From: Russ Combs Date: Sat, 1 Nov 2014 12:16:24 +0000 (-0400) Subject: added default bindings for stream only configs X-Git-Tag: 3.0.0-233~1284 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9e63b85b627d17fae964350f7b742cf259b4dfd0;p=thirdparty%2Fsnort3.git added default bindings for stream only configs --- diff --git a/ChangeLog b/ChangeLog index 4efd64427..1bd4c0113 100644 --- a/ChangeLog +++ b/ChangeLog @@ -10,6 +10,7 @@ -- new_http_inspect now gid 219 and other Tom Tweaks -- new_http_inspect reactiveated (no longer REG_TEST only) -- ip defrag fixes from Josh +-- added default bindings for stream only configs 126 -- pulled latest from tom diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc index 013fae904..7a7e70ee6 100644 --- a/src/managers/inspector_manager.cc +++ b/src/managers/inspector_manager.cc @@ -59,7 +59,7 @@ using namespace std; struct PHGlobal { const InspectApi& api; - bool init; + bool init; // call api.pinit() PHGlobal(const InspectApi& p) : api(p) { init = true; }; @@ -71,9 +71,10 @@ struct PHGlobal struct PHClass { const InspectApi& api; + bool init; // call pin->tinit() - PHClass(const InspectApi& p) : api(p) { }; - ~PHClass() { }; + PHClass(const InspectApi& p) : api(p) + { init = true; }; static bool comp (PHClass* a, PHClass* b) { return ( a->api.type < b->api.type ); }; @@ -408,10 +409,14 @@ void InspectorManager::free_inspector(Inspector* p) p->get_api()->dtor(p); } -InspectSsnFunc InspectorManager::get_session(const char* key) +InspectSsnFunc InspectorManager::get_session(uint16_t proto) { - const InspectApi* api = get_plugin(key); - return api ? api->ssn : nullptr; + for ( auto* p : s_handlers ) + { + if ( p->api.type == IT_STREAM && p->api.proto_bits == proto && !p->init ) + return p->api.ssn; + } + return nullptr; } //------------------------------------------------------------------------- @@ -432,7 +437,7 @@ void InspectorManager::delete_config (SnortConfig* sc) sc->framework_config = nullptr; } -static PHClass* GetClass(const char* keyword, FrameworkConfig* fc) +static PHClass* get_class(const char* keyword, FrameworkConfig* fc) { for ( auto* p : fc->clist ) if ( !strcmp(p->api.base.name, keyword) ) @@ -467,7 +472,11 @@ void InspectorManager::thread_init(SnortConfig* sc) if ( pi && pi->framework_policy ) { for ( auto* p : pi->framework_policy->ilist ) - p->handler->tinit(); + if ( p->pp_class.init ) + { + p->handler->tinit(); + p->pp_class.init = false; + } } } @@ -478,7 +487,11 @@ void InspectorManager::thread_term(SnortConfig* sc) if ( pi && pi->framework_policy ) { for ( auto* p : pi->framework_policy->ilist ) - p->handler->tterm(); + if ( !p->pp_class.init ) + { + p->handler->tterm(); + p->pp_class.init = true; + } } for ( auto* p : sc->framework_config->clist ) @@ -501,7 +514,7 @@ void InspectorManager::instantiate( // since given api and mod const char* keyword = api->base.name; - PHClass* ppc = GetClass(keyword, fc); + PHClass* ppc = get_class(keyword, fc); if ( !ppc ) ParseError("unknown inspector: '%s'.", keyword); @@ -560,7 +573,7 @@ static bool configure(SnortConfig* sc, FrameworkPolicy* fp) sort(fp->ilist.begin(), fp->ilist.end(), PHInstance::comp); fp->vectorize(); - if ( fp->service.num && !fp->binder && InspectorManager::get_wizard() ) + if ( fp->session.num && !fp->binder ) instantiate_binder(sc, fp); return ok; diff --git a/src/managers/inspector_manager.h b/src/managers/inspector_manager.h index b44fe0eea..e5129488a 100644 --- a/src/managers/inspector_manager.h +++ b/src/managers/inspector_manager.h @@ -50,7 +50,7 @@ public: const InspectApi*, Module*, SnortConfig*, const char* name = nullptr); static void free_inspector(Inspector*); - static InspectSsnFunc get_session(const char* key); + static InspectSsnFunc get_session(uint16_t proto); static InspectorType get_type(const char* key); static Inspector* get_inspector(const char* key, bool dflt_only = false); diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc index 7d73c5c52..7b44b325f 100644 --- a/src/stream/base/stream_base.cc +++ b/src/stream/base/stream_base.cc @@ -158,22 +158,22 @@ void StreamBase::tinit() if ( config->tcp_cfg.max_sessions ) { - if ( (f = InspectorManager::get_session("stream_tcp")) ) + if ( (f = InspectorManager::get_session((uint16_t)PktType::TCP)) ) flow_con->init_tcp(config->tcp_cfg, f); } if ( config->udp_cfg.max_sessions ) { - if ( (f = InspectorManager::get_session("stream_udp")) ) + if ( (f = InspectorManager::get_session((uint16_t)PktType::UDP)) ) flow_con->init_udp(config->udp_cfg, f); } if ( config->ip_cfg.max_sessions ) { - if ( (f = InspectorManager::get_session("stream_ip")) ) + if ( (f = InspectorManager::get_session((uint16_t)PktType::IP)) ) flow_con->init_ip(config->ip_cfg, f); } if ( config->icmp_cfg.max_sessions ) { - if ( (f = InspectorManager::get_session("stream_icmp")) ) + if ( (f = InspectorManager::get_session((uint16_t)PktType::ICMP)) ) flow_con->init_icmp(config->icmp_cfg, f); } if ( config->tcp_cfg.max_sessions || config->udp_cfg.max_sessions ) diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc index f99ff5ea0..9957e9e50 100644 --- a/src/stream/icmp/icmp_session.cc +++ b/src/stream/icmp/icmp_session.cc @@ -72,7 +72,8 @@ static void IcmpSessionCleanup(Flow *ssn) ssn->clear(); - icmpStats.released++; + if ( ssn->s5_state.session_flags & SSNFLAG_SEEN_SENDER ) + icmpStats.released++; } static int ProcessIcmpUnreach(Packet *p) @@ -202,6 +203,7 @@ bool IcmpSession::setup(Packet*) ssn_time.tv_sec = 0; ssn_time.tv_usec = 0; icmpStats.created++; + flow->s5_state.session_flags |= SSNFLAG_SEEN_SENDER; return true; } diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc index f72adf720..129e9d526 100644 --- a/src/stream/tcp/stream_tcp.cc +++ b/src/stream/tcp/stream_tcp.cc @@ -141,10 +141,10 @@ static const InspectApi tcp_api = }, IT_STREAM, (unsigned)PktType::TCP, - nullptr, // buffers - nullptr, // service - nullptr, // init - nullptr, // term + nullptr, // buffers + nullptr, // service + nullptr, // init + nullptr, // term tcp_tinit, tcp_tterm, tcp_ctor, diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc index 0f4bca6c6..df8644005 100644 --- a/src/stream/udp/udp_session.cc +++ b/src/stream/udp/udp_session.cc @@ -69,7 +69,9 @@ static void UdpSessionCleanup(Flow *lwssn) CloseStreamSession(&sfBase, SESSION_CLOSED_NORMALLY); } - udpStats.released++; + if ( lwssn->s5_state.session_flags & SSNFLAG_SEEN_SENDER ) + udpStats.released++; + RemoveUDPSession(&sfBase); }