+Pending - build 148
+
+-- added publish-subscribe handling of data events
+-- added data_log plugin example for pub-sub
+
15/04/23 - build 147
-- change PT_DATA to IT_PASSIVE; supports named instances, reload, and consumers
-add_example_library(dpx inspectors dpx.cc)
+add_example_library(insex inspectors dpx.cc)
+add_example_library(insex inspectors data_log.cc)
AUTOMAKE_OPTIONS=foreign
-dpxlibdir = $(pkglibdir)/inspectors
-dpxlib_LTLIBRARIES = libdpx.la
+insexlibdir = $(pkglibdir)/inspectors
+
+insexlib_LTLIBRARIES = libdpx.la
libdpx_la_CXXFLAGS = $(AM_CXXFLAGS)
libdpx_la_LDFLAGS = -export-dynamic -shared
libdpx_la_SOURCES = dpx.cc
+insexlib_LTLIBRARIES += libdata_log.la
+libdata_log_la_CXXFLAGS = $(AM_CXXFLAGS)
+libdata_log_la_LDFLAGS = -export-dynamic -shared
+libdata_log_la_SOURCES = data_log.cc
+
AM_CXXFLAGS = @AM_CXXFLAGS@
--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2015-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+// data_log.cc author Russ Combs <rcombs@sourcefire.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string.h>
+#include <time.h>
+
+#include <iostream>
+#include <string>
+
+#include "main/snort_debug.h"
+#include "main/snort_types.h"
+#include "framework/data_bus.h"
+#include "framework/inspector.h"
+#include "framework/module.h"
+#include "log/messages.h"
+#include "log/text_log.h"
+#include "protocols/packet.h"
+#include "time/profiler.h"
+#include "utils/stats.h"
+#include "flow/flow.h"
+#include "sfip/sfip_t.h"
+
+static const char* s_name = "data_log";
+static const char* f_name = "data.log";
+static const char* s_help = "log selected published data to data.log";
+
+static THREAD_LOCAL SimpleStats dl_stats;
+
+//-------------------------------------------------------------------------
+// log stuff
+//-------------------------------------------------------------------------
+
+static THREAD_LOCAL TextLog* tlog = nullptr;
+
+static void dl_tinit()
+{
+ std::string fname;
+ get_instance_file(fname, f_name);
+ tlog = TextLog_Init(fname.c_str(), 64*K_BYTES, 1*M_BYTES);
+}
+
+static void dl_tterm()
+{
+ TextLog_Term(tlog);
+}
+
+//-------------------------------------------------------------------------
+// data stuff
+//-------------------------------------------------------------------------
+
+class LogHandler : public DataHandler
+{
+public:
+ LogHandler(std::string s)
+ { key = s; }
+
+ void handle(DataEvent& e, Flow*);
+
+private:
+ std::string key;
+};
+
+void LogHandler::handle(DataEvent& e, Flow* f)
+{
+ unsigned n;
+ const char* b = (char*)e.get_data(n);
+
+ // FIXIT-L hexify binary data
+ std::string val(b, n);
+
+ TextLog_Print(tlog, "%u, ", time(nullptr));
+ TextLog_Print(tlog, "%s, %d, ", sfip_to_str(&f->client_ip), f->client_port);
+ TextLog_Print(tlog, "%s, %d, ", sfip_to_str(&f->server_ip), f->server_port);
+ TextLog_Print(tlog, "%s, %*s\n", key.c_str(), n, val.c_str());
+
+ dl_stats.total_packets++;
+}
+
+//-------------------------------------------------------------------------
+// inspector stuff
+//-------------------------------------------------------------------------
+
+class DataLog : public Inspector
+{
+public:
+ DataLog(std::string s) { key = s; }
+
+ void show(SnortConfig*) override;
+ void eval(Packet*) override { };
+
+ bool configure(SnortConfig*) override
+ {
+ get_data_bus().subscribe(key.c_str(), new LogHandler(key));
+ return true;
+ }
+
+private:
+ std::string key;
+};
+
+void DataLog::show(SnortConfig*)
+{
+ LogMessage("%s config:\n", s_name);
+ LogMessage(" key = %s\n", key.c_str());
+}
+
