,10 +885,10 @@ static StreamSplitter::Status hi_scan_fsm(Hi5State* s, int c) #ifdef HI_TRACE get_state(prev, before, sizeof(before)); get_state(s->fsm, after, sizeof(after)); - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, + DebugFormat(DEBUG_STREAM_PAF, "%s: %s(%u)[0x%2X, '%c'] -> %d,%s(%u)\n", __FUNCTION__, before, prev, c, isgraph(c) ? c : '.', - cell->action, after, s->fsm); ) + cell->action, after, s->fsm); #endif status = hi_exec(s, (Action)cell->action, c); @@ -898,8 +898,8 @@ static StreamSplitter::Status hi_scan_fsm(Hi5State* s, int c) static StreamSplitter::Status hi_eoh(Hi5State* s, Flow* ssn) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: flags=0x%X, len=%u\n", __FUNCTION__, s->flags, s->len); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s: flags=0x%X, len=%u\n", __FUNCTION__, s->flags, s->len); if ( (s->flags & HIF_REQ) ) hi_pipe_push(s, ssn); @@ -950,8 +950,8 @@ static inline StreamSplitter::Status hi_scan_msg( Hi5State* s, int c, uint32_t* fp, Flow* ssn) { StreamSplitter::Status paf = StreamSplitter::SEARCH; - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s[%d]: 0x%2X, '%c'\n", __FUNCTION__, s->msg, c, isgraph(c) ? c : '.'); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s[%d]: 0x%2X, '%c'\n", __FUNCTION__, s->msg, c, isgraph(c) ? c : '.'); if ( c == '\r' ) { @@ -1047,8 +1047,8 @@ static void hi_reset(Hi5State* s, uint32_t flags) } s->flags = 0; - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: fsm=%u, flags=0x%X\n", __FUNCTION__, s->fsm, s->flags); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s: fsm=%u, flags=0x%X\n", __FUNCTION__, s->fsm, s->flags); } //-------------------------------------------------------------------- @@ -1077,8 +1077,7 @@ StreamSplitter::Status HttpSplitter::scan( uint32_t n = 0; *fp = 0; - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: len=%u\n", __FUNCTION__, len); ) + DebugFormat(DEBUG_STREAM_PAF, "%s: len=%u\n", __FUNCTION__, len); if ( hip->flags & HIF_ERR ) { @@ -1119,8 +1118,8 @@ StreamSplitter::Status HttpSplitter::scan( break; } } - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: paf=%d, rfp=%u\n", __FUNCTION__, paf, *fp); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s: paf=%d, rfp=%u\n", __FUNCTION__, paf, *fp); hi_paf_calls++; hi_paf_bytes += n; @@ -1134,8 +1133,8 @@ StreamSplitter::Status HttpSplitter::scan( bool hi_paf_init(uint32_t cap) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, - "%s: cap=%u\n", __FUNCTION__, cap); ) + DebugFormat(DEBUG_STREAM_PAF, + "%s: cap=%u\n", __FUNCTION__, cap); hi_cap = cap; @@ -1152,9 +1151,9 @@ bool hi_paf_init(uint32_t cap) void hi_paf_term(void) { free(hi_fsm); - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, + DebugFormat(DEBUG_STREAM_PAF, "%s: calls=%u, bytes=%u\n", __FUNCTION__, - hi_paf_calls, hi_paf_bytes); ) + hi_paf_calls, hi_paf_bytes); hi_fsm = NULL; hi_fsm_size = 0; diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc index 1b3f8e4f2..b7e23016f 100644 --- a/src/service_inspectors/imap/imap.cc +++ b/src/service_inspectors/imap/imap.cc @@ -169,8 +169,8 @@ IMAPData* SetNewIMAPData(IMAP_PROTO_CONF* config, Packet* p) if (p->packet_flags & SSNFLAG_MIDSTREAM) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Got midstream packet - " - "setting state to unknown\n"); ); + DebugMessage(DEBUG_IMAP, "Got midstream packet - " + "setting state to unknown\n"); imap_ssn->state = STATE_UNKNOWN; } @@ -385,16 +385,16 @@ static int IMAP_Setup(Packet* p, IMAPData* ssn) if (ssn->session_flags & IMAP_FLAG_NEXT_STATE_UNKNOWN) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Found gap in previous reassembly buffer - " - "set state to unknown\n"); ); + DebugMessage(DEBUG_IMAP, "Found gap in previous reassembly buffer - " + "set state to unknown\n"); ssn->state = STATE_UNKNOWN; ssn->session_flags &= ~IMAP_FLAG_NEXT_STATE_UNKNOWN; } if (missing_in_rebuilt == SSN_MISSING_BEFORE) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Found missing packets before " - "in reassembly buffer - set state to unknown\n"); ); + DebugMessage(DEBUG_IMAP, "Found missing packets before " + "in reassembly buffer - set state to unknown\n"); ssn->state = STATE_UNKNOWN; } } @@ -449,15 +449,15 @@ static const uint8_t* IMAP_HandleCommand(Packet* p, IMAPData* imap_ssn, const ui { if (imap_ssn->state == STATE_UNKNOWN) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Command not found, but state is " - "unknown - checking for SSL\n"); ); + DebugMessage(DEBUG_IMAP, "Command not found, but state is " + "unknown - checking for SSL\n"); /* check for encrypted */ if ((imap_ssn->session_flags & IMAP_FLAG_CHECK_SSL) && (IsSSL(ptr, end - ptr, p->packet_flags))) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Packet is SSL encrypted\n"); ); + DebugMessage(DEBUG_IMAP, "Packet is SSL encrypted\n"); imap_ssn->state = STATE_TLS_DATA; @@ -466,7 +466,7 @@ static const uint8_t* IMAP_HandleCommand(Packet* p, IMAPData* imap_ssn, const ui } else { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Not SSL - try data state\n"); ); + DebugMessage(DEBUG_IMAP, "Not SSL - try data state\n"); /* don't check for ssl again in this packet */ if (imap_ssn->session_flags & IMAP_FLAG_CHECK_SSL) imap_ssn->session_flags &= ~IMAP_FLAG_CHECK_SSL; @@ -480,7 +480,7 @@ static const uint8_t* IMAP_HandleCommand(Packet* p, IMAPData* imap_ssn, const ui else { SnortEventqAdd(GID_IMAP, IMAP_UNKNOWN_CMD); - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "No known command found\n"); ); + DebugMessage(DEBUG_IMAP, "No known command found\n"); return eol; } } @@ -540,7 +540,7 @@ static void IMAP_ProcessServerPacket(Packet* p, IMAPData* imap_ssn) { if (imap_ssn->state == STATE_DATA) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_IMAP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); if ( imap_ssn->body_len > imap_ssn->body_read) { uint32_t len = imap_ssn->body_len - imap_ssn->body_read; @@ -629,13 +629,13 @@ static void IMAP_ProcessServerPacket(Packet* p, IMAPData* imap_ssn) } else { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, - "Server response not found - see if it's SSL data\n"); ); + DebugMessage(DEBUG_IMAP, + "Server response not found - see if it's SSL data\n"); if ((imap_ssn->session_flags & IMAP_FLAG_CHECK_SSL) && (IsSSL(ptr, end - ptr, p->packet_flags))) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Server response is an SSL packet\n"); ); + DebugMessage(DEBUG_IMAP, "Server response is an SSL packet\n"); imap_ssn->state = STATE_TLS_DATA; @@ -648,7 +648,7 @@ static void IMAP_ProcessServerPacket(Packet* p, IMAPData* imap_ssn) if ( (*ptr != '*') && (*ptr !='+') && (*ptr != '\r') && (*ptr != '\n') ) { SnortEventqAdd(GID_IMAP, IMAP_UNKNOWN_RESP); - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Server response not found\n"); ); + DebugMessage(DEBUG_IMAP, "Server response not found\n"); } } @@ -697,8 +697,8 @@ static void snort_imap(IMAP_PROTO_CONF* config, Packet* p) { if (IsTlsClientHello(p->data, p->data + p->dsize)) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, - "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_IMAP, + "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); imap_ssn->state = STATE_TLS_SERVER_PEND; return; @@ -715,7 +715,7 @@ static void snort_imap(IMAP_PROTO_CONF* config, Packet* p) return; } IMAP_ProcessClientPacket(p, imap_ssn); - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP client packet\n"); ); + DebugMessage(DEBUG_IMAP, "IMAP client packet\n"); } else { @@ -742,7 +742,7 @@ static void snort_imap(IMAP_PROTO_CONF* config, Packet* p) if ( !InspectPacket(p)) { /* Packet will be rebuilt, so wait for it */ - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Client packet will be reassembled\n")); + DebugMessage(DEBUG_IMAP, "Client packet will be reassembled\n"); return; } else if (!(p->packet_flags & PKT_REBUILT_STREAM)) @@ -762,8 +762,8 @@ static void snort_imap(IMAP_PROTO_CONF* config, Packet* p) * that were not rebuilt, state is going to be messed up * so set state to unknown. It's likely this was the * beginning of the conversation so reset state */ - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "Got non-rebuilt packets before " - "this rebuilt packet\n"); ); + DebugMessage(DEBUG_IMAP, "Got non-rebuilt packets before " + "this rebuilt packet\n"); imap_ssn->state = STATE_UNKNOWN; imap_ssn->session_flags &= ~IMAP_FLAG_GOT_NON_REBUILT; diff --git a/src/service_inspectors/imap/imap_paf.cc b/src/service_inspectors/imap/imap_paf.cc index a224a2195..8609fe61d 100644 --- a/src/service_inspectors/imap/imap_paf.cc +++ b/src/service_inspectors/imap/imap_paf.cc @@ -200,7 +200,7 @@ static bool find_data_end_mime_data(const uint8_t ch, ImapPafData* pfdata) if (literal_complete(pfdata) && check_imap_data_end(&(pfdata->data_end_state), ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: End of Data!\n"); ); + DebugMessage(DEBUG_IMAP, "IMAP PAF: End of Data!\n"); reset_data_states(pfdata); return true; } @@ -208,8 +208,8 @@ static bool find_data_end_mime_data(const uint8_t ch, ImapPafData* pfdata) // check for mime flush point if (file_api->process_mime_paf_data(&(pfdata->mime_info), ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: Mime Boundary found." - " Flushing data!\n"); ); + DebugMessage(DEBUG_IMAP, "IMAP PAF: Mime Boundary found." + " Flushing data!\n"); return true; } @@ -428,7 +428,7 @@ static StreamSplitter::Status imap_paf_server(ImapPafData* pfdata, if (flush_len) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: flushing data!\n"); ); + DebugMessage(DEBUG_IMAP, "IMAP PAF: flushing data!\n"); // flush at the final termination sequence *fp = flush_len; @@ -463,8 +463,8 @@ static StreamSplitter::Status imap_paf_client(const uint8_t* data, uint32_t len, if (pch != NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: Flushing client" - " data!\n"); ); + DebugMessage(DEBUG_IMAP, "IMAP PAF: Flushing client" + " data!\n"); *fp = (uint32_t)(pch - (const char*)data) + 1; return StreamSplitter::FLUSH; } @@ -511,12 +511,12 @@ StreamSplitter::Status ImapSplitter::scan( if (flags & PKT_FROM_SERVER) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "PAF: From server.\n"); ); + DebugMessage(DEBUG_IMAP, "PAF: From server.\n"); return imap_paf_server(pfdata, data, len, fp); } else { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "PAF: From client.\n"); ); + DebugMessage(DEBUG_IMAP, "PAF: From client.\n"); return imap_paf_client(data, len, fp); } } diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc index ef152ae13..ce0749b0c 100644 --- a/src/service_inspectors/pop/pop.cc +++ b/src/service_inspectors/pop/pop.cc @@ -123,8 +123,8 @@ POPData* SetNewPOPData(POP_PROTO_CONF* config, Packet* p) if (p->packet_flags & SSNFLAG_MIDSTREAM) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Got midstream packet - " - "setting state to unknown\n"); ); + DebugMessage(DEBUG_POP, "Got midstream packet - " + "setting state to unknown\n"); pop_ssn->state = STATE_UNKNOWN; } @@ -337,16 +337,16 @@ static int POP_Setup(Packet* p, POPData* ssn) if (ssn->session_flags & POP_FLAG_NEXT_STATE_UNKNOWN) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Found gap in previous reassembly buffer - " - "set state to unknown\n"); ); + DebugMessage(DEBUG_POP, "Found gap in previous reassembly buffer - " + "set state to unknown\n"); ssn->state = STATE_UNKNOWN; ssn->session_flags &= ~POP_FLAG_NEXT_STATE_UNKNOWN; } if (missing_in_rebuilt == SSN_MISSING_BEFORE) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Found missing packets before " - "in reassembly buffer - set state to unknown\n"); ); + DebugMessage(DEBUG_POP, "Found missing packets before " + "in reassembly buffer - set state to unknown\n"); ssn->state = STATE_UNKNOWN; } } @@ -425,15 +425,15 @@ static const uint8_t* POP_HandleCommand(Packet* p, POPData* pop_ssn, const uint8 { if (pop_ssn->state == STATE_UNKNOWN) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Command not found, but state is " - "unknown - checking for SSL\n"); ); + DebugMessage(DEBUG_POP, "Command not found, but state is " + "unknown - checking for SSL\n"); /* check for encrypted */ if ((pop_ssn->session_flags & POP_FLAG_CHECK_SSL) && (IsSSL(ptr, end - ptr, p->packet_flags))) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Packet is SSL encrypted\n"); ); + DebugMessage(DEBUG_POP, "Packet is SSL encrypted\n"); pop_ssn->state = STATE_TLS_DATA; @@ -442,7 +442,7 @@ static const uint8_t* POP_HandleCommand(Packet* p, POPData* pop_ssn, const uint8 } else { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Not SSL - try data state\n"); ); + DebugMessage(DEBUG_POP, "Not SSL - try data state\n"); /* don't check for ssl again in this packet */ if (pop_ssn->session_flags & POP_FLAG_CHECK_SSL) pop_ssn->session_flags &= ~POP_FLAG_CHECK_SSL; @@ -456,7 +456,7 @@ static const uint8_t* POP_HandleCommand(Packet* p, POPData* pop_ssn, const uint8 else { SnortEventqAdd(GID_POP, POP_UNKNOWN_CMD); - DEBUG_WRAP(DebugMessage(DEBUG_POP, "No known command found\n"); ); + DebugMessage(DEBUG_POP, "No known command found\n"); return eol; } } @@ -517,7 +517,7 @@ static void POP_ProcessServerPacket(Packet* p, POPData* pop_ssn) { if (pop_ssn->state == STATE_DATA) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); //ptr = POP_HandleData(p, ptr, end); FilePosition position = file_api->get_file_position(p); ptr = file_api->process_mime_data(p->flow, ptr, end, &(pop_ssn->mime_ssn), 0, @@ -555,13 +555,13 @@ static void POP_ProcessServerPacket(Packet* p, POPData* pop_ssn) } else { - DEBUG_WRAP(DebugMessage(DEBUG_POP, - "Server response not found - see if it's SSL data\n"); ); + DebugMessage(DEBUG_POP, + "Server response not found - see if it's SSL data\n"); if ((pop_ssn->session_flags & POP_FLAG_CHECK_SSL) && (IsSSL(ptr, end - ptr, p->packet_flags))) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Server response is an SSL packet\n"); ); + DebugMessage(DEBUG_POP, "Server response is an SSL packet\n"); pop_ssn->state = STATE_TLS_DATA; @@ -582,7 +582,7 @@ static void POP_ProcessServerPacket(Packet* p, POPData* pop_ssn) else if (*ptr == '+') { SnortEventqAdd(GID_POP, POP_UNKNOWN_RESP); - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Server response not found\n"); ); + DebugMessage(DEBUG_POP, "Server response not found\n"); } } @@ -631,8 +631,8 @@ static void snort_pop(POP_PROTO_CONF* config, Packet* p) { if (IsTlsClientHello(p->data, p->data + p->dsize)) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, - "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_POP, + "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); pop_ssn->state = STATE_TLS_SERVER_PEND; return; @@ -649,7 +649,7 @@ static void snort_pop(POP_PROTO_CONF* config, Packet* p) return; } POP_ProcessClientPacket(p, pop_ssn); - DEBUG_WRAP(DebugMessage(DEBUG_POP, "POP client packet\n"); ); + DebugMessage(DEBUG_POP, "POP client packet\n"); } else { @@ -676,7 +676,7 @@ static void snort_pop(POP_PROTO_CONF* config, Packet* p) if ( !InspectPacket(p)) { /* Packet will be rebuilt, so wait for it */ - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Client packet will be reassembled\n")); + DebugMessage(DEBUG_POP, "Client packet will be reassembled\n"); return; } else if (!(p->packet_flags & PKT_REBUILT_STREAM)) @@ -696,8 +696,8 @@ static void snort_pop(POP_PROTO_CONF* config, Packet* p) * that were not rebuilt, state is going to be messed up * so set state to unknown. It's likely this was the * beginning of the conversation so reset state */ - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Got non-rebuilt packets before " - "this rebuilt packet\n"); ); + DebugMessage(DEBUG_POP, "Got non-rebuilt packets before " + "this rebuilt packet\n"); pop_ssn->state = STATE_UNKNOWN; pop_ssn->session_flags &= ~POP_FLAG_GOT_NON_REBUILT; diff --git a/src/service_inspectors/pop/pop_paf.cc b/src/service_inspectors/pop/pop_paf.cc index 577350464..5a1af3543 100644 --- a/src/service_inspectors/pop/pop_paf.cc +++ b/src/service_inspectors/pop/pop_paf.cc @@ -203,7 +203,7 @@ static bool find_data_end_multi_line(PopPafData* pfdata, const uint8_t ch, bool if (file_api->check_data_end(&(pfdata->end_state), ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "End of Multi-line response found\n"); ); + DebugMessage(DEBUG_POP, "End of Multi-line response found\n"); pfdata->end_of_data = true; pfdata->pop_state = POP_PAF_SINGLE_LINE_STATE; reset_data_states(pfdata); @@ -215,7 +215,7 @@ static bool find_data_end_multi_line(PopPafData* pfdata, const uint8_t ch, bool { if (file_api->process_mime_paf_data(&(pfdata->data_info), ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Mime Boundary found. Flushing data!\n"); ); + DebugMessage(DEBUG_POP, "Mime Boundary found. Flushing data!\n"); pfdata->cmd_continued = true; return true; } @@ -244,8 +244,8 @@ static inline bool find_data_end_single_line(PopPafData* pfdata, const uint8_t c else reset_data_states(pfdata); - DEBUG_WRAP(DebugMessage(DEBUG_POP, "End of single-line response " - "found. Flushing data!\n"); ); + DebugMessage(DEBUG_POP, "End of single-line response " + "found. Flushing data!\n"); return true; } @@ -400,12 +400,12 @@ StreamSplitter::Status PopSplitter::scan( if (flags & PKT_FROM_SERVER) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "PAF: From server.\n"); ); + DebugMessage(DEBUG_POP, "PAF: From server.\n"); return pop_paf_server(pfdata, data, len, fp); } else { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "PAF: From client.\n"); ); + DebugMessage(DEBUG_POP, "PAF: From client.\n"); return pop_paf_client(ssn, pfdata, data, len, fp); } } diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc index c5f0c2b9b..f0cc6e2ba 100644 --- a/src/service_inspectors/rpc_decode/rpc_decode.cc +++ b/src/service_inspectors/rpc_decode/rpc_decode.cc @@ -199,10 +199,10 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, int need; RpcStatus status; - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Start *******************************\n"); ); - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Ssn: %p\n", rsdata); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Start *******************************\n"); + DebugFormat(DEBUG_RPC, + "STATEFUL: Ssn: %p\n", rsdata); if ((rsdata->nseq != seq) && (rsdata->nseq != 0)) { @@ -211,16 +211,16 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, if (rsdata->nseq < seq) { /* Missed packets - stop tracking */ - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Missed data\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Missed data\n"); return RPC_STATUS__ERROR; } overlap = rsdata->nseq - seq; if (dsize <= overlap) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: All data overlapped\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: All data overlapped\n"); return RPC_STATUS__SUCCESS; } @@ -236,19 +236,19 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, { if (dsize < rsdata->ignore) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Ignoring %u bytes\n", dsize); ); + DebugFormat(DEBUG_RPC, + "STATEFUL: Ignoring %u bytes\n", dsize); rsdata->ignore -= dsize; - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Bytes left to ignore: %u \n", rsdata->ignore); ); + DebugFormat(DEBUG_RPC, + "STATEFUL: Bytes left to ignore: %u \n", rsdata->ignore); return RPC_STATUS__SUCCESS; } - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Ignoring %u bytes\n", rsdata->ignore); ); + DebugFormat(DEBUG_RPC, + "STATEFUL: Ignoring %u bytes\n", rsdata->ignore); dsize -= (uint16_t)rsdata->ignore; data += rsdata->ignore; @@ -266,9 +266,9 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, { if (dsize < RPC_FRAG_HDR_SIZE) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, + DebugFormat(DEBUG_RPC, "STATEFUL: Not enough data for frag header: %u\n", - dsize); ); + dsize); RpcPreprocEvent(rconfig, rsdata, RPC_INCOMPLETE_SEGMENT); @@ -280,14 +280,14 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, rsdata->frag_len = RPC_FRAG_LEN(data); - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Fragment length: %u\n", rsdata->frag_len); ); + DebugFormat(DEBUG_RPC, + "STATEFUL: Fragment length: %u\n", rsdata->frag_len); if (dsize < (RPC_FRAG_HDR_SIZE + rsdata->frag_len)) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, + DebugFormat(DEBUG_RPC, "STATEFUL: Not enough data for fragment: %u\n", - dsize); ); + dsize); RpcPreprocEvent(rconfig, rsdata, RPC_INCOMPLETE_SEGMENT); @@ -306,8 +306,8 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, if (status == RPC_STATUS__DEFRAG) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Last frag - calling detect\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Last frag - calling detect\n"); if ((dsize != 0) || (data != p->data)) { @@ -332,9 +332,9 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, need = RPC_FRAG_HDR_SIZE - RpcBufLen(&rsdata->seg); if (dsize < need) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, + DebugFormat(DEBUG_RPC, "STATEFUL: Not enough data for frag header " - "(%u): %u\n", need, dsize); ); + "(%u): %u\n", need, dsize); RpcPreprocEvent(rconfig, rsdata, RPC_INCOMPLETE_SEGMENT); @@ -352,16 +352,16 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, rsdata->frag_len = RPC_FRAG_LEN(RpcBufData(&rsdata->seg)); - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Fragment length: %u\n", rsdata->frag_len); ); + DebugFormat(DEBUG_RPC, + "STATEFUL: Fragment length: %u\n", rsdata->frag_len); } need = rsdata->frag_len - (RpcBufLen(&rsdata->seg) - RPC_FRAG_HDR_SIZE); if (dsize < need) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, + DebugFormat(DEBUG_RPC, "STATEFUL: Not enough data for fragment (%u): %u\n", - need, dsize); ); + need, dsize); RpcPreprocEvent(rconfig, rsdata, RPC_INCOMPLETE_SEGMENT); @@ -395,8 +395,8 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, return RPC_STATUS__ERROR; } - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Last frag - calling detect\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Last frag - calling detect\n"); if ( (dsize > 0) ) RpcPreprocEvent(rconfig, rsdata, RPC_MULTIPLE_RECORD); @@ -411,25 +411,25 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, if (RpcBufLen(&rsdata->frag) != 0) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, + DebugFormat(DEBUG_RPC, "STATEFUL: Prepping Frag data: %u\n", - RpcBufLen(&rsdata->frag)); ); + RpcBufLen(&rsdata->frag)); if (RpcPrepFrag(rsdata, p) != RPC_STATUS__SUCCESS) return RPC_STATUS__ERROR; } else if (RpcBufLen(&rsdata->seg) != 0) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, + DebugFormat(DEBUG_RPC, "STATEFUL: Prepping Seg data: %u\n", - RpcBufLen(&rsdata->seg)); ); + RpcBufLen(&rsdata->seg)); if (RpcPrepSeg(rsdata, p) != RPC_STATUS__SUCCESS) return RPC_STATUS__ERROR; } - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Success *****************************\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Success *****************************\n"); return RPC_STATUS__SUCCESS; } @@ -443,8 +443,8 @@ static RpcStatus RpcPrepRaw(const uint8_t* data, uint32_t fraglen, Packet*) if (status != SAFEMEM_SUCCESS) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Failed to copy raw data to alt buffer\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Failed to copy raw data to alt buffer\n"); return RPC_STATUS__ERROR; } @@ -469,8 +469,8 @@ static RpcStatus RpcPrepFrag(RpcSsnData* rsdata, Packet*) if (status != SAFEMEM_SUCCESS) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Failed to copy frag data to alt buffer\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Failed to copy frag data to alt buffer\n"); RpcBufClean(&rsdata->frag); return RPC_STATUS__ERROR; } @@ -491,8 +491,8 @@ static RpcStatus RpcPrepSeg(RpcSsnData* rsdata, Packet*) if (status != SAFEMEM_SUCCESS) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Failed to copy seg data to alt buffer\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Failed to copy seg data to alt buffer\n"); RpcBufClean(&rsdata->seg); return RPC_STATUS__ERROR; } @@ -500,8 +500,8 @@ static RpcStatus RpcPrepSeg(RpcSsnData* rsdata, Packet*) if (RpcBufLen(&rsdata->seg) > RPC_MAX_BUF_SIZE) { rsdata->ignore = (sizeof(uint32_t) + rsdata->frag_len) - RpcBufLen(&rsdata->seg); - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Ignoring %u bytes\n", rsdata->ignore); ); + DebugFormat(DEBUG_RPC, + "STATEFUL: Ignoring %u bytes\n", rsdata->ignore); RpcBufClean(&rsdata->seg); } @@ -523,8 +523,8 @@ static RpcStatus RpcHandleFrag(RpcDecodeConfig* rconfig, if ((RpcBufLen(&rsdata->frag) == 0) && last_frag) return RPC_STATUS__DEFRAG; - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Adding %u bytes to frag buffer\n", frag_len); ); + DebugFormat(DEBUG_RPC, + "STATEFUL: Adding %u bytes to frag buffer\n", frag_len); if (RpcBufAdd(&rsdata->frag, fragment + sizeof(uint32_t), frag_len) != RPC_STATUS__SUCCESS) @@ -568,8 +568,8 @@ static RpcStatus RpcBufAdd(RpcBuffer* buf, const uint8_t* data, uint32_t dsize) buf->data = (uint8_t*)RpcAlloc(alloc_size); if (buf->data == NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Failed to allocate buffer data\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Failed to allocate buffer data\n"); return RPC_STATUS__ERROR; } @@ -582,8 +582,8 @@ static RpcStatus RpcBufAdd(RpcBuffer* buf, const uint8_t* data, uint32_t dsize) if (tmp == NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Failed to reallocate buffer data\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Failed to reallocate buffer data\n"); RpcBufClean(buf); return RPC_STATUS__ERROR; } @@ -595,8 +595,8 @@ static RpcStatus RpcBufAdd(RpcBuffer* buf, const uint8_t* data, uint32_t dsize) if (status != SAFEMEM_SUCCESS) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Failed to move buffer data\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Failed to move buffer data\n"); RpcBufClean(buf); return RPC_STATUS__ERROR; } @@ -606,8 +606,8 @@ static RpcStatus RpcBufAdd(RpcBuffer* buf, const uint8_t* data, uint32_t dsize) buf->data + buf->len, buf->data + buf->size); if (status != SAFEMEM_SUCCESS) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, - "STATEFUL: Failed to copy data to buffer\n"); ); + DebugMessage(DEBUG_RPC, + "STATEFUL: Failed to copy data to buffer\n"); RpcBufClean(buf); return RPC_STATUS__ERROR; } @@ -633,7 +633,7 @@ static inline void* RpcAlloc(uint32_t size) { if ((rpc_memory + size) > rpc_memcap) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "STATEFUL: Memcap exceeded\n"); ); + DebugMessage(DEBUG_RPC, "STATEFUL: Memcap exceeded\n"); return NULL; } @@ -659,8 +659,8 @@ static inline void RpcSsnSetInactive(RpcSsnData* rsdata, Packet*) if (rsdata == NULL) return; - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "STATEFUL: Deactivating session: %p\n", - rsdata); ); + DebugFormat(DEBUG_RPC, "STATEFUL: Deactivating session: %p\n", + rsdata); RpcSsnClean(rsdata); } @@ -702,7 +702,7 @@ static RpcSsnData* RpcSsnDataNew(Packet* p) p->flow->set_application_data(fd); - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "STATEFUL: Created new session: " "%p\n", rsdata); ); + DebugFormat(DEBUG_RPC, "STATEFUL: Created new session: " "%p\n", rsdata); return rsdata; } @@ -766,13 +766,13 @@ static int ConvertRPC(RpcDecodeConfig* rconfig, RpcSsnData* rsdata, Packet* p) if (psize < MIN_CALL_BODY_SZ) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Not enough data to decode: %u\n", - psize); ); + DebugFormat(DEBUG_RPC, "Not enough data to decode: %u\n", + psize); return 0; } /* on match, normalize the data */ - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Got RPC traffic (%u bytes)!\n", psize); ); + DebugFormat(DEBUG_RPC, "Got RPC traffic (%u bytes)!\n", psize); /* cheesy alignment safe fraghdr = *(uint32_t *) data*/ *((uint8_t*)&fraghdr) = data[0]; @@ -788,18 +788,18 @@ static int ConvertRPC(RpcDecodeConfig* rconfig, RpcSsnData* rsdata, Packet* p) if (fraghdr & MSB) { /* on match, normalize the data */ - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Found Last Fragment: %u!\n", length); ); + DebugFormat(DEBUG_RPC, "Found Last Fragment: %u!\n", length); if ((length + 4 != psize) && !(p->packet_flags & PKT_REBUILT_STREAM)) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "It's not the only thing in this buffer!" - " length: %d psize: %d!\n", length, psize); ); + DebugFormat(DEBUG_RPC, "It's not the only thing in this buffer!" + " length: %d psize: %d!\n", length, psize); return RPC_MULTIPLE_RECORD; } else if ( length == 0 ) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Zero-length RPC fragment detected." - " length: %d psize: %d.\n", length, psize); ); + DebugFormat(DEBUG_RPC, "Zero-length RPC fragment detected." + " length: %d psize: %d.\n", length, psize); return RPC_ZERO_LENGTH_FRAGMENT; } return 0; @@ -851,7 +851,7 @@ static int ConvertRPC(RpcDecodeConfig* rconfig, RpcSsnData* rsdata, Packet* p) if (fraghdr & MSB) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Last Fragment detected\n"); ); + DebugMessage(DEBUG_RPC, "Last Fragment detected\n"); last_fragment = 1; } @@ -861,9 +861,9 @@ static int ConvertRPC(RpcDecodeConfig* rconfig, RpcSsnData* rsdata, Packet* p) * caught by length > psize but who knows when weird * psize's might be allowed */ - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Integer Overflow" + DebugFormat(DEBUG_RPC, "Integer Overflow" " field(%d) exceeds packet size(%d)\n", - length, psize); ); + length, psize); return RPC_LARGE_FRAGSIZE; } @@ -871,9 +871,9 @@ static int ConvertRPC(RpcDecodeConfig* rconfig, RpcSsnData* rsdata, Packet* p) if (length > psize) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "Length of" + DebugFormat(DEBUG_RPC, "Length of" " field(%d) exceeds packet size(%d)\n", - length, psize); ); + length, psize); return RPC_INCOMPLETE_SEGMENT; } else if (decoded_len > psize) @@ -881,25 +881,25 @@ static int ConvertRPC(RpcDecodeConfig* rconfig, RpcSsnData* rsdata, Packet* p) /* The entire request is larger than our current packet * size */ - DEBUG_WRAP(DebugMessage(DEBUG_RPC, " Decoded Length (%d)" + DebugFormat(DEBUG_RPC, " Decoded Length (%d)" "exceeds packet size(%d)\n", - decoded_len, psize); ); + decoded_len, psize); return RPC_LARGE_FRAGSIZE; } else if ((data_index + length) > data_end) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, + DebugMessage(DEBUG_RPC, "returning LARGE_FRAGSIZE" - "since we'd read past our end\n"); ); + "since we'd read past our end\n"); return RPC_LARGE_FRAGSIZE; } else { fragcount++; - DEBUG_WRAP(DebugMessage(DEBUG_RPC, + DebugFormat(DEBUG_RPC, "length: %d size: %d decoded_len: %d\n", - length, psize, decoded_len); ); + length, psize, decoded_len); ret = SafeMemcpy(norm_index, data_index, length, decode_buf_start, decode_buf_end); if (ret != SAFEMEM_SUCCESS) @@ -930,15 +930,14 @@ static int ConvertRPC(RpcDecodeConfig* rconfig, RpcSsnData* rsdata, Packet* p) */ if (decoded_len + ((fragcount - 1) * 4) != psize) { - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "decoded len does not compute: %d\n", - decoded_len); ); + DebugFormat(DEBUG_RPC, "decoded len does not compute: %d\n", + decoded_len); return RPC_MULTIPLE_RECORD; } - DEBUG_WRAP(DebugMessage(DEBUG_RPC, "New size: %d\n", decoded_len); + DebugFormat(DEBUG_RPC, "New size: %d\n", decoded_len); DebugMessage(DEBUG_RPC, "converted data:\n"); - //LogNetData(data, decoded_len, p); - ); + //LogNetData(data, decoded_len, p); return 0; } @@ -1063,7 +1062,7 @@ void RpcDecode::eval(Packet* p) RpcSsnSetInactive(rsdata, p); } - DEBUG_WRAP(DebugMessage(DEBUG_RPC,"Stateless inspection\n"); ); + DebugMessage(DEBUG_RPC,"Stateless inspection\n"); RpcPreprocEvent(&config, rsdata, ConvertRPC(&config, rsdata, p)); diff --git a/src/service_inspectors/sip/sip.cc b/src/service_inspectors/sip/sip.cc index 6c9c95b20..25732168f 100644 --- a/src/service_inspectors/sip/sip.cc +++ b/src/service_inspectors/sip/sip.cc @@ -217,16 +217,16 @@ static inline int SIP_Process(Packet* p, SIPData* sessp, SIP_PROTO_CONF* config) pRopts->body_data = sipMsg.body_data; pRopts->status_code = sipMsg.status_code; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "SIP message header length: %d\n", - sipMsg.headerLen)); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed method: %.*s, Flag: 0x%x\n", - sipMsg.methodLen, sipMsg.method, sipMsg.methodFlag)); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed status code: %d\n", - sipMsg.status_code)); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed header address: %p.\n", - sipMsg.header)); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed body address: %p.\n", - sipMsg.body_data)); + DebugFormat(DEBUG_SIP, "SIP message header length: %d\n", + sipMsg.headerLen); + DebugFormat(DEBUG_SIP, "Parsed method: %.*s, Flag: 0x%x\n", + sipMsg.methodLen, sipMsg.method, sipMsg.methodFlag); + DebugFormat(DEBUG_SIP, "Parsed status code: %d\n", + sipMsg.status_code); + DebugFormat(DEBUG_SIP, "Parsed header address: %p.\n", + sipMsg.header); + DebugFormat(DEBUG_SIP, "Parsed body address: %p.\n", + sipMsg.body_data); sip_freeMsg(&sipMsg); return status; diff --git a/src/service_inspectors/sip/sip_config.cc b/src/service_inspectors/sip/sip_config.cc index 960ffe59e..abf170860 100644 --- a/src/service_inspectors/sip/sip_config.cc +++ b/src/service_inspectors/sip/sip_config.cc @@ -112,7 +112,7 @@ void SIP_ParseMethods(const char* cur_tokenp, uint32_t* methodsConfig, SIPMethod /* If the user specified methods, remove default methods for now since * it now needs to be set explicitly. */ *methodsConfig = SIP_METHOD_NULL; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Method token: %s\n",cur_tokenp); ); + DebugFormat(DEBUG_SIP, "Method token: %s\n",cur_tokenp); // Check whether this is a standard method i_method = SIP_findMethod(cur_tokenp, StandardMethods); diff --git a/src/service_inspectors/sip/sip_dialog.cc b/src/service_inspectors/sip/sip_dialog.cc index 00ef81ec4..624c9e56f 100644 --- a/src/service_inspectors/sip/sip_dialog.cc +++ b/src/service_inspectors/sip/sip_dialog.cc @@ -142,7 +142,7 @@ static int SIP_processRequest(SIPMsg* sipMsg, SIP_DialogData* dialog, SIP_Dialog static int SIP_processInvite(SIPMsg* sipMsg, SIP_DialogData* dialog, SIP_DialogList* dList) { int ret = true; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Processing invite, dialog state %d \n", dialog->state); ); + DebugFormat(DEBUG_SIP, "Processing invite, dialog state %d \n", dialog->state); if (NULL == dialog) return false; @@ -151,8 +151,8 @@ static int SIP_processInvite(SIPMsg* sipMsg, SIP_DialogData* dialog, SIP_DialogL // check whether this invite has authorization information if ((SIP_DLG_AUTHENCATING != dialog->state) && (NULL != sipMsg->authorization)) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Dialog state code: %u\n", - dialog->status_code)); + DebugFormat(DEBUG_SIP, "Dialog state code: %u\n", + dialog->status_code); SnortEventqAdd(GID_SIP, SIP_EVENT_AUTH_INVITE_REPLAY_ATTACK); return false; @@ -249,8 +249,7 @@ static int SIP_processResponse(SIPMsg* sipMsg, SIP_DialogData* dialog, SIP_Dialo if (NULL == dialog) return false; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Processing response, dialog state %d \n", dialog->state); - ); + DebugFormat(DEBUG_SIP, "Processing response, dialog state %d \n", dialog->state); if (sipMsg->status_code > 0) dialog->status_code = sipMsg->status_code; @@ -354,8 +353,8 @@ static int SIP_checkMediaChange(SIPMsg* sipMsg, SIP_DialogData* dialog) if (NULL == medias) { // Can't find the media session by ID, SDP has been changed. - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Can't find the media data, ID: %u\n", - sipMsg->mediaSession->sessionID); ); + DebugFormat(DEBUG_SIP, "Can't find the media data, ID: %u\n", + sipMsg->mediaSession->sessionID); return false; } @@ -363,7 +362,7 @@ static int SIP_checkMediaChange(SIPMsg* sipMsg, SIP_DialogData* dialog) if (0 != SIP_compareMedias(medias->medias, sipMsg->mediaSession->medias)) { // Can't find the media session by ID, SDP has been changed. - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "The media data is different!\n"); ); + DebugMessage(DEBUG_SIP, "The media data is different!\n"); return false; } return true; @@ -391,8 +390,8 @@ static int SIP_ignoreChannels(SIP_DialogData* dialog, Packet* p, SIP_PROTO_CONF* if (0 == config->ignoreChannel) return false; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Ignoring the media data in Dialog: %u\n", - dialog->dlgID.callIdHash); ); + DebugFormat(DEBUG_SIP, "Ignoring the media data in Dialog: %u\n", + dialog->dlgID.callIdHash); // check the first media session if (NULL == dialog->mediaSessions) return false; @@ -400,18 +399,18 @@ static int SIP_ignoreChannels(SIP_DialogData* dialog, Packet* p, SIP_PROTO_CONF* if (NULL == dialog->mediaSessions->nextS) return false; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Ignoring the media sessions ID: %u and %u\n", - dialog->mediaSessions->sessionID, dialog->mediaSessions->nextS->sessionID); ); + DebugFormat(DEBUG_SIP, "Ignoring the media sessions ID: %u and %u\n", + dialog->mediaSessions->sessionID, dialog->mediaSessions->nextS->sessionID); mdataA = dialog->mediaSessions->medias; mdataB = dialog->mediaSessions->nextS->medias; sip_stats.ignoreSessions++; while ((NULL != mdataA)&&(NULL != mdataB)) { //void *ssn; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Ignoring channels Source IP: %s Port: %u\n", - sfip_to_str(&mdataA->maddress), mdataA->mport); ); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Ignoring channels Destine IP: %s Port: %u\n", - sfip_to_str(&mdataB->maddress), mdataB->mport); ); + DebugFormat(DEBUG_SIP, "Ignoring channels Source IP: %s Port: %u\n", + sfip_to_str(&mdataA->maddress), mdataA->mport); + DebugFormat(DEBUG_SIP, "Ignoring channels Destine IP: %s Port: %u\n", + sfip_to_str(&mdataB->maddress), mdataB->mport); /* Call into Streams to mark data channel as something to ignore. */ #ifdef HAVE_DAQ_ADDRESS_SPACE_ID @@ -461,7 +460,7 @@ static int SIP_compareMedias(SIP_MediaDataList mlistA, SIP_MediaDataList mlistB) SIP_MediaData* mdataA,* mdataB; mdataA = mlistA; mdataB = mlistB; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Compare the media data \n"); ); + DebugMessage(DEBUG_SIP, "Compare the media data \n"); while ((NULL != mdataA) && (NULL != mdataB)) { if (sfip_compare(&mdataA->maddress, &mdataB->maddress) != SFIP_EQUAL) @@ -496,19 +495,19 @@ static void SIP_updateMedias(SIP_MediaSession* mSession, SIP_MediaList* dList) if (NULL == mSession) return; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Updating session id: %u\n", - mSession->sessionID)); + DebugFormat(DEBUG_SIP, "Updating session id: %u\n", + mSession->sessionID); mSession->savedFlag = SIP_SESSION_SAVED; // Find out the media session based on session id currSession = *dList; while (NULL != currSession) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Session id: %u\n", - currSession->sessionID)); + DebugFormat(DEBUG_SIP, "Session id: %u\n", + currSession->sessionID); if (currSession->sessionID == mSession->sessionID) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Found Session id: %u\n", - currSession->sessionID)); + DebugFormat(DEBUG_SIP, "Found Session id: %u\n", + currSession->sessionID); break; } preSession = currSession; @@ -519,8 +518,8 @@ static void SIP_updateMedias(SIP_MediaSession* mSession, SIP_MediaList* dList) { mSession->nextS = *dList; *dList = mSession; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Add Session id: %u\n", - mSession->sessionID)); + DebugFormat(DEBUG_SIP, "Add Session id: %u\n", + mSession->sessionID); // Display the final media session #ifdef DEBUG_MSGS SIP_displayMedias(dList); @@ -528,8 +527,8 @@ static void SIP_updateMedias(SIP_MediaSession* mSession, SIP_MediaList* dList) return; } // if this session needs to be updated - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Insert Session id: %u\n", - mSession->sessionID)); + DebugFormat(DEBUG_SIP, "Insert Session id: %u\n", + mSession->sessionID); mSession->nextS = currSession->nextS; // if this is the header, update the new header if (NULL == preSession) @@ -551,22 +550,22 @@ static void SIP_updateMedias(SIP_MediaSession* mSession, SIP_MediaList* dList) void SIP_displayMedias(SIP_MediaList* dList) { SIP_MediaSession* currSession; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Updated Session information------------\n")); + DebugMessage(DEBUG_SIP, "Updated Session information------------\n"); currSession = *dList; while (NULL != currSession) { SIP_MediaData* mdata; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Session id: %u\n", currSession->sessionID)); + DebugFormat(DEBUG_SIP, "Session id: %u\n", currSession->sessionID); mdata = currSession->medias; while (NULL != mdata) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Media IP: %s, port: %u, number of ports %u\n", - sfip_to_str(&mdata->maddress), mdata->mport, mdata->numPort)); + DebugFormat(DEBUG_SIP, "Media IP: %s, port: %u, number of ports %u\n", + sfip_to_str(&mdata->maddress), mdata->mport, mdata->numPort); mdata = mdata->nextM; } currSession = currSession->nextS; } - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "End of Session information------------\n")); + DebugMessage(DEBUG_SIP, "End of Session information------------\n"); } #endif @@ -589,9 +588,9 @@ static SIP_DialogData* SIP_addDialog(SIPMsg* sipMsg, SIP_DialogData* currDialog, { SIP_DialogData* dialog; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Add Dialog id: %u, From: %u, To: %u, status code: %u\n", + DebugFormat(DEBUG_SIP, "Add Dialog id: %u, From: %u, To: %u, status code: %u\n", sipMsg->dlgID.callIdHash,sipMsg->dlgID.fromTagHash,sipMsg->dlgID.toTagHash, - sipMsg->status_code)); + sipMsg->status_code); sip_stats.dialogs++; @@ -642,8 +641,8 @@ static int SIP_deleteDialog(SIP_DialogData* currDialog, SIP_DialogList* dList) if ((NULL == currDialog)||(NULL == dList)) return false; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Delete Dialog id: %u, From: %u, To: %u \n", - currDialog->dlgID.callIdHash,currDialog->dlgID.fromTagHash,currDialog->dlgID.toTagHash)); + DebugFormat(DEBUG_SIP, "Delete Dialog id: %u, From: %u, To: %u \n", + currDialog->dlgID.callIdHash,currDialog->dlgID.fromTagHash,currDialog->dlgID.toTagHash); // If this is the header if (NULL == currDialog->prevD) { @@ -742,8 +741,8 @@ int SIP_updateDialog(SIPMsg* sipMsg, SIP_DialogList* dList, Packet* p, SIP_PROTO if ((NULL == sipMsg)||(0 == sipMsg->dlgID.callIdHash)) return false; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Updating Dialog id: %u, From: %u, To: %u\n", - sipMsg->dlgID.callIdHash,sipMsg->dlgID.fromTagHash,sipMsg->dlgID.toTagHash)); + DebugFormat(DEBUG_SIP, "Updating Dialog id: %u, From: %u, To: %u\n", + sipMsg->dlgID.callIdHash,sipMsg->dlgID.fromTagHash,sipMsg->dlgID.toTagHash); dialog = dList->head; @@ -751,12 +750,12 @@ int SIP_updateDialog(SIPMsg* sipMsg, SIP_DialogList* dList, Packet* p, SIP_PROTO while (NULL != dialog) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Dialog id: %u, From: %u, To: %u\n", - dialog->dlgID.callIdHash,dialog->dlgID.fromTagHash,dialog->dlgID.toTagHash)); + DebugFormat(DEBUG_SIP, "Dialog id: %u, From: %u, To: %u\n", + dialog->dlgID.callIdHash,dialog->dlgID.fromTagHash,dialog->dlgID.toTagHash); if (sipMsg->dlgID.callIdHash == dialog->dlgID.callIdHash) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Found Dialog id: %u, From: %u, To: %u\n", - dialog->dlgID.callIdHash,dialog->dlgID.fromTagHash,dialog->dlgID.toTagHash)); + DebugFormat(DEBUG_SIP, "Found Dialog id: %u, From: %u, To: %u\n", + dialog->dlgID.callIdHash,dialog->dlgID.fromTagHash,dialog->dlgID.toTagHash); break; } oldDialog = dialog; @@ -811,10 +810,10 @@ void sip_freeDialogs(SIP_DialogList* list) while (NULL != curNode) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, + DebugFormat(DEBUG_SIP, "*Clean Dialog creator: 0x%x, id: %u, From: %u, To: %u, State: %d\n", curNode->creator, curNode->dlgID.callIdHash,curNode->dlgID.fromTagHash, - curNode->dlgID.toTagHash,curNode->state)); + curNode->dlgID.toTagHash,curNode->state); nextNode = curNode->nextD; sip_freeMediaList(curNode->mediaSessions); free(curNode); diff --git a/src/service_inspectors/sip/sip_parser.cc b/src/service_inspectors/sip/sip_parser.cc index 284e673ad..f00e55ad4 100644 --- a/src/service_inspectors/sip/sip_parser.cc +++ b/src/service_inspectors/sip/sip_parser.cc @@ -152,7 +152,7 @@ static int sip_process_headField(SIPMsg* msg, const char* start, const char* end int length = end -start; char* colonIndex; char* newStart, * newEnd, newLength; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "process line: %.