From: Russ Combs Date: Mon, 16 Mar 2015 17:46:52 +0000 (-0400) Subject: all parse warnings are optional; fix ip and tcp policy defines X-Git-Tag: 3.0.0-233~1023 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b0366f516a273654a296e2a80e88a8565537106e;p=thirdparty%2Fsnort3.git all parse warnings are optional; fix ip and tcp policy defines --- diff --git a/ChangeLog b/ChangeLog index 489e320ac..162caefec 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,7 @@ Pending - build 142 +-- make all warnings optional +-- fix ip and tcp policy defines -- fix ip and icmp flow client/server ip init -- added logging examples to usage diff --git a/doc/style.txt b/doc/style.txt index 7c70d85f7..96ec6bec0 100644 --- a/doc/style.txt +++ b/doc/style.txt @@ -152,7 +152,7 @@ yet firm so feedback is welcome to get something we can live with. ==== Headers * Don't hesitate to create a new header if it is needed. Don't lump - unrelated stuff into a header because it is convenient. + unrelated stuff into an header because it is convenient. * Write header guards like this (leading underscores are reserved for system stuff). In my_header.h: @@ -164,7 +164,7 @@ yet firm so feedback is welcome to get something we can live with. * Includes from a different directory should specify parent directory. This makes it clear exactly what is included and avoids the primordial - soup that results from using -I this -I that -I the-other-thing ... . + soup that results from using -I this -I that -I the_other_thing ... . // given: src/foo/foo.cc @@ -218,7 +218,7 @@ Currently using uncrustify from at https://github.com/bengardner/uncrustify to reformat legacy code and anything that happens to need a makeover at some point. -The working config is crusty.cfg in the top level directory. It does well, +The working config is crusty.cfg in the top level directory. It does well but will munge some things. Specially formatted INDENT-OFF comments were added in 2 places to avoid a real mess. diff --git a/doc/usage.txt b/doc/usage.txt index 0c20c27b0..48a9a2ed2 100644 --- a/doc/usage.txt +++ b/doc/usage.txt @@ -34,8 +34,8 @@ Output help on "rule" options in AsciiDoc format: snort --markup --help-options rule -NOTE: Snort++ stops reading command-line options after the "--help-*" and "--list-*" options, -so any other options should be placed before them. +NOTE: Snort++ stops reading command-line options after the "--help-*" and +"--list-*" options, so any other options should be placed before them. ==== Sniffing and Logging @@ -52,8 +52,9 @@ Dump packets with application data and layer 2 headers snort -r /path/to/my.pcap -K text -d -e -NOTE: Command line options must be specified separately. "snort -de" won't work. -You can still concatenate options and their arguments, however, so "snort -Ktext" will work. +NOTE: Command line options must be specified separately. "snort -de" won't +work. You can still concatenate options and their arguments, however, so +"snort -Ktext" will work. Dump packets from all pcaps in a directory: @@ -104,12 +105,32 @@ Add or modify a configuration from the command line using the "--lua" option: NOTE: The "--lua" option can be specified multiple times. -Run Snort++ in IDS mode on an entire directory of pcaps, processing each input source on a separate thread: +Run Snort++ in IDS mode on an entire directory of pcaps, processing each +input source on a separate thread: snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \ --pcap-filter '*.pcap' --max-packet-threads 8 +=== Plugins + +Load external plugins and use the "ex" alert: + + snort -c $my_path/etc/snort/snort.lua \ + --plugin-path $my_path/lib/snort_extra \ + -A alert_ex -r /path/to/my.pcap + +Test the LuaJIT rule option 'find' loaded from stdin: + + snort -c $my_path/etc/snort/snort.lua \ + --script-path $my_path/lib/snort_extra \ + --stdin-rules -A cmg -r /path/to/my.pcap << END + alert tcp any any -> any 80 ( + sid:3; msg:"found"; content:"GET"; + find:"pat='HTTP/1%.