+//-------------------------------------------------------------------------
+// module stuff
+//-------------------------------------------------------------------------
+
+static const Parameter dl_params[] =
+{
+ { "key", Parameter::PT_STRING, nullptr, nullptr,
+ "name of data buffer to log" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+class DataLogModule : public Module
+{
+public:
+ DataLogModule() : Module(s_name, s_help, dl_params)
+ { }
+
+ const PegInfo* get_pegs() const override
+ { return simple_pegs; }
+
+ PegCount* get_counts() const override
+ { return (PegCount*)&dl_stats; }
+
+ bool set(const char*, Value& v, SnortConfig*) override;
+
+public:
+ std::string key;
+};
+
+bool DataLogModule::set(const char*, Value& v, SnortConfig*)
+{
+ if ( v.is("key") )
+ key = v.get_string();
+
+ else
+ return false;
+
+ return true;
+}
+
+//-------------------------------------------------------------------------
+// api stuff
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{ return new DataLogModule; }
+
+static void mod_dtor(Module* m)
+{ delete m; }
+
+static Inspector* dl_ctor(Module* m)
+{
+ DataLogModule* mod = (DataLogModule*)m;
+ return new DataLog(mod->key);
+}
+
+static void dl_dtor(Inspector* p)
+{
+ delete p;
+}
+
+static const InspectApi dl_api
+{
+ {
+ PT_INSPECTOR,
+ sizeof(InspectApi),
+ INSAPI_VERSION,
+ 0,
+ API_RESERVED,
+ API_OPTIONS,
+ s_name,
+ s_help,
+ mod_ctor,
+ mod_dtor
+ },
+ IT_PASSIVE,
+ (uint16_t)PktType::NONE,
+ nullptr, // buffers
+ nullptr, // service
+ nullptr, // pinit
+ nullptr, // pterm
+ dl_tinit,
+ dl_tterm,
+ dl_ctor,
+ dl_dtor,
+ nullptr, // ssn
+ nullptr // reset
+};
+
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &dl_api.base,
+ nullptr
+};
+
//--------------------------------------------------------------------------
// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2013-2013 Sourcefire, Inc.
//
// This program is free software; you can redistribute it and/or modify it
// under the terms of the GNU General Public License Version 2 as published
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
//--------------------------------------------------------------------------
-
// dpx.cc author Russ Combs <rcombs@sourcefire.com>
#ifdef HAVE_CONFIG_H
#define DPX_GID 256
#define DPX_SID 1
-#define DPX_REV 1
-#define DPX_PRI 1
-#define DPX_MSG "too much data sent to port"
-
-#if 0
-#define PP_DPX 10000
-
-#ifdef DEBUG
-#define DEBUG_DPX DEBUG_PP_EXP
-#endif
-#endif
static const char* s_name = "dpx";
static const char* s_help = "dynamic inspector example";
// class stuff
//-------------------------------------------------------------------------
-class DpxPH : public Inspector
+class Dpx : public Inspector
{
public:
- DpxPH();
+ Dpx(uint16_t port, uint16_t max);
void show(SnortConfig*) override;
void eval(Packet*) override;
uint16_t max;
};
-DpxPH::DpxPH()
+Dpx::Dpx(uint16_t p, uint16_t m)
{
- port = 68;
- max = 300;
+ port = p;
+ max = m;
}
-void DpxPH::show(SnortConfig*)
+void Dpx::show(SnortConfig*)
{
LogMessage("%s config:\n", s_name);
LogMessage(" port = %d\n", port);
LogMessage(" max = %d\n", max);
}
-void DpxPH::eval(Packet* p)
+void Dpx::eval(Packet* p)
{
// precondition - what we registered for
assert(p->is_udp());
// module stuff
//-------------------------------------------------------------------------
+static const Parameter dpx_params[] =
+{
+ { "port", Parameter::PT_PORT, nullptr, nullptr,
+ "port to check" },
+
+ { "max", Parameter::PT_INT, "0:65535", "0",
