From: Russ Combs Date: Sat, 21 Jun 2014 00:57:33 +0000 (-0400) Subject: update to build 90 X-Git-Tag: 3.0.0-233~1475 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f2016e0530e65263e28d093853ee97898a24c6d1;p=thirdparty%2Fsnort3.git update to build 90 --- diff --git a/ChangeLog b/ChangeLog index bdf96d5cd..2ea4a187a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +90 +-- added InspectApi.buffers and Inspector::getbuf() +-- changed http_* rule options to use Inspector::getbuf() +-- changed luajit rule option to use the cursor + 89 -- pulled in the latest from tom and josh diff --git a/configure.ac b/configure.ac index 259ac2970..dbc8b93d9 100644 --- a/configure.ac +++ b/configure.ac @@ -25,7 +25,7 @@ # initialization #-------------------------------------------------------------------------- -AC_INIT([snort], [2.10.089]) +AC_INIT([snort], [2.10.090]) AC_PREREQ([2.68]) AC_CONFIG_SRCDIR([src/main.h]) diff --git a/extra/src/ips_options/find.lua b/extra/src/ips_options/find.lua index 14ecc6e68..be3822a41 100755 --- a/extra/src/ips_options/find.lua +++ b/extra/src/ips_options/find.lua @@ -33,12 +33,6 @@ require("snort_plugin") -- if present, called once when script is loaded -- here we return bool indicating args ok function init () - args.bt = get_buffer_type(args.buf) - - if ( args.bt < 0 ) then - return 'bad buf' - end - if ( args.pat == nil ) then return 'missing pat' end @@ -57,7 +51,7 @@ function eval () -- see snort.lua for available buffers -- buf is a luajit cdata - local buf = ffi.C.get_buffer(args.bt) + local buf = ffi.C.get_cursor() -- str is a lua string local str = ffi.string(buf.data, buf.len) diff --git a/lua/snort.lua b/lua/snort.lua index 74ea4a5f2..6a8c964da 100644 --- a/lua/snort.lua +++ b/lua/snort.lua @@ -8,7 +8,7 @@ -- export SNORT_LUA_PATH=$install_dir/conf/ --------------------------------------------------------------------------- -require("snort_config") -- for loading +require('snort_config') -- for loading -- useful constants K = 1024 @@ -166,14 +166,15 @@ search_engine = --search_method = 'lowmem_q', split_any_any = true, search_optimize = true, - max_pattern_len = 20 + max_pattern_len = 20, + max_queue_events = 16 } -- Configure the event queue. event_queue = { - max_queue = 8, - log = 5, + max_queue = 16, + log = 8, order_events = 'content_length' } @@ -194,6 +195,7 @@ ppm = } -- Configure Perf Profiling for debugging +--[[ profile = { rules = @@ -209,6 +211,7 @@ profile = file = { append = true } } } +--]] --------------------------------------------------------------------------- -- configure inspectors @@ -323,11 +326,7 @@ hi_x = post_depth = 65495, } -nhttp_inspect = -{ - test_input = false, - test_output = false -} +nhttp_inspect = { } --------------------------------------------------------------------------- -- ftp / telnet normalization and anomaly detection @@ -452,7 +451,7 @@ stream_tcp = session_timeout = 180, --require_3whs = -1, - show_rebuilt_packets = true, + show_rebuilt_packets = false, flush_factor = 0, overlap_limit = 10, @@ -536,10 +535,28 @@ default_rules = #alert http any any -> 1.2.3.4 80 ( sid:3; msg:"3"; content:"HTTP"; ) # no ; separated content suboptions -alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLACKLIST URI request for known malicious URI - /inst.php?fff="; flow:to_server,established; content:"/inst.php?fff=", nocase, http_uri; content: "coid=", nocase, http_uri; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, reference:url,labs.snort.org/docs/16924.html; classtype:trojan-activity; sid:16924; rev:5;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLACKLIST URI request for known malicious URI - /inst.php?fff="; flow:to_server,established; http_uri; content:"/inst.php?fff=", nocase; content: "coid=", nocase; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, reference:url,labs.snort.org/docs/16924.html; classtype:trojan-activity; sid:16924; rev:5;) # fast_pattern:,; -> # fast_pattern: ; + +# test pattern = "ABABACD" +#alert tcp any any -> any any ( sid:100; content:"ABA"; ) +#alert tcp any any -> any any ( sid:200; raw_data; content:"ABA"; ) +#alert tcp any any -> any any ( sid:300; pkt_data; content:"ABA"; ) +#alert tcp any any -> any any ( sid:400; content:"ABA"; content:"C", depth 6; ) +#alert tcp any any -> any any ( sid:401; content:"ABA"; content:"C", depth 5; ) +#alert tcp any any -> any any ( sid:402; content:"ABA"; content:"C", offset 5; ) +#alert tcp any any -> any any ( sid:403; content:"ABA"; content:"C", offset 6; ) +#alert tcp any any -> any any ( sid:404; content:"ABA"; content:"C", offset 5, depth 6; ) +alert tcp any any -> any any ( sid:510; content:"ABA"; content:"C", within 1; ) +alert tcp any any -> any any ( sid:110; pcre:"/ABA/"; ) +alert tcp any any -> any any ( sid:210; raw_data; pcre:"/ABA/"; ) +alert tcp any any -> any any ( sid:310; pkt_data; pcre:"/ABA/"; ) +alert tcp any any -> any any ( sid:410; pcre:"/ABA/"; pcre:"/C/"; ) +alert tcp any any -> any any ( sid:411; pcre:"/ABA/"; pcre:"/AC/R"; ) +alert tcp any any -> any any ( sid:412; pcre:"/ABA/"; pcre:"/AC/"; ) +alert tcp any any -> any any ( sid:414; pcre:"/ABA/"; pcre:"/C/R"; ) ]] network = diff --git a/src/detection/detection_util.h b/src/detection/detection_util.h index b68ffc53a..38ddebf21 100644 --- a/src/detection/detection_util.h +++ b/src/detection/detection_util.h @@ -44,23 +44,21 @@ #define MAX_URI 8192 -// NOTE - if you change these, you must also change: -// detection-plugins/ips_pcre.h -typedef enum +enum HTTP_BUFFER { HTTP_BUFFER_NONE, - HTTP_BUFFER_URI, - HTTP_BUFFER_HEADER, HTTP_BUFFER_CLIENT_BODY, - HTTP_BUFFER_METHOD, HTTP_BUFFER_COOKIE, + HTTP_BUFFER_HEADER, + HTTP_BUFFER_METHOD, + HTTP_BUFFER_RAW_COOKIE, + HTTP_BUFFER_RAW_HEADER, + HTTP_BUFFER_RAW_URI, HTTP_BUFFER_STAT_CODE, HTTP_BUFFER_STAT_MSG, - HTTP_BUFFER_RAW_URI, - HTTP_BUFFER_RAW_HEADER, - HTTP_BUFFER_RAW_COOKIE, + HTTP_BUFFER_URI, HTTP_BUFFER_MAX -} HTTP_BUFFER; +}; #endif enum DetectFlagType diff --git a/src/detection/fpcreate.cc b/src/detection/fpcreate.cc index 1b47605f7..b35bf7d6f 100644 --- a/src/detection/fpcreate.cc +++ b/src/detection/fpcreate.cc @@ -104,8 +104,7 @@ static const char *pm_type_strings[PM_TYPE__MAX] = "Normal Content", "HTTP Uri content", "HTTP Header content", - "HTTP Client body content", - "HTTP Method content", + "HTTP Client body content" }; /* @@ -1696,7 +1695,6 @@ static void fpDeletePortGroup(void *data) } free_detection_option_root(&pg->pgNonContentTree); - free(pg); } diff --git a/src/detection/pcrm.h b/src/detection/pcrm.h index ce565e146..45edec8ab 100644 --- a/src/detection/pcrm.h +++ b/src/detection/pcrm.h @@ -51,16 +51,14 @@ typedef void * RULE_PTR; #define PRM_GET_FIRST_GROUP_NODE_NC(pg) (pg->pgHeadNC) #define PRM_GET_NEXT_GROUP_NODE_NC(rn) (rn->rnNext) -typedef enum _PmType +enum PmType { PM_TYPE__CONTENT = 0, PM_TYPE__HTTP_URI_CONTENT, PM_TYPE__HTTP_HEADER_CONTENT, PM_TYPE__HTTP_CLIENT_BODY_CONTENT, - PM_TYPE__HTTP_METHOD_CONTENT, PM_TYPE__MAX - -} PmType; +}; typedef struct _not_rule_node_ { diff --git a/src/file_api/file_service.cc b/src/file_api/file_service.cc index ae3e9a2b5..099af099f 100644 --- a/src/file_api/file_service.cc +++ b/src/file_api/file_service.cc @@ -48,8 +48,9 @@ #include "file_mime_process.h" #include "file_resume_block.h" -#include "service_inspectors/http_inspect/hi_main.h" // FIXIT bad dependency +#include "framework/inspector.h" #include "detection_util.h" +#include "service_inspectors/http_inspect/hi_main.h" // FIXIT bad dependency; use inspector::get_buf() #include "target_based/sftarget_protocol_reference.h" #include "target_based/sftarget_reader.h" @@ -433,14 +434,17 @@ static inline int check_http_partial_content(Packet *p) uint32_t len = 0; uint32_t type = 0; uint32_t file_sig; - const HttpBuffer* hb = GetHttpBuffer(HTTP_BUFFER_STAT_CODE); + InspectionBuffer hb; - /*Not HTTP response, return*/ - if ( !hb ) + if ( !p->flow || !p->flow->clouseau || + // FIXIT cache id at parse time for runtime use + !p->flow->clouseau->get_buf("http_stat_code", p, hb) ) + { return 0; + } /*Not partial content, return*/ - if ( (hb->length != 3) || strncmp((const char*)hb->buf, "206", 3) ) + if ( (hb.len != 3) || strncmp((const char*)hb.data, "206", 3) ) return 0; /*Use URI as the identifier for file*/ diff --git a/src/framework/cursor.h b/src/framework/cursor.h index 1bb43de91..ce673d1cf 100644 --- a/src/framework/cursor.h +++ b/src/framework/cursor.h @@ -35,7 +35,10 @@ public: Cursor(Packet*); Cursor(const Cursor&); - bool is(const char* s) + const char* get_name() const + { return name; }; + + bool is(const char* s) const { return !strcmp(name, s); }; void reset(Packet*); @@ -43,22 +46,22 @@ public: void set(const char* s, const uint8_t* b, unsigned n) { name = s; data = b; sz = n; pos = delta = 0; }; - const uint8_t* buffer() + const uint8_t* buffer() const { return data; }; - unsigned size() + unsigned size() const { return sz; }; - const uint8_t* start() + const uint8_t* start() const { return data + pos; }; - unsigned length() + unsigned length() const { return sz - pos; }; - unsigned get_pos() + unsigned get_pos() const { return pos; }; - unsigned get_delta() + unsigned get_delta() const { return delta; }; bool add_pos(unsigned n) diff --git a/src/framework/inspector.cc b/src/framework/inspector.cc index e1088e63f..c634f4100 100644 --- a/src/framework/inspector.cc +++ b/src/framework/inspector.cc @@ -21,6 +21,7 @@ #include "inspector.h" #include +#include //------------------------------------------------------------------------- // packet handler stuff @@ -59,3 +60,27 @@ SO_PUBLIC bool Inspector::is_inactive() return true; } +unsigned Inspector::get_buf_id(const char* key) +{ + const char** p = api->buffers; + unsigned id = 0; + + if ( !p ) + return 0; + + while ( p[id] && strcmp(key, p[id]) ) + ++id; + + return p[id] ? id+1 : 0; +} + +bool Inspector::get_buf(const char* key, Packet* p, InspectionBuffer& b) +{ + unsigned id = get_buf_id(key); + + if ( !id ) + return false; + + return get_buf(id, p, b); +} + diff --git a/src/framework/inspector.h b/src/framework/inspector.h index e397322bc..98ea49e10 100644 --- a/src/framework/inspector.h +++ b/src/framework/inspector.h @@ -44,6 +44,14 @@ struct ServiceTag bool to_server; }; +struct InspectionBuffer +{ + const uint8_t* data; + unsigned len; +}; + +struct InspectApi; + //------------------------------------------------------------------------- // api for class //------------------------------------------------------------------------- @@ -78,10 +86,20 @@ public: void set_service(ServiceId id) { srv_id = id; }; ServiceId get_service() { return srv_id; }; + // key is listed in api buffers + // id-1 is zero based index into buffers array + unsigned get_buf_id(const char* key); + virtual bool get_buf(const char* key, Packet*, InspectionBuffer&); + virtual bool get_buf(unsigned /*id*/, Packet*, InspectionBuffer&) + { return false; }; + // IT_SERVICE only virtual class StreamSplitter* get_splitter(bool /*to_server*/) { return nullptr; }; + void set_api(const InspectApi* p) + { api = p; }; + public: static unsigned max_slots; static THREAD_LOCAL unsigned slot; @@ -91,6 +109,7 @@ protected: Inspector(); // internal init only at this point private: + const InspectApi* api; unsigned* ref_count; ServiceId srv_id; }; @@ -117,6 +136,7 @@ struct InspectApi InspectorType type; uint16_t proto_bits; + const char** buffers; // null terminated list of exported buffers const char* service; // nullptr when type != IT_SERVICE //ServiceTag tags; // null terminated list of tags diff --git a/src/ips_options/CMakeLists.txt b/src/ips_options/CMakeLists.txt index 24fe71113..bc1db0712 100644 --- a/src/ips_options/CMakeLists.txt +++ b/src/ips_options/CMakeLists.txt @@ -15,6 +15,7 @@ SET( PLUGIN_LIST ips_flags.cc ips_fragbits.cc ips_fragoffset.cc + ips_http.cc ips_icmp_id.cc ips_icmp_seq.cc ips_icode.cc @@ -34,7 +35,6 @@ SET( PLUGIN_LIST ips_ttl.cc ips_window.cc ips_urilen.cc - ips_urilen.h ) set (IPS_SOURCES diff --git a/src/ips_options/Makefile.am b/src/ips_options/Makefile.am index 2f50097ed..24d6f0074 100644 --- a/src/ips_options/Makefile.am +++ b/src/ips_options/Makefile.am @@ -16,6 +16,7 @@ ips_dsize.cc \ ips_flags.cc \ ips_fragbits.cc \ ips_fragoffset.cc \ +ips_http.cc \ ips_icmp_id.cc \ ips_icmp_seq.cc \ ips_icode.cc \ @@ -33,8 +34,8 @@ ips_seq.cc \ ips_session.cc \ ips_tos.cc \ ips_ttl.cc \ -ips_window.cc \ -ips_urilen.cc ips_urilen.h +ips_urilen.cc \ +ips_window.cc libips_options_a_SOURCES = \ ips_byte_extract.cc ips_byte_extract.h \ diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc index 573b51dd0..dda7c47b2 100644 --- a/src/ips_options/ips_content.cc +++ b/src/ips_options/ips_content.cc @@ -236,7 +236,7 @@ static void update_pmd(PatternMatchData* pmd) pmd->last_check = (PmdLastCheck*)SnortAlloc(get_instance_max() * sizeof(*pmd->last_check)); } -static int FastPatterns(OptTreeNode *otn, int list_type) +static int fast_pattern_count(OptTreeNode *otn, int list_type) { OptFpList* fpl = otn ? otn->opt_func : nullptr; int c = 0; @@ -256,7 +256,8 @@ static int FastPatterns(OptTreeNode *otn, int list_type) return c; } -static int32_t ParseInt(const char* data, const char* tag) +static int32_t parse_int( + const char* data, const char* tag, int low = -65535, int high = 65535) { int32_t value = 0; char *endptr = NULL; @@ -269,13 +270,13 @@ static int32_t ParseInt(const char* data, const char* tag) if (errno == ERANGE) ParseError("Range problem on '%s' value.", tag); - if ((value > 65535) || (value < -65535)) - ParseError("'%s' must in -65535:65535", tag); + if ((value > high) || (value < low)) + ParseError("'%s' must in %d:%d", tag, low, high); return value; } -static void ValidateContent( +static void validate_content( SnortConfig*, PatternMatchData *pmd, OptTreeNode* otn) { if (pmd == NULL) @@ -307,7 +308,7 @@ static void ValidateContent( } } - if ( FastPatterns(otn, RULE_OPTION_TYPE_CONTENT) > 1 ) + if ( fast_pattern_count(otn, RULE_OPTION_TYPE_CONTENT) > 1 ) ParseError("Only one content per rule may be used for fast pattern matching."); } @@ -323,7 +324,7 @@ static void make_precomp(PatternMatchData * idx) idx->shift_stride = make_shift(idx->pattern_buf, idx->pattern_size); } -static char *PayloadExtractParameter(char *data, int *result_len) +static char *extract_parameter(char *data, int *result_len) { char *quote_one = NULL, *quote_two = NULL; char *comma = NULL; @@ -587,7 +588,7 @@ static unsigned GetCMF (PatternMatchData* pmd) #define BAD_OFFSET (CMF_OFFSET | CMF_DISTANCE | CMF_WITHIN) #define BAD_DEPTH (CMF_DEPTH | CMF_DISTANCE | CMF_WITHIN) -static void PayloadSearchOffset( +static void parse_offset( PatternMatchData* pmd, char *data, OptTreeNode*) { if ( GetCMF(pmd) & BAD_OFFSET && pmd->use_doe ) @@ -598,7 +599,7 @@ static void PayloadSearchOffset( if (isdigit(data[0]) || data[0] == '-') { - pmd->offset = ParseInt(data, "offset"); + pmd->offset = parse_int(data, "offset"); } else { @@ -613,7 +614,7 @@ static void PayloadSearchOffset( pmd->offset);); } -static void PayloadSearchDepth( +static void parse_depth( PatternMatchData* pmd, char *data, OptTreeNode*) { if ( GetCMF(pmd) & BAD_DEPTH && pmd->use_doe ) @@ -624,7 +625,7 @@ static void PayloadSearchDepth( if (isdigit(data[0]) || data[0] == '-') { - pmd->depth = ParseInt(data, "depth"); + pmd->depth = parse_int(data, "depth"); /* check to make sure that this the depth allows this rule to fire */ if (pmd->depth < (int)pmd->pattern_size) @@ -646,7 +647,7 @@ static void PayloadSearchDepth( pmd->depth);); } -static void PayloadSearchDistance( +static void parse_distance( PatternMatchData* pmd, char *data, OptTreeNode*) { if ( GetCMF(pmd) & BAD_DISTANCE && !pmd->use_doe ) @@ -657,7 +658,7 @@ static void PayloadSearchDistance( if (isdigit(data[0]) || data[0] == '-') { - pmd->offset = ParseInt(data, "distance"); + pmd->offset = parse_int(data, "distance"); } else { @@ -671,7 +672,7 @@ static void PayloadSearchDistance( pmd->use_doe = 1; } -static void PayloadSearchWithin( +static void parse_within( PatternMatchData* pmd, char *data, OptTreeNode*) { if ( GetCMF(pmd) & BAD_WITHIN && !pmd->use_doe ) @@ -682,7 +683,7 @@ static void PayloadSearchWithin( if (isdigit(data[0]) || data[0] == '-') { - pmd->depth = ParseInt(data, "within"); + pmd->depth = parse_int(data, "within"); if (pmd->depth < (int)pmd->pattern_size) ParseError("within (%d) is smaller than size of pattern", pmd->depth); @@ -702,7 +703,7 @@ static void PayloadSearchWithin( pmd->use_doe = 1; } -static void PayloadSearchNocase( +static void parse_nocase( PatternMatchData* pmd, char *data, OptTreeNode*) { unsigned int i; @@ -717,7 +718,7 @@ static void PayloadSearchNocase( make_precomp(pmd); } -static void PayloadSearchFastPattern( +static void parse_fast_pattern( PatternMatchData* pmd, char *data, OptTreeNode*) { if ( data ) @@ -726,7 +727,7 @@ static void PayloadSearchFastPattern( pmd->fp = 1; } -static void PayloadSearchFastPatternOnly( +static void parse_fast_pattern_only( PatternMatchData* pmd, char *data, OptTreeNode*) { if ( data ) @@ -736,21 +737,17 @@ static void PayloadSearchFastPatternOnly( pmd->fp_only = 1; } -static void PayloadSearchFastPatternOffset( +static const char* error_str = + "fast_pattern_offset + fast_pattern_length must be less " + "than or equal to the actual pattern length which is %u."; + +static void parse_fast_pattern_offset( PatternMatchData* pmd, char *data, OptTreeNode*) { if (data == NULL) ParseError("Missing argument to 'fast_pattern_offset' option"); - long offset = ParseInt(data, "fast_pattern_offset"); - - static const char* error_str = - "fast_pattern_offset must be non-negative and fast_pattern_offset + " - "fast_pattern_length must be less than or equal to the actual pattern " - "length which is %u."; - - if ( (offset < 0) || (offset > UINT16_MAX)) - ParseError(error_str, data, pmd->pattern_size); + long offset = parse_int(data, "fast_pattern_offset", 0, UINT16_MAX); if ((int)pmd->pattern_size < (offset + pmd->fp_length)) ParseError(error_str, data, pmd->pattern_size); @@ -759,21 +756,13 @@ static void PayloadSearchFastPatternOffset( pmd->fp = 1; } -static void PayloadSearchFastPatternLength( +static void parse_fast_pattern_length( PatternMatchData* pmd, char *data, OptTreeNode*) { if (data == NULL) ParseError("Missing argument to 'fast_pattern_length' option"); - long length = ParseInt(data, "fast_pattern_length"); - - const char* error_str = - "fast_pattern_length must be positive and fast_pattern_offset + " - "fast_pattern_length must be less than or equal to the actual pattern " - "length which is %u."; - - if ( (length < 0) || (length > UINT16_MAX)) - ParseError(error_str, data, pmd->pattern_size); + long length = parse_int(data, "fast_pattern_length", 0, UINT16_MAX); if ((int)pmd->pattern_size < (pmd->fp_offset + length)) ParseError(error_str, data, pmd->pattern_size); @@ -1082,7 +1071,7 @@ static IpsOption* content_ctor( data_dup = SnortStrdup(data); data_end = data_dup + strlen(data_dup); - opt_data = PayloadExtractParameter(data_dup, &opt_len); + opt_data = extract_parameter(data_dup, &opt_len); content_parse(opt_data, pmd); update_pmd(pmd); next_opt = opt_data + opt_len; @@ -1098,7 +1087,7 @@ static IpsOption* content_ctor( break; opt_len = 0; - opt_data = PayloadExtractParameter(next_opt, &opt_len); + opt_data = extract_parameter(next_opt, &opt_len); if (!opt_data) break; @@ -1112,39 +1101,39 @@ static IpsOption* content_ctor( if (!strcasecmp(opts[0], "offset")) { - PayloadSearchOffset(pmd, opt1, otn); + parse_offset(pmd, opt1, otn); } else if (!strcasecmp(opts[0], "depth")) { - PayloadSearchDepth(pmd, opt1, otn); + parse_depth(pmd, opt1, otn); } else if (!strcasecmp(opts[0], "nocase")) { - PayloadSearchNocase(pmd, opt1, otn); + parse_nocase(pmd, opt1, otn); } else if (!strcasecmp(opts[0], "fast_pattern")) { - PayloadSearchFastPattern(pmd, opt1, otn); + parse_fast_pattern(pmd, opt1, otn); } else if (!strcasecmp(opts[0], "fast_pattern_only")) { - PayloadSearchFastPatternOnly(pmd, opt1, otn); + parse_fast_pattern_only(pmd, opt1, otn); } else if (!strcasecmp(opts[0], "fast_pattern_offset")) { - PayloadSearchFastPatternOffset(pmd, opt1, otn); + parse_fast_pattern_offset(pmd, opt1, otn); } else if (!strcasecmp(opts[0], "fast_pattern_length")) { - PayloadSearchFastPatternLength(pmd, opt1, otn); + parse_fast_pattern_length(pmd, opt1, otn); } else if (!strcasecmp(opts[0], "distance")) { - PayloadSearchDistance(pmd, opt1, otn); + parse_distance(pmd, opt1, otn); } else if (!strcasecmp(opts[0], "within")) { - PayloadSearchWithin(pmd, opt1, otn); + parse_within(pmd, opt1, otn); } else { @@ -1154,7 +1143,7 @@ static IpsOption* content_ctor( } free(data_dup); - ValidateContent(sc, pmd, otn); + validate_content(sc, pmd, otn); return new ContentOption(pmd, "content"); } diff --git a/src/ips_options/ips_content.h b/src/ips_options/ips_content.h index 93a18ab80..c694a71ca 100644 --- a/src/ips_options/ips_content.h +++ b/src/ips_options/ips_content.h @@ -28,22 +28,17 @@ #include "snort_debug.h" #include "detection/rules.h" #include "detection/treenodes.h" -#include "detection/detection_util.h" -#include "framework/content_buffer.h" extern THREAD_LOCAL int lastType; -#define CHECK_AND_PATTERN_MATCH 1 -#define CHECK_URI_PATTERN_MATCH 2 - struct PmdLastCheck { struct timeval ts; uint64_t packet_number; uint32_t rebuild_flag; - }; +}; -typedef struct _PatternMatchData +struct PatternMatchData { int offset; /* pattern search start offset */ int depth; /* pattern search depth */ @@ -85,9 +80,9 @@ typedef struct _PatternMatchData applies to negative contents that are not relative */ PmdLastCheck* last_check; -} PatternMatchData; +}; -PatternMatchData* content_get_data(void* pv); +PatternMatchData* content_get_data(void*); bool content_next(PatternMatchData*); int PatternMatchAdjustRelativeOffsets( @@ -100,21 +95,5 @@ PatternMatchData* get_pmd(OptFpList*); bool is_fast_pattern_only(OptFpList*); bool is_unbounded(void*); -// FIXIT must add same fast_pattern options from content to these -// rule options: -static inline bool IsHttpBufFpEligible (HTTP_BUFFER http_buffer) -{ - switch ( http_buffer ) - { - case HTTP_BUFFER_URI: - case HTTP_BUFFER_HEADER: - case