*s\n", length, start)); + DebugFormat(DEBUG_SIP, "process line: %.*s\n", length, start); // If this is folding if ((' ' == start[0]) || ('\t' == start[0])) @@ -334,20 +334,20 @@ static int sip_startline_parse(SIPMsg* msg, const char* buff, char* end, char** if (numOfLineBreaks < 1) { /*No CRLF */ - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "No CRLF, check failed\n")); + DebugMessage(DEBUG_SIP, "No CRLF, check failed\n"); return false; } /*Exclude CRLF from start line*/ length = next - start - numOfLineBreaks; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Start line: %.*s \n", length, start)); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "End of Start line \n")); + DebugFormat(DEBUG_SIP, "Start line: %.*s \n", length, start); + DebugMessage(DEBUG_SIP, "End of Start line \n"); /*Should at least have SIP/2.0 */ if (length < SIP_MIN_MSG_LEN) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Message too short, check failed\n")); + DebugMessage(DEBUG_SIP, "Message too short, check failed\n"); return false; } @@ -379,7 +379,7 @@ static int sip_startline_parse(SIPMsg* msg, const char* buff, char* end, char** } else msg->status_code = (uint16_t)statusCode; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Status code: %d \n", msg->status_code)); + DebugFormat(DEBUG_SIP, "Status code: %d \n", msg->status_code); } else /* This might be a request*/ { @@ -398,14 +398,14 @@ static int sip_startline_parse(SIPMsg* msg, const char* buff, char* end, char** length = space - buff; msg->method = (char*)buff; msg->methodLen = length; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "method: %.*s\n", msg->methodLen, msg->method)); + DebugFormat(DEBUG_SIP, "method: %.*s\n", msg->methodLen, msg->method); method = SIP_FindMethod (config->methods, msg->method, msg->methodLen); if (method) { msg->methodFlag = method->methodFlag; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Found the method: %s, Flag: 0x%x\n", - method->methodName, method->methodFlag)); + DebugFormat(DEBUG_SIP, "Found the method: %s, Flag: 0x%x\n", + method->methodName, method->methodFlag); } // parse the uri @@ -416,8 +416,8 @@ static int sip_startline_parse(SIPMsg* msg, const char* buff, char* end, char** if (space == NULL) return false; msg->uriLen = space - msg->uri; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "uri: %.*s, length: %u\n", msg->uriLen, msg->uri, - msg->uriLen)); + DebugFormat(DEBUG_SIP, "uri: %.*s, length: %u\n", msg->uriLen, msg->uri, + msg->uriLen); if (0 == msg->uriLen) SnortEventqAdd(GID_SIP, SIP_EVENT_EMPTY_REQUEST_URI); else if (config->maxUriLen && (msg->uriLen > config->maxUriLen)) @@ -478,7 +478,7 @@ static int sip_headers_parse(SIPMsg* msg, const char* buff, char* end, char** he /*Processing this line*/ length = next - start - numOfLineBreaks; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Header line: %.*s\n", length, start)); + DebugFormat(DEBUG_SIP, "Header line: %.*s\n", length, start); /*Process headers*/ sip_process_headField(msg, start, start + length, &lastFieldIndex, config); @@ -524,8 +524,8 @@ static int sip_body_parse(SIPMsg* msg, const char* buff, char* end, char** bodyE #ifdef DEBUG_MSGS length = end - buff; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Body length: %d\n", length); ); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Body line: %.*s\n", length, buff); ); + DebugFormat(DEBUG_SIP, "Body length: %d\n", length); + DebugFormat(DEBUG_SIP, "Body line: %.*s\n", length, buff); #endif // Initialize it @@ -552,7 +552,7 @@ static int sip_body_parse(SIPMsg* msg, const char* buff, char* end, char** bodyE /*Processing this line*/ length = next - start - numOfLineBreaks; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Body line: %.*s\n", length, start)); + DebugFormat(DEBUG_SIP, "Body line: %.*s\n", length, start); /*Process body fields*/ sip_process_bodyField(msg, start, start + length); @@ -636,7 +636,7 @@ static int sip_check_headers(SIPMsg* msg, SIP_PROTO_CONF* config) ret = false; } - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Method flag: %d\n", msg->methodFlag)); + DebugFormat(DEBUG_SIP, "Method flag: %d\n", msg->methodFlag); // Contact is required for invite message if ((0 == msg->contactLen)&&(msg->methodFlag == SIP_METHOD_INVITE)&&(0 == msg->status_code)) @@ -676,9 +676,9 @@ static int sip_check_headers(SIPMsg* msg, SIP_PROTO_CONF* config) static int sip_parse_via(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*) { int length = end -start; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Via value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Via value: %.*s\n", length, start); msg->viaLen = msg->viaLen + length; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Via length: %d\n", msg->viaLen); ); + DebugFormat(DEBUG_SIP, "Via length: %d\n", msg->viaLen); return SIP_PARSE_SUCCESS; } @@ -705,12 +705,12 @@ static int sip_parse_from(SIPMsg* msg, const char* start, const char* end, SIP_P char* userEnd; char* userStart; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "From value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "From value: %.*s\n", length, start); msg->from = (char*)start; msg->fromLen = end - start; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "From length: %d , content: %.*s\n", - msg->fromLen, msg->fromLen, msg->from); ); + DebugFormat(DEBUG_SIP, "From length: %d , content: %.*s\n", + msg->fromLen, msg->fromLen, msg->from); /*Get the from tag*/ msg->fromTagLen = 0; @@ -742,8 +742,8 @@ static int sip_parse_from(SIPMsg* msg, const char* start, const char* end, SIP_P msg->userNameLen = 0; } - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "From tag length: %d , hash: %u, content: %.*s\n", - msg->fromTagLen, msg->dlgID.fromTagHash, msg->fromTagLen, msg->from_tag); ); + DebugFormat(DEBUG_SIP, "From tag length: %d , hash: %u, content: %.*s\n", + msg->fromTagLen, msg->dlgID.fromTagHash, msg->fromTagLen, msg->from_tag); return SIP_PARSE_SUCCESS; } @@ -766,12 +766,12 @@ static int sip_parse_to(SIPMsg* msg, const char* start, const char* end, SIP_PRO { DEBUG_WRAP(int length = end -start; ) char* buff; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "To value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "To value: %.*s\n", length, start); msg->to = (char*)start; msg->toLen = end - start; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "To length: %d , content: %.*s\n", - msg->toLen, msg->toLen, msg->to); ); + DebugFormat(DEBUG_SIP, "To length: %d , content: %.*s\n", + msg->toLen, msg->toLen, msg->to); /*Processing tag information*/ msg->toTagLen = 0; @@ -789,8 +789,8 @@ static int sip_parse_to(SIPMsg* msg, const char* start, const char* end, SIP_PRO buff = (char*)memchr(buff + 1, ';', msg->toLen); } - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "To tag length: %d , Hash: %u, content: %.*s\n", - msg->toTagLen, msg->dlgID.toTagHash, msg->toTagLen, msg->to_tag); ); + DebugFormat(DEBUG_SIP, "To tag length: %d , Hash: %u, content: %.*s\n", + msg->toTagLen, msg->dlgID.toTagHash, msg->toTagLen, msg->to_tag); return SIP_PARSE_SUCCESS; } @@ -812,12 +812,12 @@ static int sip_parse_to(SIPMsg* msg, const char* start, const char* end, SIP_PRO static int sip_parse_call_id(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*) { DEBUG_WRAP(int length = end -start; ) - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Call-Id value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Call-Id value: %.*s\n", length, start); msg->call_id = (char*)start; msg->callIdLen = end - start; msg->dlgID.callIdHash = strToHash(msg->call_id, msg->callIdLen); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Call-Id length: %d, Hash: %u\n", - msg->callIdLen, msg->dlgID.callIdHash); ); + DebugFormat(DEBUG_SIP, "Call-Id length: %d, Hash: %u\n", + msg->callIdLen, msg->dlgID.callIdHash); return SIP_PARSE_SUCCESS; } @@ -838,7 +838,7 @@ static int sip_parse_call_id(SIPMsg* msg, const char* start, const char* end, SI static int sip_parse_user_agent(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*) { DEBUG_WRAP(int length = end -start; ) - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "User-Agent value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "User-Agent value: %.*s\n", length, start); msg->userAgent = (char*)start; msg->userAgentLen = end - start; @@ -862,7 +862,7 @@ static int sip_parse_user_agent(SIPMsg* msg, const char* start, const char* end, static int sip_parse_server(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*) { DEBUG_WRAP(int length = end -start; ) - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Server value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Server value: %.*s\n", length, start); msg->server = (char*)start; msg->serverLen = end - start; @@ -891,7 +891,7 @@ static int sip_parse_cseq(SIPMsg* msg, const char* start, const char* end, SIP_P DEBUG_WRAP(int length = end -start; ) SIPMethodNode* method = NULL; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "CSeq value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "CSeq value: %.*s\n", length, start); msg->cseqnum = SnortStrtoul(start, &next, 10); if ((NULL != next )&&(next < end)) { @@ -899,8 +899,8 @@ static int sip_parse_cseq(SIPMsg* msg, const char* start, const char* end, SIP_P msg->cseqNameLen = end - msg->cseqName; method = SIP_FindMethod (config->methods, msg->cseqName, msg->cseqNameLen); } - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "CSeq number: %d, CSeqName: %.*s\n", - msg->cseqnum, msg->cseqNameLen, msg->cseqName); ); + DebugFormat(DEBUG_SIP, "CSeq number: %d, CSeqName: %.*s\n", + msg->cseqnum, msg->cseqNameLen, msg->cseqName); if (NULL == method) { @@ -916,8 +916,8 @@ static int sip_parse_cseq(SIPMsg* msg, const char* start, const char* end, SIP_P { SnortEventqAdd(GID_SIP, SIP_EVENT_MISMATCH_METHOD); } - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Found the method: %s, Flag: 0x%x\n", - method->methodName, method->methodFlag)); + DebugFormat(DEBUG_SIP, "Found the method: %s, Flag: 0x%x\n", + method->methodName, method->methodFlag); } return SIP_PARSE_SUCCESS; @@ -941,10 +941,10 @@ static int sip_parse_cseq(SIPMsg* msg, const char* start, const char* end, SIP_P static int sip_parse_contact(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*) { int length = end -start; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Contact value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Contact value: %.*s\n", length, start); msg->contact = (char*)start; msg->contactLen = msg->contactLen + length; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Contact length: %d\n", msg->contactLen); ); + DebugFormat(DEBUG_SIP, "Contact length: %d\n", msg->contactLen); return SIP_PARSE_SUCCESS; } @@ -967,7 +967,7 @@ static int sip_parse_authorization( { #ifdef DEBUG_MSGS DEBUG_WRAP(int length = end -start; ) - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Authorization value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Authorization value: %.*s\n", length, start); #else UNUSED(end); #endif @@ -992,7 +992,7 @@ static int sip_parse_authorization( static int sip_parse_content_type(SIPMsg* msg, const char* start, const char* end, SIP_PROTO_CONF*) { DEBUG_WRAP(int length = end -start; ) - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Content type value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Content type value: %.*s\n", length, start); msg->contentTypeLen = end - start; msg->content_type = (char*)start; return SIP_PARSE_SUCCESS; @@ -1027,7 +1027,7 @@ static int sip_parse_content_len(SIPMsg* msg, const char* start, const char*, SnortEventqAdd(GID_SIP, SIP_EVENT_BAD_CONTENT_LEN); return SIP_PARSE_ERROR; } - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Content length: %u\n", msg->content_len); ); + DebugFormat(DEBUG_SIP, "Content length: %u\n", msg->content_len); return SIP_PARSE_SUCCESS; } @@ -1051,7 +1051,7 @@ static int sip_parse_content_encode( { #ifdef DEBUG_MSGS DEBUG_WRAP(int length = end -start; ) - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Content encode value: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Content encode value: %.*s\n", length, start); #else UNUSED(end); #endif @@ -1081,7 +1081,7 @@ static int sip_parse_sdp_o(SIPMsg* msg, const char* start, const char* end) if (NULL == msg->mediaSession) return SIP_PARSE_ERROR; length = end - start; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Origination information: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Origination information: %.*s\n", length, start); // Get username and session ID information (before second space) spaceIndex = (char*)memchr(start, ' ', length); // first space if ((NULL == spaceIndex)||(spaceIndex == end)) @@ -1093,13 +1093,13 @@ static int sip_parse_sdp_o(SIPMsg* msg, const char* start, const char* end) if (NULL == spaceIndex2) return SIP_PARSE_ERROR; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Session information: %.*s\n", spaceIndex - start, start); - ); + DebugFormat(DEBUG_SIP, "Session information: %.*s\n", spaceIndex - start, start); + //sessionId uses all elements from o: line except sessionId version msg->mediaSession->sessionID = strToHash(start, spaceIndex - start); msg->mediaSession->sessionID += strToHash(spaceIndex2+1, end - (spaceIndex2+1)); - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Session ID: %u\n", msg->mediaSession->sessionID); ); + DebugFormat(DEBUG_SIP, "Session ID: %u\n", msg->mediaSession->sessionID); return SIP_PARSE_SUCCESS; } @@ -1127,7 +1127,7 @@ static int sip_parse_sdp_c(SIPMsg* msg, const char* start, const char* end) if (NULL == msg->mediaSession) return SIP_PARSE_ERROR; length = end - start; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Connection data: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Connection data: %.*s\n", length, start); /*Get the IP address*/ spaceIndex = (char*)memchr(start, ' ', length); // first space @@ -1145,7 +1145,7 @@ static int sip_parse_sdp_c(SIPMsg* msg, const char* start, const char* end) } strncpy(ipStr, spaceIndex, length); ipStr[length] = '\0'; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "IP data: %s\n", ipStr); ); + DebugFormat(DEBUG_SIP, "IP data: %s\n", ipStr); // If no default session connect information, add it if (NULL == msg->mediaSession->medias) @@ -1158,10 +1158,10 @@ static int sip_parse_sdp_c(SIPMsg* msg, const char* start, const char* end) } if ( (sfip_pton(ipStr, ip)) != SFIP_SUCCESS) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed error! \n"); ); + DebugMessage(DEBUG_SIP, "Parsed error! \n"); return SIP_PARSE_ERROR; } - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed Connection data: %s\n", sfip_to_str (ip)); ); + DebugFormat(DEBUG_SIP, "Parsed Connection data: %s\n", sfip_to_str (ip)); return SIP_PARSE_SUCCESS; } @@ -1189,7 +1189,7 @@ static int sip_parse_sdp_m(SIPMsg* msg, const char* start, const char* end) if (NULL == msg->mediaSession) return SIP_PARSE_ERROR; length = end - start; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Media information: %.*s\n", length, start); ); + DebugFormat(DEBUG_SIP, "Media information: %.*s\n", length, start); spaceIndex = (char*)memchr(start, ' ', length); // first space if ((NULL == spaceIndex)||(spaceIndex == end)) @@ -1206,8 +1206,8 @@ static int sip_parse_sdp_m(SIPMsg* msg, const char* start, const char* end) mdata->nextM = msg->mediaSession->medias; mdata->maddress = msg->mediaSession->maddress_default; msg->mediaSession->medias = mdata; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Media IP: %s, Media port %u, number of media: %d\n", - sfip_to_str(&mdata->maddress), mdata->mport, mdata->numPort); ); + DebugFormat(DEBUG_SIP, "Media IP: %s, Media port %u, number of media: %d\n", + sfip_to_str(&mdata->maddress), mdata->mport, mdata->numPort); return SIP_PARSE_SUCCESS; } @@ -1238,14 +1238,14 @@ int sip_parse(SIPMsg* msg, const char* buff, char* end, SIP_PROTO_CONF* config) /*Parse the start line*/ start = (char*)buff; nextIndex = NULL; - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Start parsing...\n")); + DebugMessage(DEBUG_SIP, "Start parsing...\n"); msg->header = (uint8_t*)buff; status = sip_startline_parse(msg, start, end, &nextIndex, config); if (false == status ) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Start line parsing failed...\n")); + DebugMessage(DEBUG_SIP, "Start line parsing failed...\n"); return status; } @@ -1256,14 +1256,14 @@ int sip_parse(SIPMsg* msg, const char* buff, char* end, SIP_PROTO_CONF* config) if (false == status ) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Header parsing failed...\n")); + DebugMessage(DEBUG_SIP, "Header parsing failed...\n"); } status = sip_check_headers(msg, config); if (false == status ) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Headers validation failed...\n")); + DebugMessage(DEBUG_SIP, "Headers validation failed...\n"); } /*Parse the body*/ @@ -1280,7 +1280,7 @@ int sip_parse(SIPMsg* msg, const char* buff, char* end, SIP_PROTO_CONF* config) if (false == status ) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Headers validation failed...\n")); + DebugMessage(DEBUG_SIP, "Headers validation failed...\n"); } // Find out whether multiple SIP messages in this packet @@ -1348,8 +1348,8 @@ void sip_freeMediaSession(SIP_MediaSession* mediaSession) while (NULL != curNode) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Clear media ip: %s, port: %d, number of port: %d\n", - sfip_to_str(&curNode->maddress), curNode->mport, curNode->numPort)); + DebugFormat(DEBUG_SIP, "Clear media ip: %s, port: %d, number of port: %d\n", + sfip_to_str(&curNode->maddress), curNode->mport, curNode->numPort); nextNode = curNode->nextM; free(curNode); curNode = nextNode; @@ -1377,8 +1377,8 @@ void sip_freeMediaList(SIP_MediaList medias) while (NULL != curNode) { - DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Clean Media session default IP: %s, session ID: %u\n", - sfip_to_str(&curNode->maddress_default), curNode->sessionID)); + DebugFormat(DEBUG_SIP, "Clean Media session default IP: %s, session ID: %u\n", + sfip_to_str(&curNode->maddress_default), curNode->sessionID); nextNode = curNode->nextS; sip_freeMediaSession(curNode); curNode = nextNode; diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc index eb22691cd..53679a4ae 100644 --- a/src/service_inspectors/smtp/smtp.cc +++ b/src/service_inspectors/smtp/smtp.cc @@ -206,8 +206,8 @@ SMTPData* SetNewSMTPData(SMTP_PROTO_CONF* config, Packet* p) if(stream.is_midstream(p->flow)) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Got midstream packet - " - "setting state to unknown\n"); ); + DebugMessage(DEBUG_SMTP, "Got midstream packet - " + "setting state to unknown\n"); smtp_ssn->state = STATE_UNKNOWN; } @@ -631,16 +631,16 @@ static int SMTP_Setup(Packet* p, SMTPData* ssn) if (ssn->session_flags & SMTP_FLAG_NEXT_STATE_UNKNOWN) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Found gap in previous reassembly buffer - " - "set state to unknown\n"); ); + DebugMessage(DEBUG_SMTP, "Found gap in previous reassembly buffer - " + "set state to unknown\n"); ssn->state = STATE_UNKNOWN; ssn->session_flags &= ~SMTP_FLAG_NEXT_STATE_UNKNOWN; } if (missing_in_rebuilt == SSN_MISSING_BEFORE) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Found missing packets before " - "in reassembly buffer - set state to unknown\n"); ); + DebugMessage(DEBUG_SMTP, "Found missing packets before " + "in reassembly buffer - set state to unknown\n"); ssn->state = STATE_UNKNOWN; } } @@ -806,29 +806,29 @@ static const uint8_t* SMTP_HandleCommand(SMTP_PROTO_CONF* config, Packet* p, SMT * state. Check to see if we're encrypted */ if (smtp_ssn->state == STATE_UNKNOWN) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Command not found, but state is " - "unknown - checking for SSL\n"); ); + DebugMessage(DEBUG_SMTP, "Command not found, but state is " + "unknown - checking for SSL\n"); /* check for encrypted */ if ((smtp_ssn->session_flags & SMTP_FLAG_CHECK_SSL) && (IsSSL(ptr, end - ptr, p->packet_flags))) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Packet is SSL encrypted\n"); ); + DebugMessage(DEBUG_SMTP, "Packet is SSL encrypted\n"); smtp_ssn->state = STATE_TLS_DATA; /* Ignore data */ if (config->ignore_tls_data) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Ignoring encrypted data\n"); ); + DebugMessage(DEBUG_SMTP, "Ignoring encrypted data\n"); } return end; } else { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Not SSL - try data state\n"); ); + DebugMessage(DEBUG_SMTP, "Not SSL - try data state\n"); /* don't check for ssl again in this packet */ if (smtp_ssn->session_flags & SMTP_FLAG_CHECK_SSL) smtp_ssn->session_flags &= ~SMTP_FLAG_CHECK_SSL; @@ -841,7 +841,7 @@ static const uint8_t* SMTP_HandleCommand(SMTP_PROTO_CONF* config, Packet* p, SMT } else { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "No known command found\n"); ); + DebugMessage(DEBUG_SMTP, "No known command found\n"); if (smtp_ssn->state != STATE_AUTH) { @@ -960,15 +960,15 @@ static const uint8_t* SMTP_HandleCommand(SMTP_PROTO_CONF* config, Packet* p, SMT if ((smtp_ssn->state_flags & SMTP_FLAG_GOT_RCPT_CMD) || smtp_ssn->state == STATE_UNKNOWN) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Set to data state.