+ "maximum payload before alert" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+static const RuleMap dpx_rules[] =
+{
+ { DPX_SID, "too much data sent to port" },
+ { 0, nullptr }
+};
+
class DpxModule : public Module
{
public:
- DpxModule() : Module(s_name, s_help)
+ DpxModule() : Module(s_name, s_help, dpx_params)
{ }
- const PegInfo* get_pegs() const
+ unsigned get_gid() const override
+ { return DPX_GID; }
+
+ const RuleMap* get_rules() const override
+ { return dpx_rules; }
+
+ const PegInfo* get_pegs() const override
{ return simple_pegs; }
PegCount* get_counts() const override
ProfileStats* get_profile() const override
{ return &dpxPerfStats; }
+
+ bool set(const char*, Value& v, SnortConfig*) override;
+
+public:
+ uint16_t port;
+ uint16_t max;
};
+bool DpxModule::set(const char*, Value& v, SnortConfig*)
+{
+ if ( v.is("port") )
+ port = v.get_long();
+
+ else if ( v.is("max") )
+ max = v.get_long();
+
+ else
+ return false;
+
+ return true;
+}
+
//-------------------------------------------------------------------------
// api stuff
//-------------------------------------------------------------------------
-static Inspector* dpx_ctor(Module*)
+static Module* mod_ctor()
+{ return new DpxModule; }
+
+static void mod_dtor(Module* m)
+{ delete m; }
+
+static Inspector* dpx_ctor(Module* m)
{
- return new DpxPH;
+ DpxModule* mod = (DpxModule*)m;
+ return new Dpx(mod->port, mod->max);
}
static void dpx_dtor(Inspector* p)
API_OPTIONS,
s_name,
s_help,
- nullptr,
- nullptr
+ mod_ctor,
+ mod_dtor
},
IT_NETWORK,
- PROTO_BIT__UDP,
+ (uint16_t)PktType::UDP,
+ nullptr, // buffers
nullptr, // service
- nullptr, // contents
nullptr, // pinit
nullptr, // pterm
nullptr, // tinit
#define SFKSEARCH_TRACK_Q
-#ifdef SFKSEARCH_TRACK_Q
-//# include "snort.h"
-//# include "util.h"
-#endif
-
static void KTrieFree(KTRIENODE* n);
static unsigned int mtot = 0;
/* detection/manipulation funcs */
void snort_ignore(Packet*);
void snort_inspect(Packet*);
-SO_PUBLIC bool Detect(Packet*);
+bool Detect(Packet*);
void CallOutputPlugins(Packet*);
int EvalPacket(ListHead*, int, Packet*);
int EvalHeader(RuleTreeNode*, Packet*, int);
#include "search_engines/search_tool.h"
#include "protocols/packet.h"
#include "detection_util.h"
+#include "framework/data_bus.h"
MimePcre mime_boundary_pcre;
file_api->set_file_name_from_log(&(mime_ssn->log_state->file_log), p->flow);
}
updateFilePosition(&position, file_api->get_file_processed_size(p->flow));
- Detect(p);
+ get_data_bus().publish(PACKET_EVENT, p);
mime_ssn->state_flags &= ~MIME_FLAG_MULTIPLE_EMAIL_ATTACH;
ResetEmailDecodeState((Email_DecodeState*)(mime_ssn->decode_state));
p->packet_flags |= PKT_ALLOW_MULTIPLE_DETECT;
codec.h
counts.h
cursor.h
+ data_bus.h
decode_data.h
logger.h
inspector.h
${FRAMEWORK_INCLUDES}
codec.cc
cursor.cc
+ data_bus.cc
inspector.cc
ips_option.cc
parameter.cc
codec.h \
counts.h \
cursor.h \
+data_bus.h \
decode_data.h \
logger.h \
inspector.h \
libframework_a_SOURCES = \
codec.cc \
cursor.cc \
+data_bus.cc \
inspector.cc \
ips_option.cc \
parameter.cc \
--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+// data_bus.cc author Russ Combs <rucombs@cisco.com>
+
+#include "framework/data_bus.h"
+#include "main/policy.h"
+#include "protocols/packet.h"
+
+DataBus& get_data_bus()
+{ return get_inspection_policy()->dbus; }
+
+class BufferEvent : public DataEvent
+{
+public:
+ BufferEvent(const uint8_t* b, unsigned n)
+ { buf = b; len = n; }
+
+ const uint8_t* get_data(unsigned& n) override
+ { n = len; return buf; }
+
+private:
+ const uint8_t* buf;
+ unsigned len;
+};
+
