From: Russ Combs Date: Fri, 5 Sep 2014 16:35:00 +0000 (-0400) Subject: added brief help to module X-Git-Tag: 3.0.0-233~1417^2~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f5defd6b96b26e1cd88f209c91f8f668d3c46d57;p=thirdparty%2Fsnort3.git added brief help to module --- diff --git a/ChangeLog b/ChangeLog index 50c41cf3c..9c415efea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,7 @@ 118 -- fixed bind action -- tweaked main loop +-- added module 1-line help 117 -- added --stdin-rules diff --git a/src/actions/act_react.cc b/src/actions/act_react.cc index fc97821c6..7ff4f95bc 100644 --- a/src/actions/act_react.cc +++ b/src/actions/act_react.cc @@ -261,10 +261,13 @@ static const Parameter react_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* react_help = + "send response to client and terminate session"; + class ReactModule : public Module { public: - ReactModule() : Module(s_name, react_params) { }; + ReactModule() : Module(s_name, react_help, react_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/actions/act_reject.cc b/src/actions/act_reject.cc index adb782a0d..deab2c897 100644 --- a/src/actions/act_reject.cc +++ b/src/actions/act_reject.cc @@ -146,10 +146,13 @@ static const Parameter rej_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* rej_help = + "terminate session with TCP reset or ICMP unreachable"; + class RejectModule : public Module { public: - RejectModule() : Module(s_name, rej_params) { }; + RejectModule() : Module(s_name, rej_help, rej_params) { }; bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); diff --git a/src/actions/act_replace.cc b/src/actions/act_replace.cc index 3cba768ea..6cabb26ea 100644 --- a/src/actions/act_replace.cc +++ b/src/actions/act_replace.cc @@ -105,10 +105,13 @@ static const Parameter rep_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* rep_help = + "overwrite packet contents"; + class ReplaceModule : public Module { public: - ReplaceModule() : Module(s_name, rep_params) { }; + ReplaceModule() : Module(s_name, rep_help, rep_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); diff --git a/src/codecs/decode_module.h b/src/codecs/decode_module.h index d1eddc94e..926de8e4d 100644 --- a/src/codecs/decode_module.h +++ b/src/codecs/decode_module.h @@ -213,11 +213,11 @@ enum CodecSid { class DecodeModule : public Module { public: - DecodeModule(const char* s) : Module(s) + DecodeModule(const char* s, const char* h) : Module(s, h) { }; - DecodeModule(const char* s, const Parameter* p, bool is_list = false) - : Module(s, p, is_list) { }; + DecodeModule(const char* s, const char* h, const Parameter* p, bool is_list = false) + : Module(s, h, p, is_list) { }; unsigned get_gid() const { return GID_DECODE; }; diff --git a/src/codecs/ip/cd_auth.cc b/src/codecs/ip/cd_auth.cc index 50341a13d..32ef1b989 100644 --- a/src/codecs/ip/cd_auth.cc +++ b/src/codecs/ip/cd_auth.cc @@ -44,10 +44,13 @@ static const RuleMap auth_rules[] = { 0, nullptr } }; +static const char* s_help = + "support for IP authentication header"; + class AuthModule : public DecodeModule { public: - AuthModule() : DecodeModule(CD_AUTH_NAME) {} + AuthModule() : DecodeModule(CD_AUTH_NAME, s_help) {} const RuleMap* get_rules() const { return auth_rules; } @@ -58,7 +61,6 @@ public: // auth module //------------------------------------------------------------------------- - class AuthCodec : public Codec { public: diff --git a/src/codecs/ip/cd_esp.cc b/src/codecs/ip/cd_esp.cc index 3c576f4d2..1a86c049d 100644 --- a/src/codecs/ip/cd_esp.cc +++ b/src/codecs/ip/cd_esp.cc @@ -52,11 +52,13 @@ static const Parameter esp_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* esp_help = + "support for encapsulating security payload"; class EspModule : public DecodeModule { public: - EspModule() : DecodeModule(CD_ESP_NAME, esp_params) {} + EspModule() : DecodeModule(CD_ESP_NAME, esp_help, esp_params) {} const RuleMap* get_rules() const { return esp_rules; } diff --git a/src/codecs/ip/cd_gre.cc b/src/codecs/ip/cd_gre.cc index 1fa7df200..0949d26b7 100644 --- a/src/codecs/ip/cd_gre.cc +++ b/src/codecs/ip/cd_gre.cc @@ -47,20 +47,18 @@ static const RuleMap gre_rules[] = { 0, nullptr } }; +static const char* gre_help = + "support for generic routing encapsulation"; class GreModule : public DecodeModule { public: - GreModule() : DecodeModule(CD_GRE_NAME) {} + GreModule() : DecodeModule(CD_GRE_NAME, gre_help) {} const RuleMap* get_rules() const { return gre_rules; } }; - - - - class GreCodec : public Codec { public: diff --git a/src/codecs/ip/cd_icmp4.cc b/src/codecs/ip/cd_icmp4.cc index 89de5a60b..4d7b0dea9 100644 --- a/src/codecs/ip/cd_icmp4.cc +++ b/src/codecs/ip/cd_icmp4.cc @@ -71,17 +71,18 @@ static const RuleMap icmp4_rules[] = { 0, nullptr } }; +static const char* icmp4_help = + "support for internet control message protocol v4"; + class Icmp4Module : public DecodeModule { public: - Icmp4Module() : DecodeModule(CD_ICMP4_NAME) {} + Icmp4Module() : DecodeModule(CD_ICMP4_NAME, icmp4_help) {} const RuleMap* get_rules() const { return icmp4_rules; } }; - - class Icmp4Codec : public Codec{ public: diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc index d7caf8795..6ede9d1fe 100644 --- a/src/codecs/ip/cd_icmp6.cc +++ b/src/codecs/ip/cd_icmp6.cc @@ -59,10 +59,13 @@ static const RuleMap icmp6_rules[] = { 0, nullptr } }; +static const char* icmp6_help = + "support for internet control message protocol v6"; + class Icmp6Module : public DecodeModule { public: - Icmp6Module() : DecodeModule(CD_ICMP6_NAME) {} + Icmp6Module() : DecodeModule(CD_ICMP6_NAME, icmp6_help) {} const RuleMap* get_rules() const { return icmp6_rules; } diff --git a/src/codecs/ip/cd_igmp.cc b/src/codecs/ip/cd_igmp.cc index e15d94fa5..677fc231a 100644 --- a/src/codecs/ip/cd_igmp.cc +++ b/src/codecs/ip/cd_igmp.cc @@ -43,11 +43,13 @@ static const RuleMap igmp_rules[] = { 0, nullptr } }; +static const char* igmp_help = + "support for internet group management protocol"; class IgmpModule : public DecodeModule { public: - IgmpModule() : DecodeModule(CD_IGMP_NAME) {} + IgmpModule() : DecodeModule(CD_IGMP_NAME, igmp_help) {} const RuleMap* get_rules() const { return igmp_rules; } diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc index ed5f05e31..d9abc8ab6 100644 --- a/src/codecs/ip/cd_ipv4.cc +++ b/src/codecs/ip/cd_ipv4.cc @@ -84,17 +84,18 @@ static const RuleMap ipv4_rules[] = { 0, nullptr } }; +static const char* ipv4_help = + "support for internet protocol v4"; + class Ipv4Module : public DecodeModule { public: - Ipv4Module() : DecodeModule(CD_IPV4_NAME) {} + Ipv4Module() : DecodeModule(CD_IPV4_NAME, ipv4_help) {} const RuleMap* get_rules() const { return ipv4_rules; } }; - - class Ipv4Codec : public Codec { public: diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index 3f6b2b2ed..ac4a10b4a 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -71,11 +71,13 @@ static const RuleMap ipv6_rules[] = { 0, nullptr } }; +static const char* ipv6_help = + "support for internet protocol v6"; class Ipv6Module : public DecodeModule { public: - Ipv6Module() : DecodeModule(CD_IPV6_NAME) {} + Ipv6Module() : DecodeModule(CD_IPV6_NAME, ipv6_help) {} const RuleMap* get_rules() const { return ipv6_rules; } diff --git a/src/codecs/ip/cd_pgm.cc b/src/codecs/ip/cd_pgm.cc index aaf0b7817..0fcdac164 100644 --- a/src/codecs/ip/cd_pgm.cc +++ b/src/codecs/ip/cd_pgm.cc @@ -42,11 +42,13 @@ static const RuleMap pgm_rules[] = { 0, nullptr } }; +static const char* pgm_help = + "support for pragmatic general multicast"; class PgmModule : public DecodeModule { public: - PgmModule() : DecodeModule(CD_PGM_NAME) {} + PgmModule() : DecodeModule(CD_PGM_NAME, pgm_help) {} const RuleMap* get_rules() const { return pgm_rules; } diff --git a/src/codecs/ip/cd_tcp.cc b/src/codecs/ip/cd_tcp.cc index 5bbf58fbf..7e0ba42e4 100644 --- a/src/codecs/ip/cd_tcp.cc +++ b/src/codecs/ip/cd_tcp.cc @@ -79,18 +79,18 @@ static const RuleMap tcp_rules[] = { 0, nullptr } }; +static const char* tcp_help = + "support for transmission control protocol"; class TcpModule : public DecodeModule { public: - TcpModule() : DecodeModule(CD_TCP_NAME) {} + TcpModule() : DecodeModule(CD_TCP_NAME, tcp_help) {} const RuleMap* get_rules() const { return tcp_rules; } }; - - class TcpCodec : public Codec { public: diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc index 8ac7397d6..1d1eb6387 100644 --- a/src/codecs/ip/cd_udp.cc +++ b/src/codecs/ip/cd_udp.cc @@ -83,10 +83,13 @@ static const RuleMap udp_rules[] = { 0, nullptr } }; +static const char* udp_help = + "support for user datagram protocol"; + class UdpModule : public DecodeModule { public: - UdpModule() : DecodeModule(CD_UDP_NAME, udp_params) {} + UdpModule() : DecodeModule(CD_UDP_NAME, udp_help, udp_params) {} const RuleMap* get_rules() const { return udp_rules; } diff --git a/src/codecs/link/cd_arp.cc b/src/codecs/link/cd_arp.cc index 1c794adb4..5bb51c6b1 100644 --- a/src/codecs/link/cd_arp.cc +++ b/src/codecs/link/cd_arp.cc @@ -19,11 +19,6 @@ */ // cd_arp.cc author Josh Rosenbaum - - - - - #include "framework/codec.h" #include "codecs/decode_module.h" #include "codecs/codec_events.h" @@ -43,11 +38,13 @@ static const RuleMap arp_rules[] = { 0, nullptr } }; +static const char* arp_help = + "support for address resolution protocol"; class ArpModule : public DecodeModule { public: - ArpModule() : DecodeModule(CD_ARP_NAME) {} + ArpModule() : DecodeModule(CD_ARP_NAME, arp_help) {} const RuleMap* get_rules() const { return arp_rules; } diff --git a/src/codecs/link/cd_eapol.cc b/src/codecs/link/cd_eapol.cc index eda308871..1a6c12da4 100644 --- a/src/codecs/link/cd_eapol.cc +++ b/src/codecs/link/cd_eapol.cc @@ -44,10 +44,13 @@ static const RuleMap eapol_rules[] = { 0, nullptr } }; +static const char* eapol_help = + "support for extensible authentication protocol over LAN"; + class EapolModule : public DecodeModule { public: - EapolModule() : DecodeModule(CD_EAPOL_NAME) {} + EapolModule() : DecodeModule(CD_EAPOL_NAME, eapol_help) {} const RuleMap* get_rules() const { return eapol_rules; } diff --git a/src/codecs/link/cd_erspan2.cc b/src/codecs/link/cd_erspan2.cc index ec6250ed4..e4c54380d 100644 --- a/src/codecs/link/cd_erspan2.cc +++ b/src/codecs/link/cd_erspan2.cc @@ -39,10 +39,13 @@ static const RuleMap erspan2_rules[] = { 0, nullptr } }; +static const char* erspan2_help = + "support for encapsulated remote switched port analyzer - type 2"; + class Erspan2Module : public DecodeModule { public: - Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME) {} + Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME, erspan2_help) {} const RuleMap* get_rules() const { return erspan2_rules; } diff --git a/src/codecs/link/cd_erspan3.cc b/src/codecs/link/cd_erspan3.cc index bd0fd3474..faa7a54a1 100644 --- a/src/codecs/link/cd_erspan3.cc +++ b/src/codecs/link/cd_erspan3.cc @@ -40,10 +40,13 @@ static const RuleMap erspan3_rules[] = { 0, nullptr } }; +static const char* erspan3_help = + "support for encapsulated remote switched port analyzer - type 3"; + class Erspan3Module : public DecodeModule { public: - Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME) {} + Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME, erspan3_help) {} const RuleMap* get_rules() const { return erspan3_rules; } diff --git a/src/codecs/link/cd_mpls.cc b/src/codecs/link/cd_mpls.cc index cc69a8990..2f208b70f 100644 --- a/src/codecs/link/cd_mpls.cc +++ b/src/codecs/link/cd_mpls.cc @@ -71,10 +71,13 @@ static const RuleMap mpls_rules[] = { 0, nullptr } }; +static const char* mpls_help = + "support for multiprotocol label switching"; + class MplsModule : public DecodeModule { public: - MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_params) {}; + MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_help, mpls_params) {}; const RuleMap* get_rules() const { return mpls_rules; } diff --git a/src/codecs/link/cd_pppoe.cc b/src/codecs/link/cd_pppoe.cc index 8e59c6e24..aa149cae2 100644 --- a/src/codecs/link/cd_pppoe.cc +++ b/src/codecs/link/cd_pppoe.cc @@ -64,10 +64,13 @@ static const RuleMap pppoe_rules[] = { 0, nullptr } }; +static const char* pppoe_help = + "support for point-to-point protocol over ethernet"; + class PPPoEModule : public DecodeModule { public: - PPPoEModule() : DecodeModule(CD_PPPOE_NAME) {} + PPPoEModule() : DecodeModule(CD_PPPOE_NAME, pppoe_help) {} const RuleMap* get_rules() const { return pppoe_rules; } diff --git a/src/codecs/link/cd_vlan.cc b/src/codecs/link/cd_vlan.cc index d90ff1324..d58fa99b1 100644 --- a/src/codecs/link/cd_vlan.cc +++ b/src/codecs/link/cd_vlan.cc @@ -45,10 +45,13 @@ static const RuleMap vlan_rules[] = { 0, nullptr } }; +static const char* vlan_help = + "support for virtual local area network"; + class VlanModule : public DecodeModule { public: - VlanModule() : DecodeModule(CD_VLAN_NAME) {} + VlanModule() : DecodeModule(CD_VLAN_NAME, vlan_help) {} const RuleMap* get_rules() const { return vlan_rules; } diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc index 5626ae5d8..19fbde7cc 100644 --- a/src/codecs/misc/cd_gtp.cc +++ b/src/codecs/misc/cd_gtp.cc @@ -47,10 +47,13 @@ static const RuleMap gtp_rules[] = { 0, nullptr } }; +static const char* gtp_help = + "support for general-packet-radio-service tunnelling protocol"; + class GtpModule : public DecodeModule { public: - GtpModule() : DecodeModule(CD_GTP_NAME) {}; + GtpModule() : DecodeModule(CD_GTP_NAME, gtp_help) {}; const RuleMap* get_rules() const { return gtp_rules; } diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc index 97dd53468..4ca173d52 100644 --- a/src/codecs/root/cd_eth.cc +++ b/src/codecs/root/cd_eth.cc @@ -42,10 +42,13 @@ static const RuleMap eth_rules[] = { 0, nullptr } }; +static const char* eth_help = + "support for ethernet protocol"; + class EthModule : public DecodeModule { public: - EthModule() : DecodeModule(CD_ETH_NAME) {} + EthModule() : DecodeModule(CD_ETH_NAME, eth_help) {} const RuleMap* get_rules() const { return eth_rules; } diff --git a/src/codecs/root/cd_wlan.cc b/src/codecs/root/cd_wlan.cc index c8332dfad..794c3d349 100644 --- a/src/codecs/root/cd_wlan.cc +++ b/src/codecs/root/cd_wlan.cc @@ -48,10 +48,13 @@ static const RuleMap wlan_rules[] = { 0, nullptr } }; +static const char* wlan_help = + "support for wireless local area network protocol"; + class WlanCodecModule : public DecodeModule { public: - WlanCodecModule() : DecodeModule(CD_WLAN_NAME) {} + WlanCodecModule() : DecodeModule(CD_WLAN_NAME, wlan_help) {} const RuleMap* get_rules() const { return wlan_rules; } diff --git a/src/codecs/template_module.h b/src/codecs/template_module.h index 09baa2032..4bd633e33 100644 --- a/src/codecs/template_module.h +++ b/src/codecs/template_module.h @@ -27,6 +27,9 @@ #define CODEC_NAME "name" +static const char* name_help = + "support for name protocol"; + // inherit from DecodeModule rather than Module so the GID for // all codecs are identical. Additionally, all of the SIDS are // defined in DecodeModule. So, when creating new events, you @@ -34,7 +37,7 @@ class NameModule : public DecodeModule { public: - NameModule(); + NameModule() : Module("name", name_help) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); diff --git a/src/framework/module.cc b/src/framework/module.cc index 60d5e2e8f..940eb5a5f 100644 --- a/src/framework/module.cc +++ b/src/framework/module.cc @@ -27,9 +27,10 @@ static const Parameter null_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; -void Module::init(const char* s) +void Module::init(const char* s, const char* h) { name = s; + help = h; params = null_params; list = false; cmds = nullptr; @@ -37,12 +38,12 @@ void Module::init(const char* s) num_counts = -1; } -Module::Module(const char* s) -{ init(s); } +Module::Module(const char* s, const char* h) +{ init(s, h); } -Module::Module(const char* s, const Parameter* p, bool is_list) +Module::Module(const char* s, const char* h, const Parameter* p, bool is_list) { - init(s); + init(s, h); params = p; list = is_list; } diff --git a/src/framework/module.h b/src/framework/module.h index 8684336a5..36e4a6679 100644 --- a/src/framework/module.h +++ b/src/framework/module.h @@ -93,6 +93,9 @@ public: return params->type; }; + const char* get_help() const + { return help; }; + const Parameter* get_parameters() const { return params; }; @@ -117,23 +120,30 @@ public: unsigned /*index*/, const char*& /*name*/, const char*& /*parent*/) const { return nullptr; }; + virtual const char* get_defaults() const + { return nullptr; }; + virtual void sum_stats(); virtual void show_stats(); virtual void reset_stats(); protected: - Module(const char*); - Module(const char*, const Parameter*, bool is_list = false); + Module(const char* name, const char* help); + Module(const char* name, const char* help, const Parameter*, bool is_list = false); private: friend class ModuleManager; - void init(const char* s); + void init(const char*, const char* = nullptr); - bool list; const char* name; + const char* help; + const Parameter* params; + bool list; + const Command* cmds; const RuleMap* rules; + std::vector counts; int num_counts; }; diff --git a/src/ips_options/ips_ack.cc b/src/ips_options/ips_ack.cc index 87f5bfacd..171dabf43 100644 --- a/src/ips_options/ips_ack.cc +++ b/src/ips_options/ips_ack.cc @@ -110,7 +110,7 @@ int TcpAckOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter ack_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, "check if packet payload size is min<>max | min" }, @@ -118,10 +118,13 @@ static const Parameter ack_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to match on TCP ack numbers"; + class AckModule : public Module { public: - AckModule() : Module(s_name, ack_params) { }; + AckModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_asn1.cc b/src/ips_options/ips_asn1.cc index 2af08c40f..e35224f25 100644 --- a/src/ips_options/ips_asn1.cc +++ b/src/ips_options/ips_asn1.cc @@ -191,7 +191,7 @@ int Asn1Option::eval(Cursor& c, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter asn1_params[] = +static const Parameter s_params[] = { { BITSTRING_OPT, Parameter::PT_IMPLIED, nullptr, nullptr, "Detects invalid bitstring encodings that are known to be remotely exploitable." }, @@ -214,10 +214,13 @@ static const Parameter asn1_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option for asn1 detection"; + class Asn1Module : public Module { public: - Asn1Module() : Module(s_name, asn1_params) { }; + Asn1Module() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_base64.cc b/src/ips_options/ips_base64.cc index ff15d4f54..8fc3aee18 100644 --- a/src/ips_options/ips_base64.cc +++ b/src/ips_options/ips_base64.cc @@ -185,7 +185,7 @@ int Base64DecodeOption::eval(Cursor& c, Packet*) // decode module //------------------------------------------------------------------------- -static const Parameter decode_params[] = +static const Parameter s_params[] = { { "bytes", Parameter::PT_INT, "1:", nullptr, "Number of base64 encoded bytes to decode." }, @@ -199,10 +199,13 @@ static const Parameter decode_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to decode base64 data - must be used with base64_data option"; + class B64DecodeModule : public Module { public: - B64DecodeModule() : Module(s_name, decode_params) { }; + B64DecodeModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_bufferlen.cc b/src/ips_options/ips_bufferlen.cc index 29fe21bce..026452dbe 100644 --- a/src/ips_options/ips_bufferlen.cc +++ b/src/ips_options/ips_bufferlen.cc @@ -104,7 +104,7 @@ int LenOption::eval(Cursor& c, Packet*) // module //------------------------------------------------------------------------- -static const Parameter len_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, "min<>max | min" }, @@ -112,10 +112,13 @@ static const Parameter len_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check length of current buffer"; + class LenModule : public Module { public: - LenModule() : Module(s_name, len_params) { }; + LenModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_byte_extract.cc b/src/ips_options/ips_byte_extract.cc index 10f454c21..cdd6ab3b2 100644 --- a/src/ips_options/ips_byte_extract.cc +++ b/src/ips_options/ips_byte_extract.cc @@ -380,7 +380,7 @@ static bool ByteExtractVerify(ByteExtractData *data) // module //------------------------------------------------------------------------- -static const Parameter extract_params[] = +static const Parameter s_params[] = { { "~count", Parameter::PT_INT, "1:10", nullptr, "number of bytes to pick up from the buffer" }, @@ -424,10 +424,13 @@ static const Parameter extract_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to convert data to an integer variable"; + class ExtractModule : public Module { public: - ExtractModule() : Module(s_name, extract_params) { }; + ExtractModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); diff --git a/src/ips_options/ips_byte_jump.cc b/src/ips_options/ips_byte_jump.cc index 5943ef620..8b4c9d8aa 100644 --- a/src/ips_options/ips_byte_jump.cc +++ b/src/ips_options/ips_byte_jump.cc @@ -304,7 +304,7 @@ int ByteJumpOption::eval(Cursor& c, Packet*) // module //------------------------------------------------------------------------- -static const Parameter jump_params[] = +static const Parameter s_params[] = { { "~count", Parameter::PT_INT, "1:10", nullptr, "number of bytes to pick up from the buffer" }, @@ -351,10 +351,13 @@ static const Parameter jump_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to move the detection cursor"; + class ByteJumpModule : public Module { public: - ByteJumpModule() : Module(s_name, jump_params) { }; + ByteJumpModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); diff --git a/src/ips_options/ips_byte_test.cc b/src/ips_options/ips_byte_test.cc index c64c1d64e..6b226f4ea 100644 --- a/src/ips_options/ips_byte_test.cc +++ b/src/ips_options/ips_byte_test.cc @@ -441,7 +441,7 @@ static void parse_operator(const char* cptr, ByteTestData& idx) // module //------------------------------------------------------------------------- -static const Parameter jump_params[] = +static const Parameter s_params[] = { { "~count", Parameter::PT_INT, "1:10", nullptr, "number of bytes to pick up from the buffer" }, @@ -482,10 +482,13 @@ static const Parameter jump_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to convert data to integer and compare"; + class ByteTestModule : public Module { public: - ByteTestModule() : Module(s_name, jump_params) { }; + ByteTestModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); diff --git a/src/ips_options/ips_classtype.cc b/src/ips_options/ips_classtype.cc index 1fd2fd908..0f3a02fb3 100644 --- a/src/ips_options/ips_classtype.cc +++ b/src/ips_options/ips_classtype.cc @@ -42,7 +42,7 @@ static const char* s_name = "classtype"; // module //------------------------------------------------------------------------- -static const Parameter classtype_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_STRING, nullptr, nullptr, "classification for this rule" }, @@ -50,10 +50,13 @@ static const Parameter classtype_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "general rule option for rule classification"; + class ClassTypeModule : public Module { public: - ClassTypeModule() : Module(s_name, classtype_params) { }; + ClassTypeModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); ClassType* type; }; diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc index 62e79fa15..af316b7d5 100644 --- a/src/ips_options/ips_content.cc +++ b/src/ips_options/ips_content.cc @@ -679,7 +679,7 @@ static void parse_within(PatternMatchData* pmd, const char *data) // module //------------------------------------------------------------------------- -static const Parameter content_params[] = +static const Parameter s_params[] = { { "~data", Parameter::PT_STRING, nullptr, nullptr, "data to match" }, @@ -711,10 +711,13 @@ static const Parameter content_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "payload rule option for basic pattern matching"; + class ContentModule : public Module { public: - ContentModule() : Module(s_name, content_params) + ContentModule() : Module(s_name, s_help, s_params) { pmd = nullptr; }; ~ContentModule() diff --git a/src/ips_options/ips_cvs.cc b/src/ips_options/ips_cvs.cc index dc67f3ab7..72dfc6222 100644 --- a/src/ips_options/ips_cvs.cc +++ b/src/ips_options/ips_cvs.cc @@ -429,7 +429,7 @@ static void CvsGetEOL(const uint8_t *ptr, const uint8_t *end, // module //------------------------------------------------------------------------- -static const Parameter cvs_params[] = +static const Parameter s_params[] = { { CVS_CONF_INVALID_ENTRY_STR, Parameter::PT_IMPLIED, nullptr, nullptr, "looks for an invalid Entry string" }, @@ -437,10 +437,13 @@ static const Parameter cvs_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "payload rule option for detecting specific attacks"; + class CvsModule : public Module { public: - CvsModule() : Module(s_name, cvs_params) { }; + CvsModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_detection_filter.cc b/src/ips_options/ips_detection_filter.cc index 24f880f73..97a8739d3 100644 --- a/src/ips_options/ips_detection_filter.cc +++ b/src/ips_options/ips_detection_filter.cc @@ -47,7 +47,7 @@ static const char* s_name = "detection_filter"; // module //------------------------------------------------------------------------- -static const Parameter detection_filter_params[] = +static const Parameter s_params[] = { { "track", Parameter::PT_ENUM, "by_src | by_dst", nullptr, "track hits by source or destination IP address" }, @@ -61,10 +61,13 @@ static const Parameter detection_filter_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to require multiple hits before a rule generates an event"; + class DetectionFilterModule : public Module { public: - DetectionFilterModule() : Module(s_name, detection_filter_params) { }; + DetectionFilterModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); diff --git a/src/ips_options/ips_dsize.cc b/src/ips_options/ips_dsize.cc index 88017ec69..2f2759334 100644 --- a/src/ips_options/ips_dsize.cc +++ b/src/ips_options/ips_dsize.cc @@ -122,7 +122,7 @@ int DsizeOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter dsize_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, "check if packet payload size is min<>max | min" }, @@ -130,10 +130,13 @@ static const Parameter dsize_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to test payload size"; + class DsizeModule : public Module { public: - DsizeModule() : Module(s_name, dsize_params) { }; + DsizeModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_file_data.cc b/src/ips_options/ips_file_data.cc index ac1453a53..df70d960f 100644 --- a/src/ips_options/ips_file_data.cc +++ b/src/ips_options/ips_file_data.cc @@ -86,10 +86,13 @@ int FileDataOption::eval(Cursor& c, Packet*) // module //------------------------------------------------------------------------- +static const char* s_help = + "rule option to set detection cursor to file data"; + class FileDataModule : public Module { public: - FileDataModule() : Module(s_name) { }; + FileDataModule() : Module(s_name, s_help) { }; ProfileStats* get_profile() const { return &fileDataPerfStats; }; diff --git a/src/ips_options/ips_flags.cc b/src/ips_options/ips_flags.cc index 7f0efbee3..9ab82acaf 100644 --- a/src/ips_options/ips_flags.cc +++ b/src/ips_options/ips_flags.cc @@ -398,7 +398,7 @@ static void flags_parse_mask(const char *rule, TcpFlagCheckData *idx) // module //------------------------------------------------------------------------- -static const Parameter flags_params[] = +static const Parameter s_params[] = { { "~test_flags", Parameter::PT_STRING, nullptr, nullptr, "these flags are tested" }, @@ -409,10 +409,13 @@ static const Parameter flags_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to test TCP control flags"; + class FlagsModule : public Module { public: - FlagsModule() : Module(s_name, flags_params) { }; + FlagsModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_flow.cc b/src/ips_options/ips_flow.cc index da02b010b..28f20c9c2 100644 --- a/src/ips_options/ips_flow.cc +++ b/src/ips_options/ips_flow.cc @@ -331,7 +331,7 @@ static void flow_verify(FlowCheckData* fcd) // module //------------------------------------------------------------------------- -static const Parameter flow_params[] = +static const Parameter s_params[] = { { "to_client", Parameter::PT_IMPLIED, nullptr, nullptr, "match on server responses" }, @@ -369,10 +369,13 @@ static const Parameter flow_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check session properties"; + class FlowModule : public Module { public: - FlowModule() : Module(s_name, flow_params) { }; + FlowModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_flowbits.cc b/src/ips_options/ips_flowbits.cc index 9e99a4291..0be05fd1c 100644 --- a/src/ips_options/ips_flowbits.cc +++ b/src/ips_options/ips_flowbits.cc @@ -1128,7 +1128,7 @@ static void flowbits_gterm(SnortConfig*) // module //------------------------------------------------------------------------- -static const Parameter flowbits_params[] = +static const Parameter s_params[] = { { "~command", Parameter::PT_STRING, nullptr, nullptr, "set|reset|isset|etc." }, @@ -1142,10 +1142,13 @@ static const Parameter flowbits_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to set and test arbitrary boolean flags"; + class FlowbitsModule : public Module { public: - FlowbitsModule() : Module(s_name, flowbits_params) { }; + FlowbitsModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_fragbits.cc b/src/ips_options/ips_fragbits.cc index 66a4148fa..97f0ea95b 100644 --- a/src/ips_options/ips_fragbits.cc +++ b/src/ips_options/ips_fragbits.cc @@ -299,7 +299,7 @@ void fragbits_parse(const char *data, FragBitsData *ds_ptr) // module //------------------------------------------------------------------------- -static const Parameter fragbits_params[] = +static const Parameter s_params[] = { { "~flags", Parameter::PT_STRING, nullptr, nullptr, "these flags are tested" }, @@ -307,10 +307,13 @@ static const Parameter fragbits_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to test IP frag flags"; + class FragBitsModule : public Module { public: - FragBitsModule() : Module(s_name, fragbits_params) { }; + FragBitsModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_fragoffset.cc b/src/ips_options/ips_fragoffset.cc index 6b8fc0b13..053946c6c 100644 --- a/src/ips_options/ips_fragoffset.cc +++ b/src/ips_options/ips_fragoffset.cc @@ -112,7 +112,7 @@ int FragOffsetOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter fragoff_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, "check if packet payload size is min<>max | min" }, @@ -120,10 +120,13 @@ static const Parameter fragoff_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to test IP frag offset"; + class FragOffsetModule : public Module { public: - FragOffsetModule() : Module(s_name, fragoff_params) { }; + FragOffsetModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_gid.cc b/src/ips_options/ips_gid.cc index 1d494ca13..c995fd5f5 100644 --- a/src/ips_options/ips_gid.cc +++ b/src/ips_options/ips_gid.cc @@ -39,7 +39,7 @@ static const char* s_name = "gid"; // module //------------------------------------------------------------------------- -static const Parameter gid_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_INT, "1:", nullptr, "generator id" }, @@ -47,10 +47,13 @@ static const Parameter gid_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option specifying