\n"); ); + DebugMessage(DEBUG_SMTP, "Set to data state.\n"); smtp_ssn->state = STATE_DATA; smtp_ssn->state_flags &= ~(SMTP_FLAG_GOT_MAIL_CMD | SMTP_FLAG_GOT_RCPT_CMD); } else { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Didn't get MAIL -> RCPT command sequence - " - "stay in command state.\n"); ); + DebugMessage(DEBUG_SMTP, "Didn't get MAIL -> RCPT command sequence - " + "stay in command state.\n"); } break; @@ -1177,12 +1177,12 @@ static void SMTP_ProcessClientPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat switch (smtp_ssn->state) { case STATE_COMMAND: - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "COMMAND STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_SMTP, "COMMAND STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ptr = SMTP_HandleCommand(config, p, smtp_ssn, ptr, end); break; case STATE_DATA: case STATE_BDATA: - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); position = file_api->get_file_position(p); ptr = file_api->process_mime_data(p->flow, ptr, end, &(smtp_ssn->mime_ssn), 1, position); @@ -1198,13 +1198,13 @@ static void SMTP_ProcessClientPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat ptr = SMTP_HandleCommand(config, p, smtp_ssn, ptr, end); break; case STATE_UNKNOWN: - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "UNKNOWN STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_SMTP, "UNKNOWN STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); /* If state is unknown try command state to see if we can * regain our bearings */ ptr = SMTP_HandleCommand(config, p, smtp_ssn, ptr, end); break; default: - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Bad SMTP state\n"); ); + DebugMessage(DEBUG_SMTP, "Bad SMTP state\n"); return; } } @@ -1212,7 +1212,7 @@ static void SMTP_ProcessClientPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat #ifdef DEBUG_MSGS if (smtp_normalizing) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Normalized data\n%s\n", SMTP_PrintBuffer(p)); ); + DebugFormat(DEBUG_SMTP, "Normalized data\n%s\n", SMTP_PrintBuffer(p)); } #endif } @@ -1313,27 +1313,27 @@ static void SMTP_ProcessServerPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat /* only add response if not a dash after response code */ if ((dash == eolm) || ((dash < eolm) && (*dash != '-'))) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Server sent %s response\n", - smtp_resps[smtp_search_info.id].name); ); + DebugFormat(DEBUG_SMTP, "Server sent %s response\n", + smtp_resps[smtp_search_info.id].name); } #endif } else { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, - "Server response not found - see if it's SSL data\n"); ); + DebugMessage(DEBUG_SMTP, + "Server response not found - see if it's SSL data\n"); if ((smtp_ssn->session_flags & SMTP_FLAG_CHECK_SSL) && (IsSSL(ptr, end - ptr, p->packet_flags))) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Server response is an SSL packet\n"); ); + DebugMessage(DEBUG_SMTP, "Server response is an SSL packet\n"); smtp_ssn->state = STATE_TLS_DATA; /* Ignore data */ if (config->ignore_tls_data) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Ignoring Server TLS encrypted data\n"); ); + DebugMessage(DEBUG_SMTP, "Ignoring Server TLS encrypted data\n"); } return; @@ -1394,7 +1394,7 @@ static void snort_smtp(SMTP_PROTO_CONF* config, Packet* p) { int next_state = 0; - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "SMTP server packet\n"); ); + DebugMessage(DEBUG_SMTP, "SMTP server packet\n"); /* Process as a server packet */ SMTP_ProcessServerPacket(config, p, smtp_ssn, &next_state); @@ -1407,12 +1407,12 @@ static void snort_smtp(SMTP_PROTO_CONF* config, Packet* p) #ifdef DEBUG_MSGS if (pkt_dir == SMTP_PKT_FROM_CLIENT) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "SMTP client packet\n"); ); + DebugMessage(DEBUG_SMTP, "SMTP client packet\n"); } else { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "SMTP packet NOT from client or server! " - "Processing as a client packet\n"); ); + DebugMessage(DEBUG_SMTP, "SMTP packet NOT from client or server! " + "Processing as a client packet\n"); } #endif @@ -1421,8 +1421,8 @@ static void snort_smtp(SMTP_PROTO_CONF* config, Packet* p) { if (IsTlsClientHello(p->data, p->data + p->dsize)) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, - "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_SMTP, + "TLS DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~\n"); smtp_ssn->state = STATE_TLS_SERVER_PEND; } @@ -1448,7 +1448,7 @@ static void snort_smtp(SMTP_PROTO_CONF* config, Packet* p) if ( !InspectPacket(p)) { /* Packet will be rebuilt, so wait for it */ - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Client packet will be reassembled\n")); + DebugMessage(DEBUG_SMTP, "Client packet will be reassembled\n"); return; } else if (!(p->packet_flags & PKT_REBUILT_STREAM)) @@ -1468,8 +1468,8 @@ static void snort_smtp(SMTP_PROTO_CONF* config, Packet* p) * that were not rebuilt, state is going to be messed up * so set state to unknown. It's likely this was the * beginning of the conversation so reset state */ - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Got non-rebuilt packets before " - "this rebuilt packet\n"); ); + DebugMessage(DEBUG_SMTP, "Got non-rebuilt packets before " + "this rebuilt packet\n"); smtp_ssn->state = STATE_UNKNOWN; smtp_ssn->session_flags &= ~SMTP_FLAG_GOT_NON_REBUILT; @@ -1477,10 +1477,10 @@ static void snort_smtp(SMTP_PROTO_CONF* config, Packet* p) #ifdef DEBUG_MSGS /* Interesting to see how often packets are rebuilt */ - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Payload: %s\n%s\n", + DebugFormat(DEBUG_SMTP, "Payload: %s\n%s\n", (p->packet_flags & PKT_REBUILT_STREAM) ? "reassembled" : "not reassembled", - SMTP_PrintBuffer(p)); ); + SMTP_PrintBuffer(p)); #endif SMTP_ProcessClientPacket(config, p, smtp_ssn); diff --git a/src/service_inspectors/smtp/smtp_paf.cc b/src/service_inspectors/smtp/smtp_paf.cc index b992897f5..74fab0c7c 100644 --- a/src/service_inspectors/smtp/smtp_paf.cc +++ b/src/service_inspectors/smtp/smtp_paf.cc @@ -88,7 +88,7 @@ static inline StreamSplitter::Status smtp_paf_server(SmtpPafData* pfdata, if (pch != NULL) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Find end of line!\n"); ); + DebugMessage(DEBUG_SMTP, "Find end of line!\n"); *fp = (uint32_t)(pch - (const char*)data) + 1; return StreamSplitter::FLUSH; } @@ -228,8 +228,8 @@ static inline bool process_command(SmtpPafData* pfdata, uint8_t val) /* Continue finding the data length ...*/ if (get_length(val, &pfdata->length) != SMTP_PAF_LENGTH_CONTINUE) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Find data length: %d\n", - pfdata->length); ); + DebugFormat(DEBUG_SMTP, "Find data length: %d\n", + pfdata->length); pfdata->cmd_info.cmd_state = SMTP_PAF_CMD_DATA_END_STATE; } break; @@ -262,7 +262,7 @@ static inline bool process_data(SmtpPafData* pfdata, uint8_t data) { if (flush_based_length(pfdata)|| file_api->check_data_end(&(pfdata->data_end_state), data)) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "End of data\n"); ); + DebugMessage(DEBUG_SMTP, "End of data\n"); /*Clean up states*/ pfdata->smtp_state = SMTP_PAF_CMD_STATE; pfdata->end_of_data = true; @@ -283,7 +283,7 @@ static inline StreamSplitter::Status smtp_paf_client(SmtpPafData* pfdata, uint32_t i; uint32_t boundary_start = 0; - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "From client: %s \n", data); ); + DebugFormat(DEBUG_SMTP, "From client: %s \n", data); for (i = 0; i < len; i++) { uint8_t ch = data[i]; @@ -292,7 +292,7 @@ static inline StreamSplitter::Status smtp_paf_client(SmtpPafData* pfdata, case SMTP_PAF_CMD_STATE: if (process_command(pfdata, ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Flush command: %s \n", data); ); + DebugFormat(DEBUG_SMTP, "Flush command: %s \n", data); *fp = i + 1; return StreamSplitter::FLUSH; } @@ -300,7 +300,7 @@ static inline StreamSplitter::Status smtp_paf_client(SmtpPafData* pfdata, case SMTP_PAF_DATA_STATE: if (process_data(pfdata, ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "Flush data!\n"); ); + DebugMessage(DEBUG_SMTP, "Flush data!\n"); *fp = i + 1; return StreamSplitter::FLUSH; } @@ -359,12 +359,12 @@ StreamSplitter::Status SmtpSplitter::scan( if (flags & PKT_FROM_SERVER) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "PAF: From server.\n"); ); + DebugMessage(DEBUG_SMTP, "PAF: From server.\n"); return smtp_paf_server(pfdata, data, len, fp); } else { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "PAF: From client.\n"); ); + DebugMessage(DEBUG_SMTP, "PAF: From client.\n"); return smtp_paf_client(pfdata, data, len, fp); } } diff --git a/src/service_inspectors/ssl/ssl_inspector.cc b/src/service_inspectors/ssl/ssl_inspector.cc index c24a4a6b2..a794d2884 100644 --- a/src/service_inspectors/ssl/ssl_inspector.cc +++ b/src/service_inspectors/ssl/ssl_inspector.cc @@ -160,7 +160,7 @@ static inline bool SSLPP_is_encrypted(SSL_PROTO_CONF* config, uint32_t ssl_flags static inline uint32_t SSLPP_process_alert( SSL_PROTO_CONF*, uint32_t ssn_flags, uint32_t new_flags, Packet* packet) { - DEBUG_WRAP(DebugMessage(DEBUG_SSL, "Process Alert\n"); ); + DebugMessage(DEBUG_SSL, "Process Alert\n"); ssn_flags |= new_flags; @@ -171,7 +171,7 @@ static inline uint32_t SSLPP_process_alert( !(new_flags & SSL_CHANGE_CIPHER_FLAG) && !(new_flags & SSL_HEARTBEAT_SEEN)) { - DEBUG_WRAP(DebugMessage(DEBUG_SSL, "Disabling detect\n"); ); + DebugMessage(DEBUG_SSL, "Disabling detect\n"); DisableDetect(packet); } @@ -188,7 +188,7 @@ static inline uint32_t SSLPP_process_alert( static inline uint32_t SSLPP_process_hs(uint32_t ssl_flags, uint32_t new_flags) { - DEBUG_WRAP(DebugMessage(DEBUG_SSL, "Process Handshake\n"); ); + DebugMessage(DEBUG_SSL, "Process Handshake\n"); if (!SSL_BAD_HS(new_flags)) { @@ -208,7 +208,7 @@ static inline uint32_t SSLPP_process_hs(uint32_t ssl_flags, uint32_t new_flags) static inline uint32_t SSLPP_process_app(SSL_PROTO_CONF* config, uint32_t ssn_flags, uint32_t new_flags, Packet* packet) { - DEBUG_WRAP(DebugMessage(DEBUG_SSL, "Process Application\n"); ); + DebugMessage(DEBUG_SSL, "Process Application\n"); if (SSLPP_is_encrypted(config, ssn_flags | new_flags, packet) ) { @@ -217,7 +217,7 @@ static inline uint32_t SSLPP_process_app(SSL_PROTO_CONF* config, uint32_t ssn_fl // Heartbleed check is disabled. Stop inspection on this session. if (!config->max_heartbeat_len) { - DEBUG_WRAP(DebugMessage(DEBUG_SSL, "STOPPING INSPECTION (process_app)\n"); ); + DebugMessage(DEBUG_SSL, "STOPPING INSPECTION (process_app)\n"); stream.stop_inspection(packet->flow, packet, SSN_DIR_BOTH, -1, 0); counts.stopped++; @@ -246,7 +246,7 @@ static inline void SSLPP_process_other(SSL_PROTO_CONF* config, SSLData* sd, uint if (!config->max_heartbeat_len) { - DEBUG_WRAP(DebugMessage(DEBUG_SSL, "STOPPING INSPECTION (process_other)\n"); ); + DebugMessage(DEBUG_SSL, "STOPPING INSPECTION (process_other)\n"); stream.stop_inspection(packet->flow, packet, SSN_DIR_BOTH, -1, 0); } diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc index 8ad2c049f..5c4168a1f 100644 --- a/src/stream/icmp/icmp_session.cc +++ b/src/stream/icmp/icmp_session.cc @@ -189,8 +189,8 @@ static int ProcessIcmpUnreach(Packet* p) if (ssn) { /* Mark this session as dead. */ - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Marking session as dead, per ICMP Unreachable!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Marking session as dead, per ICMP Unreachable!\n"); ssn->ssn_state.session_flags |= SSNFLAG_DROP_CLIENT; ssn->ssn_state.session_flags |= SSNFLAG_DROP_SERVER; ssn->session_state |= STREAM_STATE_UNREACH; diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index 2861d5e2f..132bc2980 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -459,7 +459,7 @@ static inline int FragCheckFirstLast(const Packet* const p, { ft->frag_flags |= FRAG_GOT_FIRST; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Got first frag\n"); ); + DebugMessage(DEBUG_FRAG, "Got first frag\n"); } else if ((!(p->ptrs.decode_flags & DECODE_MF)) && (frag_offset > 0)) /* set for last frag too */ @@ -474,7 +474,7 @@ static inline int FragCheckFirstLast(const Packet* const p, if (ft->frag_flags & FRAG_GOT_LAST) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Got last frag again!\n"); ); + DebugMessage(DEBUG_FRAG, "Got last frag again!\n"); switch (ft->frag_policy) { case FRAG_POLICY_BSD: @@ -539,10 +539,10 @@ static inline int FragCheckFirstLast(const Packet* const p, { ft->calculated_size = endOfThisFrag; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Got last frag, Bytes: %d, " + DebugFormat(DEBUG_FRAG, "Got last frag, Bytes: %d, " "Calculated size: %d\n", ft->frag_bytes, - ft->calculated_size); ); + ft->calculated_size); } } @@ -551,9 +551,9 @@ static inline int FragCheckFirstLast(const Packet* const p, ft->frag_flags |= FRAG_NO_BSD_VULN; } - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Frag Status: %s:%s\n", + DebugFormat(DEBUG_FRAG, "Frag Status: %s:%s\n", ft->frag_flags&FRAG_GOT_FIRST ? "FIRST" : "No FIRST", - ft->frag_flags&FRAG_GOT_LAST ? "LAST" : "No LAST"); ); + ft->frag_flags&FRAG_GOT_LAST ? "LAST" : "No LAST"); return retVal; } @@ -659,9 +659,9 @@ static inline int checkTinyFragments( { if (p->dsize <= engine->min_fragment_length) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Frag: Received fragment size(%d) is not more than configured min_fragment_length (%d)\n", - p->dsize, engine->min_fragment_length); ); + p->dsize, engine->min_fragment_length); EventTinyFragments(engine); return 1; } @@ -669,9 +669,9 @@ static inline int checkTinyFragments( ///detect tiny fragments after processing overlaps. if (trimmedLength <= engine->min_fragment_length) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Frag: # of New octets in Received fragment(%d) is not more than configured min_fragment_length (%d)\n", - trimmedLength, engine->min_fragment_length); ); + trimmedLength, engine->min_fragment_length); EventTinyFragments(engine); return 1; } @@ -693,8 +693,8 @@ int drop_all_fragments( //drop this and all following fragments if (ft && !(ft->frag_flags & FRAG_DROP_FRAGMENTS)) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "Frag: Will drop all fragments on this packet\n"); ); + DebugMessage(DEBUG_FRAG, + "Frag: Will drop all fragments on this packet\n"); ft->frag_flags |= FRAG_DROP_FRAGMENTS; } @@ -712,8 +712,8 @@ int drop_all_fragments( */ static inline int FragIsComplete(FragTracker* ft) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[$] Checking completion criteria\n"); ); + DebugMessage(DEBUG_FRAG, + "[$] Checking completion criteria\n"); /* * check to see if the first and last frags have arrived @@ -721,8 +721,8 @@ static inline int FragIsComplete(FragTracker* ft) if ((ft->frag_flags & FRAG_GOT_FIRST) && (ft->frag_flags & FRAG_GOT_LAST)) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - " Got First and Last frags\n"); ); + DebugMessage(DEBUG_FRAG, + " Got First and Last frags\n"); /* * if we've accumulated enough data to match the calculated size @@ -730,8 +730,8 @@ static inline int FragIsComplete(FragTracker* ft) */ if (ft->frag_bytes == ft->calculated_size) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - " [!] frag_bytes = calculated_size!\n"); ); + DebugMessage(DEBUG_FRAG, + " [!] frag_bytes = calculated_size!\n"); sfBase.iFragCompletes++; @@ -740,17 +740,17 @@ static inline int FragIsComplete(FragTracker* ft) if (ft->frag_bytes > ft->calculated_size) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - " [!] frag_bytes > calculated_size!\n"); ); + DebugMessage(DEBUG_FRAG, + " [!] frag_bytes > calculated_size!\n"); sfBase.iFragCompletes++; return 1; } - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, " Calc size (%d) != frag bytes (%d)\n", - ft->calculated_size, ft->frag_bytes); ); + ft->calculated_size, ft->frag_bytes); /* * no dice @@ -758,9 +758,9 @@ static inline int FragIsComplete(FragTracker* ft) return 0; } - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, " Missing First or Last frags (frag_flags: 0x%X)\n", - ft->frag_flags); ); + ft->frag_flags); return 0; } @@ -814,9 +814,9 @@ static void FragRebuild(FragTracker* ft, Packet* p) /* Adjust the IP header size in pseudo packet for the new length */ uint8_t new_ip_hlen = ip::IP4_HEADER_LEN + ft->ip_options_len; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Adjusting IP Header to %d bytes\n", - new_ip_hlen); ); + new_ip_hlen); iph->set_hlen(new_ip_hlen >> 2); ret = SafeMemcpy(rebuild_ptr, ft->ip_options_data, @@ -843,8 +843,8 @@ static void FragRebuild(FragTracker* ft, Packet* p) iph->ip_off = 0x0000; dpkt->ptrs.decode_flags &= ~DECODE_FRAG; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[^^] Walking fraglist:\n"); ); + DebugMessage(DEBUG_FRAG, + "[^^] Walking fraglist:\n"); } /* @@ -852,7 +852,7 @@ static void FragRebuild(FragTracker* ft, Packet* p) */ for (frag = ft->fraglist; frag; frag = frag->next) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, " frag: %p\n" " frag->data: %p\n" " frag->offset: %d\n" @@ -860,7 +860,7 @@ static void FragRebuild(FragTracker* ft, Packet* p) " frag->prev: %p\n" " frag->next: %p\n", frag, frag->data, frag->offset, - frag->size, frag->prev, frag->next); ); + frag->size, frag->prev, frag->next); /* * We somehow got a frag that had data beyond the calculated @@ -934,8 +934,8 @@ static void FragRebuild(FragTracker* ft, Packet* p) /* * process the packet through the detection engine */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "Processing rebuilt packet:\n"); ); + DebugMessage(DEBUG_FRAG, + "Processing rebuilt packet:\n"); ip_stats.reassembles++; @@ -946,9 +946,8 @@ static void FragRebuild(FragTracker* ft, Packet* p) * Note, that this won't print out the IP Options or any other * data that is established when the packet is decoded. */ - if (DEBUG_FRAG & GetDebugLevel()) + if ( Debug::enabled(DEBUG_FRAG) ) LogIPPkt(dpkt); - #endif encap_frag_cnt++; @@ -958,8 +957,8 @@ static void FragRebuild(FragTracker* ft, Packet* p) SnortEventqPop(); encap_frag_cnt--; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "Done with rebuilt packet, marking rebuilt...\n"); ); + DebugMessage(DEBUG_FRAG, + "Done with rebuilt packet, marking rebuilt...\n"); ft->frag_flags = ft->frag_flags | FRAG_REBUILT; } @@ -1035,8 +1034,8 @@ static void delete_frag(Fragment* frag) */ static inline void delete_node(FragTracker* ft, Fragment* node) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Deleting list node %p (p %p n %p)\n", - node, node->prev, node->next); ); + DebugFormat(DEBUG_FRAG, "Deleting list node %p (p %p n %p)\n", + node, node->prev, node->next); if (node->prev) { @@ -1073,8 +1072,8 @@ static void delete_tracker(FragTracker* ft) Fragment* idx = ft->fraglist; /* pointer to the fraglist to delete */ Fragment* dump_me = NULL; /* ptr to the Fragment element to drop */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "delete_tracker %d nodes to dump\n", ft->fraglist_count); ); + DebugFormat(DEBUG_FRAG, + "delete_tracker %d nodes to dump\n", ft->fraglist_count); /* * delete all the nodes in a fraglist @@ -1202,13 +1201,13 @@ void Defrag::process(Packet* p, FragTracker* ft) #ifdef DEBUG if ( p->is_ip4() ) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "[FRAG] Fragment discarded due to low TTL " "[0x%X->0x%X], TTL: %d " "Offset: %d Length: %d\n", ntohl(p->ptrs.ip_api.get_ip4h()->get_src()), ntohl(p->ptrs.ip_api.get_ip4h()->get_dst()), p->ptrs.ip_api.ttl(), frag_offset, - p->dsize); ); + p->dsize); } #endif @@ -1279,14 +1278,14 @@ void Defrag::process(Packet* p, FragTracker* ft) #ifdef DEBUG if ( p->is_ip4() ) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "[FRAG] Fragment discarded due to large TTL Delta " "[0x%X->0x%X], TTL: %d orig TTL: %d " "Offset: %d Length: %d\n", ntohl(p->ptrs.ip_api.get_ip4h()->get_src()), ntohl(p->ptrs.ip_api.get_ip4h()->get_dst()), p->ptrs.ip_api.ttl(), ft->ttl, frag_offset, - p->dsize); ); + p->dsize); } #endif ip_stats.discards++; @@ -1324,8 +1323,8 @@ void Defrag::process(Packet* p, FragTracker* ft) */ if (FragIsComplete(ft)) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[*] Fragment is complete, rebuilding!