+class PacketEvent : public DataEvent
+{
+public:
+ PacketEvent(Packet* p)
+ { packet = p; }
+
+ const Packet* get_packet() override
+ { return packet; }
+
+private:
+ const Packet* packet;
+};
+
+DataBus::DataBus() { }
+
+DataBus::~DataBus()
+{
+ for ( auto& p : map )
+ for ( auto* h : p.second )
+ delete h;
+}
+
+// add handler to list of handlers to be notified upon
+// publication of given event
+void DataBus::subscribe(const char* key, DataHandler* h)
+{
+ DataList& v = map[key];
+ v.push_back(h);
+}
+
+// notify subscribers of event
+void DataBus::publish(const char* key, DataEvent& e, Flow* f)
+{
+ DataList& v = map[key];
+
+ for ( auto* h : v )
+ h->handle(e, f);
+}
+
+void DataBus::publish(const char* key, const uint8_t* buf, unsigned len, Flow* f)
+{
+ BufferEvent e(buf, len);
+ publish(key, e, f);
+}
+
+void DataBus::publish(const char* key, Packet* p, Flow* f)
+{
+ PacketEvent e(p);
+ if ( !f )
+ f = p->flow;
+ publish(key, e, f);
+}
+
--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+// data_bus.h author Russ Combs <rucombs@cisco.com>
+
+#ifndef DATA_BUS_H
+#define DATA_BUS_H
+
+#include <map>
+#include <string>
+#include <vector>
+
+// FIXIT-P evaluate perf; focus is on correctness
+typedef std::vector<struct DataHandler*> DataList;
+typedef std::map<std::string, DataList> DataMap;
+
+#include "main/snort_types.h"
+
+class Flow;
+struct Packet;
+
+class DataEvent
+{
+public:
+ virtual ~DataEvent() { }
+
+ virtual const Packet* get_packet()
+ { return nullptr; }
+
+ virtual const uint8_t* get_data(unsigned& len)
+ { len = 0; return nullptr; }
+
+ virtual const uint8_t* get_normalized_data(unsigned& len)
+ { return get_data(len); }
+
+protected:
+ DataEvent() { }
+};
+
+class DataHandler
+{
+public:
+ virtual ~DataHandler() { }
+
+ virtual void handle(DataEvent&, Flow*) { }
+
+protected:
+ DataHandler() { }
+};
+
+class SO_PUBLIC DataBus
+{
+public:
+ DataBus();
+ ~DataBus();
+
+ void subscribe(const char* key, DataHandler*);
+ void publish(const char* key, DataEvent&, Flow* = nullptr);
+
+ // convenience methods
+ void publish(const char* key, const uint8_t*, unsigned, Flow* = nullptr);
+ void publish(const char* key, Packet*, Flow* = nullptr);
+
+private:
+ DataMap map;
+};
+
+// FIXIT-L this should be in snort_confg.h or similar but that
+// requires refactoring to work as installed header
+SO_PUBLIC DataBus& get_data_bus();
+
+// common data events
+#define PACKET_EVENT "detection.packet"
+
+#endif
+
#define MIN_BUF (1* K_BYTES)
#define MIN_FILE (MIN_BUF)
+struct TextLog
+{
+/* private:
+ file attributes: */
+ FILE* file;
+ char* name;
+ size_t size;
+ size_t maxFile;
+ time_t last;
+
+/* buffer attributes: */
+ unsigned int pos;
+ unsigned int maxBuf;
+ char buf[1];
+};
+
/*-------------------------------------------------------------------
* TextLog_Open/Close: open/close associated log file
*-------------------------------------------------------------------
return err ? 0 : sbuf.st_size;
}
+int TextLog_Tell(TextLog* const txt)
+{
+ return txt->pos;
+}
+
+int TextLog_Avail(TextLog* const txt)
+{
+ return txt->maxBuf - txt->pos - 1;
+}
+
+void TextLog_Reset(TextLog* const txt)
+{
+ txt->pos = 0;
+ txt->buf[txt->pos] = '\0';
+}
+
/*-------------------------------------------------------------------
* TextLog_Init: constructor
*-------------------------------------------------------------------
// FIXIT-L need a LogMessage based subclass of TextLog
// or some such to get stdout or syslog
-
-/*
- * DO NOT ACCESS STRUCT MEMBERS DIRECTLY
- * EXCEPT FROM WITHIN THE IMPLEMENTATION!