rule generator"; + class GidModule : public Module { public: - GidModule() : Module(s_name, gid_params) { }; + GidModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); int gid; }; diff --git a/src/ips_options/ips_http.cc b/src/ips_options/ips_http.cc index b37984e1e..e9576d2df 100644 --- a/src/ips_options/ips_http.cc +++ b/src/ips_options/ips_http.cc @@ -41,8 +41,8 @@ class HttpCursorModule : public Module { public: - HttpCursorModule(const char* s, ProfileStats& p) : - Module(s), ps(p) { }; + HttpCursorModule(const char* s, const char* h, ProfileStats& p) : + Module(s, h), ps(p) { }; ProfileStats* get_profile() const { return &ps; }; @@ -114,11 +114,14 @@ int HttpIpsOption::eval(Cursor& c, Packet* p) #undef IPS_OPT #define IPS_OPT "http_uri" +static const char* uri_help = + "rule option to set the detection cursor to the normalized URI buffer"; + static THREAD_LOCAL ProfileStats uri_ps; static Module* uri_mod_ctor() { - return new HttpCursorModule(IPS_OPT, uri_ps); + return new HttpCursorModule(IPS_OPT, uri_help, uri_ps); } static IpsOption* uri_opt_ctor(Module*, OptTreeNode*) @@ -154,16 +157,19 @@ static const IpsApi uri_api = #undef IPS_OPT #define IPS_OPT "http_client_body" -static THREAD_LOCAL ProfileStats client_body_ps; +static const char* cb_help = + "rule option to set the detection cursor to the request body"; + +static THREAD_LOCAL ProfileStats cb_ps; static Module* client_body_mod_ctor() { - return new HttpCursorModule(IPS_OPT, client_body_ps); + return new HttpCursorModule(IPS_OPT, cb_help, cb_ps); } static IpsOption* client_body_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, client_body_ps, CAT_SET_BODY); + return new HttpIpsOption(IPS_OPT, cb_ps, CAT_SET_BODY); } static const IpsApi client_body_api = @@ -194,16 +200,19 @@ static const IpsApi client_body_api = #undef IPS_OPT #define IPS_OPT "http_method" -static THREAD_LOCAL ProfileStats method_ps; +static const char* meth_help = + "rule option to set the detection cursor to the HTTP request method"; + +static THREAD_LOCAL ProfileStats meth_ps; static Module* method_mod_ctor() { - return new HttpCursorModule(IPS_OPT, method_ps); + return new HttpCursorModule(IPS_OPT, meth_help, meth_ps); } static IpsOption* method_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, method_ps); + return new HttpIpsOption(IPS_OPT, meth_ps); } static const IpsApi method_api = @@ -234,11 +243,14 @@ static const IpsApi method_api = #undef IPS_OPT #define IPS_OPT "http_cookie" +static const char* cookie_help = + "rule option to set the detection cursor to the HTTP cookie"; + static THREAD_LOCAL ProfileStats cookie_ps; static Module* cookie_mod_ctor() { - return new HttpCursorModule(IPS_OPT, cookie_ps); + return new HttpCursorModule(IPS_OPT, cookie_help, cookie_ps); } static IpsOption* cookie_opt_ctor(Module*, OptTreeNode*) @@ -274,11 +286,14 @@ static const IpsApi cookie_api = #undef IPS_OPT #define IPS_OPT "http_stat_code" +static const char* stat_code_help = + "rule option to set the detection cursor to the HTTP status code"; + static THREAD_LOCAL ProfileStats stat_code_ps; static Module* stat_code_mod_ctor() { - return new HttpCursorModule(IPS_OPT, stat_code_ps); + return new HttpCursorModule(IPS_OPT, stat_code_help, stat_code_ps); } static IpsOption* stat_code_opt_ctor(Module*, OptTreeNode*) @@ -314,11 +329,14 @@ static const IpsApi stat_code_api = #undef IPS_OPT #define IPS_OPT "http_stat_msg" +static const char* stat_msg_help = + "rule option to set the detection cursor to the HTTP status message"; + static THREAD_LOCAL ProfileStats stat_msg_ps; static Module* stat_msg_mod_ctor() { - return new HttpCursorModule(IPS_OPT, stat_msg_ps); + return new HttpCursorModule(IPS_OPT, stat_msg_help, stat_msg_ps); } static IpsOption* stat_msg_opt_ctor(Module*, OptTreeNode*) @@ -354,11 +372,14 @@ static const IpsApi stat_msg_api = #undef IPS_OPT #define IPS_OPT "http_raw_uri" +static const char* raw_uri_help = + "rule option to set the detection cursor to the unnormalized URI"; + static THREAD_LOCAL ProfileStats raw_uri_ps; static Module* raw_uri_mod_ctor() { - return new HttpCursorModule(IPS_OPT, raw_uri_ps); + return new HttpCursorModule(IPS_OPT, raw_uri_help, raw_uri_ps); } static IpsOption* raw_uri_opt_ctor(Module*, OptTreeNode*) @@ -394,11 +415,14 @@ static const IpsApi raw_uri_api = #undef IPS_OPT #define IPS_OPT "http_raw_header" +static const char* raw_header_help = + "rule option to set the detection cursor to the unnormalized headers"; + static THREAD_LOCAL ProfileStats raw_header_ps; static Module* raw_header_mod_ctor() { - return new HttpCursorModule(IPS_OPT, raw_header_ps); + return new HttpCursorModule(IPS_OPT, raw_header_help, raw_header_ps); } static IpsOption* raw_header_opt_ctor(Module*, OptTreeNode*) @@ -434,11 +458,14 @@ static const IpsApi raw_header_api = #undef IPS_OPT #define IPS_OPT "http_raw_cookie" +static const char* raw_cookie_help = + "rule option to set the detection cursor to the unnormalized cookie"; + static THREAD_LOCAL ProfileStats raw_cookie_ps; static Module* raw_cookie_mod_ctor() { - return new HttpCursorModule(IPS_OPT, raw_cookie_ps); + return new HttpCursorModule(IPS_OPT, raw_cookie_help, raw_cookie_ps); } static IpsOption* raw_cookie_opt_ctor(Module*, OptTreeNode*) diff --git a/src/ips_options/ips_http_header.cc b/src/ips_options/ips_http_header.cc index f9f12258c..11d201b21 100644 --- a/src/ips_options/ips_http_header.cc +++ b/src/ips_options/ips_http_header.cc @@ -41,7 +41,7 @@ static const char* s_name = "http_header"; static THREAD_LOCAL ProfileStats httpHeaderPerfStats; -static const Parameter hh_params[] = +static const Parameter s_params[] = { { "~name", Parameter::PT_STRING, nullptr, nullptr, "restrict to given header" }, @@ -53,10 +53,13 @@ static const Parameter hh_params[] = // module //------------------------------------------------------------------------- +static const char* s_help = + "rule option to set the detection cursor to the normalized header(s)"; + class HttpHeaderModule : public Module { public: - HttpHeaderModule() : Module(s_name, hh_params) { }; + HttpHeaderModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_icmp_id.cc b/src/ips_options/ips_icmp_id.cc index 123bac74f..8b28aaa89 100644 --- a/src/ips_options/ips_icmp_id.cc +++ b/src/ips_options/ips_icmp_id.cc @@ -134,18 +134,21 @@ int IcmpIdOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter icmp_id_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, - "check if packet payload size is min<>max | min" }, + "check if icmp id is min<>max | min" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check ICMP ID"; + class IcmpIdModule : public Module { public: - IcmpIdModule() : Module(s_name, icmp_id_params) { }; + IcmpIdModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_icmp_seq.cc b/src/ips_options/ips_icmp_seq.cc index 855427956..7538d4645 100644 --- a/src/ips_options/ips_icmp_seq.cc +++ b/src/ips_options/ips_icmp_seq.cc @@ -136,18 +136,21 @@ int IcmpSeqOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter icmp_id_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, - "check if packet payload size is min<>max | min" }, + "check if icmp sequence number is min<>max | min" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check ICMP sequence number"; + class IcmpSeqModule : public Module { public: - IcmpSeqModule() : Module(s_name, icmp_id_params) { }; + IcmpSeqModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_icode.cc b/src/ips_options/ips_icode.cc index e7b7f850b..0679ea5c0 100644 --- a/src/ips_options/ips_icode.cc +++ b/src/ips_options/ips_icode.cc @@ -108,18 +108,21 @@ int IcodeOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter icmp_id_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, - "check if packet payload size is min<>max | min" }, + "check if ICMP code is min<>max | min" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check ICMP code"; + class IcodeModule : public Module { public: - IcodeModule() : Module(s_name, icmp_id_params) { }; + IcodeModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_id.cc b/src/ips_options/ips_id.cc index e466e2938..4f36755ad 100644 --- a/src/ips_options/ips_id.cc +++ b/src/ips_options/ips_id.cc @@ -104,18 +104,21 @@ int IpIdOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter ip_id_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, - "check if packet payload size is min<>max | min" }, + "check if the IP ID is min<>max | min" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check the IP ID field"; + class IpIdModule : public Module { public: - IpIdModule() : Module(s_name, ip_id_params) { }; + IpIdModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_ip_proto.cc b/src/ips_options/ips_ip_proto.cc index 3349c29b5..f6180a427 100644 --- a/src/ips_options/ips_ip_proto.cc +++ b/src/ips_options/ips_ip_proto.cc @@ -284,7 +284,7 @@ static void ip_proto_parse(const char* data, IpProtoData* ds_ptr) // module //------------------------------------------------------------------------- -static const Parameter ip_proto_params[] = +static const Parameter s_params[] = { { "~proto", Parameter::PT_STRING, nullptr, nullptr, "[!