From: Russ Combs Date: Wed, 29 Apr 2015 20:03:12 +0000 (-0400) Subject: Squashed commit of the following: X-Git-Tag: 3.0.0-233~989 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ea013765532a7c10bc8d4c391501a48d1e9e2a67;p=thirdparty%2Fsnort3.git Squashed commit of the following: russ: -- ensure unknown sources are analyzed -- change daq.var to daq.vars to support multiple params, reported by Sancho Panza -- fixed urg option -- fix hi mpse search -- additional refactoring and cleanup --- diff --git a/ChangeLog b/ChangeLog index 89b3559cd..779cfdfff 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,11 @@ Pending - build 150 +-- additional refactoring and cleanup +-- fix http_inspect mpse search +-- fixed urg rule option +-- change daq.var to daq.vars to support multiple params + reported by Sancho Panza +-- ensure unknown sources are analyzed -- pop and imap inspectors ported 15/04/28 - build 149 diff --git a/extra/src/inspectors/data_log.cc b/extra/src/inspectors/data_log.cc index 761de955d..e76537eb9 100644 --- a/extra/src/inspectors/data_log.cc +++ b/extra/src/inspectors/data_log.cc @@ -130,7 +130,7 @@ void DataLog::show(SnortConfig*) static const Parameter dl_params[] = { - { "key", Parameter::PT_STRING, nullptr, nullptr, + { "key", Parameter::PT_STRING, nullptr, "http_uri", "name of data buffer to log" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc index ddedb6321..b414aa400 100644 --- a/extra/src/ips_options/ips_urg.cc +++ b/extra/src/ips_options/ips_urg.cc @@ -42,10 +42,6 @@ static const char* s_name = "urg"; static const char* s_help = "detection for TCP urgent pointer"; -// FIXIT-H profiling is desirable but must be refactored to -// avoid dependence on snort_config.h which snowballs -//#undef PERF_PROFILING - static THREAD_LOCAL ProfileStats tcpUrgPerfStats; //------------------------------------------------------------------------- @@ -92,15 +88,18 @@ bool TcpUrgOption::operator==(const IpsOption& ips) const int TcpUrgOption::eval(Cursor&, Packet* p) { - //PROFILE_VARS; - //MODULE_PROFILE_START(tcpUrgPerfStats); + PROFILE_VARS; + MODULE_PROFILE_START(tcpUrgPerfStats); int rval = DETECTION_OPTION_NO_MATCH; - if ( p->ptrs.tcph && config.eval(p->ptrs.tcph->th_ack) ) + if ( p->ptrs.tcph and p->ptrs.tcph->are_flags_set(TH_URG) and + config.eval(p->ptrs.tcph->urp()) ) + { rval = DETECTION_OPTION_MATCH; + } - //MODULE_PROFILE_END(tcpUrgPerfStats); + MODULE_PROFILE_END(tcpUrgPerfStats); return rval; } @@ -110,7 +109,7 @@ int TcpUrgOption::eval(Cursor&, Packet* p) static const Parameter s_params[] = { - { "*range", Parameter::PT_STRING, nullptr, nullptr, + { "~range", Parameter::PT_STRING, nullptr, nullptr, "check if urgent offset is min<>max | min" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } @@ -138,7 +137,7 @@ bool UrgModule::begin(const char*, int, SnortConfig*) bool UrgModule::set(const char*, Value& v, SnortConfig*) { - if ( !v.is("*range") ) + if ( !v.is("~range") ) return false; return data.parse(v.get_string()); diff --git a/src/detection/detection_util.cc b/src/detection/detection_util.cc index 80ce745f3..e09a7295e 100644 --- a/src/detection/detection_util.cc +++ b/src/detection/detection_util.cc @@ -21,6 +21,7 @@ #include "detection_util.h" #include +#include #include "snort_config.h" #include "log/text_log.h" @@ -121,11 +122,10 @@ void EventTrace_Init(void) char time_buf[26]; ctime_r(&now, time_buf); - char buf[STD_BUF]; - const char* dir = snort_conf->log_dir ? snort_conf->log_dir : "."; - snprintf(buf, sizeof(buf), "%s/%s", dir, snort_conf->event_trace_file); + std::string fname; + get_instance_file(fname, "event_trace.txt"); - tlog = TextLog_Init (buf, 128, 8*1024*1024); + tlog = TextLog_Init (fname.c_str(), 128, 8*1024*1024); TextLog_Print(tlog, "\nTrace started at %s", time_buf); TextLog_Print(tlog, "Trace max_data is %u bytes\n", snort_conf->event_trace_max); } diff --git a/src/framework/parameter.h b/src/framework/parameter.h index 9d4f2cb3d..270557b1a 100644 --- a/src/framework/parameter.h +++ b/src/framework/parameter.h @@ -28,8 +28,8 @@ struct Parameter { enum Type { - PT_TABLE, // range is Parameter*, deflt is TBD - PT_LIST, // range is Parameter*, deflt is TBD + PT_TABLE, // range is Parameter*, no default + PT_LIST, // range is Parameter*, no default PT_BOOL, // if you are reading this, get more coffee PT_INT, // signed 64 bits or less determined by range PT_REAL, // double diff --git a/src/framework/value.cc b/src/framework/value.cc index cafe1d6b7..0ae924274 100644 --- a/src/framework/value.cc +++ b/src/framework/value.cc @@ -133,7 +133,12 @@ void Value::set_first_token() bool Value::get_next_token(string& tok) { - return ss && ( *ss >> tok ); + return ss and ( *ss >> tok ); +} + +bool Value::get_next_csv_token(string& tok) +{ + return ss and std::getline(*ss, tok, ','); } bool Value::strtol(long& n) const @@ -171,3 +176,35 @@ const char* Value::get_as_string() return str.c_str(); } +void Value::update_mask(uint8_t& mask, uint8_t flag, bool invert) +{ + if ( get_bool() xor invert ) + mask |= flag; + else + mask &= ~flag; +} + +void Value::update_mask(uint16_t& mask, uint16_t flag, bool invert) +{ + if ( get_bool() xor invert ) + mask |= flag; + else + mask &= ~flag; +} + +void Value::update_mask(uint32_t& mask, uint32_t flag, bool invert) +{ + if ( get_bool() xor invert ) + mask |= flag; + else + mask &= ~flag; +} + +void Value::update_mask(uint64_t& mask, uint64_t flag, bool invert) +{ + if ( get_bool() xor invert ) + mask |= flag; + else + mask &= ~flag; +} + diff --git a/src/framework/value.h b/src/framework/value.h index b8d73c5e8..c11f3e261 100644 --- a/src/framework/value.h +++ b/src/framework/value.h @@ -128,6 +128,13 @@ public: void set_first_token(); bool get_next_token(std::string&); + bool get_next_csv_token(std::string&); + + // set/clear flag based on get_bool() + void update_mask(uint8_t& mask, uint8_t flag, bool invert = false); + void update_mask(uint16_t& mask, uint16_t flag, bool invert = false); + void update_mask(uint32_t& mask, uint32_t flag, bool invert = false); + void update_mask(uint64_t& mask, uint64_t flag, bool invert = false); private: void init() diff --git a/src/main.cc b/src/main.cc index f9b8875e4..e66e2189b 100644 --- a/src/main.cc +++ b/src/main.cc @@ -753,6 +753,19 @@ static inline bool dont_stop() return