From: Russ Combs Date: Thu, 10 Apr 2014 10:42:30 +0000 (-0400) Subject: fix compile issue reported by Josh X-Git-Tag: 3.0.0-233~1585 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dbdfcfa0e27e529e326d0863ac752d8ade488a88;p=thirdparty%2Fsnort3.git fix compile issue reported by Josh --- diff --git a/doc/differences.txt b/doc/differences.txt index 030d530e7..83f9fb46e 100644 --- a/doc/differences.txt +++ b/doc/differences.txt @@ -1,81 +1,94 @@ Snort++ differs from Snort in the following ways: -* no ; separated content suboptions -* fastpattern:1 2; -* replaced "unknown args are bpf" with --bpf +* command line and conf file syntax made more uniform +* removed unused and deprecated features +* remove as many barriers to successful run as possible + (eg: no upper bounds on memcaps) +* assume the simplest mode of operation + (eg: never assume input from or output to some hardcoded filename) + +=== Build Options + +* configure --with-lib{pcap,pcre}-* -> --with-{pcap,pcre}-* +* control socket, cs_dir, and users were deleted + +=== Command Line + +* --pause loads config and waits for resume before processing packets +* --require-rule-sid is hardened +* --shell enables interactive Lua shell +* -T is assumed if no input given +* added --help-config prefix to dump all matching settings +* added --script-path +* added -K text; -K text/pcap is old dump/log mode * added -z <#> and --max-packet-threads <#> -* sid == 0 not allowed -* all rules must have a sid -* deleted log_ascii -* deleted activate / dynamic rules -* changed default logging mode to -K none -* deleted layer2resets and flexresp2_* -* deleted config threshold and ips rule threshold (-> event_filter) -* deleted --disable-attribute-table-reload-thread -* deleted config decode_*_{alerts,drops} (use rules only) +* delete --enable-mpls-multicast, --enable-mpls-overlapping-ip, + --max-mpls-labelchain-len, --mpls-payload-type * deleted --no-interface-pidfile +* deleting command line options which will be available with --lua or some such including: + -I, -h, -F, -p, --disable-inline-init-failopen +* hardened -n < 0 +* removed --search-method +* replaced "unknown args are bpf" with --bpf * replaced --dynamic-*-lib[-dir] with --plugin-path (with : separators) + +=== Conf File + +* Snort++ has a default unicode.map +* Snort++ will not enforce an upper bound on memcaps and the like within 64 bits +* Snort++ will supply a default *_global config if not specified + (Snort would fatal; eg http_inspect_server w/o http_inspect_global) +* address list syntax changes: [[ and ]] must be [ [ and ] ] to avoid Lua string + parsing errors (unless in quoted string) +* because the Lua conf is live code, we lose file:line locations in app error messages + (syntax errors from Lua have file:line) * changed search-method names for consistency -* eliminated ac-split; must use ac-full-q split-any-any -* removed --search-method -* lowmem* search methods are now in snort_examples -* deleted config dump-dynamic-rules-path -* deleted config ipv6_frag (not actually used) -* deleted metadata engine shared -* soid is now a non-metadata option -* rule option sequence: soid -* added --script-path -* switched to lua path -* config autogenerate_preprocessor_decoder_rules: - only with 1 packet thread (should probably delete this) - renamed to autogenerate_builtin_rules -* deleting command line options which will be available with --lua or some - such including: -I, -h, -F, -p, --disable-inline-init-failopen * delete config include_vlan_in_alerts (not used in code) * delete config so_rule_memcap (not used in code) -* delete --enable-mpls-multicast, --enable-mpls-overlapping-ip, - --max-mpls-labelchain-len, --mpls-payload-type -* lua field names are (lower) case sensitive; snort.conf