HTTP_BUFFER_CLIENT_BODY: - return true; - default: - break; - } - return false; -} - #endif diff --git a/src/ips_options/ips_luajit.cc b/src/ips_options/ips_luajit.cc index b004d053a..1d6b560fc 100644 --- a/src/ips_options/ips_luajit.cc +++ b/src/ips_options/ips_luajit.cc @@ -25,7 +25,7 @@ #include "managers/ips_manager.h" #include "hash/sfhashfcn.h" #include "parser/parser.h" -#include "detection/detection_util.h" +#include "framework/cursor.h" using namespace std; @@ -39,53 +39,30 @@ static const char* opt_eval = "eval"; // luajit ffi stuff //------------------------------------------------------------------------- -enum BufferType -{ - BT_PAYLOAD, - BT_URI -}; - struct Buffer { - enum BufferType type; + const char* type; const uint8_t* data; - uint32_t len; + unsigned len; }; extern "C" { // ensure Lua can link with this -const Buffer* get_buffer(BufferType); +const Buffer* get_buffer(); } static THREAD_LOCAL Packet* packet; +static THREAD_LOCAL Cursor* cursor; +static THREAD_LOCAL Buffer buf; //namespace snort_ffi //{ -const Buffer* get_buffer(BufferType type) +const Buffer* get_buffer() { - static Buffer buf; - buf.type = type; - - if ( type == BT_PAYLOAD && packet ) - { - buf.data = packet->data; - buf.len = packet->dsize; - return &buf; - } - else if ( type != BT_PAYLOAD ) - { - const HttpBuffer* p = GetHttpBuffer((HTTP_BUFFER)type); - - if ( p ) - { - buf.data = p->buf; - buf.len = p->length; - return &buf; - } - } - buf.data = (uint8_t*)""; - buf.len = 0; - + assert(cursor); + buf.type = cursor->get_name(); + buf.data = cursor->start(); + buf.len = cursor->length(); return &buf; } //}; @@ -232,9 +209,10 @@ bool LuaJITOption::operator==(const IpsOption& ips) const return true; } -int LuaJITOption::eval(Cursor&, Packet* p) +int LuaJITOption::eval(Cursor& c, Packet* p) { packet = p; + cursor = &c; lua_State* L = lua[get_instance_id()]; lua_getglobal(L, opt_eval); diff --git a/src/ips_options/ips_options.cc b/src/ips_options/ips_options.cc index 08d750048..552341546 100644 --- a/src/ips_options/ips_options.cc +++ b/src/ips_options/ips_options.cc @@ -46,6 +46,16 @@ extern const BaseApi* ips_dsize; extern const BaseApi* ips_flags; extern const BaseApi* ips_fragbits; extern const BaseApi* ips_fragoffset; +extern const BaseApi* ips_http_uri; +extern const BaseApi* ips_http_header; +extern const BaseApi* ips_http_client_body; +extern const BaseApi* ips_http_method; +extern const BaseApi* ips_http_cookie; +extern const BaseApi* ips_http_stat_code; +extern const BaseApi* ips_http_stat_msg; +extern const BaseApi* ips_http_raw_uri; +extern const BaseApi* ips_http_raw_header; +extern const BaseApi* ips_http_raw_cookie; extern const BaseApi* ips_icmp_id; extern const BaseApi* ips_icmp_seq; extern const BaseApi* ips_icode; @@ -74,6 +84,16 @@ const BaseApi* ips_options[] = ips_file_data, ips_flow, ips_flowbits, + ips_http_uri, + ips_http_header, + ips_http_client_body, + ips_http_method, + ips_http_cookie, + ips_http_stat_code, + ips_http_stat_msg, + ips_http_raw_uri, + ips_http_raw_header, + ips_http_raw_cookie, ips_ip_proto, ips_pcre, ips_so, diff --git a/src/ips_options/ips_urilen.cc b/src/ips_options/ips_urilen.cc index fdd35b41a..ae5f44eb6 100644 --- a/src/ips_options/ips_urilen.cc +++ b/src/ips_options/ips_urilen.cc @@ -19,8 +19,6 @@ ** USA */ -#include "ips_urilen.h" - #ifdef HAVE_CONFIG_H #include "config.h" #endif @@ -44,6 +42,8 @@ #include "detection/detection_defines.h" #include "detection_util.h" #include "framework/ips_option.h" +#include "framework/inspector.h" +#include "flow/flow.h" static const char* s_name = "urilen"; @@ -52,7 +52,7 @@ static THREAD_LOCAL PreprocStats urilenCheckPerfStats; static PreprocStats* uc_get_profile(const char* key) { - if ( !strcmp(key, "urilen_check") ) + if ( !strcmp(key, s_name) ) return &urilenCheckPerfStats; return nullptr; @@ -67,6 +67,15 @@ static PreprocStats* uc_get_profile(const char* key) #define URILEN_CHECK_LT 3 #define URILEN_CHECK_RG 4 +struct UriLenCheckData +{ + uint16_t urilen; + uint16_t urilen2; + char oper; + const char* key; + +}; + class UriLenOption : public IpsOption { public: @@ -98,7 +107,7 @@ uint32_t UriLenOption::hash() const mix(a,b,c); - a += data->uri_buf; + a += strcmp(data->key, "http_uri"); b += 0; mix_str(a,b,c,get_name()); @@ -119,7 +128,7 @@ bool UriLenOption::operator==(const IpsOption& ips) const if ((left->urilen == right->urilen) && (left->urilen2 == right->urilen2) && (left->oper == right->oper) - && (left->uri_buf == right->uri_buf)) + && (!strcmp(left->key, right->key)) ) { return true; } @@ -127,16 +136,18 @@ bool UriLenOption::operator==(const IpsOption& ips) const return false; } -int UriLenOption::eval(Cursor&, Packet*) +int UriLenOption::eval(Cursor&, Packet* p) { UriLenCheckData *udata = &config; int rval = DETECTION_OPTION_NO_MATCH; - const HttpBuffer* hb = GetHttpBuffer((HTTP_BUFFER)udata->uri_buf); - PROFILE_VARS; + InspectionBuffer hb; + PROFILE_VARS; PREPROC_PROFILE_START(urilenCheckPerfStats); - if ( !hb ) + if ( !p->flow || !p->flow->clouseau || + // FIXIT cache id at parse time for runtime use + !p->flow->clouseau->get_buf(udata->key, p, hb) ) { PREPROC_PROFILE_END(urilenCheckPerfStats); return rval; @@ -145,26 +156,25 @@ int UriLenOption::eval(Cursor&, Packet*) switch (udata->oper) { case URILEN_CHECK_EQ: - if (udata->urilen == hb->length) + if (udata->urilen == hb.len) rval = DETECTION_OPTION_MATCH; break; case URILEN_CHECK_GT: - if (udata->urilen < hb->length) + if (udata->urilen < hb.len) rval = DETECTION_OPTION_MATCH; break; case URILEN_CHECK_LT: - if (udata->urilen > hb->length) + if (udata->urilen > hb.len) rval = DETECTION_OPTION_MATCH; break; case URILEN_CHECK_RG: - if ((udata->urilen <= hb->length) && (udata->urilen2 >= hb->length)) + if ((udata->urilen <= hb.len) && (udata->urilen2 >= hb.len)) rval = DETECTION_OPTION_MATCH; break; default: break; } - /* if the test isn't successful, return 0 */ PREPROC_PROFILE_END(urilenCheckPerfStats); return rval; } @@ -272,9 +282,9 @@ static void urilen_parse(char* argp, UriLenCheckData* ds_ptr) if (num_toks > 1) { if (!strcmp(toks[1], URI_LEN_BUF_NORM)) - ds_ptr->uri_buf = HTTP_BUFFER_URI; + ds_ptr->key = "http_uri"; else if (!strcmp(toks[1], URI_LEN_BUF_RAW)) - ds_ptr->uri_buf = HTTP_BUFFER_RAW_URI; + ds_ptr->key = "http_raw_uri"; else ParseError("Invalid 'urilen' argument."); } @@ -285,7 +295,7 @@ static void urilen_parse(char* argp, UriLenCheckData* ds_ptr) ParseError("Invalid 'urilen' argument."); } - ds_ptr->uri_buf = HTTP_BUFFER_RAW_URI; + ds_ptr->key = "http_raw_uri"; } mSplitFree(&toks, num_toks); @@ -308,7 +318,7 @@ static void urilen_dtor(IpsOption* p) static void urilen_ginit(SnortConfig*) { #ifdef PERF_PROFILING - RegisterOtnProfile("urilen_check", &urilenCheckPerfStats, uc_get_profile); + RegisterOtnProfile(s_name, &urilenCheckPerfStats, uc_get_profile); #endif } diff --git a/src/ips_options/ips_urilen.h b/src/ips_options/ips_urilen.h deleted file mode 100644 index 01df67df7..000000000 --- a/src/ips_options/ips_urilen.h +++ /dev/null @@ -1,36 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. - ** Copyright (C) 2005-2013 Sourcefire, Inc. - ** - ** This program is free software; you can redistribute it and/or modify - ** it under the terms of the GNU General Public License Version 2 as - ** published by the Free Software Foundation. You may not use, modify or - ** distribute this program under any other version of the GNU General - ** Public License. - ** - ** This program is distributed in the hope that it will be useful, - ** but WITHOUT ANY WARRANTY; without even the implied warranty of - ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - ** GNU General Public License for more details. - ** - ** You should have received a copy of the GNU General Public License - ** along with this program; if not, write to the Free Software - ** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ - -#ifndef IPS_URILEN_H -#define IPS_URILEN_H - -#include - -typedef struct _UriLenCheckData -{ - uint16_t urilen; - uint16_t urilen2; - char oper; - int uri_buf; - -} UriLenCheckData; - -#endif - diff --git a/src/log/messages.h b/src/log/messages.h index 90b7d0b1c..e0877f4be 100644 --- a/src/log/messages.h +++ b/src/log/messages.h @@ -75,6 +75,10 @@ public: const char* eol = !