- */
-struct TextLog
-{
-/* private:
- file attributes: */
- FILE* file;
- char* name;
- size_t size;
- size_t maxFile;
- time_t last;
-
-/* buffer attributes: */
- unsigned int pos;
- unsigned int maxBuf;
- char buf[1];
-};
+struct TextLog;
TextLog* TextLog_Init(
- const char* name, unsigned int maxBuf = 0, size_t maxFile = 0
- );
+ const char* name, unsigned int maxBuf = 0, size_t maxFile = 0);
void TextLog_Term(TextLog*);
bool TextLog_Putc(TextLog* const, char);
bool TextLog_Write(TextLog* const, const char*, int len);
bool TextLog_Print(TextLog* const, const char* format, ...);
bool TextLog_Flush(TextLog* const);
+int TextLog_Tell(TextLog* const);
+int TextLog_Avail(TextLog* const);
+void TextLog_Reset(TextLog* const);
/*-------------------------------------------------------------------
* helper functions
*-------------------------------------------------------------------
*/
-static inline int TextLog_Tell(TextLog* const txt)
-{
- return txt->pos;
-}
-
-static inline int TextLog_Avail(TextLog* const txt)
-{
- return txt->maxBuf - txt->pos - 1;
-}
-
-static inline void TextLog_Reset(TextLog* const txt)
-{
- txt->pos = 0;
- txt->buf[txt->pos] = '\0';
-}
-
static inline bool TextLog_NewLine(TextLog* const txt)
{
return TextLog_Putc(txt, '\n');
thread.h
snort_debug.h
snort_types.h
- snort.h
- snort_config.h
)
add_library (main STATIC
policy.h
shell.h
shell.cc
- snort.h
snort.cc
+ snort.h
+ snort_config.h
snort_debug.cc
snort_config.cc
snort_module.h
x_include_HEADERS = \
snort_debug.h \
snort_types.h \
-snort.h \
-snort_config.h \
thread.h
libmain_a_SOURCES = \
snort.h \
snort_config.cc \
snort_config.h \
+snort_config.h \
snort_debug.cc \
snort_module.cc \
snort_module.h \
#include "managers/inspector_manager.h"
#include "parser/vars.h"
#include "main/shell.h"
-#include "snort.h"
+#include "main/snort.h"
+#include "detection/detect.h"
//-------------------------------------------------------------------------
// traffic policy
// inspection policy
//-------------------------------------------------------------------------
+class AltPktHandler : public DataHandler
+{
+public:
+ AltPktHandler() { };
+
+ void handle(DataEvent& e, Flow*)
+ { Detect((Packet*)e.get_packet()); } // FIXIT-L not const!