largely wasn't -* renamed type and print config suboptions to avoid confusion with lua - functions (not strictly necessary) -* deleted unused rule_state.action -* general output guideline: don't print zero counts -* because the Lua conf is live code, we lose file:line locations in - app error messages (syntax errors from Lua have file:line) -* added --help-config prefix to dump all matching settings -* hardened -n < 0 -* removed various run modes - now just one -* added -K text; -K text/pcap is old dump/log mode -* -T is assumed if no input given -* --require-rule-sid is hardened -* --shell enables interactive Lua shell -* --pause loads config and waits for resume before processing packets -* no positional parameters; all name = value -* alert_fast includes packet data by default -* all text mode outputs default to stdout -* limits like "1234K" are now "limit = 1234, units = 'K'" -* Snort++ queues decoder and inspector events to the main event queue - before ips policy is selected; since some events may not be enabled, - the queue needs to be sized larger than with Snort which used an - intermediate queue for decoder events. -* deleted metadata: rule-flushing (with PDU flushing rule flushing can - cause missed attacks, the opposite of its intent) -* configure --with-lib{pcap,pcre}-* -> --with-{pcap,pcre}-* -* control socket, cs_dir, and users were deleted -* frag3 default policy is linux not bsd +* deleted --disable-attribute-table-reload-thread +* deleted config decode_*_{alerts,drops} (use rules only) +* deleted config dump-dynamic-rules-path +* deleted config ipv6_frag (not actually used) +* deleted config threshold and ips rule threshold (-> event_filter) +* eliminated ac-split; must use ac-full-q split-any-any * frag3 -> defrag, arpspoof -> arp_spoof, sfportscan -> port_scan, perfmonitor -> perf_monitor, bo -> back_orifice -* portscan.detect_ack_scans deleted (exact same as include_midstream) -* address list syntax changes: [[ and ]] must be [ [ and ] ] to avoid Lua - string parsing errors (unless in quoted string) -* module filenames are not configurable: - always / +* limits like "1234K" are now "limit = 1234, units = 'K'" +* lua field names are (lower) case sensitive; snort.conf largely wasn't +* module filenames are not configurable: always / (suffix is determined by module) +* no positional parameters; all name = value * perf_monitor configuration was simplified -* Snort++ will not enforce an upper bound on memcaps and the like within 64 - bits -* Snort++ will supply a default *_global config if not specified - (Snort would fatal; eg http_inspect_server w/o http_inspect_global) -* Snort++ has a default unicode.map +* portscan.detect_ack_scans deleted (exact same as include_midstream) +* removed various run modes - now just one +* frag3 default policy is linux not bsd +* lowmem* search methods are now in snort_examples +* deleted unused http_inspect stateful mode + +=== Rules + +* all rules must have a sid +* deleted activate / dynamic rules +* deleted metadata engine shared +* deleted metadata: rule-flushing (with PDU flushing rule flushing can cause + missed attacks, the opposite of its intent) +* deleted unused rule_state.action +* fastpattern:1 2; +* no ; separated content suboptions +* rule option sequence: soid +* sid == 0 not allowed +* soid is now a non-metadata option + +=== Output + +* alert_fast includes packet data by default +* all text mode outputs default to stdout +* changed default logging mode to -K none +* deleted layer2resets and flexresp2_* +* deleted log_ascii +* general output guideline: don't print zero counts +* Snort++ queues decoder and inspector events to the main event queue before ips policy + is selected; since some events may not be