%d'" ; ) + END + + === Output Files To make it simple to configure outputs when you run with multiple packet diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index d4e85a1c3..2bb856ff7 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -118,9 +118,6 @@ bool Icmp6Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) { if (raw.len < icmp::ICMP6_HEADER_MIN_LEN) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated ICMP6 header (%d bytes).\n", raw.len); ); - codec_event(codec, DECODE_ICMP6_HDR_TRUNC); return false; } diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index e6a619349..16e6b2203 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -147,9 +147,6 @@ bool Ipv4Codec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) /* do a little validation */ if (raw.len < ip::IP4_HEADER_LEN) { - DEBUG_WRAP(DebugMessage(DEBUG_DECODE, - "WARNING: Truncated IP4 header (%d bytes).\n", raw.len); ); - if ((codec.codec_flags & CODEC_UNSURE_ENCAP) == 0) codec_event(codec, DECODE_IP4_HDR_TRUNC); return false; diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc index 15277cd37..a8433ca85 100644 --- a/src/detection/fpcreate.cc +++ b/src/detection/fpcreate.cc @@ -834,7 +834,7 @@ void fpSetMaxQueueEvents(FastPatternConfig* fp, unsigned int num_events) void fpSetMaxPatternLen(FastPatternConfig* fp, unsigned int max_len) { if (fp->max_pattern_len != 0) - ParseWarning("maximum pattern length redefined from %d to %d.\n", + ParseWarning(WARN_CONF, "maximum pattern length redefined from %d to %d.\n", fp->max_pattern_len, max_len); fp->max_pattern_len = max_len; @@ -1000,10 +1000,12 @@ void set_fp_content(OptTreeNode* otn) if ( tmp->fp ) { if ( pmd ) - ParseWarning("only one fast_pattern content per rule allowed - ignored"); + ParseWarning(WARN_RULES, + "only one fast_pattern content per rule allowed - ignored"); else if ( !pmd_can_be_fp(tmp, curr_cat) ) - ParseWarning("content ineligible for fast_pattern matcher - ignored"); + ParseWarning(WARN_RULES, + "content ineligible for fast_pattern matcher - ignored"); else pmd = tmp; @@ -2253,7 +2255,7 @@ void fpBuildServicePortGroups( FatalError("Could not AddProtocolReference\n"); else if ( id >= MAX_PROTOCOL_ORDINAL ) - ParseWarning("protocol-ordinal=%d exceeds " + ParseWarning(WARN_RULES, "protocol-ordinal=%d exceeds " "limit of %d for service=%s\n",id,MAX_PROTOCOL_ORDINAL,srvc); } else if ( id > 0 ) diff --git a/src/detection/signature.cc b/src/detection/signature.cc index 56e5dd958..8d67f0173 100644 --- a/src/detection/signature.cc +++ b/src/detection/signature.cc @@ -152,7 +152,7 @@ void AddClassification( /* dup check */ if (strcasecmp(current->type, type) == 0) { - ParseWarning( + ParseWarning(WARN_CONF, "Duplicate classification \"%s\"" "found, ignoring this line", type); return; diff --git a/src/file_api/file_mime_config.cc b/src/file_api/file_mime_config.cc index acd35cc23..f2f3af86a 100644 --- a/src/file_api/file_mime_config.cc +++ b/src/file_api/file_mime_config.cc @@ -104,7 +104,7 @@ static int ProcessDecodeDepth( { decode_depth = decode_depth - 4; } - ParseWarning( + ParseWarning(WARN_CONF, "%s: 'b64_decode_depth' is not a multiple of 4. " "Rounding up to the next multiple of 4. The new 'b64_decode_depth' is %d.