\n"); ); + DebugMessage(DEBUG_FRAG, + "[*] Fragment is complete, rebuilding!\n"); /* * if the frag completes but it's bad we're just going to drop it @@ -1464,8 +1463,8 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) /* * bonk/boink/jolt/etc attack... */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[..] Short frag (Bonk, etc) attack!\n"); ); + DebugMessage(DEBUG_FRAG, + "[..] Short frag (Bonk, etc) attack!\n"); EventAnomShortFrag(fe); @@ -1488,8 +1487,8 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) if (ft->frag_flags & FRAG_GOT_LAST) { /* oversize frag attack */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[..] Oversize frag pkt!\n"); ); + DebugMessage(DEBUG_FRAG, + "[..] Oversize frag pkt!\n"); EventAnomOversize(fe); @@ -1505,8 +1504,8 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) /* * zero size frag... */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[..] Zero size frag!\n"); ); + DebugMessage(DEBUG_FRAG, + "[..] Zero size frag!\n"); EventAnomZeroFrag(fe); @@ -1519,8 +1518,8 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) /* * oversize pkt... */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[..] Oversize frag!\n"); ); + DebugMessage(DEBUG_FRAG, + "[..] Oversize frag!\n"); EventAnomBadsizeLg(fe); @@ -1539,9 +1538,9 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) ft->frag_pkts++; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Walking frag list (%d nodes), new frag %d@%d\n", - ft->fraglist_count, fragLength, frag_offset); ); + ft->fraglist_count, fragLength, frag_offset); /* * Need to figure out where in the frag list this frag should go @@ -1552,10 +1551,10 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) i++; right = idx; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "%d right o %d s %d ptr %p prv %p nxt %p\n", i, right->offset, right->size, right, - right->prev, right->next); ); + right->prev, right->next); if (right->offset >= frag_offset) { @@ -1576,9 +1575,9 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) */ if (left) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Dealing with previous (left) frag %d@%d\n", - left->size, left->offset); ); + left->size, left->offset); /* * generate the overlap of the current packet fragment @@ -1603,8 +1602,8 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) /* * teardrop attack... */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[..] Teardrop attack!\n"); ); + DebugMessage(DEBUG_FRAG, + "[..] Teardrop attack!\n"); EventAttackTeardrop(fe); @@ -1634,17 +1633,17 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) frag_offset += (int16_t)overlap; slide = (int16_t)overlap; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "left overlap, new frag moves: %d bytes, " - "slide: %d\n", overlap, slide); ); + "slide: %d\n", overlap, slide); if (frag_end <= frag_offset) { /* * zero size frag */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "zero size frag\n"); ); + DebugMessage(DEBUG_FRAG, + "zero size frag\n"); EventAnomZeroFrag(fe); @@ -1652,8 +1651,8 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) return FRAG_INSERT_ANOMALY; } - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "left overlap, " - "truncating new pkt (slide: %d)\n", slide); ); + DebugFormat(DEBUG_FRAG, "left overlap, " + "truncating new pkt (slide: %d)\n", slide); break; @@ -1708,17 +1707,17 @@ int Defrag::insert(Packet* p, FragTracker* ft, FragEngine* fe) } left_overlap_last: - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "[!!] left overlap, " + DebugFormat(DEBUG_FRAG, "[!!] left overlap, " "truncating old pkt (offset: %d overlap: %d)\n", - left->offset, overlap); ); + left->offset, overlap); if (left->size <= 0) { dump_me = left; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "retrans, " + DebugFormat(DEBUG_FRAG, "retrans, " "dumping old frag (offset: %d overlap: %d)\n", - dump_me->offset, overlap); ); + dump_me->offset, overlap); left = left->prev; @@ -1733,8 +1732,8 @@ left_overlap_last: */ if (frag_end < frag_offset) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "frag_end < frag_offset!"); ); + DebugMessage(DEBUG_FRAG, + "frag_end < frag_offset!"); EventAnomBadsizeSm(fe); @@ -1744,16 +1743,16 @@ left_overlap_last: } else { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "No left overlap!\n"); ); + DebugMessage(DEBUG_FRAG, "No left overlap!\n"); } } if ((uint16_t)fragLength > pkt_snaplen) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Overly large fragment %d 0x%x 0x%x %d\n", fragLength, p->ptrs.ip_api.dgram_len(), p->ptrs.ip_api.off(), - net_frag_offset); ); + net_frag_offset); MODULE_PROFILE_END(fragInsertPerfStats); return FRAG_INSERT_FAILED; } @@ -1766,9 +1765,9 @@ left_overlap_last: */ while (right && (right->offset < frag_end) && !done) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Next (right)fragment %d@%d\n", - right->size, right->offset); ); + right->size, right->offset); trunc = 0; overlap = frag_end - right->offset; @@ -1784,8 +1783,8 @@ left_overlap_last: /* * teardrop attack... */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[..] Teardrop attack!\n"); ); + DebugMessage(DEBUG_FRAG, + "[..] Teardrop attack!\n"); EventAttackTeardrop(fe); @@ -1805,8 +1804,8 @@ left_overlap_last: ip_stats.overlaps++; ft->overlap_count++; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "Right-side overlap %d bytes\n", overlap); ); + DebugFormat(DEBUG_FRAG, + "Right-side overlap %d bytes\n", overlap); /* * once again, engine-based policy processing @@ -1832,18 +1831,18 @@ left_overlap_last: right->size -= (int16_t)overlap; ft->frag_bytes -= (int16_t)overlap; } - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "[!!] right overlap, " + DebugFormat(DEBUG_FRAG, "[!!] right overlap, " "truncating old frag (offset: %d, " "overlap: %d)\n", right->offset, overlap); DebugMessage(DEBUG_FRAG, - "Exiting right overlap loop...\n"); ); + "Exiting right overlap loop...\n"); if (right->size <= 0) { dump_me = right; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "retrans, " + DebugFormat(DEBUG_FRAG, "retrans, " "dumping old frag (offset: %d overlap: %d)\n", - dump_me->offset, overlap); ); + dump_me->offset, overlap); right = right->next; @@ -1859,12 +1858,12 @@ left_overlap_last: case FRAG_POLICY_SOLARIS: case FRAG_POLICY_BSD_RIGHT: trunc = (int16_t)overlap; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "[!!] right overlap, " + DebugFormat(DEBUG_FRAG, "[!!] right overlap, " "truncating new frag (offset: %d " "overlap: %d)\n", right->offset, overlap); DebugMessage(DEBUG_FRAG, - "Exiting right overlap loop...\n"); ); + "Exiting right overlap loop...\n"); break; } @@ -1912,9 +1911,9 @@ left_overlap_last: dump_me = right; ft->frag_bytes -= right->size; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "retrans, " + DebugFormat(DEBUG_FRAG, "retrans, " "dumping old frag (offset: %d overlap: %d)\n", - dump_me->offset, overlap); ); + dump_me->offset, overlap); right = right->next; @@ -1960,18 +1959,18 @@ left_overlap_last: trunc = (int16_t)overlap; } - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "right overlap, " + DebugFormat(DEBUG_FRAG, "right overlap, " "rejecting new overlap data (overlap: %d, " - "trunc: %d)\n", overlap, trunc); ); + "trunc: %d)\n", overlap, trunc); if (frag_end - trunc <= frag_offset) { /* * zero size frag */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "zero size frag (len: %d overlap: %d)\n", - fragLength, overlap); ); + fragLength, overlap); ip_stats.discards++; @@ -2058,9 +2057,9 @@ right_overlap_last: dump_me = right; ft->frag_bytes -= right->size; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "retrans, " + DebugFormat(DEBUG_FRAG, "retrans, " "dumping old frag (offset: %d overlap: %d)\n", - dump_me->offset, overlap); ); + dump_me->offset, overlap); right = right->next; @@ -2078,7 +2077,7 @@ right_overlap_last: (ft->overlap_count >= fe->max_overlaps)) { // overlap limit exceeded. Raise event on all subsequent fragments - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, "Reached overlap limit.\n"); ); + DebugMessage(DEBUG_FRAG, "Reached overlap limit.\n"); EventExcessiveOverlap(fe); @@ -2093,12 +2092,12 @@ right_overlap_last: } else { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "Fully truncated right overlap\n"); ); + DebugMessage(DEBUG_FRAG, + "Fully truncated right overlap\n"); } - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "insert(): returning normally\n"); ); + DebugMessage(DEBUG_FRAG, + "insert(): returning normally\n"); MODULE_PROFILE_END(fragInsertPerfStats); return ret; @@ -2131,10 +2130,10 @@ int Defrag::new_tracker(Packet* p, FragTracker* ft) /* Just to double check */ if (fragLength > pkt_snaplen) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Overly large fragment length:%d(0x%x) off:0x%x(%d)\n", fragLength, p->ptrs.ip_api.dgram_len(), p->ptrs.ip_api.off(), - p->ptrs.ip_api.off()); ); + p->ptrs.ip_api.off()); /* Ah, crap. Return that tracker. */ return 0; @@ -2225,8 +2224,8 @@ int Defrag::new_tracker(Packet* p, FragTracker* ft) /* * bonk/boink/jolt/etc attack... */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, - "[..] Short frag (Bonk, etc) attack!\n"); ); + DebugMessage(DEBUG_FRAG, + "[..] Short frag (Bonk, etc) attack!\n"); EventAnomShortFrag(&engine); @@ -2299,10 +2298,10 @@ int Defrag::add_frag_node(FragTracker* ft, /* * zero size frag */ - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "zero size frag after left & right trimming " "(len: %d slide: %d trunc: %d)\n", - len, slide, trunc); ); + len, slide, trunc); ip_stats.discards++; @@ -2310,13 +2309,13 @@ int Defrag::add_frag_node(FragTracker* ft, newfrag = ft->fraglist; while (newfrag) { - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "Size: %d, offset: %d, len %d, " "Prev: 0x%x, Next: 0x%x, This: 0x%x, Ord: %d, %s\n", newfrag->size, newfrag->offset, newfrag->flen, newfrag->prev, newfrag->next, newfrag, newfrag->ord, - newfrag->last ? "Last" : ""); ); + newfrag->last ? "Last" : ""); newfrag = newfrag->next; } #endif @@ -2362,31 +2361,31 @@ int Defrag::add_frag_node(FragTracker* ft, newfrag->offset = frag_offset; newfrag->last = lastfrag; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "[+] Adding new frag, offset %d, size %d\n" " nf->data = nf->fptr(%p) + slide (%d)\n" " nf->size = len(%d) - slide(%d) - trunc(%d)\n", newfrag->offset, newfrag->size, newfrag->fptr, - slide, fragLength, slide, trunc); ); + slide, fragLength, slide, trunc); /* * insert the new frag into the list */ add_node(ft, left, newfrag); - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "[*] Inserted new frag %d@%d ptr %p data %p prv %p nxt %p\n", newfrag->size, newfrag->offset, newfrag, newfrag->data, - newfrag->prev, newfrag->next); ); + newfrag->prev, newfrag->next); /* * record the current size of the data in the fraglist */ ft->frag_bytes += newfrag->size; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "[#] accumulated bytes on FragTracker %d, count" - " %d\n", ft->frag_bytes, ft->fraglist_count); ); + " %d\n", ft->frag_bytes, ft->fraglist_count); *retFrag = newfrag; return FRAG_INSERT_OK; @@ -2453,19 +2452,19 @@ int Defrag::dup_frag_node( */ add_node(ft, left, newfrag); - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "[*] Inserted new frag %d@%d ptr %p data %p prv %p nxt %p\n", newfrag->size, newfrag->offset, newfrag, newfrag->data, - newfrag->prev, newfrag->next); ); + newfrag->prev, newfrag->next); /* * record the current size of the data in the fraglist */ ft->frag_bytes += newfrag->size; - DEBUG_WRAP(DebugMessage(DEBUG_FRAG, + DebugFormat(DEBUG_FRAG, "[#] accumulated bytes on FragTracker %d, count" - " %d\n", ft->frag_bytes, ft->fraglist_count); ); + " %d\n", ft->frag_bytes, ft->fraglist_count); *retFrag = newfrag; return FRAG_INSERT_OK; diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc index 72a6ffbd3..7d150e088 100644 --- a/src/stream/ip/ip_session.cc +++ b/src/stream/ip/ip_session.cc @@ -74,15 +74,15 @@ static inline void UpdateSession(Packet* p, Flow* lws) { if ( p->packet_flags & PKT_FROM_CLIENT ) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream: Updating on packet from client\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Stream: Updating on packet from client\n"); lws->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT; } else { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream: Updating on packet from server\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Stream: Updating on packet from server\n"); lws->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER; } @@ -90,8 +90,8 @@ static inline void UpdateSession(Packet* p, Flow* lws) if ( (lws->ssn_state.session_flags & SSNFLAG_SEEN_CLIENT) && (lws->ssn_state.session_flags & SSNFLAG_SEEN_SERVER) ) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream: session established!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Stream: session established!\n"); lws->ssn_state.session_flags |= SSNFLAG_ESTABLISHED; @@ -121,8 +121,8 @@ void IpSession::clear() bool IpSession::setup(Packet*) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM, - "Stream IP session created!\n"); ); + DebugMessage(DEBUG_STREAM, + "Stream IP session created!\n"); memset(&tracker, 0, sizeof(tracker)); // FIXIT count ip session creates here diff --git a/src/stream/paf.cc b/src/stream/paf.cc index 3ff2f1d68..ab7241bef 100644 --- a/src/stream/paf.cc +++ b/src/stream/paf.cc @@ -75,9 +75,9 @@ static uint32_t paf_flush ( uint32_t at = 0; *flags &= ~(PKT_PDU_HEAD | PKT_PDU_TAIL); - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, + DebugFormat(DEBUG_STREAM_PAF, "%s: type=%d, fpt=%u, len=%u, tot=%u\n", - __FUNCTION__, ft, ps->fpt, s5_len, ps->tot); ) + __FUNCTION__, ft, ps->fpt, s5_len, ps->tot); switch ( ft ) { @@ -171,9 +171,9 @@ static inline bool paf_eval ( StreamSplitter* ss, PAF_State* ps, Flow* ssn, uint32_t flags, const uint8_t* data, uint32_t len, FlushType* ft) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, + DebugFormat(DEBUG_STREAM_PAF, "%s: paf=%d, idx=%u, len=%u, fpt=%u\n", - __FUNCTION__, ps->paf, s5_idx, s5_len, ps->fpt); ) + __FUNCTION__, ps->paf, s5_idx, s5_len, ps->fpt); uint16_t fuzz = 0; // FIXIT-L PAF add a little zippedy-do-dah @@ -272,9 +272,9 @@ int32_t paf_check ( const uint8_t* data, uint32_t len, uint32_t total, uint32_t seq, uint32_t* flags) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_PAF, + DebugFormat(DEBUG_STREAM_PAF, "%s: len=%u, amt=%u, seq=%u, cur=%u, pos=%u, fpt=%u, tot=%u, paf=%d\n", - __FUNCTION__, len, total, seq, ps->seq, ps->pos, ps->fpt, ps->tot, ps->paf); ) + __FUNCTION__, len, total, seq, ps->seq, ps->pos, ps->fpt, ps->tot, ps->paf); if ( !paf_initialized(ps) ) { diff --git a/src/stream/stream.h b/src/stream/stream.h index bc9c0660e..2c190a156 100644 --- a/src/stream/stream.h +++ b/src/stream/stream.h @@ -27,8 +27,6 @@ #include "stream/stream_api.h" #include "network_inspectors/normalize/norm.h" -//#define DEBUG_STREAM DEBUG - #define STREAM_DEFAULT_SSN_TIMEOUT 30 /* seconds to timeout a session */ #define STREAM_MAX_SSN_TIMEOUT 3600*24 /* max timeout (approx 1 day) */ #define STREAM_MIN_SSN_TIMEOUT 1 /* min timeout (1 second) */ diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc index 768767d86..3e6783d8a 100644 --- a/src/stream/stream_api.cc +++ b/src/stream/stream_api.cc @@ -646,9 +646,9 @@ bool Stream::blocked_session(Flow* flow, Packet* p) ((p->packet_flags & PKT_FROM_CLIENT) && (flow->ssn_state.session_flags & SSNFLAG_DROP_CLIENT)) ) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Blocking %s packet as session was blocked\n", - p->packet_flags & PKT_FROM_SERVER ? "server" : "client"); ); + p->packet_flags & PKT_FROM_SERVER ? "server" : "client"); DisableDetect(p); Active::drop_packet(p); @@ -667,9 +667,9 @@ bool Stream::ignored_session(Flow* flow, Packet* p) ((p->packet_flags & PKT_FROM_CLIENT) && (flow->ssn_state.ignore_direction & SSN_DIR_FROM_SERVER)) ) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Stream Ignoring packet from %d. Session marked as ignore\n", - p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder"); ); + p->packet_flags & PKT_FROM_CLIENT ? "sender" : "responder"); DisableInspection(p); return true; @@ -703,7 +703,7 @@ bool Stream::expired_session(Flow* flow, Packet* p) if ( (flow->session_state & STREAM_STATE_TIMEDOUT) || StreamExpire(p, flow) ) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM, "Stream IP session timeout!\n"); ); + DebugMessage(DEBUG_STREAM, "Stream IP session timeout!\n"); flow->ssn_state.session_flags |= SSNFLAG_TIMEDOUT; return true; } diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index 340c6a801..56c05b9fe 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -287,13 +287,6 @@ THREAD_LOCAL Memcap* tcp_memcap = nullptr; #define SLAM_MAX 4 -//#define DEBUG_STREAM_EX -#ifdef DEBUG_STREAM_EX -#define STREAM_DEBUG_WRAP(x) DEBUG_WRAP(x) -#else -#define STREAM_DEBUG_WRAP(x) -#endif - #define SL_BUF_FLUSHED 1 struct TcpDataBlock @@ -395,7 +388,7 @@ static const char* const reassembly_policy_names[] = "proxy" }; -#ifdef DEBUG_STREAM_EX +#ifdef DEBUG_MSGS static const char* const state_names[] = { "none", @@ -797,32 +790,7 @@ static void PrintTcpDataBlock(TcpDataBlock* tdb) LogMessage(" win: %d\n", tdb->win); LogMessage(" end: 0x%08X\n", tdb->end_seq); } - -static void PrintFlushMgr(FlushMgr* fm) -{ - if (fm == NULL) - return; - - switch (fm->flush_policy) - { - case STREAM_FLPOLICY_IGNORE: - STREAM_DEBUG_WRAP(DebugMessage( - DEBUG_STREAM_STATE, " IGNORE\n"); ); - break; - - case STREAM_FLPOLICY_ON_ACK: - STREAM_DEBUG_WRAP(DebugMessage( - DEBUG_STREAM_STATE, " PROTOCOL\n"); ); - break; - - case STREAM_FLPOLICY_ON_DATA: - STREAM_DEBUG_WRAP(DebugMessage( - DEBUG_STREAM_STATE, " PROTOCOL_IPS\n"); ); - break; - } -} - -#endif // DEBUG_STREAM_EX +#endif static inline void Discard() { @@ -944,8 +912,8 @@ static inline void EventInternal(uint32_t eventSid) tcpStats.internalEvents++; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream raised internal event %d\n", eventSid); ); + DebugFormat(DEBUG_STREAM_STATE, + "Stream raised internal event %d\n", eventSid); SnortEventqAdd(GENERATOR_INTERNAL, eventSid); } @@ -1199,8 +1167,8 @@ static inline void SwapPacketHeaderFoo(TcpSession* tcpssn) static inline int IsBetween(uint32_t low, uint32_t high, uint32_t cur) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "(%X, %X, %X) = (low, high, cur)\n", low,high,cur); ); + DebugFormat(DEBUG_STREAM_STATE, + "(%X, %X, %X) = (low, high, cur)\n", low,high,cur); /* If we haven't seen anything, ie, low & high are 0, return true */ if ((low == 0) && (low == high)) @@ -1247,23 +1215,23 @@ static inline int ValidRstSynSent(TcpTracker *st, TcpDataBlock *tdb) static inline int ValidRst( Flow* lwssn, TcpTracker *st, TcpDataBlock *tdb) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Checking end_seq (%X) > r_win_base (%X) && " "seq (%X) < r_nxt_ack(%X)\n", tdb->end_seq, st->r_win_base, tdb->seq, - st->r_nxt_ack+StreamGetWindow(lwssn, st, tdb)); ); + st->r_nxt_ack+StreamGetWindow(lwssn, st, tdb)); switch (st->os_policy) { case STREAM_POLICY_HPUX11: if (SEQ_GEQ(tdb->seq, st->r_nxt_ack)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "rst is valid seq (>= next seq)!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "rst is valid seq (>= next seq)!\n"); return 1; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "rst is not valid seq (>= next seq)!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "rst is not valid seq (>= next seq)!\n"); return 0; break; case STREAM_POLICY_FIRST: @@ -1276,12 +1244,12 @@ static inline int ValidRst( case STREAM_POLICY_IRIX: if (SEQ_EQ(tdb->seq, st->r_nxt_ack)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "rst is valid seq (next seq)!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "rst is valid seq (next seq)!\n"); return 1; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "rst is not valid seq (next seq)!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "rst is not valid seq (next seq)!\n"); return 0; break; case STREAM_POLICY_BSD: @@ -1293,20 +1261,20 @@ static inline int ValidRst( // reset must be admitted when window closed if ( SEQ_LEQ(tdb->seq, st->r_win_base+StreamGetWindow(lwssn, st, tdb)) ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "rst is valid seq (within window)!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "rst is valid seq (within window)!\n"); return 1; } } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "rst is not valid seq (within window)!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "rst is not valid seq (within window)!\n"); return 0; break; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "rst is not valid!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "rst is not valid!