]> git.ipfire.org Git - thirdparty/snort3.git/commit
Merge pull request #2800 in SNORT/snort3 from ~BBANTWAL/snort3:ips_actions to master
authorMichael Altizer (mialtize) <mialtize@cisco.com>
Fri, 26 Mar 2021 19:20:37 +0000 (19:20 +0000)
committerMichael Altizer (mialtize) <mialtize@cisco.com>
Fri, 26 Mar 2021 19:20:37 +0000 (19:20 +0000)
commit2414d8b9d22c6e977fa1babd40cc6b596d0ba8c1
tree499622ce2c8572d6eabe5b0f7224b8712182ea0b
parent516b36c3a3e4074e557662f6abd8faadc1edcde5
Merge pull request #2800 in SNORT/snort3 from ~BBANTWAL/snort3:ips_actions to master

Squashed commit of the following:

commit 9ea4a671998c7c5270d91ca26ee1cca8228030ff
Author: Bhagya Tholpady <bbantwal@cisco.com>
Date:   Fri Mar 26 12:08:39 2021 -0400

    actions: dynamically construct the default eval order for all the loaded ips actions

commit 39c59c2dd92c4ad3b1ed1d3ac4914c511b5a7edf
Author: Bhagya Tholpady <bbantwal@cisco.com>
Date:   Sun Mar 21 13:07:52 2021 -0400

    detection: Update the rtn's listHead to reflect the new action set in the rule state

commit 628648057da9d38fc7c212a209427623700efaa3
Author: Bhagya Tholpady <bbantwal@cisco.com>
Date:   Thu Mar 25 09:48:18 2021 -0400

    rate_filter: Get the available ips actions dynamically to configure the new_action

commit 15c13d82d360fc37aa83ebf30dea71b2877b5a14
Author: Bhagya Tholpady <bbantwal@cisco.com>
Date:   Wed Mar 17 12:13:06 2021 -0400

    snort_config: Remove is_active_enabled and set_active_enabled functions

commit fce81b9ed016b3aa118371fec104cc3d62c5109b
Author: Bhagya Tholpady <bbantwal@cisco.com>
Date:   Tue Mar 16 14:26:49 2021 -0400

    snort2lua: delete conversion of disable_replace option

commit 13ad5f9b33620576f11483058425fc8b43031acc
Author: Bhagya Tholpady <bbantwal@cisco.com>
Date:   Tue Mar 9 11:33:31 2021 -0500

    actions: Make all IPS actions pluggable

    * All actions, including the previously "built-in" actions, have been
    refactored into a set of equal IPS action plugins. Each IPS action has
    an immediate effect and may or may not contain an active response to be
    carried out as a delayed action.
    * The reset and reject IPS actions have been merged into a single
    reject IPS action. The reject IPS action can no longer be built as a
    dynamic plugin.
    * All IPS actions will be instantiated in a default state in each IPS
    policy where they have not been otherwise explicitly configured via a
    module.
    * The rewrite IPS action is no longer configurable and has lost its
    module. Its active response priority has been corrected to AP_MODIFY.
    * Rate filter thresholding has been corrected to apply to any IPS
    action that drops traffic.
    * Rule evaluation action ordering has been expanded to include all
    IPS actions, static and dynamic. Dynamic actions will currently default
    to the lowest priority.
57 files changed:
doc/user/active.txt
lua/snort.lua
src/actions/CMakeLists.txt
src/actions/act_alert.cc [new file with mode: 0644]
src/actions/act_block.cc [new file with mode: 0644]
src/actions/act_drop.cc [new file with mode: 0644]
src/actions/act_log.cc [new file with mode: 0644]
src/actions/act_pass.cc [new file with mode: 0644]
src/actions/act_react.cc
src/actions/act_reject.cc
src/actions/act_replace.cc
src/actions/actions.cc
src/actions/actions.h
src/actions/dev_notes.txt
src/actions/ips_actions.cc
src/detection/detection_engine.cc
src/detection/detection_engine.h
src/detection/detection_util.cc
src/detection/detection_util.h
src/detection/fp_detect.cc
src/detection/rules.cc
src/detection/rules.h
src/detection/signature.cc
src/detection/treenodes.h
src/events/event_queue.h
src/file_api/file_module.cc
src/filters/sfrf.cc
src/filters/sfrf.h
src/filters/sfrf_test.cc
src/framework/ips_action.h
src/main/modules.cc
src/main/policy.cc
src/main/policy.h
src/main/snort.cc
src/main/snort_config.cc
src/main/snort_config.h
src/managers/action_manager.cc
src/managers/action_manager.h
src/packet_io/active.cc
src/packet_io/active_action.h
src/parser/parse_conf.cc
src/parser/parse_conf.h
src/parser/parse_rule.cc
src/parser/parser.cc
src/parser/parser.h
src/payload_injector/test/payload_injector_test.cc
src/piglet_plugins/pp_inspector_iface.cc
src/piglet_plugins/pp_ips_action_iface.cc
src/service_inspectors/http2_inspect/test/http2_hpack_int_decode_test.cc
src/service_inspectors/http2_inspect/test/http2_hpack_string_decode_test.cc
src/service_inspectors/http_inspect/test/http_module_test.cc
src/service_inspectors/http_inspect/test/http_transaction_test.cc
src/service_inspectors/http_inspect/test/http_uri_norm_test.cc
src/service_inspectors/smtp/smtp_module.cc
tools/snort2lua/config_states/config_deleted.cc
tools/snort2lua/config_states/config_no_option.cc
tools/snort2lua/rule_states/rule_replace.cc