+};
+
InspectionPolicy::InspectionPolicy()
{
framework_policy = nullptr;
InspectorManager::delete_policy(this);
}
+void InspectionPolicy::configure()
+{
+ dbus.subscribe(PACKET_EVENT, new AltPktHandler);
+}
+
//-------------------------------------------------------------------------
// detection policy
//-------------------------------------------------------------------------
#include <vector>
#include "main/snort_types.h"
+#include "framework/data_bus.h"
struct PortTable;
struct vartable_t;
InspectionPolicy();
~InspectionPolicy();
+ void configure();
+
public:
struct FrameworkPolicy* framework_policy;
+ DataBus dbus;
};
//-------------------------------------------------------------------------
SnortEventqPop();
}
-DAQ_Verdict ProcessPacket(
+static DAQ_Verdict ProcessPacket(
Packet* p, const DAQ_PktHdr_t* pkthdr, const uint8_t* pkt, bool is_frag)
{
DAQ_Verdict verdict = DAQ_VERDICT_PASS;
return verdict;
}
+void ProcessDefragPacket(Packet* p, Packet* dpkt)
+{
+ SnortEventqPush();
+ PacketManager::encode_set_pkt(p);
+ ProcessPacket(dpkt, dpkt->pkth, dpkt->pkt, true);
+ SnortEventqPop();
+}
+
DAQ_Verdict fail_open(
void*, const DAQ_PktHdr_t*, const uint8_t*)
{
ActionManager::reset_queue();
- verdict = ProcessPacket(s_packet, pkthdr, pkt);
+ verdict = ProcessPacket(s_packet, pkthdr, pkt, false);
ActionManager::execute(s_packet);
void snort_thread_rotate();
void CapturePacket();
+void ProcessDefragPacket(Packet* raw, Packet* defrag);
void DecodeRebuiltPacket(Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt, Flow*);
void DetectRebuiltPacket(Packet*);
void LogRebuiltPacket(Packet*);
-DAQ_Verdict ProcessPacket(Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt, bool is_frag=false);
-
DAQ_Verdict fail_open(void*, const DAQ_PktHdr_t*, const uint8_t*);
DAQ_Verdict packet_callback(void*, const DAQ_PktHdr_t*, const uint8_t*);
{
set_policies(sc, idx);
InspectionPolicy* p = sc->policy_map->inspection_policy[idx];
+ p->configure();
ok = ::configure(sc, p->framework_policy) && ok;
}
#include "detection_util.h"
#include "parser.h"
#include "sfsnprintfappend.h"
+#include "framework/data_bus.h"
#ifdef PERF_PROFILING
// FIXIT-M ftp, http, etc. should not be calling Detect()
* main detection engine for each protocol field.
*/
MODULE_PROFILE_START(ftppDetectPerfStats);
- Detect(p);
+ get_data_bus().publish(PACKET_EVENT, p);
DisableInspection(p);
MODULE_PROFILE_END(ftppDetectPerfStats);
#include "file_api/file_api.h"
#include "sf_email_attach_decode.h"
#include "protocols/tcp.h"
+#include "framework/data_bus.h"
const HiSearchToken hi_patterns[] =
{
}
// see comments on call to Detect() below
MODULE_PROFILE_START(hiDetectPerfStats);
- Detect(p);
+ get_data_bus().publish(PACKET_EVENT, p);
#ifdef PERF_PROFILING
hiDetectCalled = 1;
#endif
session->client.request.uri_size);
p->packet_flags |= PKT_HTTP_DECODE;
+
+ get_data_bus().publish(
+ "http_uri", session->client.request.uri_norm,
+ session->client.request.uri_norm_size, p->flow);
}
else if ( session->client.request.uri )
{
session->client.request.uri_size);
p->packet_flags |= PKT_HTTP_DECODE;
+
+ get_data_bus().publish(
+ "http_raw_uri", session->client.request.uri,
+ session->client.request.uri_size, p->flow);
}
if ( session->client.request.header_norm ||
#include "stream/stream_splitter.h"
#include "target_based/sftarget_protocol_reference.h"
#include "protocols/tcp.h"
+#include "framework/data_bus.h"
#define RPC_MAX_BUF_SIZE 256
#define RPC_FRAG_HDR_SIZE sizeof(uint32_t)
if (RpcPrepRaw(data, rsdata->frag_len, p) != RPC_STATUS__SUCCESS)
return RPC_STATUS__ERROR;
- Detect(p);
+ get_data_bus().publish(PACKET_EVENT, p);
}
if ( (dsize > 0) )
if ( (dsize > 0) )
RpcPreprocEvent(rconfig, rsdata, RPC_MULTIPLE_RECORD);
- Detect(p);
+ get_data_bus().publish(PACKET_EVENT, p);
RpcBufClean(&rsdata->frag);
}
#endif
encap_frag_cnt++;
- SnortEventqPush();
- PacketManager::encode_set_pkt(p);
- ProcessPacket(dpkt, dpkt->pkth, dpkt->pkt, true);
- SnortEventqPop();
+ ProcessDefragPacket(p, dpkt);
encap_frag_cnt--;
DEBUG_WRAP(DebugMessage(DEBUG_FRAG,
projects / thirdparty / snort3.git / commitdiff
