From: Russ Combs Date: Tue, 5 Aug 2014 17:55:35 +0000 (-0400) Subject: 109 X-Git-Tag: 3.0.0-233~1429^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a442ce89141007eab920ddf98652a7b08b91d550;p=thirdparty%2Fsnort3.git 109 --- diff --git a/ChangeLog b/ChangeLog index 8f2f1912f..5a48116bd 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,6 +2,8 @@ -- changed --help to give overview of help -- fixed stream_ip alerts (defrag -> stream_ip) -- added missing help to parameters +-- pulled in latest from Josh +-- added Flow* to StreamSplitter::reassemble() 108 -- added IpsAction for ips rule action plugins diff --git a/configure.ac b/configure.ac index fad740cce..b78433f15 100644 --- a/configure.ac +++ b/configure.ac @@ -25,7 +25,7 @@ # initialization #-------------------------------------------------------------------------- -AC_INIT([snort], [2.10.108]) +AC_INIT([snort], [2.10.109]) AC_PREREQ([2.68]) AC_CONFIG_SRCDIR([src/main.h]) diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc index ebd43a3ab..ed2728f59 100644 --- a/src/managers/module_manager.cc +++ b/src/managers/module_manager.cc @@ -718,7 +718,7 @@ void ModuleManager::load_rules(SnortConfig* sc) // note: you can NOT do ss.str().c_str() here const string& rule = ss.str(); - ParseConfigString(sc, rule.c_str(), true); + ParseConfigString(sc, rule.c_str()); r++; } diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc index 60a3ebfdc..5b665d0e0 100644 --- a/src/network_inspectors/binder/binder.cc +++ b/src/network_inspectors/binder/binder.cc @@ -176,7 +176,6 @@ int Binder::check_rules(Flow* flow, Packet* p) unsigned i, sz = bindings.size(); Port port = (p->packet_flags & PKT_FROM_CLIENT) ? p->dp : p->sp; - uint16_t vlan = vlan::vth_vlan(layer::get_vlan_layer(p)); for ( i = 0; i < sz; i++ ) { diff --git a/src/parser/keywords.h b/src/parser/keywords.h index a15b47654..1170890f2 100644 --- a/src/parser/keywords.h +++ b/src/parser/keywords.h @@ -60,6 +60,7 @@ #define RULE_OPT__METADATA "metadata" #define RULE_OPT__PRIORITY "priority" #define RULE_OPT__REFERENCE "reference" +#define RULE_OPT__REM "rem" #define RULE_OPT__REVISION "rev" #define RULE_OPT__SID "sid" #define RULE_OPT__SOID "soid" diff --git a/src/parser/parse_conf.cc b/src/parser/parse_conf.cc index 1c679e2f6..deae69d58 100644 --- a/src/parser/parse_conf.cc +++ b/src/parser/parse_conf.cc @@ -124,30 +124,18 @@ static void inc_parse_position() ++loc.line; } -static bool s_parse_rules = false; static void ParseTheConf(SnortConfig*, const char* fname); -/* Used to determine whether or not to parse the keyword line based on - * whether or not we're parsing rules */ -typedef enum _KeywordType -{ - KEYWORD_TYPE__MAIN, - KEYWORD_TYPE__RULE, - KEYWORD_TYPE__ALL - -} KeywordType; - typedef void (*ParseFunc)(SnortConfig *, const char *); -typedef struct _KeywordFunc +struct KeywordFunc { const char *name; - KeywordType type; int expand_vars; int default_policy_only; ParseFunc parse_func; -} KeywordFunc; +}; // only keep drop rules ... // if we are inline (and can actually drop), @@ -293,11 +281,6 @@ void AddRuleState(SnortConfig* sc, const RuleState& rs) } } -static void ParseFile(SnortConfig *sc, const char *args) -{ - parse_file_rule(args, &(sc->file_config)); -} - static const KeywordFunc snort_conf_keywords[] = { // this stuff is expected to remain since rules don't fit in Lua tables @@ -305,30 +288,18 @@ static const KeywordFunc snort_conf_keywords[] = // nested rules files // however, these must become pluggable ... - { ACTION_ALERT, KEYWORD_TYPE__RULE, 0, 0, ParseAlert }, - { ACTION_DROP, KEYWORD_TYPE__RULE, 0, 0, ParseDrop }, - { ACTION_BLOCK, KEYWORD_TYPE__RULE, 0, 0, ParseDrop }, - { ACTION_LOG, KEYWORD_TYPE__RULE, 0, 0, ParseLog }, - { ACTION_PASS, KEYWORD_TYPE__RULE, 0, 0, ParsePass }, - { ACTION_REJECT, KEYWORD_TYPE__RULE, 0, 0, ParseReject }, - { ACTION_SDROP, KEYWORD_TYPE__RULE, 