\n"); return 0; } @@ -1333,8 +1301,8 @@ static inline int ValidTimestamp( if ((talker->flags & TF_TSTAMP) && (listener->flags & TF_TSTAMP)) { char validate_timestamp = 1; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Checking timestamps for PAWS\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Checking timestamps for PAWS\n"); *got_ts = StreamGetTcpTimestamp(p, &tdb->ts, 0); @@ -1396,8 +1364,8 @@ static inline int ValidTimestamp( if (result < 0) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Packet outside PAWS window, dropping\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Packet outside PAWS window, dropping\n"); /* bail, we've got a packet outside the PAWS window! */ //Discard(); *eventcode |= EVENT_BAD_TIMESTAMP; @@ -1408,10 +1376,10 @@ static inline int ValidTimestamp( ((uint32_t)p->pkth->ts.tv_sec > talker->ts_last_pkt+PAWS_24DAYS)) { /* this packet is from way too far into the future */ - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "packet PAWS timestamp way too far ahead of" "last packet %d %d...\n", p->pkth->ts.tv_sec, - talker->ts_last_pkt); ); + talker->ts_last_pkt); //Discard(); *eventcode |= EVENT_BAD_TIMESTAMP; NormalDropPacketIf(p, NORM_TCP_OPT); @@ -1419,8 +1387,8 @@ static inline int ValidTimestamp( } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "packet PAWS ok...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "packet PAWS ok...\n"); } } } @@ -1432,8 +1400,8 @@ static inline int ValidTimestamp( * but continue to process the packet */ *eventcode |= EVENT_NO_TIMESTAMP; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "packet no timestamp, had one earlier from this side...ok for now...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "packet no timestamp, had one earlier from this side...ok for now...\n"); if (listener->config->policy == STREAM_POLICY_SOLARIS) { @@ -1458,8 +1426,8 @@ static inline int ValidTimestamp( // (nop) the timestamp option. this includes the cases where // we disable timestamp handling. int strip = ( SetupOK(talker) && SetupOK(listener) ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "listener not doing timestamps...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "listener not doing timestamps...\n"); *got_ts = StreamGetTcpTimestamp(p, &tdb->ts, strip); if (*got_ts) @@ -1491,8 +1459,8 @@ static inline int ValidTimestamp( /* Old Linux & Windows allows a 0 timestamp value. */ break; default: - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Packet with 0 timestamp, dropping\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Packet with 0 timestamp, dropping\n"); //Discard(); /* bail */ *eventcode |= EVENT_BAD_TIMESTAMP; @@ -1552,11 +1520,11 @@ static inline int ValidSeq( int right_ok; uint32_t left_seq; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Checking end_seq (%X) > r_win_base (%X) && " "seq (%X) < r_nxt_ack(%X)\n", tdb->end_seq, st->r_win_base, tdb->seq, - st->r_nxt_ack+StreamGetWindow(lwssn, st, tdb)); ); + st->r_nxt_ack+StreamGetWindow(lwssn, st, tdb)); if ( SEQ_LT(st->r_nxt_ack, st->r_win_base) ) left_seq = st->r_nxt_ack; @@ -1574,20 +1542,20 @@ static inline int ValidSeq( if ( SEQ_LEQ(tdb->seq, st->r_win_base+win) ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seq is within window!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "seq is within window!\n"); return 1; } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seq is past the end of the window!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "seq is past the end of the window!\n"); } } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "end_seq is before win_base\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "end_seq is before win_base\n"); } return 0; } @@ -1687,8 +1655,8 @@ static void DeleteSeglist(TcpSegment *listhead) TcpSegment *dump_me; int i = 0; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "In DeleteSeglist\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "In DeleteSeglist\n"); while (idx) { i++; @@ -1697,8 +1665,8 @@ static void DeleteSeglist(TcpSegment *listhead) TcpSegment::term(dump_me); } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Dropped %d segments\n", i); ); + DebugFormat(DEBUG_STREAM_STATE, + "Dropped %d segments\n", i); } static inline int purge_alerts( @@ -1745,8 +1713,8 @@ static inline int purge_to_seq(TcpSession *tcpssn, TcpTracker *st, uint32_t flus { if ( SEQ_LT(st->seglist_base_seq, flush_seq) ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "setting st->seglist_base_seq to 0x%X\n", flush_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "setting st->seglist_base_seq to 0x%X\n", flush_seq); st->seglist_base_seq = flush_seq; } return 0; @@ -1754,13 +1722,13 @@ static inline int purge_to_seq(TcpSession *tcpssn, TcpTracker *st, uint32_t flus ss = st->seglist; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "In purge_to_seq, start seq = 0x%X end seq = 0x%X delta %d\n", - ss->seq, flush_seq, flush_seq-ss->seq); ); + ss->seq, flush_seq, flush_seq-ss->seq); while (ss) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "s: %X sz: %d\n", ss->seq, ss->size); ); + DebugFormat(DEBUG_STREAM_STATE, + "s: %X sz: %d\n", ss->seq, ss->size); dump_me = ss; ss = ss->next; @@ -1778,8 +1746,8 @@ static inline int purge_to_seq(TcpSession *tcpssn, TcpTracker *st, uint32_t flus if ( SEQ_LT(st->seglist_base_seq, flush_seq) ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "setting st->seglist_base_seq to 0x%X\n", flush_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "setting st->seglist_base_seq to 0x%X\n", flush_seq); st->seglist_base_seq = flush_seq; } if ( SEQ_LT(st->r_nxt_ack, flush_seq) ) @@ -1909,7 +1877,7 @@ static int FlushStream( const uint8_t *flushbuf_end) { uint16_t bytes_flushed = 0; - STREAM_DEBUG_WRAP(uint32_t bytes_queued = st->seg_bytes_logical; ); + DEBUG_WRAP(uint32_t bytes_queued = st->seg_bytes_logical; ); uint32_t segs = 0; uint32_t flags = PKT_PDU_HEAD; PROFILE_VARS; @@ -1927,8 +1895,8 @@ static int FlushStream( unsigned bytes_copied = 0; assert(bytes_to_copy); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Flushing %u bytes from %X\n", bytes_to_copy, ss->seq)); + DebugFormat(DEBUG_STREAM_STATE, + "Flushing %u bytes from %X\n", bytes_to_copy, ss->seq); if ( !ss->next || (bytes_to_copy < ss->size) || @@ -1997,11 +1965,11 @@ static int FlushStream( break; } - STREAM_DEBUG_WRAP(bytes_queued -= bytes_flushed; ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DEBUG_WRAP(bytes_queued -= bytes_flushed; ); + DebugFormat(DEBUG_STREAM_STATE, "flushed %d bytes / %d segs on stream, " "%d still queued\n", - bytes_flushed, segs, bytes_queued); ); + bytes_flushed, segs, bytes_queued); MODULE_PROFILE_END(s5TcpBuildPacketPerfStats); return bytes_flushed; @@ -2091,23 +2059,21 @@ static inline int _flush_to_seq( if (footprint == 0) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Negative footprint, bailing %d (0x%X - 0x%X)\n", - footprint, stop_seq, st->seglist_base_seq); ); + footprint, stop_seq, st->seglist_base_seq); MODULE_PROFILE_END(s5TcpFlushPerfStats); return bytes_processed; } -#ifdef DEBUG_STREAM_EX if (footprint < st->seg_bytes_logical) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Footprint less than queued bytes, " "win_base: 0x%X base_seq: 0x%X\n", - stop_seq, st->seglist_base_seq); ); + stop_seq, st->seglist_base_seq); } -#endif if (footprint > s5_pkt->max_dsize) { @@ -2116,8 +2082,8 @@ static inline int _flush_to_seq( stop_seq = st->seglist_base_seq + footprint; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Attempting to flush %lu bytes\n", footprint); ); + DebugFormat(DEBUG_STREAM_STATE, + "Attempting to flush %lu bytes\n", footprint); ((DAQ_PktHdr_t*)s5_pkt->pkth)->ts.tv_sec = st->seglist_next->tv.tv_sec; ((DAQ_PktHdr_t*)s5_pkt->pkth)->ts.tv_usec = st->seglist_next->tv.tv_usec; @@ -2165,8 +2131,8 @@ static inline int _flush_to_seq( st->seglist_base_seq += flushed_bytes; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "setting st->seglist_base_seq to 0x%X\n", st->seglist_base_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "setting st->seglist_base_seq to 0x%X\n", st->seglist_base_seq); if ( st->splitter ) st->splitter->update(); @@ -2199,27 +2165,24 @@ static inline int _flush_to_seq( static inline int flush_to_seq( TcpSession *tcpssn, TcpTracker *st, uint32_t bytes, Packet *p, uint32_t pkt_flags) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "In flush_to_seq()\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "In flush_to_seq()\n"); if ( !bytes ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "bailing, no data\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "bailing, no data\n"); return 0; } if ( !st->seglist_next ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "bailing, bad seglist ptr\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "bailing, bad seglist ptr\n"); return 0; } if (!DataToFlush(st) && !(st->flags & TF_FORCE_FLUSH)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "only 1 packet in seglist no need to flush\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "only 1 packet in seglist no need to flush\n"); return 0; } @@ -2329,12 +2292,12 @@ static inline int flush_stream( static void TcpSessionClear (Flow* lwssn, TcpSession* tcpssn, int freeApplicationData) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "In TcpSessionClear, %lu bytes in use\n", tcp_memcap->used()); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "client has %d segs queued\n", tcpssn->client.seg_count); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "server has %d segs queued\n", tcpssn->server.seg_count); ); + DebugFormat(DEBUG_STREAM_STATE, + "In TcpSessionClear, %lu bytes in use\n", tcp_memcap->used()); + DebugFormat(DEBUG_STREAM_STATE, + "client has %d segs queued\n", tcpssn->client.seg_count); + DebugFormat(DEBUG_STREAM_STATE, + "server has %d segs queued\n", tcpssn->server.seg_count); // update stats if ( tcpssn->tcp_init ) @@ -2379,8 +2342,8 @@ static void TcpSessionClear (Flow* lwssn, TcpSession* tcpssn, int freeApplicatio // generate event for rate filtering EventInternal(INTERNAL_EVENT_SESSION_DEL); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "After cleaning, %lu bytes in use\n", tcp_memcap->used()); ); + DebugFormat(DEBUG_STREAM_STATE, + "After cleaning, %lu bytes in use\n", tcp_memcap->used()); tcpssn->lws_init = tcpssn->tcp_init = false; } @@ -2659,8 +2622,7 @@ static inline void S5TraceTCP( static uint32_t StreamGetTcpTimestamp(Packet* p, uint32_t* ts, int strip) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Getting timestamp...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "Getting timestamp...\n"); const NormMode mode = Normalize_GetMode(NORM_TCP_OPT); TcpOptIterator iter(p->ptrs.tcph, p); @@ -2677,25 +2639,21 @@ static uint32_t StreamGetTcpTimestamp(Packet* p, uint32_t* ts, int strip) else if ( !strip || !NormalStripTimeStamp(p, &opt, mode) ) { *ts = EXTRACT_32BITS(opt.data); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Found timestamp %lu\n", *ts); ); - + DebugFormat(DEBUG_STREAM_STATE, "Found timestamp %lu\n", *ts); return TF_TSTAMP; } } } *ts = 0; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "No timestamp...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "No timestamp...\n"); return TF_NONE; } static uint32_t StreamGetMss(Packet* p, uint16_t* value) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Getting MSS...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "Getting MSS...\n"); TcpOptIterator iter(p->ptrs.tcph, p); for (const TcpOption& opt : iter) @@ -2703,23 +2661,20 @@ static uint32_t StreamGetMss(Packet* p, uint16_t* value) if (opt.code == TcpOptCode::MAXSEG) { *value = EXTRACT_16BITS(opt.data); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Found MSS %u\n", *value); ); + DebugFormat(DEBUG_STREAM_STATE, "Found MSS %u\n", *value); return TF_MSS; } } *value = 0; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "No MSS...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "No MSS...\n"); return TF_NONE; } static uint32_t StreamGetWscale(Packet* p, uint16_t* value) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Getting wscale...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "Getting wscale...\n"); TcpOptIterator iter(p->ptrs.tcph, p); @@ -2729,8 +2684,7 @@ static uint32_t StreamGetWscale(Packet* p, uint16_t* value) if (opt.code == TcpOptCode::WSCALE) { *value = (uint16_t)opt.data[0]; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Found wscale %d\n", *value); ); + DebugFormat(DEBUG_STREAM_STATE, "Found wscale %d\n", *value); /* If scale specified in option is larger than 14, * use 14 because of limitation in the math of @@ -2748,8 +2702,7 @@ static uint32_t StreamGetWscale(Packet* p, uint16_t* value) } *value = 0; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "No wscale...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "No wscale...\n"); return TF_NONE; } @@ -2757,8 +2710,7 @@ static uint32_t StreamPacketHasWscale(Packet* p) { uint16_t wscale; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Checking for wscale...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "Checking for wscale...\n"); return StreamGetWscale(p, &wscale); } @@ -2793,8 +2745,8 @@ static void FinishServerInit(Packet* p, TcpDataBlock* tdb, TcpSession* ssn) if ( p->ptrs.tcph->th_flags & TH_FIN ) server->l_nxt_seq--; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seglist_base_seq = %X\n", client->seglist_base_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "seglist_base_seq = %X\n", client->seglist_base_seq); if (!(ssn->flow->session_state & STREAM_STATE_MIDSTREAM)) { @@ -2822,9 +2774,9 @@ static void FinishServerInit(Packet* p, TcpDataBlock* tdb, TcpSession* ssn) static inline int SegmentFastTrack(TcpSegment *tail, TcpDataBlock *tdb) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Checking seq for fast track: %X > %X\n", tdb->seq, - tail->seq + tail->size); ); + tail->seq + tail->size); if (SEQ_EQ(tdb->seq, tail->seq + tail->size)) return 1; @@ -2850,10 +2802,10 @@ static int AddStreamNode( * zero size data because of trimming. Don't * insert it */ - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "zero size TCP data after left & right trimming " "(len: %d slide: %d trunc: %d)\n", - len, slide, trunc); ); + len, slide, trunc); Discard(); NormalTrimPayloadIfWin(p, 0, tdb); @@ -2861,14 +2813,14 @@ static int AddStreamNode( { TcpSegment *idx = st->seglist; unsigned long i = 0; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Dumping seglist, %d segments\n", st->seg_count); ); + DebugFormat(DEBUG_STREAM_STATE, + "Dumping seglist, %d segments\n", st->seg_count); while (idx) { i++; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "%d ptr: %p seq: 0x%X size: %d nxt: %p prv: %p\n", - i, idx, idx->seq, idx->size, idx->next, idx->prev); ); + i, idx, idx->seq, idx->size, idx->next, idx->prev); if (st->seg_count < i) FatalError("Circular list\n"); @@ -2937,10 +2889,10 @@ static int AddStreamNode( p->packet_flags |= PKT_STREAM_INSERT; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "added %d bytes on segment list @ seq: 0x%X, total %lu, " "%d segments queued\n", ss->size, ss->seq, - st->seg_bytes_logical, SegsToFlush(st, 0)); ); + st->seg_bytes_logical, SegsToFlush(st, 0)); #ifdef SEG_TEST CheckSegments(st); @@ -2966,10 +2918,10 @@ static int DupStreamNode( StreamSeglistAddNode(st, left, ss); //st->total_bytes_queued += ss->size; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "added %d bytes on segment list @ seq: 0x%X, total %lu, " "%d segments queued\n", ss->size, ss->seq, - st->seg_bytes_logical, SegsToFlush(st, 0)); ); + st->seg_bytes_logical, SegsToFlush(st, 0)); *retSeg = ss; return STREAM_INSERT_OK; @@ -3005,7 +2957,7 @@ static void NewQueue( PROFILE_VARS; MODULE_PROFILE_START(s5TcpInsertPerfStats); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, "In NewQueue\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "In NewQueue\n"); uint32_t overlap = 0; uint32_t seq = tdb->seq; @@ -3016,14 +2968,14 @@ static void NewQueue( /* new packet seq is below the last ack... */ if ( SEQ_GT(st->r_win_base, seq) ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "segment overlaps ack'd data...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "segment overlaps ack'd data...\n"); overlap = st->r_win_base - tdb->seq; if (overlap >= p->dsize) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "full overlap on ack'd data, dropping segment\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "full overlap on ack'd data, dropping segment\n"); MODULE_PROFILE_END(s5TcpInsertPerfStats); return; } @@ -3032,10 +2984,10 @@ static void NewQueue( // BLOCK add new block to seglist containing data AddStreamNode(st, p, tdb, p->dsize, overlap, 0, tdb->seq+overlap, NULL); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Attached new queue to seglist, %d bytes queued, " "base_seq 0x%X\n", - p->dsize-overlap, st->seglist_base_seq); ); + p->dsize-overlap, st->seglist_base_seq); MODULE_PROFILE_END(s5TcpInsertPerfStats); } @@ -3063,7 +3015,7 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, uint16_t rsize = p->dsize; uint32_t rseq = tdb->seq; PROFILE_VARS; - STREAM_DEBUG_WRAP( + DEBUG_WRAP( TcpSegment *lastptr = NULL; uint32_t base_seq = st->seglist_base_seq; int last = 0; @@ -3076,17 +3028,17 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, else reassembly_policy = st->reassembly_policy; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Queuing %d bytes on stream!\n" "base_seq: %X seq: %X seq_end: %X\n", - seq_end - seq, base_seq, seq, seq_end); ); + seq_end - seq, base_seq, seq, seq_end); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "%d segments on seglist\n", SegsToFlush(st, 0)); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); ); + DebugFormat(DEBUG_STREAM_STATE, + "%d segments on seglist\n", SegsToFlush(st, 0)); + DebugMessage(DEBUG_STREAM_STATE, + "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); + DebugMessage(DEBUG_STREAM_STATE, + "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); MODULE_PROFILE_START(s5TcpInsertPerfStats); @@ -3097,9 +3049,9 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, left = st->seglist_tail; right = NULL; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Fast tracking segment! (tail_seq %X size %d)\n", - st->seglist_tail->seq, st->seglist_tail->size); ); + st->seglist_tail->seq, st->seglist_tail->size); // BLOCK add to existing block and/or allocate new block ret = AddStreamNode(st, p, tdb, len, @@ -3141,17 +3093,18 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, /* Start iterating at the head (left) */ for (ss = st->seglist; ss; ss = ss->next) { - STREAM_DEBUG_WRAP( - DebugMessage(DEBUG_STREAM_STATE, - "ss: %p seq: 0x%X size: %lu delta: %d\n", - ss, ss->seq, ss->size, (ss->seq-base_seq) - last); + DEBUG_WRAP( + DebugFormat(DEBUG_STREAM_STATE, + "ss: %p seq: 0x%X size: %lu delta: %d\n", + ss, ss->seq, ss->size, (ss->seq-base_seq) - last); + last = ss->seq-base_seq; lastptr = ss; - DebugMessage(DEBUG_STREAM_STATE, - " lastptr: %p ss->next: %p ss->prev: %p\n", - lastptr, ss->next, ss->prev); - ); + DebugFormat(DEBUG_STREAM_STATE, + " lastptr: %p ss->next: %p ss->prev: %p\n", + lastptr, ss->next, ss->prev); + ); right = ss; @@ -3171,17 +3124,18 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, /* Start iterating at the tail (right) */ for (ss = st->seglist_tail; ss; ss = ss->prev) { - STREAM_DEBUG_WRAP( - DebugMessage(DEBUG_STREAM_STATE, - "ss: %p seq: 0x%X size: %lu delta: %d\n", - ss, ss->seq, ss->size, (ss->seq-base_seq) - last); + DEBUG_WRAP( + DebugFormat(DEBUG_STREAM_STATE, + "ss: %p seq: 0x%X size: %lu delta: %d\n", + ss, ss->seq, ss->size, (ss->seq-base_seq) - last); + last = ss->seq-base_seq; lastptr = ss; - DebugMessage(DEBUG_STREAM_STATE, - " lastptr: %p ss->next: %p ss->prev: %p\n", - lastptr, ss->next, ss->prev); - ); + DebugFormat(DEBUG_STREAM_STATE, + " lastptr: %p ss->next: %p ss->prev: %p\n", + lastptr, ss->next, ss->prev); + ); left = ss; @@ -3195,14 +3149,14 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, left = NULL; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); + DebugMessage(DEBUG_STREAM_STATE, + "!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+!