false; } +static const char* get_source() +{ + if ( Trough_Next() ) + return Trough_First(); + + if ( unknown_source ) + { + unknown_source = false; + return ""; + } + return nullptr; +} + static void main_loop() { unsigned idx = max_pigs, swine = 0; @@ -775,10 +788,10 @@ static void main_loop() --swine; } } - else if ( Trough_Next() ) + else if ( const char* src = get_source() ) { Swapper* swapper = new Swapper(snort_conf, SFAT_GetConfig()); - pig.start(idx, Trough_First(), swapper); + pig.start(idx, src, swapper); ++swine; continue; } diff --git a/src/main/modules.cc b/src/main/modules.cc index eb4f219db..052ac05a8 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -99,12 +99,8 @@ bool DetectionModule::set(const char*, Value& v, SnortConfig* sc) sc->asn1_mem = v.get_long(); else if ( v.is("pcre_enable") ) - { - if ( v.get_bool() ) - sc->run_flags &= ~RUN_FLAG__NO_PCRE; - else - sc->run_flags |= RUN_FLAG__NO_PCRE; - } + v.update_mask(sc->run_flags, RUN_FLAG__NO_PCRE, true); + else if ( v.is("pcre_match_limit") ) sc->pcre_match_limit = v.get_long(); @@ -590,7 +586,7 @@ public: bool AlertsModule::set(const char*, Value& v, SnortConfig* sc) { if ( v.is("alert_with_interface_name") ) - sc->output_flags |= OUTPUT_FLAG__ALERT_IFACE; + v.update_mask(sc->output_flags, OUTPUT_FLAG__ALERT_IFACE); else if ( v.is("default_rule_state") ) sc->default_rule_state = v.get_bool(); @@ -616,7 +612,7 @@ bool AlertsModule::set(const char*, Value& v, SnortConfig* sc) return ( sfip_pton(v.get_string(), &sc->homenet) == SFIP_SUCCESS ); else if ( v.is("stateful") ) - sc->run_flags |= RUN_FLAG__ASSURE_EST; + v.update_mask(sc->run_flags, RUN_FLAG__ASSURE_EST); else if ( v.is("tunnel_verdicts") ) ConfigTunnelVerdicts(sc, v.get_string()); @@ -633,9 +629,6 @@ bool AlertsModule::set(const char*, Value& v, SnortConfig* sc) static const Parameter output_event_trace_params[] = { - { "file", Parameter::PT_STRING, nullptr, nullptr, - "where to write event trace logs" }, - { "max_data", Parameter::PT_INT, "0:65535", "0", "maximum amount of packet data to capture" }, @@ -696,62 +689,42 @@ public: bool OutputModule::set(const char*, Value& v, SnortConfig* sc) { if ( v.is("dump_chars_only") ) - { - if ( v.get_bool() ) - sc->output_flags |= OUTPUT_FLAG__CHAR_DATA; - } + v.update_mask(sc->output_flags, OUTPUT_FLAG__CHAR_DATA); + else if ( v.is("dump_payload") ) - { - if ( v.get_bool() ) - sc->output_flags |= OUTPUT_FLAG__APP_DATA; - } + v.update_mask(sc->output_flags, OUTPUT_FLAG__APP_DATA); + else if ( v.is("dump_payload_verbose") ) - { - if ( v.get_bool() ) - sc->output_flags |= OUTPUT_FLAG__VERBOSE_DUMP; - } - else if ( v.is("file") ) - sc->event_trace_file = SnortStrdup(v.get_string()); + v.update_mask(sc->output_flags, OUTPUT_FLAG__VERBOSE_DUMP); else if ( v.is("log_ipv6_extra_data") ) - { - if ( v.get_bool() ) - sc->log_ipv6_extra = 1; // FIXIT-M move to output|logging_flags - } + // FIXIT-M move to output|logging_flags + sc->log_ipv6_extra = v.get_bool() ? 0 : 1; + else if ( v.is("quiet") ) - { - if ( v.get_bool() ) - sc->logging_flags |= LOGGING_FLAG__QUIET; - } + v.update_mask(sc->logging_flags, LOGGING_FLAG__QUIET); + else if ( v.is("logdir") ) - sc->log_dir = SnortStrdup(v.get_string()); + sc->log_dir = v.get_string(); else if ( v.is("max_data") ) sc->event_trace_max = v.get_long(); else if ( v.is("nolog") ) - { - if ( v.get_bool() ) - sc->output_flags |= OUTPUT_FLAG__NO_LOG; - } + v.update_mask(sc->output_flags, OUTPUT_FLAG__NO_LOG); + else if ( v.is("obfuscate") ) - { - if ( v.get_bool() ) - sc->output_flags |= OUTPUT_FLAG__OBFUSCATE; - } + v.update_mask(sc->output_flags, OUTPUT_FLAG__OBFUSCATE); + else if ( v.is("show_year") ) - { - if ( v.get_bool() ) - sc->output_flags |= OUTPUT_FLAG__INCLUDE_YEAR; - } + v.update_mask(sc->output_flags, OUTPUT_FLAG__INCLUDE_YEAR); + else if ( v.is("tagged_packet_limit") ) sc->tagged_packet_limit = v.get_long(); else if ( v.is("verbose") ) - { - if ( v.get_bool() ) - sc->logging_flags |= LOGGING_FLAG__VERBOSE; - } + v.update_mask(sc->logging_flags, LOGGING_FLAG__VERBOSE); + else return false; @@ -798,7 +771,7 @@ bool ActiveModule::set(const char*, Value& v, SnortConfig* sc) sc->respond_attempts = v.get_long(); else if ( v.is("device") ) - sc->respond_device = SnortStrdup(v.get_string()); + sc->respond_device = v.get_string(); else if ( v.is("dst_mac") ) ConfigDstMac(sc, v.get_string()); @@ -858,13 +831,11 @@ bool PacketsModule::set(const char*, Value& v, SnortConfig* sc) sc->addressspace_agnostic = v.get_long(); else if ( v.is("bpf_file") ) - sc->bpf_file = SnortStrdup(v.get_string()); + sc->bpf_file = v.get_string(); else if ( v.is("enable_inline_init_failopen") ) - { - if ( !v.get_bool() ) - sc->run_flags |= RUN_FLAG__DISABLE_FAILOPEN; - } + v.update_mask(sc->run_flags, RUN_FLAG__DISABLE_FAILOPEN, true); + else if ( v.is("limit") ) sc->pkt_cnt = v.get_long(); @@ -902,8 +873,8 @@ static const Parameter daq_params[] = "select type of DAQ" }, // FIXIT-L should be a list? - { "var", Parameter::PT_STRING, nullptr, nullptr, - "list of name=value DAQ-specific parameters" }, + { "vars", Parameter::PT_STRING, nullptr, nullptr, + "comma separated list of name=value DAQ-specific parameters" }, { "snaplen", Parameter::PT_INT, "0:65535", "deflt", "set snap length (same as -P)" }, @@ -934,16 +905,19 @@ bool DaqModule::set(const char*, Value& v, SnortConfig* sc) ConfigDaqMode(sc, v.get_string()); else if ( v.is("no_promisc") ) - { - if ( v.get_bool() ) - sc->run_flags |= RUN_FLAG__NO_PROMISCUOUS; - } + v.update_mask(sc->run_flags, RUN_FLAG__NO_PROMISCUOUS); + else if ( v.is("type") ) ConfigDaqType(sc, v.get_string()); - else if ( v.is("var") ) - ConfigDaqVar(sc, v.get_string()); + else if ( v.is("vars") ) + { + string tok; + v.set_first_token(); + while ( v.get_next_csv_token(tok) ) + ConfigDaqVar(sc, tok.c_str()); + } else if ( v.is("decode_data_link") ) { if ( v.get_bool() ) diff --git a/src/main/snort.cc b/src/main/snort.cc index f62cc0618..5ce2614fc 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -248,8 +248,8 @@ void Snort::init(int argc, char** argv) CodecManager::instantiate(); - if ( snort_conf->output ) - EventManager::instantiate(snort_conf->output, snort_conf); + if ( !snort_conf->output.empty() ) + EventManager::instantiate(snort_conf->output.c_str(), snort_conf); if (SnortConfig::alert_before_pass()) { @@ -282,11 +282,11 @@ void Snort::init(int argc, char** argv) // FIXIT-L stuff like this that is also done in snort_config.cc::VerifyReload() // should be refactored - if ((snort_conf->bpf_filter == NULL) && (snort_conf->bpf_file != NULL)) - snort_conf->bpf_filter = read_infile("packets.bpf_file", snort_conf->bpf_file); + if ( snort_conf->bpf_filter.empty() && !snort_conf->bpf_file.empty() ) + snort_conf->bpf_filter = read_infile("bpf_file", snort_conf->bpf_file.c_str()); - if (snort_conf->bpf_filter != NULL) - LogMessage("Snort BPF option: %s\n", snort_conf->bpf_filter); + if ( !snort_conf->bpf_filter.empty() ) + LogMessage("Snort BPF option: %s\n", snort_conf->bpf_filter.c_str()); } // this function should only include initialization that must be done as a @@ -305,19 +305,20 @@ void Snort::init(int argc, char** argv) // much initialization stuff in Snort::init() as possible and to restrict this // function to those things that depend on DAQ startup or non-root user/group. // -// FIXIT-J breaks DAQ_New()/Start() because packet threads won't be root when +// FIXIT-L breaks DAQ_New()/Start() because packet threads won't be root when // opening iface void Snort::unprivileged_init() { /* create the PID file */ - if ( !SnortConfig::read_mode() && (SnortConfig::daemon_mode() || SnortConfig::create_pid_file())) + if ( !SnortConfig::read_mode() && + (SnortConfig::daemon_mode() || SnortConfig::create_pid_file())) { CreatePidFile(snort_main_thread_pid); } /* Drop the Chrooted Settings */ - if (snort_conf->chroot_dir) - SetChroot(snort_conf->chroot_dir, &snort_conf->log_dir); + if ( !snort_conf->chroot_dir.empty() ) + SetChroot(snort_conf->chroot_dir, snort_conf->log_dir); /* Drop privileges if requested, when initialization is done */ SetUidGid(SnortConfig::get_uid(), SnortConfig::get_gid()); @@ -355,16 +356,14 @@ void Snort::term() ClosePidFile(); /* remove pid file */ - if ( snort_conf->pid_filename[0] ) + if ( !snort_conf->pid_filename.empty() ) { - int ret; - - ret = unlink(snort_conf->pid_filename); + int ret = unlink(snort_conf->pid_filename.c_str()); if (ret != 0) { ErrorMessage("Could not remove pid file %s: %s\n", - snort_conf->pid_filename, get_error(errno)); + snort_conf->pid_filename.c_str(), get_error(errno)); } } @@ -406,11 +405,8 @@ void Snort::clean_exit(int) { SnortConfig tmp; - /* Have to trick LogMessage to log correctly after snort_conf - * is freed */ - memset(&tmp, 0, sizeof(tmp)); - - if (snort_conf != NULL) + // Have to trick LogMessage to log correctly after snort_conf is freed + if ( snort_conf ) { tmp.logging_flags |= (snort_conf->logging_flags & LOGGING_FLAG__QUIET); @@ -590,8 +586,8 @@ void Snort::thread_init(const char* intf) show_source(intf); // FIXIT-M the start-up sequence is a little off due to dropping privs - DAQ_New(snort_conf, intf); - DAQ_Start(); + if ( !DAQ_New(snort_conf, intf) ) + DAQ_Start(); s_packet = PacketManager::encode_new(false); CodecManager::thread_init(snort_conf); diff --git a/src/main/snort_config.cc b/src/main/snort_config.cc index 49e260f99..73097489d 100644 --- a/src/main/snort_config.cc +++ b/src/main/snort_config.cc @@ -54,6 +54,7 @@ #include "time/ppm.h" #include "time/profiler.h" #include "main/thread.h" +#include "sfip/sf_ip.h" THREAD_LOCAL SnortConfig* snort_conf = nullptr; @@ -153,44 +154,16 @@ static void init_policies(SnortConfig* sc) * among run_modes is how we handle packets via the log_func. */ SnortConfig::SnortConfig() { - memset(this, 0, sizeof(*this)); - - pkt_cnt = 0; - pkt_skip = 0; - pkt_snaplen = -1; - output_flags = 0; num_layers = DEFAULT_LAYERMAX; - max_ip6_extensions = 0; - max_ip_layers = 0; - gtp_ports = nullptr; - - /*user_id and group_id should be initialized to -1 by default, because - * chown() use this later, -1 means no change to user_id/group_id*/ - user_id = -1; - group_id = -1; - - tagged_packet_limit = 256; - default_rule_state = true; - - // FIXIT-L pcre_match_limit* are interdependent - // somehow a packet thread needs a much lower setting - pcre_match_limit = 1500; - pcre_match_limit_recursion = 1500; - - memset(pid_filename, 0, sizeof(pid_filename)); - /* Default max size of the attribute table */ max_attribute_hosts = DEFAULT_MAX_ATTRIBUTE_HOSTS; max_attribute_services_per_host = DEFAULT_MAX_ATTRIBUTE_SERVICES_PER_HOST; - /* Default max number of services per rule */ max_metadata_services = DEFAULT_MAX_METADATA_SERVICES; mpls_stack_depth = DEFAULT_LABELCHAIN_LENGTH; InspectorManager::new_config(this); - var_list = NULL; - num_slots = get_instance_max(); state = (SnortState*)SnortAlloc(sizeof(SnortState)*num_slots); @@ -211,28 +184,21 @@ SnortConfig::SnortConfig() source_affinity = new std::map; thread_affinity = new std::vector(32, -1); -} - -SnortConfig::~SnortConfig() -{ - if ( log_dir ) - free(log_dir); - - if ( orig_log_dir ) - free(orig_log_dir); - - if ( bpf_file ) - free(bpf_file); - if ( chroot_dir ) - free(chroot_dir); + sfip_clear(homenet); + sfip_clear(obfuscation_net); - if ( bpf_filter ) - free(bpf_filter); + memset(evalOrder, 0, sizeof(evalOrder)); - if ( event_trace_file ) - free(event_trace_file); + memset(&Alert, 0, sizeof(Alert)); + memset(&Log, 0, sizeof(Log)); + memset(&Pass, 0, sizeof(Pass)); + memset(&Drop, 0, sizeof(Drop)); + memset(&SDrop, 0, sizeof(SDrop)); +} +SnortConfig::~SnortConfig() +{ FreeRuleStateList(rule_state_list); FreeClassifications(classifications); FreeReferences(references); @@ -252,9 +218,7 @@ SnortConfig::~SnortConfig() if ( ip_proto_only_lists ) { - unsigned int j; - - for (j = 0; j < NUM_IP_PROTOS; j++) + for (int j = 0; j < NUM_IP_PROTOS; j++) sflist_free_all(ip_proto_only_lists[j], NULL); free(ip_proto_only_lists); @@ -262,27 +226,15 @@ SnortConfig::~SnortConfig() fpDeleteFastPacketDetection(this); - if ( daq_type ) - free(daq_type); - - if ( daq_mode ) - free(daq_mode); - if ( daq_vars ) StringVector_Delete(daq_vars); if ( daq_dirs ) StringVector_Delete(daq_dirs); - if ( respond_device ) - free(respond_device); - if (eth_dst ) free(eth_dst); - if ( output ) - free(output); - delete file_config; if ( var_list ) @@ -358,25 +310,19 @@ void SnortConfig::setup() // merge in everything from the command line config void SnortConfig::merge(SnortConfig* cmd_line) { - if ( !cmd_line->log_dir && !log_dir ) - log_dir = SnortStrdup(DEFAULT_LOG_DIR); + if ( !cmd_line->log_dir.empty() ) + log_dir = cmd_line->log_dir; - else if ( cmd_line->log_dir ) - { - if ( log_dir ) - free(log_dir); - - log_dir = SnortStrdup(cmd_line->log_dir); - } + if ( log_dir.empty() ) + log_dir = DEFAULT_LOG_DIR; run_prefix = cmd_line->run_prefix; - cmd_line->run_prefix = nullptr; id_subdir = cmd_line->id_subdir; id_zero = cmd_line->id_zero; /* Used because of a potential chroot */ - orig_log_dir = SnortStrdup(log_dir); + orig_log_dir = log_dir; event_log_id = cmd_line->event_log_id; @@ -395,7 +341,6 @@ void SnortConfig::merge(SnortConfig* cmd_line) // only set by cmd_line to override other conf output settings output = cmd_line->output; - cmd_line->output = nullptr; /* Merge checksum flags. If command line modified them, use from the * command line, else just use from config_file. */ @@ -428,15 +373,11 @@ void SnortConfig::merge(SnortConfig* cmd_line) if (cmd_line->homenet.family != 0) memcpy(&homenet, &cmd_line->homenet, sizeof(sfip_t)); - if ( cmd_line->bpf_file ) - { - if ( bpf_file ) - free(bpf_file); - bpf_file = SnortStrdup(cmd_line->bpf_file); - } + if ( !cmd_line->bpf_file.empty() ) + bpf_file = cmd_line->bpf_file; - if ( cmd_line->bpf_filter ) - bpf_filter = SnortStrdup(cmd_line->bpf_filter); + if ( !cmd_line->bpf_filter.empty() ) + bpf_filter = cmd_line->bpf_filter; if (cmd_line->pkt_snaplen != -1) pkt_snaplen = cmd_line->pkt_snaplen; @@ -457,18 +398,16 @@ void SnortConfig::merge(SnortConfig* cmd_line) if (cmd_line->file_mask != 0) file_mask = cmd_line->file_mask; - if ( cmd_line->chroot_dir ) + if ( !cmd_line->chroot_dir.empty() ) { - if ( chroot_dir ) - free(chroot_dir); - chroot_dir = SnortStrdup(cmd_line->chroot_dir); + chroot_dir = cmd_line->chroot_dir; } - if ( cmd_line->daq_type ) - daq_type = SnortStrdup(cmd_line->daq_type); + if ( cmd_line->daq_type.size() ) + daq_type = cmd_line->daq_type; - if ( cmd_line->daq_mode ) - daq_mode = SnortStrdup(cmd_line->daq_mode); + if ( cmd_line->daq_mode.size() ) + daq_mode = cmd_line->daq_mode; if ( cmd_line->dirty_pig ) dirty_pig = cmd_line->dirty_pig; @@ -531,19 +470,7 @@ bool SnortConfig::verify() return false; } - if ( !bpf_filter && bpf_file ) - bpf_filter = read_infile("packets.bpf_file", bpf_file); - - if ( bpf_filter && snort_conf->bpf_filter ) - { - if (strcasecmp(snort_conf->bpf_filter, bpf_filter) != 0) - { - ErrorMessage("Snort Reload: Changing the bpf filter configuration " - "requires a restart.\n"); - return false; - } - } - else if (bpf_filter != snort_conf->bpf_filter) + if ( bpf_filter != snort_conf->bpf_filter ) { ErrorMessage("Snort Reload: Changing the bpf filter configuration " "requires a restart.\n"); @@ -558,16 +485,7 @@ bool SnortConfig::verify() return false; } - if ( snort_conf->chroot_dir && chroot_dir ) - { - if (strcasecmp(snort_conf->chroot_dir, chroot_dir) != 0) - { - ErrorMessage("Snort Reload: Changing the chroot directory " - "configuration requires a restart.\n"); - return false; - } - } - else if (snort_conf->chroot_dir != chroot_dir) + if (snort_conf->chroot_dir != chroot_dir) { ErrorMessage("Snort Reload: Changing the chroot directory " "configuration requires a restart.\n"); @@ -583,16 +501,7 @@ bool SnortConfig::verify() } /* Orig log dir because a chroot might have changed it */ - if ( snort_conf->orig_log_dir && orig_log_dir ) - { - if (strcasecmp(snort_conf->orig_log_dir, orig_log_dir) != 0) - { - ErrorMessage("Snort Reload: Changing the log directory " - "configuration requires a restart.\n"); - return false; - } - } - else if (snort_conf->orig_log_dir != orig_log_dir) + if (snort_conf->orig_log_dir != orig_log_dir) { ErrorMessage("Snort Reload: Changing the log directory " "configuration requires a restart.\n"); diff --git a/src/main/snort_config.h b/src/main/snort_config.h index 6cb5b9cd4..9f55c4a51 100644 --- a/src/main/snort_config.h +++ b/src/main/snort_config.h @@ -24,8 +24,9 @@ #include "config.h" #endif -#include #include +#include +#include #include #include "detection/rules.h" @@ -142,137 +143,141 @@ public: public: //------------------------------------------------------ // alert module stuff - bool default_rule_state; + bool default_rule_state = true; - uint16_t flowbit_size; + uint16_t flowbit_size = 0; sfip_t homenet; //------------------------------------------------------ // output module stuff - uint32_t output_flags; - uint32_t logging_flags; - uint32_t warning_flags; + uint32_t output_flags = 0; + uint32_t logging_flags = 0; + uint32_t warning_flags = 0; - uint8_t log_ipv6_extra; - uint16_t event_trace_max; - long int tagged_packet_limit; + uint8_t log_ipv6_extra = 0; + uint16_t event_trace_max = 0; + long int tagged_packet_limit = 256; - char* event_trace_file; - char* log_dir; /* -l or config log_dir */ + std::string log_dir; //------------------------------------------------------ // daq stuff - char* daq_type; /* --daq or config daq */ - char* daq_mode; /* --daq-mode or config daq_mode */ - void* daq_vars; /* --daq-var or config daq_var */ - void* daq_dirs; /* --daq-dir or config daq_dir */ + std::string daq_type; + std::string daq_mode; + + void* daq_vars = nullptr; + void* daq_dirs = nullptr; //------------------------------------------------------ // detection module stuff - long int pcre_match_limit; - long int pcre_match_limit_recursion; - int pcre_ovector_size; // computed from rules + // FIXIT-L pcre_match_limit* are interdependent + // somehow a packet thread needs a much lower setting + long int pcre_match_limit = 1500; + long int pcre_match_limit_recursion = 1500; + int pcre_ovector_size = 0; - int asn1_mem; - int run_flags; + int asn1_mem = 0; + uint32_t run_flags = 0; //------------------------------------------------------ // process stuff - int user_id; - int group_id; - int dirty_pig; + // user_id and group_id should be initialized to -1 by default, because + // chown() use this later, -1 means no change to user_id/group_id + int user_id = -1; + int group_id = -1; - char* chroot_dir; /* -t or config chroot */ + int dirty_pig = 0; - char* plugin_path; - char* script_path; + std::string chroot_dir; /* -t or config chroot */ + std::string plugin_path; + std::string script_path; - mode_t file_mask; + mode_t file_mask = 0; //------------------------------------------------------ // decode