From: rcombs Date: Mon, 27 Oct 2014 12:57:56 +0000 (-0400) Subject: REG_TEST changes to make -A cmg look like Snort X-Git-Tag: 3.0.0-233~1325 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bfa897b78c8bc02a99591ee743a2ce34c6ae2e80;p=thirdparty%2Fsnort3.git REG_TEST changes to make -A cmg look like Snort --- diff --git a/ChangeLog b/ChangeLog index c2f44d080..ad04866c6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -27,6 +27,7 @@ -- updated binder to bind data, session, and gadget -- http_inspect -> http_global, http_server -> http_inspect, nhttp_inspect -> new_http_inspect +-- REG_TEST patches to make -A cmg look more like Snort 125 -- discovered can't catch exceptions thrown from Lua to C++; need to diff --git a/src/log/log_text.cc b/src/log/log_text.cc index 4d0ec0580..7b161d96e 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -1601,11 +1601,18 @@ void LogNetData (TextLog* log, const uint8_t* data, const int len, Packet *p) pb += BYTES_PER_FRAME; TextLog_NewLine(log); } +#ifndef REG_TEST TextLog_NewLine(log); +#endif } +#ifdef REG_TEST +#define SEPARATOR \ + "=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+" +#else #define SEPARATOR \ "=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=" +#endif static int LogObfuscatedData(TextLog* log, Packet *p) { @@ -1645,6 +1652,7 @@ static int LogObfuscatedData(TextLog* log, Packet *p) return 0; } +#ifndef REG_TEST static void LogPacketType(TextLog* log, Packet* p) { TextLog_NewLine(log); @@ -1682,6 +1690,7 @@ static void LogPacketType(TextLog* log, Packet* p) } /* switch */ TextLog_NewLine(log); } +#endif /*-------------------------------------------------------------------- * Function: LogIPPkt(TextLog*, int, Packet *) @@ -1701,8 +1710,10 @@ static void LogPacketType(TextLog* log, Packet* p) void LogIPPkt(TextLog* log, Packet * p) { +#ifndef REG_TEST LogPacketType(log, p); TextLog_Print(log, "%s\n", SEPARATOR); +#endif /* dump the timestamp */ LogTimeStamp(log, p); @@ -1819,6 +1830,9 @@ void LogIPPkt(TextLog* log, Packet * p) { LogNetData(log, p->pkt, p->pkth->caplen, p); } +#ifdef REG_TEST + TextLog_Print(log, "\n%s\n", SEPARATOR); +#endif } /*-------------------------------------------------------------------- diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc index 5a38d0dc5..9109ef62c 100644 --- a/src/loggers/alert_fast.cc +++ b/src/loggers/alert_fast.cc @@ -190,6 +190,57 @@ void FastLogger::close() TextLog_Term(fast_log); } +#ifdef REG_TEST +static void LogReassembly(const Packet* p) +{ + /* Log whether or not this is reassembled data - only indicate + * if we're actually going to show any of the payload */ + if ( !ScOutputAppData() || !p->dsize || !PacketWasCooked(p) ) + return; + + switch ( p->pseudo_type ) + { + case PSEUDO_PKT_SMB_SEG: + TextLog_Print(fast_log, "\n%s\n", "SMB desegmented packet"); + break; + case PSEUDO_PKT_DCE_SEG: + TextLog_Print(fast_log, "\n%s\n", "DCE/RPC desegmented packet"); + break; + case PSEUDO_PKT_DCE_FRAG: + TextLog_Print(fast_log, "\n%s\n", "DCE/RPC defragmented packet"); + break; + case PSEUDO_PKT_SMB_TRANS: + TextLog_Print(fast_log, "\n%s\n", "SMB Transact reassembled packet"); + break; + case PSEUDO_PKT_DCE_RPKT: + TextLog_Print(fast_log, "\n%s\n", "DCE/RPC reassembled packet"); + break; + case PSEUDO_PKT_TCP: + TextLog_Print(fast_log, "\n%s\n", "Stream reassembled packet"); + break; + case PSEUDO_PKT_IP: + TextLog_Print(fast_log, "\n%s\n", "Frag reassembled packet"); + break; + default: + // FIXTHIS do we get here for portscan or sdf? + break; + } +} +#endif + +static const char* get_pkt_type(Packet* p) +{ + switch ( p->ptrs.get_pkt_type() ) + { + case PktType::IP: return "IP"; + case PktType::ICMP: return "ICMP"; + case PktType::TCP: return "TCP"; + case PktType::UDP: return "UDP"; + default: break; + } + return "error"; +} + void FastLogger::alert(Packet *p, const char *msg, Event *event) { LogTimeStamp(fast_log, p); @@ -230,25 +281,30 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event) if (msg != NULL) { +#ifdef REG_TEST + string tmp = msg + 1; + tmp.pop_back(); + TextLog_Puts(fast_log, tmp.c_str()); +#else TextLog_Puts(fast_log, msg); - TextLog_Puts(fast_log, " [**] "); - } - else - { - TextLog_Puts(fast_log, "[**] "); +#endif } + TextLog_Puts(fast_log, " [**] "); } /* print the packet header to the alert file */ if (p->has_ip()) { LogPriorityData(fast_log, event, 0); - TextLog_Print(fast_log, "{%s} ", protocol_names[p->get_ip_proto_next()]); + TextLog_Print(fast_log, "{%s} ", get_pkt_type(p)); LogIpAddrs(fast_log, p); } if(packet) { +#ifdef REG_TEST + LogReassembly(p); +#endif if(p->ptrs.ip_api.is_valid()) LogIPPkt(fast_log, p); diff --git a/src/main/snort.cc b/src/main/snort.cc index 0994bbd8c..2ff293c6a 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -912,8 +912,31 @@ void snort_thread_rotate() SetRotatePerfFileFlag(); } +#ifdef REG_TEST +static void PQ_Show (const char* pcap) +{ + if ( !ScPcapShow() ) + return; + + if ( !strcmp(pcap, "-") ) pcap = "stdin"; + + static bool first = true; + if ( first ) + first = false; + else + fprintf(stdout, "%s", "\n"); + + fprintf(stdout, + "Reading network traffic from \"%s\" with snaplen = %d\n", + pcap, DAQ_GetSnapLen()); +} +#endif + void snort_thread_init(const char* intf) { +#ifdef REG_TEST + PQ_Show(intf); +#endif // FIXIT-J the start-up sequence is a little off due to dropping privs DAQ_New(snort_conf, intf); DAQ_Start(); diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc index 9c7f19ce4..1d248633d 100644 --- a/src/network_inspectors/normalize/normalize.cc +++ b/src/network_inspectors/normalize/normalize.cc @@ -167,13 +167,11 @@ public: private: NormalizerConfig config; - bool disabled; }; Normalizer::Normalizer(const NormalizerConfig& nc) { config = nc; - disabled = false; } void Normalizer::tinit() @@ -187,7 +185,7 @@ void Normalizer::tinit() if ( get_ips_policy()->policy_mode != POLICY_MODE__INLINE ) { ParseWarning("normalizations disabled because not inline.\n"); - disabled = true; + config.normalizer_flags = 0; return; } diff --git a/src/service_inspectors/http_inspect/hi_module.h b/src/service_inspectors/http_inspect/hi_module.h index 30588a4a2..0b584f34a 100644 --- a/src/service_inspectors/http_inspect/hi_module.h +++ b/src/service_inspectors/http_inspect/hi_module.h @@ -28,8 +28,13 @@ #include "hi_ui_config.h" #include "hi_events.h" +#ifdef REG_TEST +#define GLOBAL_KEYWORD "http_inspect" +#define SERVER_KEYWORD "http_server" +#else #define GLOBAL_KEYWORD "http_global" #define SERVER_KEYWORD "http_inspect" +#endif #define GLOBAL_HELP "shared HTTP inspector settings" #define SERVER_HELP "main HTTP inspector module" diff --git a/src/service_inspectors/service_inspectors.cc b/src/service_inspectors/service_inspectors.cc index b05d454b4..a36fe4ea0 100644 --- a/src/service_inspectors/service_inspectors.cc +++ b/src/service_inspectors/service_inspectors.cc @@ -33,7 +33,9 @@ extern const BaseApi* sin_bo; extern const BaseApi* sin_ftp_client; extern const BaseApi* sin_ftp_server; extern const BaseApi* sin_ftp_data; +#ifndef REG_TEST extern const BaseApi* sin_nhttp; +#endif extern const BaseApi* sin_rpc_decode; extern const BaseApi* sin_telnet; extern const BaseApi* sin_wizard; @@ -49,7 +51,9 @@ const BaseApi* service_inspectors[] = sin_ftp_client, sin_ftp_server, sin_ftp_data, +#ifndef REG_TEST sin_nhttp, +#endif sin_rpc_decode, sin_telnet, sin_wizard, diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index dc29366cf..4b684847f 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -1897,7 +1897,15 @@ static void ShowRebuiltPacket (TcpSession* ssn, Packet* pkt) { if ( (ssn->client.config->flags & STREAM5_CONFIG_SHOW_PACKETS) || (ssn->server.config->flags & STREAM5_CONFIG_SHOW_PACKETS) ) + { +#ifdef REG_TEST + printf("+++++++++++++++++++Stream Packet+++++++++++++++++++++\n"); +#endif LogIPPkt(pkt); +#ifdef REG_TEST + printf("\n+++++++++++++++++++++++++++++++++++++++++++++++++++++\n"); +#endif + } } static inline unsigned int getSegmentFlushSize(