\n", preproc_name, decode_depth); diff --git a/src/helpers/process.cc b/src/helpers/process.cc index 40b043c06..3ee103bd1 100644 --- a/src/helpers/process.cc +++ b/src/helpers/process.cc @@ -220,7 +220,7 @@ static int add_signal(int sig, sighandler_t signal_handler, int check_needed) } else if (check_needed && (SIG_IGN != pre_handler) && (SIG_DFL!= pre_handler)) { - ParseWarning("handler is already installed for signal %d.\n", sig); + ParseWarning(WARN_CONF, "handler is already installed for signal %d.\n", sig); } return 1; } diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc index f05265c19..60724591f 100644 --- a/src/ips_options/ips_content.cc +++ b/src/ips_options/ips_content.cc @@ -669,7 +669,7 @@ static const Parameter s_params[] = { "fast_pattern_offset", Parameter::PT_INT, nullptr, nullptr, "number of leading characters of this content the fast pattern matcher should exclude" }, - { "fast_pattern_length", Parameter::PT_INT, nullptr, nullptr, + { "fast_pattern_length", Parameter::PT_INT, "1:", nullptr, "maximum number of characters from this content the fast pattern matcher should use" }, { "offset", Parameter::PT_STRING, nullptr, nullptr, diff --git a/src/ips_options/ips_flowbits.cc b/src/ips_options/ips_flowbits.cc index ace9842e9..e811e52d2 100644 --- a/src/ips_options/ips_flowbits.cc +++ b/src/ips_options/ips_flowbits.cc @@ -1045,14 +1045,14 @@ static void FlowBitsVerify(void) if ((fb->set > 0) && (fb->isset == 0)) { - if ( snort_conf->logging_flags & LOGGING_FLAG__WARN_FLOWBITS ) - ParseWarning("flowbits key '%s' is set but not checked.", (char*)n->key); + ParseWarning(WARN_FLOWBITS, "flowbits key '%s' is set but not checked.", + (char*)n->key); unchecked++; } else if ((fb->isset > 0) && (fb->set == 0)) { - if ( snort_conf->logging_flags & LOGGING_FLAG__WARN_FLOWBITS ) - ParseWarning("flowbits key '%s' is checked but not ever set.", (char*)n->key); + ParseWarning(WARN_FLOWBITS, "flowbits key '%s' is checked but not ever set.", + (char*)n->key); unset++; } else if ((fb->set == 0) && (fb->isset == 0)) diff --git a/src/ips_options/ips_replace.cc b/src/ips_options/ips_replace.cc index 184f0b516..57185ec4e 100644 --- a/src/ips_options/ips_replace.cc +++ b/src/ips_options/ips_replace.cc @@ -67,7 +67,7 @@ static bool replace_ok() { if ( !warned ) { - ParseWarning("payload replacements disabled because DAQ " + ParseWarning(WARN_DAQ, "payload replacements disabled because DAQ " " can't replace packets.\n"); warned = 1; } diff --git a/src/main/modules.cc b/src/main/modules.cc index e02b0dd5f..65af86b0c 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -1713,15 +1713,6 @@ bool RuleStateModule::end(const char*, int idx, SnortConfig* sc) // hosts module //------------------------------------------------------------------------- -// FIXIT-L these are cloned from ip_module.cc and tcp_module.cc - -#define ip_policies \ - "unknown | first | linux | bsd | bsd_right |last | windows | solaris" - -#define tcp_policies \ - "unknown | first | last | bsd | linux | old-linux | windows | win-2003 | " \ - "vista | solaris | hpux | hpux10 | irix | macos" - static const Parameter service_params[] = { { "name", Parameter::PT_STRING, nullptr, nullptr, @@ -1741,10 +1732,10 @@ static const Parameter hosts_params[] = { "ip", Parameter::PT_ADDR, nullptr, "0.0.0.0/32", "hosts address / cidr" }, - { "frag_policy", Parameter::PT_ENUM, ip_policies, "linux", + { "frag_policy", Parameter::PT_ENUM, IP_POLICIES, IP_POLICY_DEFAULT, "defragmentation policy" }, - { "tcp_policy", Parameter::PT_ENUM, tcp_policies, "linux", + { "tcp_policy", Parameter::PT_ENUM, TCP_POLICIES, TCP_POLICY_DEFAULT, "tcp reassembly policy" }, { "services", Parameter::PT_LIST, service_params, nullptr, @@ -1779,11 +1770,11 @@ bool HostsModule::set(const char*, Value& v, SnortConfig*) else if ( v.is("frag_policy") ) { - host->hostInfo.fragPolicy = v.get_long(); + host->hostInfo.fragPolicy = v.get_long() + 1; } else if ( v.is("tcp_policy") ) { - host->hostInfo.streamPolicy = v.get_long(); + host->hostInfo.streamPolicy = v.get_long() + 1; } else if ( v.is("name") ) app->protocol = AddProtocolReference(v.get_string()); diff --git a/src/main/snort.h b/src/main/snort.h index 66ecab154..6adb43dde 100644 --- a/src/main/snort.h +++ b/src/main/snort.h @@ -150,8 +150,6 @@ enum LoggingFlag LOGGING_FLAG__QUIET = 0x00000002, /* -q */ LOGGING_FLAG__SYSLOG = 0x00000004, /* -M */ LOGGING_FLAG__SHOW_PLUGINS = 0x00000008, // --show-plugins - LOGGING_FLAG__WARN_FLOWBITS = 0x00000010, // --warn-flowbits - LOGGING_FLAG__WARN_UNKNOWN = 0x00000020, // --warn-unknown }; enum TunnelFlags diff --git a/src/main/snort_config.cc b/src/main/snort_config.cc index fd02c6861..840a54d35 100644 --- a/src/main/snort_config.cc +++ b/src/main/snort_config.cc @@ -119,7 +119,7 @@ static void init_policy_mode(IpsPolicy* p) else if (!ScAdapterInlineMode()) { - ParseWarning("adapter is in passive mode; switching policy mode to tap."); + ParseWarning(WARN_DAQ, "adapter is in passive mode; switching policy mode to tap."); p->policy_mode = POLICY_MODE__PASSIVE; } break; diff --git a/src/main/snort_config.h b/src/main/snort_config.h index 2a28c26ad..7a8f094cd 100644 --- a/src/main/snort_config.h +++ b/src/main/snort_config.h @@ -79,8 +79,9 @@ struct SnortConfig //------------------------------------------------------ // output module stuff - int output_flags; - int logging_flags; + uint32_t output_flags; + uint32_t logging_flags; + uint32_t warning_flags; uint8_t log_ipv6_extra; uint16_t event_trace_max; diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc index de18e0c56..59a46615a 100644 --- a/src/main/snort_module.cc +++ b/src/main/snort_module.cc @@ -240,7 +240,7 @@ static const Parameter s_params[] = " are standard BPF options, as seen in TCPDump" }, { "--c2x", Parameter::PT_STRING, nullptr, nullptr, - "output hex for given char" }, + "output hex for given char (see also --x2c)" }, { "--create-pidfile", Parameter::PT_IMPLIED, nullptr, nullptr, "create PID file, even when not in Daemon mode" }, @@ -434,14 +434,32 @@ static const Parameter s_params[] = { "--warn-all", Parameter::PT_IMPLIED, nullptr, nullptr, "enable all warnings" }, + { "--warn-conf", Parameter::PT_IMPLIED, nullptr, nullptr, + "warn about configuration issues" }, + + { "--warn-daq", Parameter::PT_IMPLIED, nullptr, nullptr, + "warn about DAQ issues, usually related to mode" }, + { "--warn-flowbits", Parameter::PT_IMPLIED, nullptr, nullptr, "warn about flowbits that are checked but not set and vice-versa" }, - { "--warn-unknown", Parameter::PT_IMPLIED, nullptr, nullptr, - "warn about unknown symbols in your config" }, + { "--warn-hosts", Parameter::PT_IMPLIED, nullptr, nullptr, + "warn about host table issues" }, + + { "--warn-rules", Parameter::PT_IMPLIED, nullptr, nullptr, + "warn about duplicate rules and rule parsing issues" }, + + { "--warn-scripts", Parameter::PT_IMPLIED, nullptr, nullptr, + "warn about issues discovered while processing Lua scripts" }, + + { "--warn-symbols", Parameter::PT_IMPLIED, nullptr, nullptr, + "warn about unknown symbols in your Lua config" }, + + { "--warn-vars", Parameter::PT_IMPLIED, nullptr, nullptr, + "warn about variable definition and usage issues" }, { "--x2c", Parameter::PT_INT, nullptr, nullptr, - "output ASCII char for given hex" }, + "output ASCII char for given hex (see also --c2x)" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; @@ -793,15 +811,31 @@ bool SnortModule::set(const char*, Value& v, SnortConfig* sc) help_version(sc, v.get_string()); else if ( v.is("--warn-all") ) - { - sc->logging_flags |= LOGGING_FLAG__WARN_FLOWBITS; - sc->logging_flags |= LOGGING_FLAG__WARN_UNKNOWN; - } + sc->warning_flags = 0xFFFFFFFF; + + else if ( v.is("--warn-conf") ) + sc->warning_flags |= (1 << WARN_CONF); + + else if ( v.is("--warn-daq") ) + sc->warning_flags |= (1 << WARN_DAQ); + else if ( v.is("--warn-flowbits") ) - sc->logging_flags |= LOGGING_FLAG__WARN_FLOWBITS; + sc->warning_flags |= (1 << WARN_FLOWBITS); + + else if ( v.is("--warn-hosts") ) + sc->warning_flags |= (1 << WARN_HOSTS); + + else if ( v.is("--warn-rules") ) + sc->warning_flags |= (1 << WARN_RULES); + + else if ( v.is("--warn-scripts") ) + sc->warning_flags |= (1 << WARN_SCRIPTS); + + else if ( v.is("--warn-symbols") ) + sc->warning_flags |= (1 << WARN_SYMBOLS); - else if ( v.is("--warn-unknown") ) - sc->logging_flags |= LOGGING_FLAG__WARN_UNKNOWN; + else if ( v.is("--warn-vars") ) + sc->warning_flags |= (1 << WARN_VARS); else if ( v.is("--x2c") ) x2c(v.get_long()); diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc index 17066be10..c2517b462 100644 --- a/src/managers/module_manager.cc +++ b/src/managers/module_manager.cc @@ -400,9 +400,6 @@ static bool ignored(const char* fqn) { static const char* ignore = nullptr; - if ( !(snort_conf->logging_flags & LOGGING_FLAG__WARN_UNKNOWN) ) - return true; - if ( !ignore ) { ignore = getenv("SNORT_IGNORE"); @@ -441,7 +438,7 @@ static bool set_value(const char* fqn, Value& v) bool found = set_var(fqn, v); if ( !found && !ignored(fqn) ) - ParseWarning("uknown symbol %s", fqn); + ParseWarning(WARN_SYMBOLS, "uknown symbol %s", fqn); return found; } diff --git a/src/managers/script_manager.cc b/src/managers/script_manager.cc index 52fa21502..50d504f24 100644 --- a/src/managers/script_manager.cc +++ b/src/managers/script_manager.cc @@ -127,7 +127,7 @@ static bool get_field(lua_State* L, const char* key, int& value) if ( !lua_isnumber(L, -1) ) { - ParseWarning("%s is not a number", key); + ParseWarning(WARN_SCRIPTS, "%s is not a number", key); lua_pop(L, 1); return false; } @@ -145,7 +145,7 @@ static bool get_field(lua_State* L, const char* key, string& value) if ( !lua_isstring(L, -1) ) { - ParseWarning("%s is not a string", key); + ParseWarning(WARN_SCRIPTS, "%s is not a string", key); lua_pop(L, 1); return false; } @@ -170,7 +170,7 @@ static void load_script(const char* f) if ( luaL_loadfile(L, f) ) { - ParseWarning("can't load %s: %s", f, lua_tostring(L, -1)); + ParseWarning(WARN_SCRIPTS, "can't load %s: %s", f, lua_tostring(L, -1)); return; } @@ -180,7 +180,7 @@ static void load_script(const char* f) if ( lua_pcall(L, 0, 0, 0) ) { - ParseWarning("can't init %s: %s", f, lua_tostring(L, -1)); + ParseWarning(WARN_SCRIPTS, "can't init %s: %s", f, lua_tostring(L, -1)); return; } @@ -188,7 +188,7 @@ static void load_script(const char* f) if ( !lua_istable(L, -1) ) { - ParseWarning("can't get plugin from %s", f); + ParseWarning(WARN_SCRIPTS, "can't get plugin from %s", f); return; } diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc index 0708728a9..c5df1d592 100644 --- a/src/network_inspectors/normalize/normalize.cc +++ b/src/network_inspectors/normalize/normalize.cc @@ -187,7 +187,7 @@ bool Normalizer::configure(SnortConfig*) // FIXIT-L norm needs a nap policy mode if ( mode == POLICY_MODE__PASSIVE ) { - ParseWarning("normalizations disabled because not inline."); + ParseWarning(WARN_DAQ, "normalizations disabled because not inline."); config.normalizer_flags = 0; return true; } diff --git a/src/packet_io/active.cc b/src/packet_io/active.cc index efe2e4c45..f55fd22a0 100644 --- a/src/packet_io/active.cc +++ b/src/packet_io/active.cc @@ -111,7 +111,7 @@ int Active_Init(SnortConfig* sc) { if ( ScReadMode() || Active_Open(sc->respond_device) ) { - ParseWarning("active responses disabled since DAQ " + ParseWarning(WARN_DAQ, "active responses disabled since DAQ " "can't inject packets."); #ifndef REG_TEST s_attempts = 0; diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc index 8c3e87caf..d4f92a757 100644 --- a/src/packet_io/sfdaq.cc +++ b/src/packet_io/sfdaq.cc @@ -202,21 +202,21 @@ static int DAQ_ValidateInstance() return 1; if ( !