enabled, the queue needs to be sized larger + than with Snort which used an intermediate queue for decoder events. * deleted the intermediate http and ftp_telnet event queues diff --git a/doc/style.txt b/doc/style.txt index 05c0b0a06..a26af7ba9 100644 --- a/doc/style.txt +++ b/doc/style.txt @@ -16,6 +16,8 @@ yet firm so feedback is welcome to get something we can live with. * Use lower case filenames with underscores. +* Use lower case namespaces (preferably short, w/o underscores). + === Comments * Write comments sparingly with a mind towards future proofing. Often the @@ -61,6 +63,18 @@ yet firm so feedback is welcome to get something we can live with. calling_a_func_with_a_long_name( arg1, arg2, arg3); +* Put function signature on one line, except when breaking for the arg + list: + + No: + inline + bool foo() + { // ... + + Yes: + inline bool foo() + { // ... + === Headers * Don't hesitate to create a new header if it is needed. Don't lump diff --git a/src/framework/inspector.h b/src/framework/inspector.h index 1e859c301..bf5c82826 100644 --- a/src/framework/inspector.h +++ b/src/framework/inspector.h @@ -97,8 +97,8 @@ typedef Inspector* (*PreprocCtorFunc)(Module*); typedef void (*PreprocDtorFunc)(Inspector*); // FIXIT ensure all pp's provide stats -struct -InspectApi { +struct InspectApi +{ BaseApi base; Priority priority; uint16_t proto_bits; diff --git a/src/framework/ips_option.h b/src/framework/ips_option.h index e0b20680a..e4934c241 100644 --- a/src/framework/ips_option.h +++ b/src/framework/ips_option.h @@ -86,8 +86,8 @@ typedef enum _RuleOptType } RuleOptType; -struct -IpsApi { +struct IpsApi +{ BaseApi base; RuleOptType type; unsigned max_per_rule; diff --git a/src/framework/logger.h b/src/framework/logger.h index 3ce484aaa..dd9980ebf 100644 --- a/src/framework/logger.h +++ b/src/framework/logger.h @@ -67,8 +67,8 @@ typedef Logger* (*eh_new)(struct SnortConfig*, class Module*); typedef void (*eh_del)(Logger*); // FIXIT ensure all eh provide stats -struct -LogApi { +struct LogApi +{ BaseApi base; unsigned flags; eh_new ctor; diff --git a/src/framework/mpse.h b/src/framework/mpse.h index 6239215b7..8c2eaaffa 100644 --- a/src/framework/mpse.h +++ b/src/framework/mpse.h @@ -127,8 +127,8 @@ typedef Mpse* (*mpse_new_f)( typedef void (*mpse_del_f)(Mpse*); -struct -MpseApi { +struct MpseApi +{ BaseApi base; bool trim; diff --git a/src/framework/so_rule.h b/src/framework/so_rule.h index 609d61d0f..1470957f1 100644 --- a/src/framework/so_rule.h +++ b/src/framework/so_rule.h @@ -46,8 +46,8 @@ typedef so_eval_f (*so_new_f)(const char* key, void**); typedef void (*so_del_f)(void*); typedef void (*so_aux_f)(); -struct -SoApi { +struct SoApi +{ BaseApi base; const uint8_t* rule; diff --git a/src/log/messages.h b/src/log/messages.h index 73a1a96a9..478834f64 100644 --- a/src/log/messages.h +++ b/src/log/messages.h @@ -73,7 +73,7 @@ public: void dump(const char* s, unsigned v) { const char* eol = !(++idx % max) ? "\n" : ""; - LogMessage("\t%15.15s(v%u)%s", s, v, eol); + LogMessage(" %18.18s(v%u)%s", s, v, eol); }; private: unsigned max; diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc index 3282dbddd..77d7e8939 100644 --- a/src/packet_io/sfdaq.cc +++ b/src/packet_io/sfdaq.cc @@ -596,7 +596,7 @@ const DAQ_Stats_t* DAQ_GetStats (void) //-------------------------------------------------------------------- -int DAQ_ModifyFlow(const void* /*h*/, uint32_t /*id*/) +int DAQ_ModifyFlow(const void* h, uint32_t id) { #ifdef HAVE_DAQ_ACQUIRE_WITH_META const DAQ_PktHdr_t *hdr = (DAQ_PktHdr_t*) h; @@ -605,6 +605,8 @@ int DAQ_ModifyFlow(const void* /*h*/, uint32_t /*id*/) mod.opaque = id; return daq_modify_flow(daq_mod, daq_hand, hdr, &mod); #else + UNUSED(h); + UNUSED(id); return -1; #endif }