module stuff - uint8_t mpls_payload_type; - long int mpls_stack_depth; + uint8_t mpls_payload_type = 0; + long int mpls_stack_depth = 0; - uint8_t enable_teredo; - uint8_t enable_esp; - PortList* gtp_ports; + uint8_t enable_teredo = 0; + uint8_t enable_esp = 0; + PortList* gtp_ports = nullptr; - uint8_t num_layers; - uint8_t max_ip6_extensions; - uint8_t max_ip_layers; - int pkt_snaplen; + uint8_t num_layers = 0; + uint8_t max_ip6_extensions = 0; + uint8_t max_ip_layers = 0; + int pkt_snaplen = -1; //------------------------------------------------------ // active stuff - uint8_t respond_attempts; - uint8_t max_responses; - uint8_t min_interval; - char* respond_device; - uint8_t* eth_dst; + uint8_t respond_attempts = 0; + uint8_t max_responses = 0; + uint8_t min_interval = 0; + uint8_t* eth_dst = nullptr; - char* output; + std::string respond_device; + std::string output; //------------------------------------------------------ // attribute tables stuff - uint32_t max_attribute_hosts; - uint32_t max_attribute_services_per_host; - uint32_t max_metadata_services; + uint32_t max_attribute_hosts = 0; + uint32_t max_attribute_services_per_host = 0; + uint32_t max_metadata_services = 0; //------------------------------------------------------ // packet module stuff - uint8_t vlan_agnostic; - uint8_t addressspace_agnostic; + uint8_t vlan_agnostic = 0; + uint8_t addressspace_agnostic = 0; - uint64_t pkt_cnt; /* -n */ - uint64_t pkt_skip; + uint64_t pkt_cnt = 0; /* -n */ + uint64_t pkt_skip = 0; - char* bpf_file; /* -F or config bpf_file */ + std::string bpf_file; /* -F or config bpf_file */ //------------------------------------------------------ // various modules - struct FastPatternConfig* fast_pattern_config; - struct EventQueueConfig* event_queue_config; + struct FastPatternConfig* fast_pattern_config = nullptr; + struct EventQueueConfig* event_queue_config = nullptr; - class FileConfig* file_config; + class FileConfig* file_config = nullptr; /* XXX XXX policy specific? */ - struct ThresholdConfig* threshold_config; - struct RateFilterConfig* rate_filter_config; + struct ThresholdConfig* threshold_config = nullptr; + struct RateFilterConfig* rate_filter_config = nullptr; //------------------------------------------------------ // FIXIT-L command line only stuff, add to conf / module - uint32_t event_log_id; /* -G */ - sfip_t obfuscation_net; // -B - char* bpf_filter; // --bpf + uint32_t event_log_id = 0; + sfip_t obfuscation_net; + std::string bpf_filter; //------------------------------------------------------ // FIXIT-L non-module stuff - separate config from derived state? - char* run_prefix; - bool id_subdir; - bool id_zero; + std::string run_prefix; + bool id_subdir = false; + bool id_zero = false; - bool stdin_rules; + bool stdin_rules = false; - char pid_filename[1024]; - char* orig_log_dir; /* set in case of chroot */ + std::string pid_filename; + std::string orig_log_dir; /* set in case of chroot */ - int thiszone; + int thiszone = 0; - struct RuleState* rule_state_list; - struct ClassType* classifications; - struct ReferenceSystemNode* references; - struct SFGHASH* otn_map; + struct RuleState* rule_state_list = nullptr; + struct ClassType* classifications = nullptr; + struct ReferenceSystemNode* references = nullptr; + struct SFGHASH* otn_map = nullptr; - struct DetectionFilterConfig* detection_filter_config; + struct DetectionFilterConfig* detection_filter_config = nullptr; - struct sf_list** ip_proto_only_lists; + struct sf_list** ip_proto_only_lists = nullptr; uint8_t ip_proto_array[NUM_IP_PROTOS]; - int num_rule_types; - struct RuleListNode* rule_lists; + int num_rule_types = 0; + struct RuleListNode* rule_lists = nullptr; int evalOrder[RULE_TYPE__MAX + 1]; ListHead Alert; @@ -281,10 +286,10 @@ public: ListHead Drop; ListHead SDrop; - struct FrameworkConfig* framework_config; + struct FrameworkConfig* framework_config = nullptr; /* master port list table */ - struct RulePortTables* port_tables; + struct RulePortTables* port_tables = nullptr; /* The port-rule-maps map the src-dst ports to rules for * udp and tcp, for Ip we map the dst port as the protocol, @@ -294,44 +299,43 @@ public: * rules may or may not have content. We process the content * 1st and then the no content rules for udp/tcp and icmp, and * then we process the ip rules. */ - PORT_RULE_MAP* prmIpRTNX; - PORT_RULE_MAP* prmTcpRTNX; - PORT_RULE_MAP* prmUdpRTNX; - PORT_RULE_MAP* prmIcmpRTNX; + PORT_RULE_MAP* prmIpRTNX = nullptr; + PORT_RULE_MAP* prmTcpRTNX = nullptr; + PORT_RULE_MAP* prmUdpRTNX = nullptr; + PORT_RULE_MAP* prmIcmpRTNX = nullptr; - srmm_table_t* srmmTable; /* srvc rule map master table */ - srmm_table_t* spgmmTable; /* srvc port_group map master table */ - sopg_table_t* sopgTable; /* service-oridnal to port_group table */ + srmm_table_t* srmmTable = nullptr; /* srvc rule map master table */ + srmm_table_t* spgmmTable = nullptr; /* srvc port_group map master table */ + sopg_table_t* sopgTable = nullptr; /* service-oridnal to port_group table */ - SFXHASH* detection_option_hash_table; - SFXHASH* detection_option_tree_hash_table; + SFXHASH* detection_option_hash_table = nullptr; + SFXHASH* detection_option_tree_hash_table = nullptr; - PolicyMap* policy_map; + PolicyMap* policy_map = nullptr; - uint8_t tunnel_mask; + uint8_t tunnel_mask = 0; - char* output_dir; - - struct VarNode* var_list; + struct VarNode* var_list = nullptr; //------------------------------------------------------ // deliberately not conditional // to avoid plugin compatibility issues - struct ProfileConfig* profile_rules; - struct ProfileConfig* profile_modules; + struct ProfileConfig* profile_rules = nullptr; + struct ProfileConfig* profile_modules = nullptr; - struct ppm_cfg_t* ppm_cfg; - struct _IntelPmHandles* ipm_handles; + struct ppm_cfg_t* ppm_cfg = nullptr; + struct _IntelPmHandles* ipm_handles = nullptr; - unsigned remote_control; + unsigned remote_control = 0; //------------------------------------------------------ - SnortState* state; - unsigned num_slots; + SnortState* state = nullptr; + unsigned num_slots = 0; std::map* source_affinity; - std::vector* thread_affinity; + std::vector* thread_affinity = nullptr; + //------------------------------------------------------ // policy access InspectionPolicy* get_inspection_policy() { return