(caps & DAQ_CAPA_BLOCK) ) - ParseWarning("inline mode configured but DAQ can't block packets.\n"); + ParseWarning(WARN_DAQ, "inline mode configured but DAQ can't block packets.\n"); #if 0 // this is checked in normalize.c and sp_respond.c // and warned/disabled only if it was configured if ( !(caps & DAQ_CAPA_REPLACE) ) { - ParseWarning("normalizations/replacements disabled " + ParseWarning(WARN_DAQ, "normalizations/replacements disabled " " because DAQ can't replace packets.\n"); } // this is checked in spp_stream.c and active.c // and warned/disabled only if it was configured if ( !(caps & DAQ_CAPA_INJECT) ) - ParseWarning("inline mode configured but DAQ can't " + ParseWarning(WARN_DAQ, "inline mode configured but DAQ can't " "inject packets.\n"); #endif diff --git a/src/parser/parse_conf.cc b/src/parser/parse_conf.cc index 04197abdc..3f8d41b9d 100644 --- a/src/parser/parse_conf.cc +++ b/src/parser/parse_conf.cc @@ -168,7 +168,7 @@ void ParseIpVar(SnortConfig* sc, const char* var, const char* val) return; case SFIP_DUPLICATE: - ParseWarning("Var '%s' redefined.", var); + ParseWarning(WARN_VARS, "Var '%s' redefined.", var); break; case SFIP_CONFLICT: diff --git a/src/parser/parse_rule.cc b/src/parser/parse_rule.cc index ca3182bd9..02cf2fc75 100644 --- a/src/parser/parse_rule.cc +++ b/src/parser/parse_rule.cc @@ -1161,7 +1161,7 @@ static int mergeDuplicateOtn( //OTN is for new policy group, salvage RTN deleteRtnFromOtn(otn_new); - ParseWarning( + ParseWarning(WARN_RULES, "%d:%d duplicates previous rule. Using revision %d.", otn_cur->sigInfo.generator, otn_cur->sigInfo.id, otn_cur->sigInfo.rev); @@ -1207,7 +1207,7 @@ static int mergeDuplicateOtn( } else { - ParseWarning( + ParseWarning(WARN_RULES, "%d:%d duplicates previous rule. Using revision %d.", otn_new->sigInfo.generator, otn_new->sigInfo.id, otn_new->sigInfo.rev); } diff --git a/src/parser/parse_stream.cc b/src/parser/parse_stream.cc index b7c8c7337..7d8f90ea1 100644 --- a/src/parser/parse_stream.cc +++ b/src/parser/parse_stream.cc @@ -206,7 +206,7 @@ static TokenType get_token( else if ( c == '\\' ) state = esc ? 4 : 16; else if ( c == '\n' ) - ParseWarning("line break in string on line %d\n", lines-1); + ParseWarning(WARN_RULES, "line break in string on line %d\n", lines-1); else s += c; break; @@ -221,7 +221,7 @@ static TokenType get_token( break; case 5: // unquoted escape if ( c != '\n' && c != '\r' ) - ParseWarning("invalid escape on line %d\n", lines); + ParseWarning(WARN_RULES, "invalid escape on line %d\n", lines); state = 0; break; case 6: // token @@ -313,7 +313,7 @@ static TokenType get_token( state = 11; else if ( c == '\n' ) { - ParseWarning("line break in commented string on line %d\n", lines-1); + ParseWarning(WARN_RULES, "line break in commented string on line %d\n", lines-1); state = 11; } break; @@ -325,7 +325,7 @@ static TokenType get_token( } else { - ParseWarning("\\x used with no following hex digits", lines-1); + ParseWarning(WARN_RULES, "\\x used with no following hex digits", lines-1); s += c; state = 3; } diff --git a/src/parser/parser.cc b/src/parser/parser.cc index 931b65e77..755bee4bc 100644 --- a/src/parser/parser.cc +++ b/src/parser/parser.cc @@ -607,6 +607,7 @@ SnortConfig* ParseSnortConf(const SnortConfig* boot_conf) SnortConfig* sc = SnortConfNew(); sc->logging_flags = boot_conf->logging_flags; + sc->warning_flags = boot_conf->warning_flags; VarNode* tmp = boot_conf->var_list; const char* fname = get_snort_conf(); @@ -1123,8 +1124,11 @@ void ParseError(const char* format, ...) parse_errors++; } -void ParseWarning(const char* format, ...) +void ParseWarning(WarningGroup wg, const char* format, ...) { + if ( !