(++idx % max) ? "\n" : ""; LogMessage(" %18.18s(v%u)%s", s, v, eol); }; + void dump(const char* s, const char* t) + { + LogMessage("%s::%s\n", s, t); + }; private: unsigned max; unsigned idx; diff --git a/src/main.cc b/src/main.cc index 60ec439a0..a49de4de7 100644 --- a/src/main.cc +++ b/src/main.cc @@ -118,8 +118,10 @@ Swapper::~Swapper() void Swapper::apply() { if ( new_conf ) + { snort_conf = new_conf; set_default_policy(); + } if ( new_attribs ) SFAT_SetConfig(new_attribs); diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc index 7ae29d77d..a64577f48 100644 --- a/src/managers/inspector_manager.cc +++ b/src/managers/inspector_manager.cc @@ -89,6 +89,7 @@ PHInstance::PHInstance(PHClass& p) : pp_class(p) { Module* mod = ModuleManager::get_module(p.api.base.name); handler = p.api.ctor(mod); + handler->set_api(&p.api); } typedef list PHGlobalList; @@ -185,6 +186,22 @@ void InspectorManager::dump_plugins() d.dump(p->api.base.name, p->api.base.version); } +void InspectorManager::dump_buffers() +{ + Dumper d("Inspection Buffers"); + + for ( const auto* p : s_handlers ) + { + const char** b = p->api.buffers; + + while ( b && *b ) + { + d.dump(p->api.base.name, *b); + ++b; + } + } +} + void InspectorManager::release_plugins () { empty_trash(); diff --git a/src/managers/inspector_manager.h b/src/managers/inspector_manager.h index 018f8bd26..8be2fd251 100644 --- a/src/managers/inspector_manager.h +++ b/src/managers/inspector_manager.h @@ -37,6 +37,7 @@ class InspectorManager public: static void add_plugin(const InspectApi* api); static void dump_plugins(void); + static void dump_buffers(void); static void release_plugins(void); static void new_policy(InspectionPolicy*); diff --git a/src/managers/snort_plugin.lua b/src/managers/snort_plugin.lua index 587e7718c..0402fc11a 100644 --- a/src/managers/snort_plugin.lua +++ b/src/managers/snort_plugin.lua @@ -20,64 +20,12 @@ ffi = require("ffi") ffi.cdef[[ -enum BufferType { - BT_PAYLOAD, - BT_HTTP_URI, - BT_HTTP_HEADER, - BT_HTTP_CLIENT_BODY, - BT_HTTP_METHOD, - BT_HTTP_COOKIE, - BT_HTTP_STAT_CODE, - BT_HTTP_STAT_MSG, - BT_HTTP_RAW_URI, - BT_HTTP_RAW_HEADER, - BT_HTTP_RAW_COOKIE -}; -struct Buffer { - enum BufferType type; +struct Buffer +{ + const char* type; const uint8_t* data; - uint32_t len; + unsigned len; }; -const struct Buffer* get_buffer(enum BufferType); +const Buffer* get_buffer(); ]] -function get_buffer_type(type) - if ( type ) then - type = type:lower() - end - if ( type == nil or type == 'payload' ) then - return ffi.C.BT_PAYLOAD - end - if ( type == 'http_uri' ) then - return ffi.C.BT_HTTP_URI - end - if ( type == 'http_header' ) then - return ffi.C.BT_HTTP_HEADER - end - if ( type == 'http_client_body' ) then - return ffi.C.BT_HTTP_CLIENT_BODY - end - if ( type == 'http_method' ) then - return ffi.C.BT_HTTP_METHOD - end - if ( type == 'http_cookie' ) then - return ffi.C.BT_HTTP_COOKIE - end - if ( type == 'http_stat_code' ) then - return ffi.C.BT_HTTP_STAT_CODE - end - if ( type == 'http_stat_msg' ) then - return ffi.C.BT_HTTP_STAT_MSG - end - if ( type == 'http_raw_uri' ) then - return ffi.C.BT_HTTP_RAW_URI - end - if ( type == 'http_raw_header' ) then - return ffi.C.BT_HTTP_RAW_HEADER - end - if ( type == 'http_raw_cookie' ) then - return ffi.C.BT_HTTP_RAW_COOKIE - end - return -1 -end - diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc index ea2a83e41..86a4128d9 100644 --- a/src/network_inspectors/arp_spoof/arp_spoof.cc +++ b/src/network_inspectors/arp_spoof/arp_spoof.cc @@ -338,6 +338,7 @@ static const InspectApi as_api = }, IT_PROTOCOL, PROTO_BIT__ARP, + nullptr, // buffers nullptr, // service as_init, nullptr, // term diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc index 18ec90226..68e0e5614 100644 --- a/src/network_inspectors/normalize/normalize.cc +++ b/src/network_inspectors/normalize/normalize.cc @@ -295,6 +295,7 @@ static const InspectApi no_api = }, IT_PACKET, PROTO_BITS, + nullptr, // buffers nullptr, // service no_init, nullptr, // term diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc index 154fdbd49..d55fd3c0b 100644 --- a/src/network_inspectors/perf_monitor/perf_monitor.cc +++ b/src/network_inspectors/perf_monitor/perf_monitor.cc @@ -406,6 +406,7 @@ static const InspectApi pm_api = }, IT_PACKET, PROTO_BIT__ALL, + nullptr, // buffers nullptr, // service pm_init, nullptr, // term diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc index 8e365537f..82638e41e 100644 --- a/src/network_inspectors/port_scan/port_scan.cc +++ b/src/network_inspectors/port_scan/port_scan.cc @@ -1031,6 +1031,7 @@ static const InspectApi sp_api = }, IT_PROTOCOL, PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP|PROTO_BIT__UDP, // FIXIT dynamic assign + nullptr, // buffers nullptr, // service sp_init, nullptr, // term diff --git a/src/parser/cmd_line.cc b/src/parser/cmd_line.cc index e37de16a7..d7b7a99d8 100644 --- a/src/parser/cmd_line.cc +++ b/src/parser/cmd_line.cc @@ -37,6 +37,7 @@ using namespace std; #include "managers/shell.h" #include "managers/event_manager.h" #include "managers/ips_manager.h" +#include "managers/inspector_manager.h" #include "managers/module_manager.h" #include "managers/plugin_manager.h" #include "packet_io/trough.h" @@ -256,7 +257,7 @@ static void config_help_signals(SnortConfig*, const char*) exit(0); } -enum HelpType { HT_CFG, HT_CMD, HT_GID, HT_IPS, HT_MOD }; +enum HelpType { HT_CFG, HT_CMD, HT_GID, HT_IPS, HT_MOD, HT_BUF }; static void show_help(SnortConfig* sc, const char* val, HelpType ht) { @@ -282,6 +283,9 @@ static void show_help(SnortConfig* sc, const char* val, HelpType ht) ModuleManager::show_commands(s_markup, val); ModuleManager::show_rules(s_markup, val); break; + case HT_BUF: + InspectorManager::dump_buffers(); + break; } ModuleManager::term(); PluginManager::release_plugins(); @@ -308,6 +312,11 @@ static void config_help_gids(SnortConfig* sc, const char* val) show_help(sc, val, HT_GID); } +static void config_help_buffers(SnortConfig* sc, const char* val) +{ + show_help(sc, val, HT_BUF); +} + static void config_help_builtin(SnortConfig* sc, const char* val) { show_help(sc, val, HT_IPS); @@ -406,11 +415,6 @@ static void config_conf(SnortConfig*, const char* val) set_main_hook(snort_inspect); } -static void config_log_alerts(SnortConfig* sc, const char*) -{ - sc->output = OUTPUT_LOG; -} - static void config_line_buffer(SnortConfig* sc, const char*) { sc->output_flags |= OUTPUT_FLAG__LINE_BUFFER; @@ -682,9 +686,6 @@ static ConfigFunc basic_opts[] = { "O", ConfigObfuscate, "obfuscate