0, 0, ParseSdrop }, - { ACTION_SBLOCK, KEYWORD_TYPE__RULE, 0, 0, ParseSdrop }, - - { SNORT_CONF_KEYWORD__FILE, KEYWORD_TYPE__MAIN, 0, 1, ParseFile }, - { SNORT_CONF_KEYWORD__INCLUDE, KEYWORD_TYPE__ALL, 1, 0, ParseInclude }, - -#if 0 - // this needs to be turned into an action plugin - // the special case parsing got in the way refactoring for Lua - // so it's toast - here for reference only - - /* Special parsing case is ruletype. Need to send the file pointer so - * it can parse what's between '{' and '}' which can span multiple - * lines without a line continuation character */ - { SNORT_CONF_KEYWORD__RULE_TYPE, KEYWORD_TYPE__ALL, 1, 0, ParseRuleTypeDeclaration }, -#endif - - { NULL, KEYWORD_TYPE__ALL, 0, 0, NULL } /* Marks end of array */ + { ACTION_ALERT, 0, 0, ParseAlert }, + { ACTION_DROP, 0, 0, ParseDrop }, + { ACTION_BLOCK, 0, 0, ParseDrop }, + { ACTION_LOG, 0, 0, ParseLog }, + { ACTION_PASS, 0, 0, ParsePass }, + { ACTION_REJECT, 0, 0, ParseReject }, + { ACTION_SDROP, 0, 0, ParseSdrop }, + { ACTION_SBLOCK, 0, 0, ParseSdrop }, + + { SNORT_CONF_KEYWORD__INCLUDE, 1, 0, ParseInclude }, + + { NULL, 0, 0, NULL } // sentinel }; static int ContinuationCheck(char *rule) @@ -438,14 +409,6 @@ static void ParseConfigFileLine(SnortConfig *sc, char *buf) { if (strcasecmp(keyword, snort_conf_keywords[i].name) == 0) { - if (((snort_conf_keywords[i].type == KEYWORD_TYPE__RULE) && - !s_parse_rules) || - ((snort_conf_keywords[i].type == KEYWORD_TYPE__MAIN) && - s_parse_rules)) - { - break; - } - if (snort_conf_keywords[i].expand_vars) args = SnortStrdup(ExpandVars(sc, toks[1])); @@ -457,7 +420,7 @@ static void ParseConfigFileLine(SnortConfig *sc, char *buf) /* Didn't find any pre-defined snort_conf_keywords. Look for a user defined * rule type */ - if ((snort_conf_keywords[i].name == NULL) && s_parse_rules) + if ( (snort_conf_keywords[i].name == NULL) ) { RuleListNode *node; @@ -548,10 +511,8 @@ static void ParseTheConf(SnortConfig *sc, const char *fname) free(buf); } -void ParseConfigString(SnortConfig* sc, const char* s, bool parse_rules) +void ParseConfigString(SnortConfig* sc, const char* s) { - s_parse_rules = parse_rules; - string rules = s; stringstream ss(rules); @@ -564,10 +525,8 @@ void ParseConfigString(SnortConfig* sc, const char* s, bool parse_rules) } void ParseConfigFile( - SnortConfig *sc, const char *fname, bool parse_rules) + SnortConfig *sc, const char *fname) { - s_parse_rules = parse_rules; - if ( fname ) ParseTheConf(sc, fname); } diff --git a/src/parser/parse_conf.h b/src/parser/parse_conf.h index 32f081cf6..f421e6b5a 100644 --- a/src/parser/parse_conf.h +++ b/src/parser/parse_conf.h @@ -29,8 +29,8 @@ void parse_conf_print(); struct SnortConfig; -void ParseConfigFile(SnortConfig*, const char* fname, bool do_rules); -void ParseConfigString(SnortConfig*, const char* str, bool do_rules); +void ParseConfigFile(SnortConfig*, const char* fname); +void ParseConfigString(SnortConfig*, const char* str); void AddRuleState(SnortConfig*, const RuleState&); diff --git a/src/parser/parse_otn.cc b/src/parser/parse_otn.cc index 86dcccedf..eef20df3c 100644 --- a/src/parser/parse_otn.cc +++ b/src/parser/parse_otn.cc @@ -481,6 +481,12 @@ static void ParseOtnReference( mSplitFree(&toks, num_toks); } +static void ParseOtnRem( + SnortConfig*, RuleTreeNode*, + OptTreeNode*, const char*) +{ +} + static void ParseOtnRevision( SnortConfig*, RuleTreeNode*, OptTreeNode *otn, const char *args) @@ -717,6 +723,7 @@ static RuleOptFunc rule_options[] = { RULE_OPT__MSG, 1, 1, 0, ParseOtnMessage }, { RULE_OPT__PRIORITY, 1, 1, 0, ParseOtnPriority }, { RULE_OPT__REFERENCE, 1, 0, 0, ParseOtnReference }, + { RULE_OPT__REM, 1, 1, 0, ParseOtnRem }, { RULE_OPT__REVISION, 1, 1, 0, ParseOtnRevision }, { RULE_OPT__SID, 1, 1, 0, ParseOtnSid }, { RULE_OPT__SOID, 1, 1, 0, ParseOtnSoid }, diff --git a/src/parser/parser.cc