remove pthread and harden --enable-inline-failopen

diff --git a/configure.ac b/configure.ac
index 4b8208b6d05ac8cb82f10b58e914588860b55582..3a408dd2e9fe7ec2d078e591519ae0dfcf279cde 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -352,23 +352,6 @@ if test "x$enable_linux_smp_stats" = "xyes"; then
     AC_DEFINE(LINUX_SMP, [1], [enable proc stats])
 fi
 
-AC_ARG_ENABLE(inline-init-failopen,
-[  --enable-inline-init-failopen  Enable Fail Open during initialization for Inline Mode (adds pthread support implicitly)],
-       enable_inline_init_failopen="$enableval", enable_inline_init_failopen="no")
-
-if test "x$enable_inline_init_failopen" = "xyes"; then
-    AC_DEFINE(INLINE_FAILOPEN, [1], [pass packet during initialization])
-    LIBS="$LIBS -lpthread"
-fi
-
-AC_ARG_ENABLE(pthread,
-[  --disable-pthread        Disable pthread support],
-       enable_pthread="$enableval", enable_pthread="yes")
-
-if test "x$enable_pthread" = "xyes"; then
-    LIBS="$LIBS -lpthread"
-fi
-
 AC_ARG_ENABLE(debug-msgs,
 [  --enable-debug-msgs      Enable debug printing options (bugreports and developers only)],
        enable_debug_msgs="$enableval", enable_debug_msgs="no")
@@ -429,8 +412,6 @@ if test "x$enable_corefiles" = "xno"; then
     AC_DEFINE(NOCOREFILE, [1], [do not generate a core file on segfault etc.])
 fi
 
-LIBS="$LIBS -lpthread"
-
 AC_ARG_ENABLE(non-ether-decoders,
 [  --enable-non-ether-decoders  Enable non Ethernet decoders.],
        enable_non_ether_decoders="$enableval", enable_non_ether_decoders="no")

diff --git a/doc/differences.txt b/doc/differences.txt
index a754d70cf979fe24a49505a56a3ef0245b13fc62..a261377026792a49a40c5c9b2580fc9531623dc9 100644 (file)
--- a/doc/differences.txt
+++ b/doc/differences.txt
@@ -13,6 +13,7 @@ Snort++ differs from Snort in the following ways:
 * configure --with-lib{pcap,pcre}-* -> --with-{pcap,pcre}-*
 * control socket, cs_dir, and users were deleted
 * POLICY_BY_ID_ONLY code was deleted
+* hardened --enable-inline-init-failopen / INLINE_FAILOPEN
 
 === Command Line
 

diff --git a/src/main/modules.cc b/src/main/modules.cc
index 4acbd40a595f5ff1f3f3f2339a60cbbe3cea8c8a..35d0765599c2305ab9ad2ee94eafc1c9260339ba 100644 (file)
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -817,10 +817,8 @@ static const Parameter packets_params[] =
     { "bpf_file", Parameter::PT_STRING, nullptr, nullptr,
       "file with BPF to select traffic for Snort" },
 
-#ifdef INLINE_FAILOPEN
     { "enable_inline_init_failopen", Parameter::PT_BOOL, nullptr, "true",
       "whether to pass traffic during later stage of initialization to avoid drops" },
-#endif
 
     { "limit", Parameter::PT_INT, "0:", "0",
       "maximum number of packets to process before stopping (0 is unlimited)" },
@@ -849,13 +847,11 @@ bool PacketsModule::set(const char*, Value& v, SnortConfig* sc)
     else if ( v.is("bpf_file") )
         sc->bpf_file = SnortStrdup(v.get_string());
 
-#ifdef INLINE_FAILOPEN
     else if ( v.is("enable_inline_init_failopen") )
     {
         if ( !v.get_bool() )
             sc->run_flags |= RUN_FLAG__DISABLE_FAILOPEN;
     }
-#endif
     else if ( v.is("limit") )
         sc->pkt_cnt = v.get_long();
 

diff --git a/src/main/snort.h b/src/main/snort.h
index 89c3e0c116fd8389b6f4c0464634f35dae42df21..99aaebe5701ae4dffca17fc68b4ebfd650d97f58 100644 (file)
--- a/src/main/snort.h
+++ b/src/main/snort.h
@@ -109,9 +109,7 @@ typedef enum _RunFlag
     RUN_FLAG__PROCESS_ALL_EVENTS  = 0x00002000,
     RUN_FLAG__INLINE_TEST         = 0x00004000,     /* --enable-inline-test*/
 
-#ifdef INLINE_FAILOPEN
     RUN_FLAG__DISABLE_FAILOPEN    = 0x00100000,     /* --disable-inline-init-failopen */
-#endif
     RUN_FLAG__PCAP_RESET          = 0x00200000,
     RUN_FLAG__PCAP_SHOW           = 0x00400000,
     RUN_FLAG__PAUSE               = 0x00800000,     // --pause
@@ -414,12 +412,10 @@ static inline int ScDefaultRuleState(void)
     return snort_conf->default_rule_state;
 }
 
-#ifdef INLINE_FAILOPEN
 static inline int ScDisableInlineFailopen(void)
 {
     return snort_conf->run_flags & RUN_FLAG__DISABLE_FAILOPEN;
 }
-#endif
 
 static inline int ScNoLockPidFile(void)
 {