+\n"); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "left: %p:0x%X right: %p:0x%X\n", left, - left ? left->seq : 0, right, right ? right->seq : 0); ); + left ? left->seq : 0, right, right ? right->seq : 0); /* * handle left overlaps */ @@ -3214,8 +3168,8 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, /* check if the new segment overlaps on the left side */ overlap = left->seq + left->size - seq; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "left overlap %d\n", overlap); ); + DebugFormat(DEBUG_STREAM_STATE, + "left overlap %d\n", overlap); if (overlap > 0) { @@ -3236,8 +3190,7 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, case REASSEMBLY_POLICY_IRIX: case REASSEMBLY_POLICY_OLD_LINUX: case REASSEMBLY_POLICY_MACOS: - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "left overlap, honoring old data\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "left overlap, honoring old data\n"); if (SEQ_LT(left->seq,tdb->seq) && SEQ_GT(left->seq + left->size, tdb->seq + p->dsize)) { @@ -3284,8 +3237,7 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, /* New packet is entirely overlapped by an * existing packet on both sides. Drop the * new data. */ - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "left overlap, honoring old data\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "left overlap, honoring old data\n"); seq += overlap; //slide = overlap; if (SEQ_LEQ(seq_end, seq)) @@ -3304,8 +3256,7 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, /* Otherwise, trim the old data accordingly */ left->size -= (int16_t)overlap; st->seg_bytes_logical -= overlap; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "left overlap, honoring new data\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "left overlap, honoring new data\n"); break; case REASSEMBLY_POLICY_LAST: /* True "Last" policy" */ @@ -3342,15 +3293,13 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, st->seg_bytes_logical -= overlap; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "left overlap, honoring new data\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "left overlap, honoring new data\n"); break; } if (SEQ_LEQ(seq_end, seq)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seq_end < seq"); ); + DebugMessage(DEBUG_STREAM_STATE, "seq_end < seq"); /* * houston, we have a problem */ @@ -3363,8 +3312,7 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "No left overlap\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "No left overlap\n"); } } @@ -3376,9 +3324,9 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, //overlap = right->size - (right->seq - seq); //right->seq + right->size - seq_end; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "right overlap(%d): len: %d right->seq: 0x%X seq: 0x%X\n", - overlap, len, right->seq, seq); ); + overlap, len, right->seq, seq); /* Treat sequence number overlap as a retransmission * Only check right side since left side happens rarely */ @@ -3397,8 +3345,8 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, tcpStats.overlaps++; st->overlap_count++; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got partial right overlap\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Got partial right overlap\n"); switch (reassembly_policy) { @@ -3476,8 +3424,7 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, continue; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got full right overlap\n"); ); + DebugMessage(DEBUG_STREAM_STATE, "Got full right overlap\n"); tcpStats.overlaps++; st->overlap_count++; @@ -3496,9 +3443,9 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, { dump_me = right; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "retrans, dropping old data at seq %d, size %d\n", - right->seq, right->size); ); + right->seq, right->size); right = right->next; StreamSeglistDeleteNode(st, dump_me); break; @@ -3531,8 +3478,8 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, /* Fall through */ case REASSEMBLY_POLICY_FIRST: case REASSEMBLY_POLICY_VISTA: - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got full right overlap, truncating new\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Got full right overlap, truncating new\n"); if ( ips_data == NORM_MODE_ON ) { unsigned offset = right->seq - tdb->seq; @@ -3553,11 +3500,11 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, /* Adjusted seq is fully overlapped */ if (SEQ_EQ(seq, seq_end)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "StreamQueue got full right overlap with " "resulting seq too high, bad segment " "(seq: %X seq_end: %X overlap: %lu\n", - seq, seq_end, overlap); ); + seq, seq_end, overlap); EventBadSegment(); Discard(); MODULE_PROFILE_END(s5TcpInsertPerfStats); @@ -3611,11 +3558,11 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, trunc += overlap; if (SEQ_LEQ((int)(seq_end - trunc), seq)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "StreamQueue got full right overlap with " "resulting seq too high, bad segment " "(seq: %X seq_end: %X overlap: %lu\n", - seq, seq_end, overlap); ); + seq, seq_end, overlap); EventBadSegment(); Discard(); MODULE_PROFILE_END(s5TcpInsertPerfStats); @@ -3627,8 +3574,8 @@ static int StreamQueue(TcpTracker *st, Packet *p, TcpDataBlock *tdb, case REASSEMBLY_POLICY_OLD_LINUX: case REASSEMBLY_POLICY_LAST: right_overlap_last: - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got full right overlap of old, dropping old\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Got full right overlap of old, dropping old\n"); dump_me = right; right = right->next; StreamSeglistDeleteNode(st, dump_me); @@ -3646,12 +3593,12 @@ right_overlap_last: } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Fully truncated right overlap\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Fully truncated right overlap\n"); } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "StreamQueue returning normally\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "StreamQueue returning normally\n"); MODULE_PROFILE_END(s5TcpInsertPerfStats); return ret; @@ -3662,8 +3609,8 @@ static void ProcessTcpStream( Packet *p, TcpDataBlock *tdb, StreamTcpConfig* config) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "In ProcessTcpStream(), %d bytes to queue\n", p->dsize); ); + DebugFormat(DEBUG_STREAM_STATE, + "In ProcessTcpStream(), %d bytes to queue\n", p->dsize); if ( p->packet_flags & PKT_IGNORE ) return; @@ -3674,8 +3621,8 @@ static void ProcessTcpStream( if (rcv->flush_policy == STREAM_FLPOLICY_IGNORE) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Ignoring segment due to IGNORE flush_policy\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Ignoring segment due to IGNORE flush_policy\n"); return; } @@ -3716,8 +3663,8 @@ static void ProcessTcpStream( return; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "queuing segment\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "queuing segment\n"); if ( !rcv->seg_count ) { @@ -3769,8 +3716,8 @@ static int ProcessTcpData( else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Bailing, data on SYN, not MAC Policy!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Bailing, data on SYN, not MAC Policy!\n"); NormalTrimPayloadIfSyn(p, 0, tdb); MODULE_PROFILE_END(s5TcpDataPerfStats); return STREAM_UNALIGNED; @@ -3784,8 +3731,8 @@ static int ProcessTcpData( if ( listener->config->policy != STREAM_POLICY_PROXY and StreamGetWindow(tcpssn->flow, listener, tdb) == 0 ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Bailing, we're out of the window!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Bailing, we're out of the window!\n"); NormalTrimPayloadIfWin(p, 0, tdb); MODULE_PROFILE_END(s5TcpDataPerfStats); return STREAM_UNALIGNED; @@ -3820,9 +3767,9 @@ static int ProcessTcpData( * See HP, Solaris, et al. for those that favor * duplicate data over the original in some cases. */ - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "out of order segment (tdb->seq: 0x%X " - "l->r_nxt_ack: 0x%X!\n", tdb->seq, listener->r_nxt_ack); ); + "l->r_nxt_ack: 0x%X!\n", tdb->seq, listener->r_nxt_ack); if (listener->s_mgr.state_queue == TCP_STATE_NONE) { @@ -3830,8 +3777,8 @@ static int ProcessTcpData( if ( listener->config->policy != STREAM_POLICY_PROXY and StreamGetWindow(tcpssn->flow, listener, tdb) == 0 ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Bailing, we're out of the window!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Bailing, we're out of the window!\n"); NormalTrimPayloadIfWin(p, 0, tdb); MODULE_PROFILE_END(s5TcpDataPerfStats); return STREAM_UNALIGNED; @@ -3994,8 +3941,8 @@ static void NewTcpSession( } { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "adding TcpSession to lightweight session\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "adding TcpSession to lightweight session\n"); lwssn->protocol = p->type(); tmp->flow = lwssn; @@ -4072,8 +4019,8 @@ static void NewTcpSessionOnSyn( * start new sessions on proper SYN packets *****************************************************************/ tmp = (TcpSession*)lwssn->session; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Creating new session tracker on SYN!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Creating new session tracker on SYN!\n"); lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT; @@ -4098,8 +4045,8 @@ static void NewTcpSessionOnSyn( tmp->server.r_nxt_ack = tmp->client.l_unackd; tmp->server.r_win_base = tdb->seq+1; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); tmp->server.s_mgr.state = TCP_STATE_LISTEN; tmp->client.flags |= StreamGetTcpTimestamp(p, &tmp->client.ts_last, 0); @@ -4128,8 +4075,8 @@ static void NewTcpSessionOnSynAck( TcpSession* tmp; { tmp = (TcpSession*)lwssn->session; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Creating new session tracker on SYN_ACK!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Creating new session tracker on SYN_ACK!\n"); lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER; @@ -4156,8 +4103,8 @@ static void NewTcpSessionOnSynAck( tmp->client.l_nxt_seq = tdb->ack; tmp->client.isn = tdb->ack-1; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seglist_base_seq = %X\n", tmp->client.seglist_base_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "seglist_base_seq = %X\n", tmp->client.seglist_base_seq); tmp->client.s_mgr.state = TCP_STATE_SYN_SENT; tmp->server.flags |= StreamGetTcpTimestamp(p, &tmp->server.ts_last, 0); @@ -4189,8 +4136,8 @@ static void NewTcpSessionOn3Way( * start new sessions on completion of 3-way (ACK only, no data) *****************************************************************/ tmp = (TcpSession*)lwssn->session; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Creating new session tracker on ACK!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Creating new session tracker on ACK!\n"); lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT; @@ -4212,8 +4159,8 @@ static void NewTcpSessionOn3Way( tmp->server.r_nxt_ack = tmp->client.l_unackd; tmp->server.r_win_base = tdb->seq+1; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); tmp->server.s_mgr.state = TCP_STATE_ESTABLISHED; tmp->client.flags |= StreamGetTcpTimestamp(p, &tmp->client.ts_last, 0); @@ -4242,13 +4189,13 @@ static void NewTcpSessionOnData( TcpSession* tmp; { tmp = (TcpSession*)lwssn->session; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Creating new session tracker on data packet (ACK|PSH)!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Creating new session tracker on data packet (ACK|PSH)!\n"); if (lwssn->ssn_state.direction == FROM_CLIENT) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Session direction is FROM_CLIENT\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Session direction is FROM_CLIENT\n"); /* Sender is client (src port is higher) */ lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT; @@ -4276,8 +4223,8 @@ static void NewTcpSessionOnData( //tmp->server.l_nxt_seq = tdb->ack + 1; tmp->server.l_unackd = tdb->ack - 1; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "seglist_base_seq = %X\n", tmp->server.seglist_base_seq); tmp->server.s_mgr.state = TCP_STATE_ESTABLISHED; tmp->client.flags |= StreamGetTcpTimestamp(p, &tmp->client.ts_last, 0); @@ -4294,8 +4241,8 @@ static void NewTcpSessionOnData( } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Session direction is FROM_SERVER\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Session direction is FROM_SERVER\n"); /* Sender is server (src port is lower) */ lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER; @@ -4318,8 +4265,8 @@ static void NewTcpSessionOnData( tmp->client.l_window = 0; /* reset later */ tmp->client.isn = tdb->ack-1; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seglist_base_seq = %X\n", tmp->client.seglist_base_seq); ); + DebugFormat(DEBUG_STREAM_STATE, + "seglist_base_seq = %X\n", tmp->client.seglist_base_seq); tmp->client.s_mgr.state = TCP_STATE_ESTABLISHED; tmp->server.flags |= StreamGetTcpTimestamp(p, &tmp->server.ts_last, 0); @@ -4355,27 +4302,27 @@ static int RepeatedSyn( */ if (SEQ_EQ(tdb->seq, listener->r_nxt_ack)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, "Got syn on established windows ssn, which causes Reset," - "bailing\n"); ); + "bailing\n"); tcpssn->flow->ssn_state.session_flags |= SSNFLAG_RESET; talker->s_mgr.state = TCP_STATE_CLOSED; return ACTION_RST; } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, "Got syn on established windows ssn, not causing Reset," - "bailing\n"); ); + "bailing\n"); Discard(); return ACTION_NOTHING; } break; case STREAM_POLICY_MACOS: /* MACOS ignores a 2nd SYN, regardless of the sequence number. */ - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, "Got syn on established macos ssn, not causing Reset," - "bailing\n"); ); + "bailing\n"); Discard(); return ACTION_NOTHING; break; @@ -4391,17 +4338,17 @@ static int RepeatedSyn( /* If its not a retransmission of the actual SYN... RESET */ if (!SEQ_EQ(tdb->seq,talker->isn)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got syn on established ssn, which causes Reset, bailing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Got syn on established ssn, which causes Reset, bailing\n"); tcpssn->flow->ssn_state.session_flags |= SSNFLAG_RESET; talker->s_mgr.state = TCP_STATE_CLOSED; return ACTION_RST; } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, "Got syn on established ssn, not causing Reset," - "bailing\n"); ); + "bailing\n"); Discard(); return ACTION_NOTHING; } @@ -4476,13 +4423,13 @@ static int ProcessTcp( TcpSession *tcpssn = NULL; TcpTracker *talker = NULL; TcpTracker *listener = NULL; - STREAM_DEBUG_WRAP(char *t = NULL; char *l = NULL;) + DEBUG_WRAP(const char *t = NULL; const char *l = NULL;) PROFILE_VARS; if (lwssn->protocol != PktType::TCP) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Lightweight session not TCP on TCP packet\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Lightweight session not TCP on TCP packet\n"); return retcode; } @@ -4509,9 +4456,9 @@ static int ProcessTcp( if ( p->ptrs.tcph->is_syn_only() ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, "Stream SYN PACKET, establishing lightweight" - "session direction.\n"); ); + "session direction.\n"); /* SYN packet from client */ lwssn->ssn_state.direction = FROM_CLIENT; lwssn->session_state |= STREAM_STATE_SYN; @@ -4537,9 +4484,9 @@ static int ProcessTcp( if ((lwssn->session_state == STREAM_STATE_NONE) || (lwssn->ssn_state.session_flags & SSNFLAG_RESET)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, "Stream SYN|ACK PACKET, establishing lightweight" - "session direction.\n"); ); + "session direction.\n"); lwssn->ssn_state.direction = FROM_SERVER; } lwssn->session_state |= STREAM_STATE_SYN_ACK; @@ -4622,8 +4569,8 @@ static int ProcessTcp( if (p->packet_flags & PKT_FROM_SERVER) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream: Updating on packet from server\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Stream: Updating on packet from server\n"); lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_SERVER; if (tcpssn->tcp_init) @@ -4632,7 +4579,7 @@ static int ProcessTcp( listener = &tcpssn->client; } - STREAM_DEBUG_WRAP( + DEBUG_WRAP( t = "Server"; l = "Client"); @@ -4665,8 +4612,8 @@ static int ProcessTcp( } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream: Updating on packet from client\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Stream: Updating on packet from client\n"); /* if we got here we had to see the SYN already... */ lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_CLIENT; if (tcpssn->tcp_init) @@ -4675,7 +4622,7 @@ static int ProcessTcp( listener = &tcpssn->server; } - STREAM_DEBUG_WRAP( + DEBUG_WRAP( t = "Client"; l = "Server"; ); @@ -4768,8 +4715,8 @@ static int ProcessTcp( lwssn->ssn_state.session_flags = SSNFLAG_SEEN_SERVER; } } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got SYN pkt on reset ssn, re-SYN-ing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Got SYN pkt on reset ssn, re-SYN-ing\n"); } // FIXIT-L why flush here instead of just purge? @@ -4801,8 +4748,8 @@ static int ProcessTcp( if ( Normalize_GetMode(NORM_TCP_TRIM_SYN) == NORM_MODE_OFF ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got data on SYN packet, not processing it\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Got data on SYN packet, not processing it\n"); //EventDataOnSyn(config); eventcode |= EVENT_DATA_ON_SYN; retcode |= ACTION_BAD_PKT; @@ -4817,13 +4764,13 @@ static int ProcessTcp( return retcode; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, " %s [talker] state: %s\n", t, - state_names[talker->s_mgr.state]); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + state_names[talker->s_mgr.state]); + DebugFormat(DEBUG_STREAM_STATE, " %s state: %s(%d)\n", l, state_names[listener->s_mgr.state], - listener->s_mgr.state); ); + listener->s_mgr.state); // may find better placement to eliminate redundant flag checks if (p->ptrs.tcph->th_flags & TH_SYN) @@ -4844,8 +4791,8 @@ static int ProcessTcp( */ if (!IsBetween(listener->l_unackd, listener->l_nxt_seq, tdb->ack)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Pkt ack is out of bounds, bailing!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Pkt ack is out of bounds, bailing!\n"); Discard(); NormalTrimPayloadIfWin(p, 0, tdb); LogTcpEvents(eventcode); @@ -4863,8 +4810,8 @@ static int ProcessTcp( */ if (p->ptrs.tcph->th_flags & TH_RST) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "got RST\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "got RST\n"); NormalTrimPayloadIfRst(p, 0, tdb); @@ -4873,8 +4820,8 @@ static int ProcessTcp( */ if (ValidRstSynSent(listener, tdb)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "got RST, closing talker\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "got RST, closing talker\n"); /* Reset is valid */ /* Mark session as reset... Leave it around so that any * additional data sent from one side or the other isn't @@ -4889,8 +4836,8 @@ static int ProcessTcp( return retcode | ACTION_RST; } /* Reset not valid. */ - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "bad sequence number, bailing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "bad sequence number, bailing\n"); Discard(); eventcode |= EVENT_BAD_RST; NormalDropPacketIf(p, NORM_TCP_BLOCK); @@ -4910,13 +4857,13 @@ static int ProcessTcp( talker->ts_last_pkt = p->pkth->ts.tv_sec; talker->ts_last = tdb->ts; } - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Finish server init got called!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Finish server init got called!\n"); } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Finish server init didn't get called!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Finish server init didn't get called!\n"); } if ((p->ptrs.tcph->th_flags & TH_ECE) && @@ -4929,8 +4876,8 @@ static int ProcessTcp( * explicitly set the state */ listener->s_mgr.state = TCP_STATE_SYN_SENT; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Accepted SYN ACK\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Accepted SYN ACK\n"); LogTcpEvents(eventcode); MODULE_PROFILE_END(s5TcpStatePerfStats); return retcode; @@ -4968,8 +4915,8 @@ static int ProcessTcp( if (ValidRst(lwssn, listener, tdb)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got RST, bailing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Got RST, bailing\n"); if ( listener->s_mgr.state == TCP_STATE_FIN_WAIT_1 || @@ -4998,8 +4945,8 @@ static int ProcessTcp( return retcode | ACTION_RST; } /* Reset not valid. */ - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "bad sequence number, bailing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "bad sequence number, bailing\n"); Discard(); eventcode |= EVENT_BAD_RST; NormalDropPacketIf(p, NORM_TCP_BLOCK); @@ -5014,8 +4961,8 @@ static int ProcessTcp( (listener->s_mgr.state >= TCP_STATE_ESTABLISHED) and !ValidSeq(p, lwssn, listener, tdb) ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "bad sequence number, bailing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "bad sequence number, bailing\n"); Discard(); NormalTrimPayloadIfWin(p, 0, tdb); LogTcpEvents(eventcode); @@ -5026,8 +4973,8 @@ static int ProcessTcp( if (ts_action != ACTION_NOTHING) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "bad timestamp, bailing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "bad timestamp, bailing\n"); Discard(); // this packet was normalized elsewhere LogTcpEvents(eventcode); @@ -5038,24 +4985,24 @@ static int ProcessTcp( /* * update PAWS timestamps */ - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "PAWS update tdb->seq %lu > listener->r_win_base %lu\n", - tdb->seq, listener->r_win_base); ); + tdb->seq, listener->r_win_base); if (got_ts && SEQ_EQ(listener->r_win_base, tdb->seq)) { if ((int32_t)(tdb->ts - talker->ts_last) >= 0 || (uint32_t)p->pkth->ts.tv_sec >= talker->ts_last_pkt+PAWS_24DAYS) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "updating timestamps...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "updating timestamps...\n"); talker->ts_last = tdb->ts; talker->ts_last_pkt = p->pkth->ts.tv_sec; } } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "not updating timestamps...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "not updating timestamps...\n"); } /* @@ -5090,8 +5037,8 @@ static int ProcessTcp( { if (listener->config->max_window && (tdb->win > listener->config->max_window)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got window that was beyond the allowed policy value, bailing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Got window that was beyond the allowed policy value, bailing\n"); /* got a window too large, alert! */ eventcode |= EVENT_WINDOW_TOO_LARGE; Discard(); @@ -5105,8 +5052,8 @@ static int ProcessTcp( && !(p->ptrs.tcph->th_flags & (TH_FIN|TH_RST)) && !(lwssn->ssn_state.session_flags & SSNFLAG_MIDSTREAM)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Window slammed shut!