b/src/parser/parser.cc index 9e255b589..ac75323ce 100644 --- a/src/parser/parser.cc +++ b/src/parser/parser.cc @@ -778,14 +778,14 @@ void ParseRules(SnortConfig *sc) if ( fname && *fname ) { push_parse_location(fname); - ParseConfigFile(sc, fname, true); + ParseConfigFile(sc, fname); pop_parse_location(); } if ( !p->rules.empty() ) { push_parse_location("rules"); - ParseConfigString(sc, p->rules.c_str(), true); + ParseConfigString(sc, p->rules.c_str()); pop_parse_location(); } } diff --git a/src/service_inspectors/ftp_telnet/ftp_module.cc b/src/service_inspectors/ftp_telnet/ftp_module.cc index e8757a218..1884c7671 100644 --- a/src/service_inspectors/ftp_telnet/ftp_module.cc +++ b/src/service_inspectors/ftp_telnet/ftp_module.cc @@ -132,13 +132,19 @@ FTP_CLIENT_PROTO_CONF* FtpClientModule::get_data() return tmp; } -bool FtpClientModule::begin(const char*, int, SnortConfig*) +bool FtpClientModule::begin(const char* fqn, int, SnortConfig*) { if ( !conf ) conf = new FTP_CLIENT_PROTO_CONF; address.clear(); port = last_port = 0; + + if ( !strcmp(fqn, "ftp_client.bounce_to") ) + { + for ( auto p : bounce_to ) + delete p; + } return true; } diff --git a/src/sfip/sf_iph.cc b/src/sfip/sf_iph.cc index 2591bdb53..b5418f1d1 100644 --- a/src/sfip/sf_iph.cc +++ b/src/sfip/sf_iph.cc @@ -1,6 +1,6 @@ /**************************************************************************** * -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. * Copyright (C) 2007-2013 Sourcefire, Inc. * * This program is free software; you can redistribute it and/or modify @@ -56,12 +56,12 @@ sfip_t *ip6_ret_src(const Packet *p) return &p->ip6h->ip_src; } -sfip_t *orig_ip6_ret_src(const Packet *p) +sfip_t *orig_ip6_ret_src(const Packet*) { VALIDATE(p, 1); return nullptr; -// return &p->orig_ip6h->ip_src; + //return &p->orig_ip6h->ip_src; } sfip_t *ip6_ret_dst(const Packet *p) diff --git a/src/stream/stream_splitter.cc b/src/stream/stream_splitter.cc index 41c2f638b..961a0b68d 100644 --- a/src/stream/stream_splitter.cc +++ b/src/stream/stream_splitter.cc @@ -32,7 +32,8 @@ uint32_t StreamSplitter::max() { return 16384; } // FIXIT make default configurable const StreamBuffer* StreamSplitter::reassemble( - unsigned offset, const uint8_t* p, unsigned n, uint32_t flags, unsigned& copied) + Flow*, unsigned offset, const uint8_t* p, + unsigned n, uint32_t flags, unsigned& copied) { assert(offset + n < sizeof(pdu_buf)); memcpy(pdu_buf+offset, p, n); diff --git a/src/stream/stream_splitter.h b/src/stream/stream_splitter.h index 3690aaf02..73eb778ef 100644 --- a/src/stream/stream_splitter.h +++ b/src/stream/stream_splitter.h @@ -33,7 +33,6 @@ enum PAF_Status // FIXIT move inside StreamSplitter PAF_START, // internal use only PAF_SEARCH, // searching for next flush point PAF_FLUSH, // flush at given offset - PAF_BUILD, // reassemble to given offset PAF_SKIP // skip ahead to given offset }; @@ -59,6 +58,7 @@ public: ) = 0; virtual const StreamBuffer* reassemble( + Flow*, unsigned offset, // data offset from start of reassembly const uint8_t* data, // data to reassemble unsigned len, // length of data diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index f3cc4c7d3..85e9aa89b 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -1925,7 +1925,7 @@ static inline unsigned int getSegmentFlushSize( * flush the client seglist up to the most recently acked segment */ static int FlushStream( - Packet*, StreamTracker *st, uint32_t toSeq, uint8_t *flushbuf, + Packet* p, StreamTracker *st, uint32_t toSeq, uint8_t *flushbuf, const uint8_t *flushbuf_end) { uint16_t bytes_flushed = 0; @@ -1951,7 +1951,7 @@ static int FlushStream( flags |= PKT_PDU_TAIL; const StreamBuffer* sb = st->splitter->reassemble( - bytes_flushed, ss->payload, bytes_to_copy, flags, bytes_copied); + p->flow, bytes_flushed, ss->payload, bytes_to_copy, flags, bytes_copied); flags = 0;