the logged IP addresses" }, - { "P", ConfigPacketSnaplen, - " (same as --snaplen)" }, - { "Q", config_inline, "enable inline mode operation" }, @@ -697,8 +698,8 @@ static ConfigFunc basic_opts[] = { "S", config_set_var, " set rules file variable n equal to value v" }, - { "s", config_log_alerts, - "log alert messages to syslog" }, + { "s", ConfigPacketSnaplen, + " (same as --snaplen)" }, { "T", config_test_mode, "test and report on the current Snort configuration" }, @@ -781,6 +782,9 @@ static ConfigFunc basic_opts[] = { "help-builtin", config_help_builtin, " output matching builtin rules" }, + { "help-buffers", config_help_buffers, + "output available inspection buffers" }, + { "help-commands", config_help_commands, " output matching commands" }, @@ -863,7 +867,7 @@ static ConfigFunc basic_opts[] = " skip 1st n packets", }, { "snaplen", ConfigPacketSnaplen, - " set snaplen of packet (same as -P)", }, + " set snaplen of packet (same as -s)", }, { "treat-drop-as-alert", ConfigTreatDropAsAlert, "converts drop, sdrop, and reject rules into alert rules during startup" }, diff --git a/src/service_inspectors/back_orifice/back_orifice.cc b/src/service_inspectors/back_orifice/back_orifice.cc index 0907100c4..b282ee04a 100644 --- a/src/service_inspectors/back_orifice/back_orifice.cc +++ b/src/service_inspectors/back_orifice/back_orifice.cc @@ -627,6 +627,7 @@ static const InspectApi bo_api = }, IT_PROTOCOL, PROTO_BIT__UDP, + nullptr, // buffers nullptr, // service bo_init, nullptr, // term diff --git a/src/service_inspectors/ftp_telnet/ftp.cc b/src/service_inspectors/ftp_telnet/ftp.cc index 9a1cbfca3..51ef27ebc 100644 --- a/src/service_inspectors/ftp_telnet/ftp.cc +++ b/src/service_inspectors/ftp_telnet/ftp.cc @@ -717,6 +717,7 @@ static const InspectApi fs_api = //IT_SESSION, // FIXIT should be service only IT_SERVICE, PROTO_BIT__TCP, + nullptr, // buffers "ftp", // FIXIT add ftp-data inspector fs_init, nullptr, // term diff --git a/src/service_inspectors/ftp_telnet/telnet.cc b/src/service_inspectors/ftp_telnet/telnet.cc index 1d0ec2f8f..5f5efa800 100644 --- a/src/service_inspectors/ftp_telnet/telnet.cc +++ b/src/service_inspectors/ftp_telnet/telnet.cc @@ -345,6 +345,7 @@ const InspectApi tn_api = }, IT_SERVICE, PROTO_BIT__TCP, + nullptr, // buffers "telnet", tn_init, nullptr, // term diff --git a/src/service_inspectors/http_inspect/CMakeLists.txt b/src/service_inspectors/http_inspect/CMakeLists.txt index fe2368e29..9d4d32525 100644 --- a/src/service_inspectors/http_inspect/CMakeLists.txt +++ b/src/service_inspectors/http_inspect/CMakeLists.txt @@ -2,7 +2,6 @@ set (FILE_LIST http_inspect.cc - http_inspect.h hi_main.cc hi_main.h hi_ad.cc @@ -15,7 +14,6 @@ set (FILE_LIST hi_cmd_lookup.cc hi_cmd_lookup.h hi_include.h - hi_ips_options.cc hi_mi.cc hi_mi.h hi_norm.cc @@ -37,8 +35,6 @@ set (FILE_LIST hi_ui_config.h hi_ui_iis_unicode_map.cc hi_ui_iis_unicode_map.h - hi_uri.h - hi_urilen_check.h hi_util.h hi_util_hbm.cc hi_util_hbm.h diff --git a/src/service_inspectors/http_inspect/Makefile.am b/src/service_inspectors/http_inspect/Makefile.am index a43f8e0cd..04d64ec0c 100644 --- a/src/service_inspectors/http_inspect/Makefile.am +++ b/src/service_inspectors/http_inspect/Makefile.am @@ -1,7 +1,7 @@ AUTOMAKE_OPTIONS=foreign no-dependencies file_list = \ -http_inspect.cc http_inspect.h \ +http_inspect.cc \ hi_main.cc hi_main.h \ hi_ad.cc hi_ad.h \ hi_client.cc hi_client.h \ @@ -10,7 +10,6 @@ hi_client_stateful.h \ hi_cmd_lookup.cc hi_cmd_lookup.h \ hi_events.h \ hi_include.h \ -hi_ips_options.cc \ hi_mi.cc hi_mi.h \ hi_module.cc hi_module.h \ hi_norm.cc hi_norm.h \ @@ -23,8 +22,6 @@ hi_si.cc hi_si.h \ hi_stateful_inspect.h \ hi_ui_config.cc hi_ui_config.h \ hi_ui_iis_unicode_map.cc hi_ui_iis_unicode_map.h \ -hi_uri.h \ -hi_urilen_check.h \ hi_util.h \ hi_util_hbm.cc hi_util_hbm.h \ hi_util_kmap.cc hi_util_kmap.h \ diff --git a/src/service_inspectors/http_inspect/hi_ips_options.cc b/src/service_inspectors/http_inspect/hi_ips_options.cc deleted file mode 100644 index 619e446d2..000000000 --- a/src/service_inspectors/http_inspect/hi_ips_options.cc +++ /dev/null @@ -1,482 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** Copyright (C) 2002-2013 Sourcefire, Inc. -** Copyright (C) 1998-2002 Martin Roesch -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include -#include - -#include "snort_types.h" -#include "treenodes.h" -#include "protocols/packet.h" -#include "parser.h" -#include "util.h" -#include "snort_debug.h" -#include "snort.h" -#include "profiler.h" -#include "fpdetect.h" -#include "detection/detection_defines.h" -#include "detection/detection_util.h" -#include "framework/ips_option.h" -#include "framework/cursor.h" - -//------------------------------------------------------------------------- -// api methods -//------------------------------------------------------------------------- - -static const char* s_name = "http_ips"; - -#ifdef PERF_PROFILING -static THREAD_LOCAL PreprocStats httpIpsPerfStats; - -static PreprocStats* hi_ips_get_profile(const char* key) -{ - if ( !strcmp(key, s_name) ) - return &httpIpsPerfStats; - - return nullptr; -} -#endif - -static void hi_ips_dtor(IpsOption* p) -{ - delete p; -} - -static void hi_ips_ginit(SnortConfig*) -{ -#ifdef PERF_PROFILING - RegisterOtnProfile(s_name, &httpIpsPerfStats, hi_ips_get_profile); -#endif -} - -//------------------------------------------------------------------------- -// generic buffer stuffer -//------------------------------------------------------------------------- - -class HttpIpsOption : public IpsOption -{ -public: - HttpIpsOption(const char* s, HTTP_BUFFER b) : IpsOption(s) - { key = s; type = b; }; - - int eval(Cursor&, Packet*); -private: - const char* key; - HTTP_BUFFER type; -}; - -int HttpIpsOption::eval(Cursor& c, Packet*) -{ - PROFILE_VARS; - PREPROC_PROFILE_START(httpIpsPerfStats); - - int rval; - const HttpBuffer* hb = GetHttpBuffer(type); - - if ( !hb ) - rval = DETECTION_OPTION_MATCH; - else - { - c.set(key, hb->buf, hb->length); - rval = DETECTION_OPTION_MATCH; - } - - PREPROC_PROFILE_END(httpIpsPerfStats); - return rval; -} - -//------------------------------------------------------------------------- -// http_uri -//------------------------------------------------------------------------- - -static IpsOption* http_uri_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_uri"); - - return new HttpIpsOption("http_uri", HTTP_BUFFER_URI); -} - -static const IpsApi http_uri_api = -{ - { - PT_IPS_OPTION, - "http_uri", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_uri_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_header -//------------------------------------------------------------------------- - -static IpsOption* http_header_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_header"); - - return new HttpIpsOption("http_header", HTTP_BUFFER_HEADER); -} - -static const IpsApi http_header_api = -{ - { - PT_IPS_OPTION, - "http_header", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_header_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_client_body -//------------------------------------------------------------------------- - -static IpsOption* http_client_body_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_client_body"); - - return new HttpIpsOption("http_client_body", HTTP_BUFFER_CLIENT_BODY); -} - -static const IpsApi