|>|<] name or number" }, @@ -292,10 +292,13 @@ static const Parameter ip_proto_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check the IP protocol number"; + class IpProtoModule : public Module { public: - IpProtoModule() : Module(s_name, ip_proto_params) { }; + IpProtoModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_ipopts.cc b/src/ips_options/ips_ipopts.cc index 95551e96c..39ccaf555 100644 --- a/src/ips_options/ips_ipopts.cc +++ b/src/ips_options/ips_ipopts.cc @@ -211,7 +211,7 @@ static void ipopts_parse(const char* data, IpOptionData* ds_ptr) static const char* s_opts = "rr|eol|nop|ts|sec|esec|lsrr|lsrre|ssrr|satid|any"; -static const Parameter ipopt_params[] = +static const Parameter s_params[] = { { "~opt", Parameter::PT_SELECT, s_opts, nullptr, "output format" }, @@ -219,10 +219,13 @@ static const Parameter ipopt_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check for IP options"; + class IpOptModule : public Module { public: - IpOptModule() : Module(s_name, ipopt_params) { }; + IpOptModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_isdataat.cc b/src/ips_options/ips_isdataat.cc index 993633481..20e7959b0 100644 --- a/src/ips_options/ips_isdataat.cc +++ b/src/ips_options/ips_isdataat.cc @@ -243,7 +243,7 @@ static void isdataat_parse(const char *data, IsDataAtData *idx) // module //------------------------------------------------------------------------- -static const Parameter isdataat_params[] = +static const Parameter s_params[] = { { "~length", Parameter::PT_STRING, nullptr, nullptr, "num | !num" }, @@ -254,10 +254,13 @@ static const Parameter isdataat_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check for the presence of payload data"; + class IsDataAtModule : public Module { public: - IsDataAtModule() : Module(s_name, isdataat_params) { }; + IsDataAtModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_itype.cc b/src/ips_options/ips_itype.cc index a81fc4f50..589c8f8ed 100644 --- a/src/ips_options/ips_itype.cc +++ b/src/ips_options/ips_itype.cc @@ -105,18 +105,21 @@ int IcmpTypeOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter itype_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, - "check if packet payload size is min<>max | min" }, + "check if icmp type is min<>max | min" }, { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check ICMP type"; + class ItypeModule : public Module { public: - ItypeModule() : Module(s_name, itype_params) { }; + ItypeModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_luajit.cc b/src/ips_options/ips_luajit.cc index df69c2b89..e29111ba6 100644 --- a/src/ips_options/ips_luajit.cc +++ b/src/ips_options/ips_luajit.cc @@ -69,7 +69,7 @@ SO_PUBLIC const SnortBuffer* get_buffer() // module stuff //------------------------------------------------------------------------- -static const Parameter luajit_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_STRING, nullptr, nullptr, "luajit arguments" }, @@ -77,10 +77,13 @@ static const Parameter luajit_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option for detecting with Lua scripts"; + class LuaJitModule : public Module { public: - LuaJitModule(const char* name) : Module(name, luajit_params) + LuaJitModule(const char* name) : Module(name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); diff --git a/src/ips_options/ips_metadata.cc b/src/ips_options/ips_metadata.cc index 01aa145f9..711113d03 100644 --- a/src/ips_options/ips_metadata.cc +++ b/src/ips_options/ips_metadata.cc @@ -41,7 +41,7 @@ static const char* s_name = "metadata"; // module //------------------------------------------------------------------------- -static const Parameter metadata_params[] = +static const Parameter s_params[] = { { "service", Parameter::PT_STRING, nullptr, nullptr, "service name" }, @@ -52,10 +52,13 @@ static const Parameter metadata_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option for conveying arbitrary name, value data within the rule text"; + class MetadataModule : public Module { public: - MetadataModule() : Module(s_name, metadata_params) + MetadataModule() : Module(s_name, s_help, s_params) { snort_config = nullptr; }; bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_msg.cc b/src/ips_options/ips_msg.cc index b3de3ae7c..ae10eddec 100644 --- a/src/ips_options/ips_msg.cc +++ b/src/ips_options/ips_msg.cc @@ -41,7 +41,7 @@ static const char* s_name = "msg"; // module //------------------------------------------------------------------------- -static const Parameter msg_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_STRING, nullptr, nullptr, "message describing rule" }, @@ -49,10 +49,13 @@ static const Parameter msg_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option summarizing rule purpose output with events"; + class MsgModule : public Module { public: - MsgModule() : Module(s_name, msg_params) { }; + MsgModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); std::string msg; }; diff --git a/src/ips_options/ips_pcre.cc b/src/ips_options/ips_pcre.cc index 817a7970f..2ba4b31cd 100644 --- a/src/ips_options/ips_pcre.cc +++ b/src/ips_options/ips_pcre.cc @@ -627,7 +627,7 @@ bool pcre_next(PcreData* pcre) // module //------------------------------------------------------------------------- -static const Parameter pcre_params[] = +static const Parameter s_params[] = { { "~regex", Parameter::PT_STRING, nullptr, nullptr, "Snort regular expression" }, @@ -635,10 +635,13 @@ static const Parameter pcre_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option for matching payload data with regex"; + class PcreModule : public Module { public: - PcreModule() : Module(s_name, pcre_params) + PcreModule() : Module(s_name, s_help, s_params) { data = nullptr; }; ~PcreModule() diff --git a/src/ips_options/ips_pkt_data.cc b/src/ips_options/ips_pkt_data.cc index b11e63369..171675e9a 100644 --- a/src/ips_options/ips_pkt_data.cc +++ b/src/ips_options/ips_pkt_data.cc @@ -63,10 +63,13 @@ int PktDataOption::eval(Cursor& c, Packet* p) // module //------------------------------------------------------------------------- +static const char* s_help = + "rule option to set the detection cursor to the normalized packet data"; + class PktDataModule : public Module { public: - PktDataModule() : Module(s_name) { }; + PktDataModule() : Module(s_name, s_help) { }; ProfileStats* get_profile() const { return &pktDataPerfStats; }; diff --git a/src/ips_options/ips_priority.cc b/src/ips_options/ips_priority.cc index 6270a9940..3e4271281 100644 --- a/src/ips_options/ips_priority.cc +++ b/src/ips_options/ips_priority.cc @@ -39,7 +39,7 @@ static const char* s_name = "priority"; // module //------------------------------------------------------------------------- -static const Parameter priority_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_INT, "1:", nullptr, "generator id" }, @@ -47,10 +47,13 @@ static const Parameter priority_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option for prioritizing events"; + class PriorityModule : public Module { public: - PriorityModule() : Module(s_name, priority_params) { }; + PriorityModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); int priority; }; diff --git a/src/ips_options/ips_raw_data.cc b/src/ips_options/ips_raw_data.cc index a0557fcc9..19334fe0d 100644 --- a/src/ips_options/ips_raw_data.cc +++ b/src/ips_options/ips_raw_data.cc @@ -63,10 +63,13 @@ int RawDataOption::eval(Cursor& c, Packet* p) // module //------------------------------------------------------------------------- +static const char* s_help = + "rule option to set the detection cursor to the raw packet data"; + class RawDataModule : public Module { public: - RawDataModule() : Module(s_name) { }; + RawDataModule() : Module(s_name, s_help) { }; ProfileStats* get_profile() const { return &rawDataPerfStats; }; diff --git a/src/ips_options/ips_reference.cc b/src/ips_options/ips_reference.cc index c44dce96a..8838e2b49 100644 --- a/src/ips_options/ips_reference.cc +++ b/src/ips_options/ips_reference.cc @@ -39,7 +39,7 @@ static const char* s_name = "reference"; // module //------------------------------------------------------------------------- -static const Parameter reference_params[] = +static const Parameter s_params[] = { { "~scheme", Parameter::PT_STRING, nullptr, nullptr, "reference scheme" }, @@ -50,10 +50,13 @@ static const Parameter reference_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to indicate relevant attack indentification system"; + class ReferenceModule : public Module { public: - ReferenceModule() : Module(s_name, reference_params) { }; + ReferenceModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); diff --git a/src/ips_options/ips_rem.cc b/src/ips_options/ips_rem.cc index ef8240a62..04aec68d8 100644 --- a/src/ips_options/ips_rem.cc +++ b/src/ips_options/ips_rem.cc @@ -38,7 +38,7 @@ static const char* s_name = "rem"; // module //------------------------------------------------------------------------- -static const Parameter rem_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_STRING, nullptr, nullptr, "comment" }, @@ -46,10 +46,13 @@ static const Parameter rem_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to convey an arbitrary comment in the rule body"; + class RemModule : public Module { public: - RemModule() : Module(s_name, rem_params) { }; + RemModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); }; diff --git a/src/ips_options/ips_replace.cc b/src/ips_options/ips_replace.cc index 9070f4a88..259ae958e 100644 --- a/src/ips_options/ips_replace.cc +++ b/src/ips_options/ips_replace.cc @@ -193,7 +193,7 @@ void ReplaceOption::action(Packet*) // module //------------------------------------------------------------------------- -static const Parameter repl_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_STRING, nullptr, nullptr, "byte code to replace with" }, @@ -201,10 +201,13 @@ static const Parameter repl_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to overwrite payload data; use with rewrite action"; + class ReplModule : public Module { public: - ReplModule() : Module(s_name, repl_params) { }; + ReplModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_rev.cc b/src/ips_options/ips_rev.cc index 7aac51a7e..4f93b8bb8 100644 --- a/src/ips_options/ips_rev.cc +++ b/src/ips_options/ips_rev.cc @@ -37,7 +37,7 @@ static const char* s_name = "rev"; // module //------------------------------------------------------------------------- -static const Parameter rev_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_INT, "1:", nullptr, "revision" }, @@ -45,10 +45,13 @@ static const Parameter rev_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to indicate current revision of signature"; + class RevModule : public Module { public: - RevModule() : Module(s_name, rev_params) { }; + RevModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); int rev; }; diff --git a/src/ips_options/ips_rpc.cc b/src/ips_options/ips_rpc.cc index e36328018..e53c77db2 100644 --- a/src/ips_options/ips_rpc.cc +++ b/src/ips_options/ips_rpc.cc @@ -245,7 +245,7 @@ int RpcOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter rpc_params[] = +static const Parameter s_params[] = { { "~app", Parameter::PT_STRING, nullptr, nullptr, "application number" }, @@ -259,10 +259,13 @@ static const Parameter rpc_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check SUNRPC CALL parameters"; + class RpcModule : public Module { public: - RpcModule() : Module(s_name, rpc_params) { }; + RpcModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_seq.cc b/src/ips_options/ips_seq.cc index 516108d4e..0bec802e1 100644 --- a/src/ips_options/ips_seq.cc +++ b/src/ips_options/ips_seq.cc @@ -102,7 +102,7 @@ int TcpSeqOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter seq_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, "check if packet payload size is min<>max | min" }, @@ -110,10 +110,13 @@ static const Parameter seq_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check TCP sequence number"; + class SeqModule : public Module { public: - SeqModule() : Module(s_name, seq_params) { }; + SeqModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_session.cc b/src/ips_options/ips_session.cc index 453bde0a1..96dc1ca5b 100644 --- a/src/ips_options/ips_session.cc +++ b/src/ips_options/ips_session.cc @@ -318,7 +318,7 @@ static void DumpSessionData(FILE *fp, Packet *p, SessionData *sessionData) // module //------------------------------------------------------------------------- -static const Parameter ssn_params[] = +static const Parameter s_params[] = { { "~mode", Parameter::PT_ENUM, "printable|binary|all", nullptr, "output format" }, @@ -326,10 +326,13 @@ static const Parameter ssn_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check user data from TCP sessions"; + class SsnModule : public Module { public: - SsnModule() : Module(s_name, ssn_params) { }; + SsnModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_sid.cc b/src/ips_options/ips_sid.cc index d9cd16d97..1d3530c9c 100644 --- a/src/ips_options/ips_sid.cc +++ b/src/ips_options/ips_sid.cc @@ -37,7 +37,7 @@ static const char* s_name = "sid"; // module //------------------------------------------------------------------------- -static const Parameter sid_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_INT, "1:", nullptr, "signature id" }, @@ -45,10 +45,13 @@ static const Parameter sid_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to indicate signature number"; + class SidModule : public Module { public: - SidModule() : Module(s_name, sid_params) { }; + SidModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); int sid; }; diff --git a/src/ips_options/ips_so.cc b/src/ips_options/ips_so.cc index 414912a98..0de77e203 100644 --- a/src/ips_options/ips_so.cc +++ b/src/ips_options/ips_so.cc @@ -109,7 +109,7 @@ int SoOption::eval(Cursor&, Packet* p) // module //------------------------------------------------------------------------- -static const Parameter so_params[] = +static const Parameter s_params[] = { { "~func", Parameter::PT_STRING, nullptr, nullptr, "name of eval function" }, @@ -117,10 +117,13 @@ static const Parameter so_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to call custom eval function"; + class SoModule : public Module { public: - SoModule() : Module(s_name, so_params) { }; + SoModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_soid.cc b/src/ips_options/ips_soid.cc index a00649430..5fd45e297 100644 --- a/src/ips_options/ips_soid.cc +++ b/src/ips_options/ips_soid.cc @@ -42,7 +42,7 @@ static const char* s_name = "soid"; // module //------------------------------------------------------------------------- -static const Parameter soid_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_STRING, nullptr, nullptr, "SO rule ID has | format, like 3|12345" }, @@ -50,10 +50,13 @@ static const Parameter soid_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to specify a shared object rule ID"; + class SoidModule : public Module { public: - SoidModule() : Module(s_name, soid_params) { }; + SoidModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); std::string soid; }; diff --git a/src/ips_options/ips_tag.cc b/src/ips_options/ips_tag.cc index 4b2fda96a..33234a1f7 100644 --- a/src/ips_options/ips_tag.cc +++ b/src/ips_options/ips_tag.cc @@ -41,7 +41,7 @@ static const char* s_name = "tag"; // module //------------------------------------------------------------------------- -static const Parameter tag_params[] = +static const Parameter s_params[] = { { "~", Parameter::PT_ENUM, "session|host_src|host_dst", nullptr, "log all packets in session or all packets to or from host" }, @@ -58,10 +58,13 @@ static const Parameter tag_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to log additional packets"; + class TagModule : public Module { public: - TagModule() : Module(s_name, tag_params) + TagModule() : Module(s_name, s_help, s_params) { tag = nullptr; }; bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_tos.cc b/src/ips_options/ips_tos.cc index 9ad607633..8d67bd7b8 100644 --- a/src/ips_options/ips_tos.cc +++ b/src/ips_options/ips_tos.cc @@ -105,7 +105,7 @@ int IpTosOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter tos_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, "check if packet payload size is min<>max | min" }, @@ -113,10 +113,13 @@ static const Parameter tos_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check type of service field"; + class TosModule : public Module { public: - TosModule() : Module(s_name, tos_params) { }; + TosModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_ttl.cc b/src/ips_options/ips_ttl.cc index 5527a07c6..ab90a2cdb 100644 --- a/src/ips_options/ips_ttl.cc +++ b/src/ips_options/ips_ttl.cc @@ -104,7 +104,7 @@ int TtlOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter ttl_params[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, "check if packet payload size is min<>max | min" }, @@ -112,10 +112,13 @@ static const Parameter ttl_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check time to live field"; + class TtlModule : public Module { public: - TtlModule() : Module(s_name, ttl_params) { }; + TtlModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/ips_options/ips_window.cc b/src/ips_options/ips_window.cc index 9070adcf8..75f98434d 100644 --- a/src/ips_options/ips_window.cc +++ b/src/ips_options/ips_window.cc @@ -102,7 +102,7 @@ int TcpWinOption::eval(Cursor&, Packet *p) // module //------------------------------------------------------------------------- -static const Parameter window[] = +static const Parameter s_params[] = { { "~range", Parameter::PT_STRING, nullptr, nullptr, "check if packet payload size is min<>max | min" }, @@ -110,10 +110,13 @@ static const Parameter window[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "rule option to check TCP window field"; + class WindowModule : public Module { public: - WindowModule() : Module(s_name, window) { }; + WindowModule() : Module(s_name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*); bool set(const char*, Value&, SnortConfig*); diff --git a/src/loggers/alert_csv.cc b/src/loggers/alert_csv.cc index 46a0871fe..85866cf9a 100644 --- a/src/loggers/alert_csv.cc +++ b/src/loggers/alert_csv.cc @@ -46,6 +46,8 @@ static THREAD_LOCAL TextLog* csv_log; +static const char* s_name = "alert_csv"; + using namespace std; //------------------------------------------------------------------------- @@ -64,7 +66,7 @@ static const char* csv_range = static const char* csv_deflt = "timestamp gid sid rev src_addr src_port dst_addr dst_port"; -static const Parameter csv_params[] = +static const Parameter s_params[] = { // FIXIT-M provide PT_FILE and PT_PATH and enforce no // path chars in file (outputs file must be in instance dir) @@ -84,10 +86,13 @@ static const Parameter csv_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "output event in csv format"; + class CsvModule : public Module { public: - CsvModule() : Module("alert_csv", csv_params) { }; + CsvModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -416,7 +421,7 @@ static LogApi csv_api { { PT_LOGGER, - "alert_csv", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc index 4dc1b3c31..f967e4ec3 100644 --- a/src/loggers/alert_fast.cc +++ b/src/loggers/alert_fast.cc @@ -72,11 +72,13 @@ static THREAD_LOCAL TextLog* fast_log = nullptr; using namespace std; +static const char* s_name = "alert_fast"; + //------------------------------------------------------------------------- // module stuff //------------------------------------------------------------------------- -static const Parameter fast_params[] = +static const Parameter s_params[] = { { "file", Parameter::PT_STRING, nullptr, "stdout", "name of alert file" }, @@ -93,10 +95,13 @@ static const Parameter fast_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "output event with brief text format"; + class FastModule : public Module { public: - FastModule() : Module("alert_fast", fast_params) { }; + FastModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -273,7 +278,7 @@ static LogApi fast_api { { PT_LOGGER, - "alert_fast", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/alert_full.cc b/src/loggers/alert_full.cc index 1c8b576a8..e4f425b8f 100644 --- a/src/loggers/alert_full.cc +++ b/src/loggers/alert_full.cc @@ -64,11 +64,13 @@ static THREAD_LOCAL TextLog* full_log = nullptr; using namespace std; +static const char* s_name = "alert_full"; + //------------------------------------------------------------------------- // module stuff //------------------------------------------------------------------------- -static const Parameter full_params[] = +static const Parameter s_params[] = { { "file", Parameter::PT_STRING, nullptr, nullptr, "name of alert file" }, @@ -82,10 +84,13 @@ static const Parameter full_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "output event with full packet dump"; + class FullModule : public Module { public: - FullModule() : Module("alert_full", full_params) { }; + FullModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -266,7 +271,7 @@ static LogApi full_api { { PT_LOGGER, - "alert_full", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/alert_luajit.cc b/src/loggers/alert_luajit.cc index 2b72442e7..1cb91ff0f 100644 --- a/src/loggers/alert_luajit.cc +++ b/src/loggers/alert_luajit.cc @@ -84,7 +84,7 @@ SO_PUBLIC const SnortEvent* get_event() // module stuff //------------------------------------------------------------------------- -static const Parameter luajit_params[] = +static const Parameter s_params[] = { { "args", Parameter::PT_STRING, nullptr, nullptr, "luajit logger arguments" }, @@ -92,10 +92,13 @@ static const Parameter luajit_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "output event from custom Lua script"; + class LuaLogModule : public Module { public: - LuaLogModule(const char* name) : Module(name, luajit_params) + LuaLogModule(const char* name) : Module(name, s_help, s_params) { }; bool begin(const char*, int, SnortConfig*) @@ -220,7 +223,7 @@ static const LogApi log_lua_api = { { PT_LOGGER, - "tbd", + "luajit", LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/alert_sf_socket.cc b/src/loggers/alert_sf_socket.cc index b674f0875..1b5814c6d 100644 --- a/src/loggers/alert_sf_socket.cc +++ b/src/loggers/alert_sf_socket.cc @@ -66,6 +66,8 @@ static THREAD_LOCAL SfSock