policy_map->inspection_policy[0]; } diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc index 09d158984..e5aec4357 100644 --- a/src/main/snort_module.cc +++ b/src/main/snort_module.cc @@ -631,7 +631,7 @@ bool SnortModule::set(const char*, Value& v, SnortConfig* sc) ConfigAlertBeforePass(sc, v.get_string()); else if ( v.is("--bpf") ) - sc->bpf_filter = SnortStrdup(v.get_string()); + sc->bpf_filter = v.get_string(); else if ( v.is("--c2x") ) c2x(v.get_string()); @@ -776,7 +776,7 @@ bool SnortModule::set(const char*, Value& v, SnortConfig* sc) dump_rule_text(sc, v.get_string()); else if ( v.is("--run-prefix") ) - sc->run_prefix = SnortStrdup(v.get_string()); + sc->run_prefix = v.get_string(); else if ( v.is("--script-path") ) ConfigScriptPath(sc, v.get_string()); diff --git a/src/main/thread.cc b/src/main/thread.cc index e4fb2643a..1f45cddd2 100644 --- a/src/main/thread.cc +++ b/src/main/thread.cc @@ -191,12 +191,12 @@ bool break_time() const char* get_instance_file(std::string& file, const char* name) { bool sep = false; - file = snort_conf->log_dir ? snort_conf->log_dir : "./"; + file = !snort_conf->log_dir.empty() ? snort_conf->log_dir : "./"; if ( file.back() != '/' ) file += '/'; - if ( snort_conf->run_prefix ) + if ( !snort_conf->run_prefix.empty() ) { file += snort_conf->run_prefix; sep = true; diff --git a/src/managers/plugin_manager.cc b/src/managers/plugin_manager.cc index 1437ad2fb..b569da686 100644 --- a/src/managers/plugin_manager.cc +++ b/src/managers/plugin_manager.cc @@ -311,15 +311,13 @@ static void add_plugin(Plugin& p) } } -static void load_plugins(const char* s) +static void load_plugins(const std::string& paths) { - if ( !s ) - return; - - vector buf(s, s+strlen(s)+1); + const char* t = paths.c_str(); + vector buf(t, t+strlen(t)+1); char* last; - s = strtok_r(&buf[0], ":", &last); + char* s = strtok_r(&buf[0], ":", &last); while ( s ) { @@ -361,7 +359,7 @@ static void unload_plugins() // framework methods //------------------------------------------------------------------------- -void PluginManager::load_plugins(const char* paths) +void PluginManager::load_plugins(const std::string& paths) { // builtins load_list(codecs); @@ -374,7 +372,8 @@ void PluginManager::load_plugins(const char* paths) load_list(loggers); // plugins - ::load_plugins(paths); + if ( !paths.empty() ) + ::load_plugins(paths); // scripts // FIXIT-L need path to script for --list-plugins diff --git a/src/managers/plugin_manager.h b/src/managers/plugin_manager.h index daaf48416..81943b439 100644 --- a/src/managers/plugin_manager.h +++ b/src/managers/plugin_manager.h @@ -24,6 +24,8 @@ #include "config.h" #endif +#include + #include "snort_types.h" #include "framework/base_api.h" @@ -44,7 +46,7 @@ class PluginManager { public: // plugin methods - static void load_plugins(const char* lib_paths); + static void load_plugins(const std::string& lib_paths); static void list_plugins(); static void show_plugins(); static void dump_plugins(); diff --git a/src/managers/script_manager.cc b/src/managers/script_manager.cc index 70f2d827b..667acd5f9 100644 --- a/src/managers/script_manager.cc +++ b/src/managers/script_manager.cc @@ -238,13 +238,14 @@ static void load_script(const char* f) // public methods //------------------------------------------------------------------------- -void ScriptManager::load_scripts(const char* s) +void ScriptManager::load_scripts(const std::string& paths) { - if ( !s ) + if ( paths.empty() ) return; - vector buf(s, s+strlen(s)+1); - char* last; + const char* t = paths.c_str(); + vector buf(t, t+strlen(t)+1); + char* last, * s; s = strtok_r(&buf[0], ":", &last); diff --git a/src/managers/script_manager.h b/src/managers/script_manager.h index 87ae3e6d3..8d3831fc6 100644 --- a/src/managers/script_manager.h +++ b/src/managers/script_manager.h @@ -34,7 +34,7 @@ class ScriptManager { public: - static void load_scripts(const char* paths); + static void load_scripts(const std::string& paths); static void release_scripts(); static const BaseApi** get_plugins(); static std::string* get_chunk(const char* key); diff --git a/src/packet_io/active.cc b/src/packet_io/active.cc index 1e49eaebc..f2f96d72c 100644 --- a/src/packet_io/active.cc +++ b/src/packet_io/active.cc @@ -107,9 +107,9 @@ int Active_Init(SnortConfig* sc) if ( s_enabled && !s_attempts ) s_attempts = 1; - if ( s_enabled && (!DAQ_CanInject() || sc->respond_device) ) + if ( s_enabled && (!DAQ_CanInject() || !sc->respond_device.empty()) ) { - if ( SnortConfig::read_mode() || Active_Open(sc->respond_device) ) + if ( SnortConfig::read_mode() || Active_Open(sc->respond_device.c_str()) ) { ParseWarning(WARN_DAQ, "active responses disabled since DAQ " "can't inject packets."); diff --git a/src/packet_io/sfdaq.cc b/src/packet_io/sfdaq.cc index be0568c82..b2d43f813 100644 --- a/src/packet_io/sfdaq.cc +++ b/src/packet_io/sfdaq.cc @@ -151,20 +151,20 @@ DAQ_Mode DAQ_GetInterfaceMode(const DAQ_PktHdr_t* h) DAQ_Mode DAQ_GetMode(const SnortConfig* sc) { - if ( sc->daq_mode ) + if ( sc->daq_mode.size() ) { int i; for ( i = 0; i < MAX_DAQ_MODE; i++ ) { - if ( !strcasecmp(daq_mode_string((DAQ_Mode)i), sc->daq_mode) ) + if ( !strcasecmp(daq_mode_string((DAQ_Mode)i), sc->daq_mode.c_str()) ) { if ( SnortConfig::adaptor_inline_mode() && (i != DAQ_MODE_INLINE) ) - FatalError("DAQ '%s' mode incompatible with -Q\n", sc->daq_mode); + FatalError("DAQ '%s' mode incompatible with -Q\n", sc->daq_mode.c_str()); return (DAQ_Mode)i; } } - FatalError("Bad DAQ mode '%s'\n", sc->daq_mode); + FatalError("Bad DAQ mode '%s'\n", sc->daq_mode.c_str()); } if ( SnortConfig::adaptor_inline_mode() ) return DAQ_MODE_INLINE; @@ -227,12 +227,13 @@ static int DAQ_ValidateInstance() void DAQ_Init(const SnortConfig* sc) { - const char* type = DAQ_DEFAULT; if ( !loaded ) DAQ_Load(sc); - if ( sc->daq_type ) - type = sc->daq_type; + const char* type = DAQ_DEFAULT; + + if ( sc->daq_type.size() ) + type = sc->daq_type.c_str(); daq_mod = daq_find_module(type); @@ -366,6 +367,9 @@ static void DAQ_LoadVars(DAQ_Config_t* cfg, const SnortConfig* sc) if ( !key ) break; + while ( isspace(*key) ) + ++key; + val = strchr(key, '='); if ( val ) @@ -426,7 +430,8 @@ int DAQ_New(const SnortConfig* sc, const char* intf) cfg.flags |= DAQ_CFG_PROMISC; } - DAQ_Config(&cfg); + if ( DAQ_Config(&cfg) ) + return -1; if ( !DAQ_ValidateInstance() ) FatalError("DAQ configuration incompatible with intended operation.