http_client_body_api = -{ - { - PT_IPS_OPTION, - "http_client_body", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_client_body_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_method -//------------------------------------------------------------------------- - -static IpsOption* http_method_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_method"); - - return new HttpIpsOption("http_method", HTTP_BUFFER_METHOD); -} - -static const IpsApi http_method_api = -{ - { - PT_IPS_OPTION, - "http_method", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_method_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_cookie -//------------------------------------------------------------------------- - -static IpsOption* http_cookie_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_cookie"); - - return new HttpIpsOption("http_cookie", HTTP_BUFFER_COOKIE); -} - -static const IpsApi http_cookie_api = -{ - { - PT_IPS_OPTION, - "http_cookie", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_cookie_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_stat_code -//------------------------------------------------------------------------- - -static IpsOption* http_stat_code_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_stat_code"); - - return new HttpIpsOption("http_stat_code", HTTP_BUFFER_STAT_CODE); -} - -static const IpsApi http_stat_code_api = -{ - { - PT_IPS_OPTION, - "http_stat_code", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_stat_code_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_stat_msg -//------------------------------------------------------------------------- - -static IpsOption* http_stat_msg_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_stat_msg"); - - return new HttpIpsOption("http_stat_msg", HTTP_BUFFER_STAT_MSG); -} - -static const IpsApi http_stat_msg_api = -{ - { - PT_IPS_OPTION, - "http_stat_msg", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_stat_msg_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_raw_uri -//------------------------------------------------------------------------- - -static IpsOption* http_raw_uri_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_raw_uri"); - - return new HttpIpsOption("http_raw_uri", HTTP_BUFFER_RAW_URI); -} - -static const IpsApi http_raw_uri_api = -{ - { - PT_IPS_OPTION, - "http_raw_uri", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_raw_uri_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_raw_header -//------------------------------------------------------------------------- - -static IpsOption* http_raw_header_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_raw_header"); - - return new HttpIpsOption("http_raw_header", HTTP_BUFFER_RAW_HEADER); -} - -static const IpsApi http_raw_header_api = -{ - { - PT_IPS_OPTION, - "http_raw_header", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_raw_header_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// http_raw_cookie -//------------------------------------------------------------------------- - -static IpsOption* http_raw_cookie_ctor( - SnortConfig*, char* data, OptTreeNode*) -{ - if (!IsEmptyStr(data)) - ParseError("%s takes no arguments", "http_raw_cookie"); - - return new HttpIpsOption("http_raw_cookie", HTTP_BUFFER_RAW_COOKIE); -} - -static const IpsApi http_raw_cookie_api = -{ - { - PT_IPS_OPTION, - "http_raw_cookie", - IPSAPI_PLUGIN_V0, - 0, - nullptr, - nullptr - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - hi_ips_ginit, - nullptr, - nullptr, - nullptr, - http_raw_cookie_ctor, - hi_ips_dtor, - nullptr -}; - -//------------------------------------------------------------------------- -// plugins -//------------------------------------------------------------------------- - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &http_uri_api.base, - &http_header_api.base, - &http_client_body_api.base, - &http_method_api.base, - &http_cookie_api.base, - &http_stat_code_api.base, - &http_stat_msg_api.base, - &http_raw_uri_api.base, - &http_raw_header_api.base, - &http_raw_cookie_api.base, - nullptr -}; -#else -const BaseApi* ips_http_uri = &http_uri_api.base; -const BaseApi* ips_http_header = &http_header_api.base; -const BaseApi* ips_http_client_body = &http_client_body_api.base; -const BaseApi* ips_http_method = &http_method_api.base; -const BaseApi* ips_http_cookie = &http_cookie_api.base; -const BaseApi* ips_http_stat_code = &http_stat_code_api.base; -const BaseApi* ips_http_stat_msg = &http_stat_msg_api.base; -const BaseApi* ips_http_raw_uri = &http_raw_uri_api.base; -const BaseApi* ips_http_raw_header = &http_raw_header_api.base; -const BaseApi* ips_http_raw_cookie = &http_raw_cookie_api.base; -#endif - diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc index 95a9f08ad..0df997ae0 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/src/service_inspectors/http_inspect/hi_main.cc @@ -1106,6 +1106,7 @@ void FreeHttpsessionData(void *data) file_api->free_mime_session(hsd->mime_ssn); } +// FIXIT this should leverage inspector get_buf() int GetHttpTrueIP(Flow* flow, uint8_t **buf, uint32_t *len, uint32_t *type) { HttpsessionData* hsd = get_session_data(flow); diff --git a/src/service_inspectors/http_inspect/hi_uri.h b/src/service_inspectors/http_inspect/hi_uri.h deleted file mode 100644 index fd401f60f..000000000 --- a/src/service_inspectors/http_inspect/hi_uri.h +++ /dev/null @@ -1,62 +0,0 @@ -/**************************************************************************** - * -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. - * Copyright (C) 2005-2013 Sourcefire, Inc. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License Version 2 as - * published by the Free Software Foundation. You may not use, modify or - * distribute this program under any other version of the GNU General - * Public License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - * - ****************************************************************************/ - -#ifndef HI_URI_H -#define HI_URI_H - -#ifdef HAVE_CONFIG_H -#include -#endif -/** -** This structure holds pointers to the different sections of an HTTP -** request. We need to track where whitespace begins and ends, so we -** can evaluate the placement of the URI correctly. -** -** For example, -** -** GET / HTTP/1.0 -** ^ ^ -** start end -** -** The end space pointers are set to NULL if there is space until the end -** of the buffer. -*/ -typedef struct s_URI_PTR -{ - const u_char *uri; /* the beginning of the URI */ - const u_char *uri_end; /* the end of the URI */ - const u_char *norm; /* ptr to first normalization occurence */ - const u_char *ident; /* ptr to beginning of the HTTP identifier */ - const u_char *first_sp_start; /* beginning of first space delimiter */ - const u_char *first_sp_end; /* end of first space delimiter */ - const u_char *second_sp_start; /* beginning of second space delimiter */ - const u_char *second_sp_end; /* end of second space delimiter */ - const u_char *param; /* '?' (beginning of parameter field) */ - const u_char *delimiter; /* HTTP URI delimiter (\r\n\) */ - const u_char *last_dir; /* ptr to last dir, so we catch long dirs */ - const u_char *proxy; /* ptr to the absolute URI */ -} URI_PTR; - -#define URI_END 1 -#define NO_URI -1 - -#endif /* HI_URI_H */ diff --git a/src/service_inspectors/http_inspect/hi_urilen_check.h b/src/service_inspectors/http_inspect/hi_urilen_check.h