(snort_conf->warning_flags & (1 << wg)) ) + return; + char buf[STD_BUF+1]; va_list ap; diff --git a/src/parser/parser.h b/src/parser/parser.h index e82929603..7b9bc10bb 100644 --- a/src/parser/parser.h +++ b/src/parser/parser.h @@ -68,9 +68,16 @@ void ConfigureSideChannelModules(SnortConfig*); SO_PUBLIC NORETURN void ParseAbort(const char*, ...); SO_PUBLIC void ParseError(const char*, ...); -SO_PUBLIC void ParseWarning(const char*, ...); SO_PUBLIC void ParseMessage(const char*, ...); +enum WarningGroup +{ + WARN_DAQ, WARN_CONF, WARN_VARS, WARN_SYMBOLS, WARN_SCRIPTS, + WARN_HOSTS, WARN_RULES, WARN_FLOWBITS, WARN_MAX +}; + +SO_PUBLIC void ParseWarning(WarningGroup, const char*, ...); + int ParseBool(const char* arg); int addRtnToOtn(struct OptTreeNode*, RuleTreeNode*); diff --git a/src/parser/vars.cc b/src/parser/vars.cc index 16965618d..dbca6dda6 100644 --- a/src/parser/vars.cc +++ b/src/parser/vars.cc @@ -196,7 +196,7 @@ int PortVarDefine(SnortConfig* sc, const char* name, const char* s) } else if ( rstat > 0 ) { - ParseWarning("PortVar '%s', already defined.", po->name); + ParseWarning(WARN_VARS, "PortVar '%s', already defined.", po->name); } #if 0 @@ -522,7 +522,7 @@ VarEntry* VarDefine( break; case SFIP_DUPLICATE: - ParseWarning("Var '%s' redefined.", name); + ParseWarning(WARN_VARS, "Var '%s' redefined.", name); break; case SFIP_CONFLICT: @@ -612,7 +612,7 @@ VarEntry* VarDefine( free(p->value); p->value = SnortStrdup(value); - ParseWarning("Var '%s' redefined\n", p->name); + ParseWarning(WARN_VARS, "Var '%s' redefined\n", p->name); return p; } diff --git a/src/service_inspectors/ftp_telnet/telnet.cc b/src/service_inspectors/ftp_telnet/telnet.cc index b3dd3adb2..ab57720ae 100644 --- a/src/service_inspectors/ftp_telnet/telnet.cc +++ b/src/service_inspectors/ftp_telnet/telnet.cc @@ -59,14 +59,14 @@ static int TelnetCheckConfigs(SnortConfig*, void* pData) if ((telnet_config->ayt_threshold > 0) && !telnet_config->normalize) { - ParseWarning("telnet configuration check: using an " + ParseWarning(WARN_CONF, "telnet configuration check: using an " "AreYouThere threshold requires telnet normalization to be " "turned on.\n"); } if ( telnet_config->detect_encrypted && !telnet_config->normalize) { - ParseWarning("telnet configuration check: checking for " + ParseWarning(WARN_CONF, "telnet configuration check: checking for " "encrypted traffic requires telnet normalization to be turned on.\n"); } diff --git a/src/stream/ip/ip_module.cc b/src/stream/ip/ip_module.cc index c68ae4271..29376ab7a 100644 --- a/src/stream/ip/ip_module.cc +++ b/src/stream/ip/ip_module.cc @@ -79,10 +79,6 @@ FragEngine::FragEngine() // stream_ip module //------------------------------------------------------------------------- -// sequence must match FRAG_POLICY_* enum -#define policies \ - "first | linux | bsd | bsd_right | last | windows | solaris" - static const RuleMap stream_ip_rules[] = { { DEFRAG_IPOPTIONS, DEFRAG_IPOPTIONS_STR }, @@ -114,7 +110,7 @@ static const Parameter s_params[] = { "min_ttl", Parameter::PT_INT, "1:255", "1", "discard fragments with ttl below the minimum" }, - { "policy", Parameter::PT_ENUM, policies, "linux", + { "policy", Parameter::PT_ENUM, IP_POLICIES, IP_POLICY_DEFAULT, "fragment reassembly