context; using namespace std; typedef vector RuleVector; +static const char* s_name = "alert_sfsocket"; + //------------------------------------------------------------------------- // alert_sfsocket module //------------------------------------------------------------------------- @@ -81,7 +83,7 @@ static const Parameter rule_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; -static const Parameter sfsocket_params[] = +static const Parameter s_params[] = { { "file", Parameter::PT_STRING, nullptr, nullptr, "name of unix socket file" }, @@ -92,10 +94,13 @@ static const Parameter sfsocket_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "output event over socket"; + class SfSocketModule : public Module { public: - SfSocketModule() : Module("alert_sfsocket", sfsocket_params) { }; + SfSocketModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -398,7 +403,7 @@ static LogApi sf_sock_api { { PT_LOGGER, - "alert_sfsocket", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/alert_syslog.cc b/src/loggers/alert_syslog.cc index f2628ef90..5e2f29782 100644 --- a/src/loggers/alert_syslog.cc +++ b/src/loggers/alert_syslog.cc @@ -51,6 +51,8 @@ using namespace std; +static const char* s_name = "alert_syslog"; + //------------------------------------------------------------------------- // translation stuff //------------------------------------------------------------------------- @@ -125,7 +127,7 @@ static int get_options(const char* s) // module stuff //------------------------------------------------------------------------- -static const Parameter syslog_params[] = +static const Parameter s_params[] = { { "facility", Parameter::PT_ENUM, syslog_facilities, "auth", "part of priority applied to each message" }, @@ -139,10 +141,13 @@ static const Parameter syslog_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "output event to syslog"; + class SyslogModule : public Module { public: - SyslogModule() : Module("alert_syslog", syslog_params) { }; + SyslogModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -344,7 +349,7 @@ static LogApi syslog_api { { PT_LOGGER, - "alert_syslog", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/alert_test.cc b/src/loggers/alert_test.cc index 6075cf274..f962fb78c 100644 --- a/src/loggers/alert_test.cc +++ b/src/loggers/alert_test.cc @@ -57,11 +57,13 @@ static THREAD_LOCAL TextLog* test_file = nullptr; using namespace std; +static const char* s_name = "alert_test"; + //------------------------------------------------------------------------- // alert_test module //------------------------------------------------------------------------- -static const Parameter test_params[] = +static const Parameter s_params[] = { { "file", Parameter::PT_STRING, nullptr, "stdout", "name of tsv alert file or 'stdout'" }, @@ -78,10 +80,13 @@ static const Parameter test_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "output event in custom tsv format"; + class TestModule : public Module { public: - TestModule() : Module("alert_test", test_params) { }; + TestModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -222,7 +227,7 @@ static LogApi test_api { { PT_LOGGER, - "alert_test", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/alert_unixsock.cc b/src/loggers/alert_unixsock.cc index 9ed9a1b8f..32b62d0ea 100644 --- a/src/loggers/alert_unixsock.cc +++ b/src/loggers/alert_unixsock.cc @@ -96,21 +96,26 @@ struct UnixSock static THREAD_LOCAL UnixSock us; +static const char* s_name = "alert_unixsock"; + //------------------------------------------------------------------------- // alert_unixsock module //------------------------------------------------------------------------- -static const Parameter unixsock_params[] = +static const Parameter s_params[] = { // FIXIT-L add name param? { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "output event over unix socket"; + class UnixSockModule : public Module { public: - UnixSockModule() : Module("alert_unixsock", unixsock_params) { }; + UnixSockModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*) { return false; }; }; @@ -285,7 +290,7 @@ static LogApi unix_sock_api { { PT_LOGGER, - "alert_unixsock", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/log_tcpdump.cc b/src/loggers/log_tcpdump.cc index 638c7d17f..952b430f4 100644 --- a/src/loggers/log_tcpdump.cc +++ b/src/loggers/log_tcpdump.cc @@ -83,11 +83,13 @@ static THREAD_LOCAL LtdContext context; static void TcpdumpRollLogFile(LtdConfig*); +static const char* s_name = "log_tcpdump"; + //------------------------------------------------------------------------- // module stuff //------------------------------------------------------------------------- -static const Parameter tcpdump_params[] = +static const Parameter s_params[] = { { "file", Parameter::PT_STRING, nullptr, "snort.pcap", "name of alert file" }, @@ -101,10 +103,13 @@ static const Parameter tcpdump_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "log packet in pcap format"; + class TcpdumpModule : public Module { public: - TcpdumpModule() : Module("log_tcpdump", tcpdump_params) { }; + TcpdumpModule() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -233,14 +238,14 @@ static void TcpdumpInitLogFile(LtdConfig* data, int /*nostamps?*/) pcap = pcap_open_dead(dlt, DAQ_GetSnapLen()); if ( !pcap ) - FatalError("log_tcpdump: can't get pcap context\n"); + FatalError("%s: can't get pcap context\n", s_name); context.dumpd = pcap ? pcap_dump_open(pcap, file.c_str()) : NULL; if(context.dumpd == NULL) { - FatalError("log_tcpdump: can't open %s: %s\n", - file.c_str(), pcap_geterr(pcap)); + FatalError("%s: can't open %s: %s\n", + s_name, file.c_str(), pcap_geterr(pcap)); } pcap_close(pcap); } @@ -372,7 +377,7 @@ static LogApi tcpdump_api { { PT_LOGGER, - "log_tcpdump", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index 808f741f9..9f0905e07 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -67,6 +67,8 @@ using namespace std; +static const char* s_name = "unified2"; + /* ------------------ Data structures --------------------------*/ typedef struct _Unified2Config { @@ -1026,7 +1028,7 @@ static void Unified2Write(uint8_t *buf, uint32_t buf_len, Unified2Config *config // unified2 module //------------------------------------------------------------------------- -static const Parameter u2_params[] = +static const Parameter s_params[] = { { "file", Parameter::PT_STRING, nullptr, "unified2.log", "name of alert file" }, @@ -1049,10 +1051,13 @@ static const Parameter u2_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* s_help = + "ouput event and packet in unified2 format file"; + class U2Module : public Module { public: - U2Module() : Module("unified2", u2_params) { }; + U2Module() : Module(s_name, s_help, s_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -1245,7 +1250,7 @@ static LogApi u2_api { { PT_LOGGER, - "unified2", + s_name, LOGAPI_PLUGIN_V0, 0, mod_ctor, diff --git a/src/main/help.cc b/src/main/help.cc index 29aa83d10..fabf633a8 100644 --- a/src/main/help.cc +++ b/src/main/help.cc @@ -139,7 +139,8 @@ void help_signals(SnortConfig*, const char*) enum HelpType { HT_CFG, HT_CMD, HT_GID, HT_IPS, HT_MOD, - HT_BUF, HT_LST, HT_PLG, HT_DDR, HT_DBR + HT_BUF, HT_LST, HT_PLG, HT_DDR, HT_DBR, + HT_SHO }; static void show_help(SnortConfig* sc, const char* val, HelpType ht) @@ -180,6 +181,9 @@ static void show_help(SnortConfig* sc, const char* val, HelpType ht) case HT_DBR: ModuleManager::dump_rules(val); break; + case HT_SHO: + ModuleManager::show_modules(); + break; } ModuleManager::term(); PluginManager::release_plugins(); @@ -222,6 +226,11 @@ void help_module(SnortConfig* sc, const char* val) show_help(sc, val, HT_MOD); } +void help_modules(SnortConfig* sc, const char* val) +{ + show_help(sc, val, HT_SHO); +} + void list_modules(SnortConfig* sc, const char* val) { show_help(sc, val, HT_LST); diff --git a/src/main/help.h b/src/main/help.h index f1e19061f..8853bac5c 100644 --- a/src/main/help.h +++ b/src/main/help.h @@ -36,6 +36,7 @@ void help_gids(SnortConfig* sc, const char*); void help_buffers(SnortConfig* sc, const char*); void help_builtin(SnortConfig* sc, const char*); void help_module(SnortConfig* sc, const char*); +void help_modules(SnortConfig* sc, const char*); void help_version(SnortConfig*, const char*); void list_modules(SnortConfig* sc, const char*); diff --git a/src/main/modules.cc b/src/main/modules.cc index 4b1f7e829..1b0e01ae0 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -80,10 +80,13 @@ static const Parameter detection_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* detection_help = + "configure general IPS rule processing parameters"; + class DetectionModule : public Module { public: - DetectionModule() : Module("detection", detection_params) { }; + DetectionModule() : Module("detection", detection_help, detection_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -133,10 +136,13 @@ static const Parameter event_queue_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* event_queue_help = + "configure event queue parameters"; + class EventQueueModule : public Module { public: - EventQueueModule() : Module("event_queue", event_queue_params) { }; + EventQueueModule() : Module("event_queue", event_queue_help, event_queue_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -223,10 +229,13 @@ static const Parameter search_engine_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* search_engine_help = + "configure fast pattern matcher"; + class SearchEngineModule : public Module { public: - SearchEngineModule() : Module("search_engine", search_engine_params) { }; + SearchEngineModule() : Module("search_engine", search_engine_help, search_engine_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -342,10 +351,13 @@ static const Parameter profile_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* profile_help = + "configure profiling of rules and/or modules"; + class ProfileModule : public Module { public: - ProfileModule() : Module("profile", profile_params) { }; + ProfileModule() : Module("profile", profile_help, profile_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); }; @@ -395,6 +407,9 @@ bool ProfileModule::set(const char* fqn, Value& v, SnortConfig* sc) // FIXIT-L signature.