\n"); @@ -434,7 +439,7 @@ int DAQ_New(const SnortConfig* sc, const char* intf) if ( DAQ_UnprivilegedStart() ) daq_dlt = daq_get_datalink_type(daq_mod, daq_hand); - DAQ_SetFilter(sc->bpf_filter); + DAQ_SetFilter(sc->bpf_filter.c_str()); daq_config_clear_values(&cfg); memset(&daq_stats, 0, sizeof(daq_stats)); diff --git a/src/parser/config_file.cc b/src/parser/config_file.cc index e28685591..1a41f28d8 100644 --- a/src/parser/config_file.cc +++ b/src/parser/config_file.cc @@ -212,10 +212,10 @@ void ConfigChecksumMode(SnortConfig*, const char* args) void ConfigChrootDir(SnortConfig* sc, const char* args) { - if ((args == NULL) || (sc->chroot_dir != NULL)) + if ( !args || !sc ) return; - sc->chroot_dir = SnortStrdup(args); + sc->chroot_dir = args; } void ConfigCreatePidFile(SnortConfig* sc, const char*) @@ -271,10 +271,10 @@ void ConfigDstMac(SnortConfig* sc, const char* s) void ConfigLogDir(SnortConfig* sc, const char* args) { - if ((args == NULL) || (sc->log_dir != NULL)) + if ( !args || !sc ) return; - sc->log_dir = SnortStrdup(args); + sc->log_dir = args; } void ConfigDaqType(SnortConfig* sc, const char* args) @@ -282,23 +282,17 @@ void ConfigDaqType(SnortConfig* sc, const char* args) if ( !args || !sc ) return; - if ( sc->daq_type ) - { - ParseError("setting DAQ to %s but %s already selected.", args, sc->daq_type); - return; - } - // will be validated later after paths are established - sc->daq_type = SnortStrdup(args); + sc->daq_type = args; } void ConfigDaqMode(SnortConfig* sc, const char* args) { - if ( !args || !sc || sc->daq_mode ) + if ( !args || !sc ) return; // will be validated later when daq is instantiated - sc->daq_mode = SnortStrdup(args); + sc->daq_mode = args; } void ConfigDaqVar(SnortConfig* sc, const char* args) @@ -572,13 +566,13 @@ void ConfigTunnelVerdicts(SnortConfig* sc, const char* args) void ConfigPluginPath(SnortConfig* sc, const char* args) { if ( sc && args ) - sc->plugin_path = SnortStrdup(args); + sc->plugin_path = args; } void ConfigScriptPath(SnortConfig* sc, const char* args) { if ( sc && args ) - sc->script_path = SnortStrdup(args); + sc->script_path = args; } void config_syslog(SnortConfig* sc, const char*) diff --git a/src/parser/parser.cc b/src/parser/parser.cc index fcab20c1d..6cf60fbcc 100644 --- a/src/parser/parser.cc +++ b/src/parser/parser.cc @@ -706,53 +706,6 @@ void DestroyRuleTreeNode(RuleTreeNode* rtn) free(rtn); } -char* ProcessFileOption(SnortConfig* sc, const char* filespec) -{ - char* filename = NULL; - - if (sc == NULL) - sc = snort_conf; - - if (filespec == NULL) - { - ParseAbort( - "no arguement in this file option, remove extra ':' at the end of the alert option"); - } - - /* look for ".." in the string and complain and exit if it is found */ - if (strstr(filespec, "..") != NULL) - { - ParseError("file definition contains '..'. Do not do that."); - } - - if (filespec[0] == '/') - { - /* absolute filespecs are saved as is */ - filename = SnortStrdup(filespec); - } - else - { - std::string buf; - - /* relative filespec is considered relative to the log directory - or /var/log if the log directory has not been set - Make sure this function isn't called before log dir is set */ - if ((sc != NULL) && (sc->log_dir != NULL)) - buf = snort_conf->log_dir; - else - buf = DEFAULT_LOG_DIR; - - buf += "/"; - buf += filespec; - - filename = SnortStrdup(buf.c_str()); - } - - DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"ProcessFileOption: %s\n", filename); ); - - return filename; -} - /**************************************************************************** * Purpose: Adjust the information for a given rule * relative to the Rule State list diff --git a/src/protocols/tcp.h b/src/protocols/tcp.h index c0c14caed..750d1d082 100644 --- a/src/protocols/tcp.h +++ b/src/protocols/tcp.h @@ -106,6 +106,9 @@ struct TCPHdr inline uint32_t seq() const { return ntohl(th_seq); } + inline uint32_t ack() const + { return ntohl(th_ack); } + inline bool has_options() const { return ((th_offx2 & 0xf0) > 0x50); } @@ -137,6 +140,9 @@ struct TCPHdr inline uint32_t raw_seq() const { return th_seq; } + inline uint32_t raw_ack() const + { return th_ack; } + inline uint8_t raw_hlen() const { return th_offx2 >> 4; } diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc index a017c6682..21b3db7c9 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/src/service_inspectors/http_inspect/hi_main.cc @@ -103,9 +103,10 @@ static uint32_t xtra_hname_id; static uint32_t xtra_gzip_id; static uint32_t xtra_jsnorm_id; -THREAD_LOCAL HISearch hi_js_search[HI_LAST]; -THREAD_LOCAL HISearch hi_html_search[HTML_LAST]; -THREAD_LOCAL HISearch* hi_current_search = NULL; +HISearch hi_js_search[HI_LAST]; +HISearch hi_html_search[HTML_LAST]; + +THREAD_LOCAL const HISearch* hi_current_search = NULL; THREAD_LOCAL HISearchInfo hi_search_info; THREAD_LOCAL HIStats hi_stats; diff --git a/src/service_inspectors/http_inspect/hi_main.h b/src/service_inspectors/http_inspect/hi_main.h index 44f48d1b3..106f36d57 100644 --- a/src/service_inspectors/http_inspect/hi_main.h +++ b/src/service_inspectors/http_inspect/hi_main.h @@ -174,9 +174,10 @@ typedef enum _HtmlSearchIdEnum extern class SearchTool* hi_javascript_search_mpse; extern class SearchTool* hi_htmltype_search_mpse; -extern THREAD_LOCAL HISearch hi_js_search[HI_LAST]; -extern THREAD_LOCAL HISearch hi_html_search[HTML_LAST]; -extern THREAD_LOCAL HISearch* hi_current_search; +extern HISearch hi_js_search[HI_LAST]; +extern HISearch hi_html_search[HTML_LAST]; + +extern const THREAD_LOCAL HISearch* hi_current_search; extern THREAD_LOCAL HISearchInfo hi_search_info; void ApplyFlowDepth(HTTPINSPECT_CONF*, Packet*, HttpSessionData*, int, int, uint32_t); diff --git a/src/utils/util.cc b/src/utils/util.cc index 0cbacd832..109c1a94d 100644 --- a/src/utils/util.cc +++ b/src/utils/util.cc @@ -291,21 +291,19 @@ static FILE* pid_file = NULL; void CreatePidFile(pid_t pid) { - const char* dir = snort_conf->log_dir ? snort_conf->log_dir : "."; - SnortSnprintf(snort_conf->pid_filename, - sizeof(snort_conf->pid_filename), "%s/snort.pid", dir); + snort_conf->pid_filename = snort_conf->log_dir; + snort_conf->pid_filename += "/snort.pid"; - if (!SnortConfig::no_lock_pid_file()) + if ( !SnortConfig::no_lock_pid_file() ) { - char pid_lockfilename[STD_BUF+1]; + std::string pid_lockfilename = snort_conf->pid_filename; + pid_lockfilename += ".lck"; int lock_fd; /* First, lock the PID file */ - SnortSnprintf(pid_lockfilename, STD_BUF, "%s.lck", - snort_conf->pid_filename); - pid_lockfile = fopen(pid_lockfilename, "w"); + pid_lockfile = fopen(pid_lockfilename.c_str(), "w"); - if (pid_lockfile) + if ( pid_lockfile ) { struct flock lock; lock_fd = fileno(pid_lockfile); @@ -319,18 +317,18 @@ void CreatePidFile(pid_t pid) { ClosePidFile(); ParseError("Failed to Lock PID File \"%s\" for PID \"%d\"\n", - snort_conf->pid_filename, (int)pid); + snort_conf->pid_filename.c_str(), (int)pid); return; } } } /* Okay, were able to lock PID file, now open and write PID */ - pid_file = fopen(snort_conf->pid_filename, "w"); + pid_file = fopen(snort_conf->pid_filename.c_str(), "w"); if (pid_file) { LogMessage("Writing PID \"%d\" to file \"%s\"\n", (int)pid, - snort_conf->pid_filename); + snort_conf->pid_filename.c_str()); fprintf(pid_file, "%d\n", (int)pid); fflush(pid_file); } @@ -338,8 +336,8 @@ void CreatePidFile(pid_t pid) { const char* error = get_error(errno); ErrorMessage("Failed to create pid file %s, Error: %s", - snort_conf->pid_filename, error); - snort_conf->pid_filename[0] = 0; + snort_conf->pid_filename.c_str(), error); + snort_conf->pid_filename.clear(); } } @@ -566,38 +564,6 @@ char* read_infile(const char* key, const char* fname) return(cp); } -/**************************************************************************** - * - * Function: CheckLogDir() - * - * Purpose: CyberPsychotic sez: basically we only check if logdir exist and - * writable, since it might screw the whole thing in the middle. Any - * other checks could be performed here as well. - * - * Arguments: None. - * - * Returns: void function - * - ****************************************************************************/ -void CheckLogDir(void) -{ - struct stat st; - - if (snort_conf->log_dir == NULL) - return; - - if (stat(snort_conf->log_dir, &st) == -1) - ParseError("Stat check on log dir failed: %s.\n", get_error(errno)); - - else if (!S_ISDIR(st.st_mode) || (access(snort_conf->log_dir, W_OK) == -1)) - { - ParseError("Can not get write access to logging directory \"%s\". " - "(directory doesn't exist or permissions are set incorrectly " - "or it is not a directory at all)\n", - snort_conf->log_dir); - } -} - /* Guaranteed to be '\0' terminated even if truncation occurs. * * returns SNORT_SNPRINTF_SUCCESS if successful @@ -891,21 +857,12 @@ const char* SnortStrcasestr(const char* s, int slen, const char* substr) * @param directory directory to chroot to * @param logstore ptr to snort_conf->log_dir which must be dynamically allocated */ -void SetChroot(char* directory, char** logstore) +void SetChroot(std::string directory, std::string& logstore) { char* absdir; size_t abslen; - char* logdir; - - if (!directory || !logstore) - { - ParseError("Null parameter passed\n"); - return; - } - logdir = *logstore; - - if (logdir == NULL || *logdir == '\0') + if ( logstore.empty() ) { ParseError("Null log directory\n"); return; @@ -914,23 +871,16 @@ void SetChroot(char* directory, char** logstore) DEBUG_WRAP(DebugMessage(DEBUG_INIT,"SetChroot: %s\n", CurrentWorkingDir()); ); - logdir = GetAbsolutePath(logdir); + const char* logdir = GetAbsolutePath(logstore.c_str()); DEBUG_WRAP(DebugMessage(DEBUG_INIT, "SetChroot: %s\n", CurrentWorkingDir())); - logdir = SnortStrdup(logdir); - - /* We're going to reset logstore, so free it now */ - free(*logstore); - *logstore = NULL; - /* change to the directory */ - if (chdir(directory) != 0) + if (chdir(directory.c_str()) != 0) { - ParseError("SetChroot: Can not chdir to \"%s\": %s\n", directory, + ParseError("SetChroot: Can not chdir to \"%s\": %s\n", directory.c_str(), get_error(errno)); - free(logdir); return; } @@ -940,7 +890,6 @@ void SetChroot(char* directory, char** logstore) if (absdir == NULL) { ParseError("NULL Chroot found\n"); - free(logdir); return; } @@ -952,8 +901,7 @@ void SetChroot(char* directory, char** logstore) if (chroot(absdir) < 0) { ParseError("Can not chroot to \"%s\": absolute: %s: %s\n", - directory, absdir, get_error(errno)); - free(logdir); + directory.c_str(), absdir, get_error(errno)); return; } @@ -965,7 +913,6 @@ void SetChroot(char* directory, char** logstore) { ParseError("Can not chdir to \"/\" after chroot: %s\n", get_error(errno)); - free(logdir); return; } @@ -975,24 +922,22 @@ void SetChroot(char* directory, char** logstore) if (strncmp(absdir, logdir, strlen(absdir))) { ParseError("Absdir is not a subset of the logdir"); - free(logdir); return; } if (abslen >= strlen(logdir)) { - *logstore = SnortStrdup("/"); + logstore = "/"; } else { - *logstore = SnortStrdup(logdir + abslen); + logstore = logdir + abslen; } DEBUG_WRAP(DebugMessage(DEBUG_INIT,"new logdir from %s to %s\n", - logdir, *logstore)); + logdir, logstore.c_str())); - LogMessage("Chroot directory = %s\n", directory); - free(logdir); + LogMessage("Chroot directory = %s\n", directory.c_str()); } /** @@ -1016,7 +961,7 @@ char* CurrentWorkingDir(void) /** * Given a directory name, return a ptr to a static */ -char* GetAbsolutePath(char* dir) +char* GetAbsolutePath(const char* dir) { char* savedir, * dirp; static THREAD_LOCAL char buf[PATH_MAX_UTIL + 1]; diff --git a/src/utils/util.h b/src/utils/util.h index 2e9c530fc..19920da61 100644 --- a/src/utils/util.h +++ b/src/utils/util.h @@ -39,6 +39,8 @@ #include #endif +#include + #include "main/snort_types.h" #include "log/messages.h" @@ -85,7 +87,7 @@ void CreatePidFile(pid_t); void ClosePidFile(void); void SetUidGid(int, int); void InitGroups(int, int); -void SetChroot(char*, char**); +void SetChroot(std::string root_dir, std::string& log_dir); void InitProtoNames(void); SO_PUBLIC int SnortSnprintf(char*, size_t, const char*, ...) __attribute__((format (printf, 3, @@ -104,7 +106,7 @@ int CheckValueInRange(const char* value_str, const char* option, unsigned long lo, unsigned long hi, unsigned long* value); char* CurrentWorkingDir(void); -char* GetAbsolutePath(char* dir); +char* GetAbsolutePath(const char* dir); char* StripPrefixDir(char* prefix, char* dir); void PrintVersion(void);