policy" }, { "session_timeout", Parameter::PT_INT, "1:86400", "30", diff --git a/src/stream/ip/stream_ip.h b/src/stream/ip/stream_ip.h index fd6a9e4c4..0c4dcfb1c 100644 --- a/src/stream/ip/stream_ip.h +++ b/src/stream/ip/stream_ip.h @@ -29,7 +29,7 @@ #include "flow/flow.h" /* engine-based defragmentation policy enums */ -// must update parameter in defrag_module.cc if this changes +// must update stream_api.h::IP_POLICIES if this changes enum { FRAG_POLICY_FIRST = 1, diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h index 9af18721d..660a30487 100644 --- a/src/stream/stream_api.h +++ b/src/stream/stream_api.h @@ -51,6 +51,18 @@ #define SSN_DIR_FROM_RESPONDER 0x02 #define SSN_DIR_BOTH 0x03 +// sequence must match FRAG_POLICY_* enum in stream_ip.h (1-based) +#define IP_POLICIES \ + "first | linux | bsd | bsd-right | last | windows | solaris" + +// sequence must match STREAM_POLICY_* defines in tcp_session.cc (1-based) +#define TCP_POLICIES \ + "first | last | linux | old-linux | bsd | macos | solaris | irix | " \ + "hpux11 | hpux10 | windows | win-2003 | vista | proxy" + +#define IP_POLICY_DEFAULT "linux" +#define TCP_POLICY_DEFAULT "bsd" + class Flow; typedef int (* LogFunction)(Flow*, uint8_t** buf, uint32_t* len, uint32_t* type); diff --git a/src/stream/tcp/tcp_module.cc b/src/stream/tcp/tcp_module.cc index a3f0b548a..a0d565ee7 100644 --- a/src/stream/tcp/tcp_module.cc +++ b/src/stream/tcp/tcp_module.cc @@ -72,11 +72,6 @@ using namespace std; #define STREAM_TCP_NO_3WHS_STR \ "TCP session without 3-way handshake" -// sequence must match STREAM_POLICY_* and REASSEMBLY_POLICY_* defines -#define policies \ - "first | last | linux | old-linux | bsd | macos | solaris | irix | " \ - "hpux | hpux10 | windows | win-2003 | vista | proxy" - static const Parameter stream_tcp_small_params[] = { { "count", Parameter::PT_INT, "0:2048", "0", @@ -119,7 +114,7 @@ static const Parameter s_params[] = { "max_pdu", Parameter::PT_INT, "1460:63780", "16384", "maximum reassembled PDU size" }, - { "policy", Parameter::PT_ENUM, policies, "linux", + { "policy", Parameter::PT_ENUM, TCP_POLICIES, TCP_POLICY_DEFAULT, "determines operating system characteristics like reassembly" }, { "reassemble_async", Parameter::PT_BOOL, nullptr, "true", diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index ebff01d79..6f1e5dd14 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -248,6 +248,7 @@ THREAD_LOCAL Memcap* tcp_memcap = nullptr; #define STREAM_MAX_FLUSH_FACTOR 2048 /* target-based policy types */ +// changes to this enum require changes to stream_api.h::TCP_POLICIES #define STREAM_POLICY_FIRST 1 #define STREAM_POLICY_LAST 2 #define STREAM_POLICY_LINUX 3 @@ -423,17 +424,17 @@ static const char* const reassembly_policy_names[] = "first", "last", "linux", - "old linux", + "old-linux", "bsd", "macos", - "windows", "solaris", "irix", "hpux11", "hpux10", "windows", "win-2003", - "vista" + "vista", + "proxy" }; #ifdef DEBUG_STREAM_EX diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc index a6292ff6b..f0689fe54 100644 --- a/src/target_based/sftarget_reader.cc +++ b/src/target_based/sftarget_reader.cc @@ -264,7 +264,7 @@ int SFAT_AddHostEntryToMap(HostAttributeEntry* host) { if ( !sfat_insufficient_space_logged ) { - ParseWarning( + ParseWarning(WARN_HOSTS, "AttributeTable insertion failed: %d Insufficient " "space in attribute table, only configured to store %d hosts\n", ret, ScMaxAttrHosts()); @@ -275,7 +275,7 @@ int SFAT_AddHostEntryToMap(HostAttributeEntry* host) } else if ( !sfat_grammar_error_printed ) { - ParseWarning( + ParseWarning(WARN_HOSTS, "AttributeTable insertion failed: %d '%s'\n", ret, rt_error_messages[ret]); sfat_grammar_error_printed = true;