{h,cc} has type and name confused // the keys here make more sense +static const char* classifications_help = + "define rule categories with priority"; + static const Parameter classification_params[] = { { "name", Parameter::PT_STRING, nullptr, nullptr, @@ -413,7 +428,7 @@ class ClassificationsModule : public Module { public: ClassificationsModule() : - Module("classifications", classification_params, true) { }; + Module("classifications", classifications_help, classification_params, true) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); @@ -460,13 +475,14 @@ bool ClassificationsModule::set(const char*, Value& v, SnortConfig*) //------------------------------------------------------------------------- // reference module //------------------------------------------------------------------------- -// FIXIT-L signature.{h,cc} has type and name confused -// the keys here make more sense + +static const char* reference_help = + "define reference systems used in rules"; static const Parameter reference_params[] = { { "name", Parameter::PT_STRING, nullptr, nullptr, - "name used with classtype rule option" }, + "name used with reference rule option" }, { "url", Parameter::PT_STRING, nullptr, nullptr, "where this reference is defined" }, @@ -478,7 +494,7 @@ class ReferencesModule : public Module { public: ReferencesModule() : - Module("references", reference_params, true) { }; + Module("references", reference_help, reference_params, true) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); @@ -559,10 +575,13 @@ static const Parameter alerts_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* alerts_help = + "configure alerts"; + class AlertsModule : public Module { public: - AlertsModule() : Module("alerts", alerts_params) { }; + AlertsModule() : Module("alerts", alerts_help, alerts_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -663,10 +682,13 @@ static const Parameter output_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* output_help = + "configure general output parameters"; + class OutputModule : public Module { public: - OutputModule() : Module("output", output_params) { }; + OutputModule() : Module("output", output_help, output_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -759,10 +781,13 @@ static const Parameter active_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* active_help = + "configure responses"; + class ActiveModule : public Module { public: - ActiveModule() : Module("active", active_params) { }; + ActiveModule() : Module("active", active_help, active_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -816,10 +841,13 @@ static const Parameter packets_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* packets_help = + "configure basic packet handling"; + class PacketsModule : public Module { public: - PacketsModule() : Module("packets", packets_params) { }; + PacketsModule() : Module("packets", packets_help, packets_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -883,10 +911,13 @@ static const Parameter daq_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* daq_help = + "configure packet acquisition interface"; + class DaqModule : public Module { public: - DaqModule() : Module("daq", daq_params) { }; + DaqModule() : Module("daq", daq_help, daq_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -941,10 +972,14 @@ static const Parameter attribute_table_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +const char* attribute_table_help = + "configure hosts loading"; + class AttributeTableModule : public Module { public: - AttributeTableModule() : Module("attribute_table", attribute_table_params) { }; + AttributeTableModule() : + Module("attribute_table", attribute_table_help, attribute_table_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -998,10 +1033,13 @@ static const Parameter network_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* network_help = + "configure basic network parameters"; + class NetworkModule : public Module { public: - NetworkModule() : Module("network", network_params) { }; + NetworkModule() : Module("network", network_help, network_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -1060,10 +1098,13 @@ static const Parameter ips_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* ips_help = + "configure IPS rule processing"; + class IpsModule : public Module { public: - IpsModule() : Module("ips", ips_params) { }; + IpsModule() : Module("ips", ips_help, ips_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -1122,10 +1163,13 @@ static const Parameter process_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* process_help = + "configure basic process setup"; + class ProcessModule : public Module { public: - ProcessModule() : Module("process", process_params) { }; + ProcessModule() : Module("process", process_help, process_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -1164,37 +1208,6 @@ bool ProcessModule::set(const char*, Value& v, SnortConfig* sc) return true; } -//------------------------------------------------------------------------- -// vars module -//------------------------------------------------------------------------- -// FIXIT-L signature.{h,cc} has type and name confused -// the keys here make more sense - -static const Parameter vars_params[] = -{ - { nullptr, Parameter::PT_STRING, nullptr, nullptr, - "port, ip, or path variable" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -class VarsModule : public Module -{ -public: - VarsModule() : - Module("vars", vars_params, true) { }; - - bool set(const char*, Value&, SnortConfig*); -}; - -#include -bool VarsModule::set(const char* fqn, Value& v, SnortConfig*) -{ - cout << fqn << " = " << v.get_name() << endl; - - return true; -} - //------------------------------------------------------------------------- // file_id module //------------------------------------------------------------------------- @@ -1229,10 +1242,13 @@ static const Parameter file_id_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* file_id_help = + "configure file identification"; + class FileIdModule : public Module { public: - FileIdModule() : Module("file_id", file_id_params) { }; + FileIdModule() : Module("file_id", file_id_help, file_id_params) { }; bool set(const char*, Value&, SnortConfig*); }; @@ -1293,10 +1309,13 @@ static const Parameter suppress_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* suppress_help = + "configure event suppressions"; + class SuppressModule : public Module { public: - SuppressModule() : Module("suppress", suppress_params, true) { }; + SuppressModule() : Module("suppress", suppress_help, suppress_params, true) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -1372,10 +1391,14 @@ static const Parameter event_filter_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* event_filter_help = + "configure thresholding of events"; + class EventFilterModule : public Module { public: - EventFilterModule() : Module("event_filter", event_filter_params, true) { }; + EventFilterModule() : + Module("event_filter", event_filter_help, event_filter_params, true) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -1467,10 +1490,13 @@ static const Parameter rate_filter_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* rate_filter_help = + "configure rate filters (which change rule actions)"; + class RateFilterModule : public Module { public: - RateFilterModule() : Module("rate_filter", rate_filter_params, true) { }; + RateFilterModule() : Module("rate_filter", rate_filter_help, rate_filter_params, true) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -1543,10 +1569,13 @@ static const Parameter rule_state_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* rule_state_help = + "enable/disable specific IPS rules"; + class RuleStateModule : public Module { public: - RuleStateModule() : Module("rule_state", rule_state_params) { }; + RuleStateModule() : Module("rule_state", rule_state_help, rule_state_params) { }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); bool end(const char*, int, SnortConfig*); @@ -1629,10 +1658,13 @@ static const Parameter hosts_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* hosts_help = + "configure hosts"; + class HostsModule : public Module { public: - HostsModule() : Module("hosts", hosts_params, true) { }; + HostsModule() : Module("hosts", hosts_help, hosts_params, true) { }; ~HostsModule() { assert(!host && !app); }; bool set(const char*, Value&, SnortConfig*); @@ -1727,10 +1759,13 @@ static const Parameter xxx_params[] = { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } }; +static const char* _help = + "configure "; + class XXXModule : public Module { public: - XXXModule() : Module("xxx", xxx_params) { }; + XXXModule() : Module("xxx", xxx_help, xxx_params) { }; const RuleMap* get_rules() { return xxx_rules; }; bool set(const char*, Value&, SnortConfig*); bool begin(const char*, int, SnortConfig*); @@ -1757,34 +1792,8 @@ bool XXXModule::end(const char*, int, SnortConfig*) { return true; } - -static const Parameter xxx_params[] = -{ - { "name", Parameter::PT_INT, "range", "deflt", - "help" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -class XXXModule : public Module -{ -public: - XXXModule() : Module("xxx", xxx_params) { }; - bool set(const char*, Value&, SnortConfig*); -}; - -bool XXXModule::set(const char*, Value& v, SnortConfig* sc) -{ - if ( v.is("name") ) - sc->pkt_cnt = v.get_long(); - - else - return false; - - return true; -} - #endif + //------------------------------------------------------------------------- // module manager stuff - move to framework/module_manager.cc //------------------------------------------------------------------------- @@ -1828,7 +1837,6 @@ void module_init() ModuleManager::add_module(new EventFilterModule); ModuleManager::add_module(new RateFilterModule); ModuleManager::add_module(new SuppressModule); - ModuleManager::add_module(new VarsModule); // these are preliminary policies ModuleManager::add_module(new NetworkModule); diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc index fd17f5bdb..14c8a4e7e 100644 --- a/src/main/snort_module.cc +++ b/src/main/snort_module.cc @@ -72,7 +72,7 @@ static const Command snort_cmds[] = // parameters //------------------------------------------------------------------------- -static const Parameter snort_params[] = +static const Parameter s_params[] = { { "-?", Parameter::PT_IMPLIED, nullptr, nullptr, "list command line options (same as --help)" }, @@ -257,6 +257,9 @@ static const Parameter snort_params[] = { "--help-module", Parameter::PT_STRING, nullptr, nullptr, " output description of given module" }, + { "--help-modules", Parameter::PT_IMPLIED, nullptr, nullptr, + "list all modules with brief help" }, + { "--help-options", Parameter::PT_STRING, "(optional)", nullptr, "