deleted file mode 100644 index a85b39383..000000000 --- a/src/service_inspectors/http_inspect/hi_urilen_check.h +++ /dev/null @@ -1,50 +0,0 @@ -/* -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. -** Copyright (C) 2005-2013 Sourcefire, Inc. -** -** This program is free software; you can redistribute it and/or modify -** it under the terms of the GNU General Public License Version 2 as -** published by the Free Software Foundation. You may not use, modify or -** distribute this program under any other version of the GNU General -** Public License. -** -** This program is distributed in the hope that it will be useful, -** but WITHOUT ANY WARRANTY; without even the implied warranty of -** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -** GNU General Public License for more details. -** -** You should have received a copy of the GNU General Public License -** along with this program; if not, write to the Free Software -** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -*/ - -/* - * hi_urilen_check.h: Structure definitions/function prototype(s) - * for the URI length detection plugin. - */ - -/* $Id */ - -#ifndef HI_URILEN_CHECK_H -#define HI_URILEN_CHECK_H - -#define URILEN_OP_GT (0x1) -#define URILEN_OP_LT (0x2) -#define URILEN_OP_EQ (0x3) -#define URILEN_OP_RANGE (0x4) - -/* Structure stored as callback data for use by URILEN - * detection plugin code. - */ -typedef struct _UriLenCheckData -{ - int urilen; - int urilen2; - char op; -} UriLenCheckData; - -/* Function prototype(s) */ -extern int UriLenCheckInit( char*, char*, void** ); -extern int UriLenCheckEval( void*, uint8_t**, void* ); - -#endif /* HI_URILEN_CHECK_H */ diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc index 49ed7c017..39bfcdfdc 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/src/service_inspectors/http_inspect/http_inspect.cc @@ -283,6 +283,7 @@ public: { return new HttpSplitter(c2s); }; void eval(Packet*); + bool get_buf(unsigned, Packet*, InspectionBuffer&); void pinit(); void pterm(); @@ -307,6 +308,18 @@ HttpInspect::~HttpInspect () Share::release(global); } +bool HttpInspect::get_buf(unsigned id, Packet*, InspectionBuffer& b) +{ + const HttpBuffer* h = GetHttpBuffer((HTTP_BUFFER)id); + + if ( !h ) + return false; + + b.data = h->buf; + b.len = h->length; + return true; +} + bool HttpInspect::configure (SnortConfig* sc) { global = (HttpData*)Share::acquire(GLOBAL_KEYWORD); @@ -482,6 +495,21 @@ static void hs_reset() //------------------------------------------------------------------------- +static const char* buffers[] = +{ + "http_client_body", + "http_cookie", + "http_header", + "http_method", + "http_raw_cookie", + "http_raw_header", + "http_raw_uri", + "http_stat_code", + "http_stat_msg", + "http_uri", + nullptr +}; + static const InspectApi hs_api = { { @@ -494,6 +522,7 @@ static const InspectApi hs_api = }, IT_SERVICE, PROTO_BIT__TCP, + buffers, "http", hs_init, hs_term, diff --git a/src/service_inspectors/http_inspect/http_inspect.h b/src/service_inspectors/http_inspect/http_inspect.h deleted file mode 100644 index 16b093a3b..000000000 --- a/src/service_inspectors/http_inspect/http_inspect.h +++ /dev/null @@ -1,43 +0,0 @@ -/**************************************************************************** - * - * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License Version 2 as - * published by the Free Software Foundation. You may not use, modify or - * distribute this program under any other version of the GNU General - * Public License. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - * - ****************************************************************************/ - -#ifndef HTTP_INSPECT_H -#define HTTP_INSPECT_H - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -struct BaseApi; - -extern const BaseApi* ips_http_uri; -extern const BaseApi* ips_http_header; -extern const BaseApi* ips_http_client_body; -extern const BaseApi* ips_http_method; -extern const BaseApi* ips_http_cookie; -extern const BaseApi* ips_http_stat_code; -extern const BaseApi* ips_http_stat_msg; -extern const BaseApi* ips_http_raw_uri; -extern const BaseApi* ips_http_raw_header; -extern const BaseApi* ips_http_raw_cookie; - -#endif - diff --git a/src/service_inspectors/nhttp_inspect/nhttp_api.cc b/src/service_inspectors/nhttp_inspect/nhttp_api.cc index 30e060488..477c89ce8 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_api.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_api.cc @@ -107,6 +107,7 @@ const InspectApi NHttpApi::nhttp_api = }, IT_SERVICE, PROTO_BIT__TCP, + nullptr, // buffers "http", NHttpApi::nhttp_init, NHttpApi::nhttp_term, diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc index b131b6c8e..805d6d1c2 100644 --- a/src/service_inspectors/rpc_decode/rpc_decode.cc +++ b/src/service_inspectors/rpc_decode/rpc_decode.cc @@ -1165,6 +1165,7 @@ static const InspectApi rd_api = }, IT_SERVICE, PROTO_BIT__TCP, + nullptr, // buffers "sunrpc", rd_init, nullptr, // term diff --git a/src/service_inspectors/service_inspectors.cc b/src/service_inspectors/service_inspectors.cc index 22be9a070..2b67d9891 100644 --- a/src/service_inspectors/service_inspectors.cc +++ b/src/service_inspectors/service_inspectors.cc @@ -24,7 +24,6 @@ #include "config.h" #endif #include "framework/inspector.h" -#include "http_inspect/http_inspect.h" extern const BaseApi* sin_http_global; extern const BaseApi* sin_http_server; @@ -43,17 +42,6 @@ const BaseApi* service_inspectors[] = sin_http_global, sin_http_server, - ips_http_uri, - ips_http_header, - ips_http_client_body, - ips_http_method, - ips_http_cookie, - ips_http_stat_code, - ips_http_stat_msg, - ips_http_raw_uri, - ips_http_raw_header, - ips_http_raw_cookie, - #ifdef STATIC_INSPECTORS sin_bo, sin_ftp_client, diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc index 8f10a6ed7..b53ab29c5 100644 --- a/src/stream/base/stream_base.cc +++ b/src/stream/base/stream_base.cc @@ -298,6 +298,7 @@ static const InspectApi base_api = }, IT_STREAM, PROTO_BIT__IP, + nullptr, // buffers nullptr, // service base_init, nullptr, // term diff --git a/src/stream/icmp/stream_icmp.cc b/src/stream/icmp/stream_icmp.cc index a26f05de5..3ac825ef8 100644 --- a/src/stream/icmp/stream_icmp.cc +++ b/src/stream/icmp/stream_icmp.cc @@ -122,6 +122,7 @@ static const InspectApi icmp_api = }, IT_STREAM, PROTO_BIT__ICMP, + nullptr, // buffers nullptr, // service icmp_init, nullptr, // term diff --git a/src/stream/ip/stream_ip.cc b/src/stream/ip/stream_ip.cc index bc7071407..4f555f6ca 100644 --- a/src/stream/ip/stream_ip.cc +++ b/src/stream/ip/stream_ip.cc @@ -169,6 +169,7 @@ static const InspectApi ip_api = }, IT_STREAM, PROTO_BIT__IP, + nullptr, // buffers nullptr, // service ip_init, nullptr, // term diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc index d96a9710e..9a79cf186 100644 --- a/src/stream/tcp/stream_tcp.cc +++ b/src/stream/tcp/stream_tcp.cc @@ -137,6 +137,7 @@ static const InspectApi tcp_api = }, IT_STREAM, PROTO_BIT__TCP, + nullptr, // buffers nullptr, // service tcp_init, nullptr, // term diff --git a/src/stream/udp/stream_udp.cc b/src/stream/udp/stream_udp.cc index 86e59057a..e8a9e4af3 100644 --- a/src/stream/udp/stream_udp.cc +++ b/src/stream/udp/stream_udp.cc @@ -137,6 +137,7 @@ static const InspectApi udp_api = }, IT_STREAM, PROTO_BIT__UDP, + nullptr, // buffers nullptr, // service udp_init, nullptr, // term