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Window slammed shut!\n"); /* got a window slam alert! */ eventcode |= EVENT_WINDOW_SLAM; Discard(); @@ -5122,14 +5069,14 @@ static int ProcessTcp( if (talker->s_mgr.state_queue != TCP_STATE_NONE) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Found queued state transition on ack 0x%X, " "current 0x%X!\n", talker->s_mgr.transition_seq, - tdb->ack); ); + tdb->ack); if (tdb->ack == talker->s_mgr.transition_seq) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "accepting transition!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "accepting transition!\n"); talker->s_mgr.state = talker->s_mgr.state_queue; talker->s_mgr.state_queue = TCP_STATE_NONE; } @@ -5140,19 +5087,19 @@ static int ProcessTcp( */ if ( p->ptrs.tcph->th_flags & TH_ACK ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got an ACK...\n"); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, + "Got an ACK...\n"); + DebugFormat(DEBUG_STREAM_STATE, " %s [listener] state: %s\n", l, - state_names[listener->s_mgr.state]); ); + state_names[listener->s_mgr.state]); switch (listener->s_mgr.state) { case TCP_STATE_SYN_SENT: break; case TCP_STATE_SYN_RCVD: - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "listener state is SYN_SENT...\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "listener state is SYN_SENT...\n"); if ( IsBetween(listener->l_unackd, listener->l_nxt_seq, tdb->ack) ) { UpdateSsn(p, listener, talker, tdb); @@ -5182,9 +5129,9 @@ static int ProcessTcp( case TCP_STATE_FIN_WAIT_1: UpdateSsn(p, listener, talker, tdb); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "tdb->ack %X >= talker->r_nxt_ack %X\n", - tdb->ack, talker->r_nxt_ack); ); + tdb->ack, talker->r_nxt_ack); if ( SEQ_EQ(tdb->ack, listener->l_nxt_seq) ) { @@ -5205,8 +5152,8 @@ static int ProcessTcp( if ( (p->ptrs.tcph->th_flags & TH_FIN) ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "seq ok, setting state!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "seq ok, setting state!\n"); if (talker->s_mgr.state_queue == TCP_STATE_NONE) { @@ -5231,8 +5178,8 @@ static int ProcessTcp( } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "bad ack!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "bad ack!\n"); } break; @@ -5278,10 +5225,10 @@ static int ProcessTcp( */ if (p->dsize) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, " %s state: %s(%d) getting data\n", l, state_names[listener->s_mgr.state], - listener->s_mgr.state); ); + listener->s_mgr.state); // FIN means only that sender is done talking, // other side may continue yapping. @@ -5317,10 +5264,10 @@ static int ProcessTcp( } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Queuing data on listener, t %s, l %s...\n", flush_policy_names[talker->flush_policy], - flush_policy_names[listener->flush_policy]); ); + flush_policy_names[listener->flush_policy]); if ( config->policy != STREAM_POLICY_PROXY ) { @@ -5366,20 +5313,20 @@ static int ProcessTcp( if (p->ptrs.tcph->th_flags & TH_FIN) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Got a FIN...\n"); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, + "Got a FIN...\n"); + DebugFormat(DEBUG_STREAM_STATE, " %s state: %s(%d)\n", l, state_names[talker->s_mgr.state], - talker->s_mgr.state); ); + talker->s_mgr.state); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "checking ack (0x%X) vs nxt_ack (0x%X)\n", - tdb->end_seq, listener->r_win_base); ); + tdb->end_seq, listener->r_win_base); if (SEQ_LT(tdb->end_seq,listener->r_win_base)) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "FIN inside r_win_base, bailing\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "FIN inside r_win_base, bailing\n"); goto dupfin; } else @@ -5447,8 +5394,8 @@ static int ProcessTcp( if ( (listener->s_mgr.expected_flags == TH_ACK) && SEQ_GEQ(end_seq, listener->s_mgr.transition_seq) ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "FIN beyond previous, ignoring\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "FIN beyond previous, ignoring\n"); eventcode |= EVENT_BAD_FIN; LogTcpEvents(eventcode); NormalDropPacketIf(p, NORM_TCP_BLOCK); @@ -5481,13 +5428,13 @@ static int ProcessTcp( dupfin: - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, " %s [talker] state: %s\n", t, - state_names[talker->s_mgr.state]); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + state_names[talker->s_mgr.state]); + DebugFormat(DEBUG_STREAM_STATE, " %s state: %s(%d)\n", l, state_names[listener->s_mgr.state], - listener->s_mgr.state); ); + listener->s_mgr.state); /* * handle TIME_WAIT timer stuff @@ -5623,20 +5570,20 @@ static inline int CheckFlushPolicyOnData( { uint32_t flushed = 0; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "In CheckFlushPolicyOnData\n"); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, + "In CheckFlushPolicyOnData\n"); + DebugFormat(DEBUG_STREAM_STATE, "Talker flush policy: %s\n", - flush_policy_names[talker->flush_policy]); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + flush_policy_names[talker->flush_policy]); + DebugFormat(DEBUG_STREAM_STATE, "Listener flush policy: %s\n", - flush_policy_names[listener->flush_policy]); ); + flush_policy_names[listener->flush_policy]); switch (listener->flush_policy) { case STREAM_FLPOLICY_IGNORE: - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "STREAM_FLPOLICY_IGNORE\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "STREAM_FLPOLICY_IGNORE\n"); return 0; case STREAM_FLPOLICY_ON_ACK: @@ -5777,20 +5724,20 @@ int CheckFlushPolicyOnAck( { uint32_t flushed = 0; - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "In CheckFlushPolicyOnAck\n"); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, + "In CheckFlushPolicyOnAck\n"); + DebugFormat(DEBUG_STREAM_STATE, "Talker flush policy: %s\n", - flush_policy_names[talker->flush_policy]); ); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + flush_policy_names[talker->flush_policy]); + DebugFormat(DEBUG_STREAM_STATE, "Listener flush policy: %s\n", - flush_policy_names[listener->flush_policy]); ); + flush_policy_names[listener->flush_policy]); switch (talker->flush_policy) { case STREAM_FLPOLICY_IGNORE: - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "STREAM_FLPOLICY_IGNORE\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "STREAM_FLPOLICY_IGNORE\n"); return 0; case STREAM_FLPOLICY_ON_ACK: @@ -5872,9 +5819,9 @@ static int StreamSeglistDeleteNode (TcpTracker* st, TcpSegment* seg) int ret; assert(st && seg); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Dropping segment at seq %X, len %d\n", - seg->seq, seg->size); ); + seg->seq, seg->size); if (seg->prev) seg->prev->next = seg->next; @@ -5918,9 +5865,9 @@ static int StreamSeglistDeleteNodeTrim( if ( delta < seg->size ) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Left-Trimming segment at seq %X, len %d, delta %u\n", - seg->seq, seg->size, delta); ); + seg->seq, seg->size, delta); seg->seq = flush_seq; seg->size -= (uint16_t)delta; @@ -6120,16 +6067,14 @@ void TcpSession::flush_listener(Packet* p) * looked at it, so the packet_flags are already set. */ if(p->packet_flags & PKT_FROM_SERVER) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Flushing listener on packet from server\n");); + DebugMessage(DEBUG_STREAM_STATE, "Flushing listener on packet from server\n"); listener = &client; /* dir of flush is the data from the opposite side */ dir = PKT_FROM_SERVER; } else if (p->packet_flags & PKT_FROM_CLIENT) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Flushing listener on packet from client\n");); + DebugMessage(DEBUG_STREAM_STATE, "Flushing listener on packet from client\n"); listener = &server; /* dir of flush is the data from the opposite side */ dir = PKT_FROM_CLIENT; @@ -6157,16 +6102,14 @@ void TcpSession::flush_talker(Packet* p) * looked at it, so the packet_flags are already set. */ if(p->packet_flags & PKT_FROM_SERVER) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Flushing talker on packet from server\n");); + DebugMessage(DEBUG_STREAM_STATE, "Flushing talker on packet from server\n"); talker = &server; /* dir of flush is the data from the opposite side */ dir = PKT_FROM_CLIENT; } else if (p->packet_flags & PKT_FROM_CLIENT) { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Flushing talker on packet from client\n");); + DebugMessage(DEBUG_STREAM_STATE, "Flushing talker on packet from client\n"); talker = &client; /* dir of flush is the data from the opposite side */ dir = PKT_FROM_SERVER; @@ -6424,13 +6367,14 @@ int TcpSession::process(Packet* p) int status; PROFILE_VARS; - STREAM_DEBUG_WRAP( + DEBUG_WRAP( char flagbuf[9]; CreateTCPFlagString(p->ptrs.tcph, flagbuf); - DebugMessage((DEBUG_STREAM|DEBUG_STREAM_STATE), - "Got TCP Packet 0x%X:%d -> 0x%X:%d %s\nseq: 0x%X ack:0x%X dsize: %u\n", - p->ptrs.ip_api.get_src(), p->ptrs.sp, p->ptrs.ip_api.get_dst(), p->ptrs.dp, flagbuf, - ntohl(p->ptrs.tcph->th_seq), ntohl(p->ptrs.tcph->th_ack), p->dsize); ); + DebugFormat((DEBUG_STREAM|DEBUG_STREAM_STATE), + "Got TCP Packet 0x%X:%d -> 0x%X:%d %s\nseq: 0x%X ack:0x%X dsize: %u\n", + p->ptrs.ip_api.get_src(), p->ptrs.sp, p->ptrs.ip_api.get_dst(), p->ptrs.dp, flagbuf, + ntohl(p->ptrs.tcph->th_seq), ntohl(p->ptrs.tcph->th_ack), p->dsize); + ); MODULE_PROFILE_START(s5TcpPerfStats); @@ -6465,8 +6409,8 @@ int TcpSession::process(Packet* p) // Do nothing with this packet since we require a 3-way ;) DEBUG_WRAP( DebugMessage(DEBUG_STREAM_STATE, "Stream: Requiring 3-way " - "Handshake, but failed to retrieve session object " - "for non SYN packet.\n"); ); + "Handshake, but failed to retrieve session object " + "for non SYN packet.\n"); ); if ( !p->ptrs.tcph->is_rst() && !(event_mask & EVENT_NO_3WHS) ) { @@ -6514,8 +6458,8 @@ midstream_pickup_allowed: } else { - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream TCP session timedout!\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Stream TCP session timedout!\n"); /* Not reset, simply time'd out. Clean it up */ TcpSessionCleanup(flow, 1); @@ -6524,9 +6468,9 @@ midstream_pickup_allowed: } status = ProcessTcp(flow, p, &tdb, config); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugMessage(DEBUG_STREAM_STATE, "Finished Stream TCP cleanly!\n" - "---------------------------------------------------\n"); ); + "---------------------------------------------------\n"); if ( !(status & ACTION_LWSSN_CLOSED) ) { @@ -6537,9 +6481,9 @@ midstream_pickup_allowed: { DisableInspection(p); - STREAM_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, + DebugFormat(DEBUG_STREAM_STATE, "Stream Ignoring packet from %d. Session marked as ignore\n", - p->packet_flags & PKT_FROM_SERVER ? "server" : "client"); ); + p->packet_flags & PKT_FROM_SERVER ? "server" : "client"); } MODULE_PROFILE_END(s5TcpPerfStats); diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc index 64ba6fa7a..63714135b 100644 --- a/src/stream/udp/udp_session.cc +++ b/src/stream/udp/udp_session.cc @@ -102,15 +102,15 @@ static int ProcessUdp( /* if both seen, mark established */ if (p->packet_flags & PKT_FROM_SERVER) { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream: Updating on packet from responder\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Stream: Updating on packet from responder\n"); lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_RESPONDER; lwssn->set_ttl(p, false); } else { - DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE, - "Stream: Updating on packet from client\n"); ); + DebugMessage(DEBUG_STREAM_STATE, + "Stream: Updating on packet from client\n"); lwssn->ssn_state.session_flags |= SSNFLAG_SEEN_SENDER; lwssn->set_ttl(p, true); } diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc index 40f5ce97e..201bf0a54 100644 --- a/src/target_based/sftarget_reader.cc +++ b/src/target_based/sftarget_reader.cc @@ -105,8 +105,7 @@ uint32_t SFAT_NumberOfHosts(void) void FreeApplicationEntry(ApplicationEntry* app) { - DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Freeing ApplicationEntry: 0x%x\n", - app); ); + DebugFormat(DEBUG_ATTRIBUTE, "Freeing ApplicationEntry: 0x%x\n", app); free(app); } @@ -127,8 +126,7 @@ void FreeHostEntry(HostAttributeEntry* host) if (!host) return; - DEBUG_WRAP(DebugMessage(DEBUG_ATTRIBUTE, "Freeing HostEntry: 0x%x\n", - host); ); + DebugFormat(DEBUG_ATTRIBUTE, "Freeing HostEntry: 0x%x\n", host); /* Free the service list */ if (host->services) @@ -203,11 +201,11 @@ void PrintHostAttributeEntry(HostAttributeEntry* host) if (!host) return; - DebugMessage(DEBUG_ATTRIBUTE, "Host IP: %s/%d\n", + DebugFormat(DEBUG_ATTRIBUTE, "Host IP: %s/%d\n", inet_ntoa(&host->ipAddr), host->ipAddr.bits); - DebugMessage(DEBUG_ATTRIBUTE, + DebugFormat(DEBUG_ATTRIBUTE, "\tPolicy Information: frag:%s (%u) stream: %s (%u)\n", "look-me-up", host->hostInfo.fragPolicy, "look-me-up", host->hostInfo.streamPolicy); @@ -216,8 +214,8 @@ void PrintHostAttributeEntry(HostAttributeEntry* host) for (i=0, app = host->services; app; app = app->next,i++) { - DebugMessage(DEBUG_ATTRIBUTE, "\tService #%d:\n", i); - DebugMessage(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tPort: %s\tProtocol %s\n", + DebugFormat(DEBUG_ATTRIBUTE, "\tService #%d:\n", i); + DebugFormat(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tPort: %s\tProtocol %s\n", app->ipproto, app->port, app->protocol); } if (i==0) @@ -226,13 +224,13 @@ void PrintHostAttributeEntry(HostAttributeEntry* host) DebugMessage(DEBUG_ATTRIBUTE, "\tClients:\n"); for (i=0, app = host->clients; app; app = app->next,i++) { - DebugMessage(DEBUG_ATTRIBUTE, "\tClient #%d:\n", i); - DebugMessage(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tProtocol %s\n", + DebugFormat(DEBUG_ATTRIBUTE, "\tClient #%d:\n", i); + DebugFormat(DEBUG_ATTRIBUTE, "\t\tIPProtocol: %s\tProtocol %s\n", app->ipproto, app->protocol); if (app->fields & APPLICATION_ENTRY_PORT) { - DebugMessage(DEBUG_ATTRIBUTE, "\t\tPort: %s\n", app->port); + DebugFormat(DEBUG_ATTRIBUTE, "\t\tPort: %s\n", app->port); } } if (i==0) diff --git a/src/target_based/snort_protocols.cc b/src/target_based/snort_protocols.cc index 5df74a6a1..ae3a9cc69 100644 --- a/src/target_based/snort_protocols.cc +++ b/src/target_based/snort_protocols.cc @@ -91,10 +91,10 @@ int16_t AddProtocolReference(const char* protocol) reference = (SFTargetProtocolReference*)sfghash_find(proto_reference_table, (void*)protocol); if (reference) { - DEBUG_WRAP( - DebugMessage(DEBUG_ATTRIBUTE, + DebugFormat(DEBUG_ATTRIBUTE, "Protocol Reference for %s exists as %d\n", - protocol, reference->ordinal); ); + protocol, reference->ordinal); + return reference->ordinal; } @@ -109,10 +109,9 @@ int16_t AddProtocolReference(const char* protocol) sfghash_add(proto_reference_table, reference->name, reference); - DEBUG_WRAP( - DebugMessage(DEBUG_ATTRIBUTE, + DebugFormat(DEBUG_ATTRIBUTE, "Added Protocol Reference for %s as %d\n", - protocol, reference->ordinal); ); + protocol, reference->ordinal); return reference->ordinal; } diff --git a/src/utils/boyer_moore.cc b/src/utils/boyer_moore.cc index 188226b96..7be3053b2 100644 --- a/src/utils/boyer_moore.cc +++ b/src/utils/boyer_moore.cc @@ -73,9 +73,9 @@ int main() /* shift=make_shift(find,sizeof(find)-1); skip=make_skip(find,sizeof(find)-1); */ - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,"%d\n", + DebugFormat(DEBUG_PATTERN_MATCH,"%d\n", mSearch(test, sizeof(test) - 1, find, - sizeof(find) - 1, shift, skip)); ); + sizeof(find) - 1, shift, skip)); return 0; } @@ -182,8 +182,8 @@ int* make_shift(char* ptrn, int plen) int mSearch( const char* buf, int blen, const char* ptrn, int plen, int* skip, int* shift) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,"buf: %p blen: %d ptrn: %p " - "plen: %d\n", buf, blen, ptrn, plen); ); + DebugFormat(DEBUG_PATTERN_MATCH,"buf: %p blen: %d ptrn: %p " + "plen: %d\n", buf, blen, ptrn, plen); if (plen == 0) return -1; @@ -284,12 +284,10 @@ int mSearchREG( int cmpcnt = 0; #endif /* DEBUG_MSGS */ - DEBUG_WRAP( - DebugMessage(DEBUG_PATTERN_MATCH, "buf: %p blen: %d ptrn: %p " + DebugFormat(DEBUG_PATTERN_MATCH, "buf: %p blen: %d ptrn: %p " " plen: %d b_idx: %d\n", buf, blen, ptrn, plen, b_idx); - DebugMessage(DEBUG_PATTERN_MATCH, "packet data: \"%s\"\n", buf); - DebugMessage(DEBUG_PATTERN_MATCH, "matching for \"%s\"\n", ptrn); - ); + DebugFormat(DEBUG_PATTERN_MATCH, "packet data: \"%s\"\n", buf); + DebugFormat(DEBUG_PATTERN_MATCH, "matching for \"%s\"\n", ptrn); if (plen == 0) return 1; @@ -298,19 +296,19 @@ int mSearchREG( { int p_idx = plen, skip_stride, shift_stride; - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "Looping... " + DebugFormat(DEBUG_PATTERN_MATCH, "Looping... " "([%d]0x%X (%c) -> [%d]0x%X(%c))\n", b_idx, buf[b_idx-1], buf[b_idx-1], - p_idx, ptrn[p_idx-1], ptrn[p_idx-1]); ); + p_idx, ptrn[p_idx-1], ptrn[p_idx-1]); while (buf[--b_idx] == ptrn[--p_idx] || (ptrn[p_idx] == '?' && !literal) || (ptrn[p_idx] == '*' && !literal) || (ptrn[p_idx] == '\\' && !literal)) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "comparing: b:%c -> p:%c\n", - buf[b_idx], ptrn[p_idx]); ); + DebugFormat(DEBUG_PATTERN_MATCH, "comparing: b:%c -> p:%c\n", + buf[b_idx], ptrn[p_idx]); #ifdef DEBUG_MSGS cmpcnt++; #endif @@ -321,34 +319,34 @@ int mSearchREG( literal = 1; if (ptrn[p_idx] == '*') { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH,"Checking wildcard matching...\n"); ); + DebugMessage(DEBUG_PATTERN_MATCH,"Checking wildcard matching...\n"); while (p_idx != 0 && ptrn[--p_idx] == '*') ; /* fool-proof */ while (buf[--b_idx] != ptrn[p_idx]) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, + DebugFormat(DEBUG_PATTERN_MATCH, "comparing: b[%d]:%c -> p[%d]:%c\n", - b_idx, buf[b_idx], p_idx, ptrn[p_idx]); ); + b_idx, buf[b_idx], p_idx, ptrn[p_idx]); regexcomp++; if (b_idx == 0) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, - "b_idx went to 0, returning 0\n"); ) + DebugMessage(DEBUG_PATTERN_MATCH, + "b_idx went to 0, returning 0\n"); return 0; } } - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, + DebugFormat(DEBUG_PATTERN_MATCH, "got wildcard final char match! (b[%d]: %c -> p[%d]: %c\n", - b_idx, buf[b_idx], p_idx, ptrn[p_idx]); ); + b_idx, buf[b_idx], p_idx, ptrn[p_idx]); } if (p_idx == 0) { - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "match: compares = %d.\n", - cmpcnt); ); + DebugFormat(DEBUG_PATTERN_MATCH, "match: compares = %d.\n", + cmpcnt); return 1; } @@ -356,20 +354,20 @@ int mSearchREG( break; } - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "skip-shifting...\n"); ); + DebugMessage(DEBUG_PATTERN_MATCH, "skip-shifting...\n"); skip_stride = skip[(unsigned char)buf[b_idx]]; shift_stride = shift[p_idx]; b_idx += (skip_stride > shift_stride) ? skip_stride : shift_stride; - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "b_idx skip-shifted to %d\n", b_idx); ); + DebugFormat(DEBUG_PATTERN_MATCH, "b_idx skip-shifted to %d\n", b_idx); b_idx += regexcomp; - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, - "b_idx regex compensated %d steps, to %d\n", regexcomp, b_idx); ); + DebugFormat(DEBUG_PATTERN_MATCH, + "b_idx regex compensated %d steps, to %d\n", regexcomp, b_idx); regexcomp = 0; } - DEBUG_WRAP(DebugMessage(DEBUG_PATTERN_MATCH, "no match: compares = %d, b_idx = %d, " - "blen = %d\n", cmpcnt, b_idx, blen); ); + DebugFormat(DEBUG_PATTERN_MATCH, "no match: compares = %d, b_idx = %d, " + "blen = %d\n", cmpcnt, b_idx, blen); return 0; } diff --git a/src/utils/util.cc b/src/utils/util.cc index 6d6cb26eb..e106082ff 100644 --- a/src/utils/util.cc +++ b/src/utils/util.cc @@ -863,13 +863,11 @@ void SetChroot(std::string directory, std::string& logstore) return; } - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"SetChroot: %s\n", - CurrentWorkingDir()); ); + DebugFormat(DEBUG_INIT,"SetChroot: %s\n", CurrentWorkingDir()); const char* logdir = GetAbsolutePath(logstore.c_str()); - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "SetChroot: %s\n", - CurrentWorkingDir())); + DebugFormat(DEBUG_INIT, "SetChroot: %s\n", CurrentWorkingDir()); /* change to the directory */ if (chdir(directory.c_str()) != 0) @@ -890,7 +888,7 @@ void SetChroot(std::string directory, std::string& logstore) abslen = strlen(absdir); - DEBUG_WRAP(DebugMessage(DEBUG_INIT, "ABS: %s %d\n", absdir, abslen); ); + DebugFormat(DEBUG_INIT, "ABS: %s %d\n", absdir, abslen); /* make the chroot call */ if (chroot(absdir) < 0) @@ -900,8 +898,8 @@ void SetChroot(std::string directory, std::string& logstore) return; } - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chroot success (%s ->", absdir); ); - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"%s)\n ", CurrentWorkingDir()); ); + DebugFormat(DEBUG_INIT,"chroot success (%s ->", absdir); + DebugFormat(DEBUG_INIT,"%s)\n ", CurrentWorkingDir()); /* change to "/" in the new directory */ if (chdir("/") < 0) @@ -911,8 +909,7 @@ void SetChroot(std::string directory, std::string& logstore) return; } - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chdir success (%s)\n", - CurrentWorkingDir()); ); + DebugFormat(DEBUG_INIT,"chdir success (%s)\n", CurrentWorkingDir()); if (strncmp(absdir, logdir, strlen(absdir))) { @@ -929,8 +926,8 @@ void SetChroot(std::string directory, std::string& logstore) logstore = logdir + abslen; } - DEBUG_WRAP(DebugMessage(DEBUG_INIT,"new logdir from %s to %s\n", - logdir, logstore.c_str())); + DebugFormat(DEBUG_INIT,"new logdir from %s to %s\n", + logdir, logstore.c_str()); LogMessage("Chroot directory = %s\n", directory.c_str()); }