+15/10/09 - build 173
+
+-- added pkt_num rule option to extras
+-- fix final -> finalize changes for extras
+-- moved alert_unixsock and log_null to extras
+-- removed duplicate pat_stats source from extras
+-- prevent tcp session restart on rebuilt packets
+ thanks to rmkml for reporting the issue
+-- fixed profiler configuration
+-- fixed ppm event logging
+-- added filename to reload commands
+-- fixed -B switch
+-- reverted tcp syn only logic to match 2X
+-- ensure ip6 extension decoder state is reset for ip4 too since ip4
+ packets may have ip6 next proto
+-- update default manuals
+
15/10/01 - build 172
-- check for bool value before setting fastpath config option in PPM
add_example_library(ips_urg ips_options ips_urg.cc)
+add_example_library(ips_pkt_num ips_options ips_pkt_num.cc)
install (
FILES find.lua
optlibdir = $(pkglibdir)/ips_options
-optlib_LTLIBRARIES = libips_urg.la
+
+optlib_LTLIBRARIES = libips_pkt_num.la
+libips_pkt_num_la_CXXFLAGS = $(AM_CXXFLAGS)
+libips_pkt_num_la_LDFLAGS = -export-dynamic -shared
+libips_pkt_num_la_SOURCES = ips_pkt_num.cc
+
+optlib_LTLIBRARIES += libips_urg.la
libips_urg_la_CXXFLAGS = $(AM_CXXFLAGS)
libips_urg_la_LDFLAGS = -export-dynamic -shared
libips_urg_la_SOURCES = ips_urg.cc
--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// ips_pkt_num.cc author Russ Combs <rucombs@cisco.com>
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <stdlib.h>
+#include <ctype.h>
+
+#include "main/snort_types.h"
+#include "main/thread.h"
+#include "detection/detection_defines.h"
+#include "detection/treenodes.h"
+#include "framework/ips_option.h"
+#include "framework/module.h"
+#include "framework/parameter.h"
+#include "framework/range.h"
+#include "hash/sfhashfcn.h"
+#include "protocols/packet.h"
+#include "protocols/tcp.h"
+#include "time/profiler.h"
+#include "utils/stats.h"
+
+static const char* s_name = "pkt_num";
+static const char* s_help = "alert on raw packet number";
+
+static THREAD_LOCAL ProfileStats pkt_num_perf_stats;
+
+//-------------------------------------------------------------------------
+// option
+//-------------------------------------------------------------------------
+
+class PktNumOption : public IpsOption
+{
+public:
+ PktNumOption(const RangeCheck& c) : IpsOption(s_name)
+ { config = c; }
+
+ uint32_t hash() const override;
+ bool operator==(const IpsOption&) const override;
+
+ int eval(Cursor&, Packet*) override;
+
+private:
+ RangeCheck config;
+};
+
+uint32_t PktNumOption::hash() const
+{
+ uint32_t a, b, c;
+
+ a = config.op;
+ b = config.min;
+ c = config.max;
+
+ mix_str(a,b,c,get_name());
+ finalize(a,b,c);
+
+ return c;
+}
+
+bool PktNumOption::operator==(const IpsOption& ips) const
+{
+ if ( strcmp(s_name, ips.get_name()) )
+ return false;
+
+ PktNumOption& rhs = (PktNumOption&)ips;
+ return ( config == rhs.config );
+}
+
+int PktNumOption::eval(Cursor&, Packet*)
+{
+ PROFILE_VARS;
+ MODULE_PROFILE_START(pkt_num_perf_stats);
+
+ int rval;
+
+ if ( config.eval(pc.total_from_daq) )
+ rval = DETECTION_OPTION_MATCH;
+
+ else
+ rval = DETECTION_OPTION_NO_MATCH;
+
+ MODULE_PROFILE_END(pkt_num_perf_stats);
+ return rval;
+}
+
+//-------------------------------------------------------------------------
+// module
+//-------------------------------------------------------------------------
+
+static const Parameter s_params[] =
+{
+ { "~range", Parameter::PT_STRING, nullptr, nullptr,
+ "check if packet number is in given range" },
+
+ { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
+};
+
+class PktNumModule : public Module
+{
+public:
+ PktNumModule() : Module(s_name, s_help, s_params) { }
+
+ bool begin(const char*, int, SnortConfig*) override;
+ bool set(const char*, Value&, SnortConfig*) override;
+
+ ProfileStats* get_profile() const override
+ { return &pkt_num_perf_stats; }
+
+ RangeCheck data;
+};
+
+bool PktNumModule::begin(const char*, int, SnortConfig*)
+{
+ data.init();
+ return true;
+}
+
+bool PktNumModule::set(const char*, Value& v, SnortConfig*)
+{
+ if ( !v.is("~range") )
+ return false;
+
+ return data.parse(v.get_string());
+}
+
+//-------------------------------------------------------------------------
+// api methods
+//-------------------------------------------------------------------------
+
+static Module* mod_ctor()
+{
+ return new PktNumModule;
+}
+
+static void mod_dtor(Module* m)
+{
+ delete m;
+}
+
+static IpsOption* pkt_num_ctor(Module* p, OptTreeNode*)
+{
+ PktNumModule* m = (PktNumModule*)p;
+ return new PktNumOption(m->data);
+}
+
+static void pkt_num_dtor(IpsOption* p)
+{
+ delete p;
+}
+
+static const IpsApi pkt_num_api =
+{
+ {
+ PT_IPS_OPTION,
+ sizeof(IpsApi),
+ IPSAPI_VERSION,
+ 0,
+ API_RESERVED,
+ API_OPTIONS,
+ s_name,
+ s_help,
+ mod_ctor,
+ mod_dtor
+ },
+ OPT_TYPE_DETECTION,
+ 1, PROTO_BIT__TCP,
+ nullptr, // pinit
+ nullptr, // pterm
+ nullptr, // tinit
+ nullptr, // tterm
+ pkt_num_ctor,
+ pkt_num_dtor,
+ nullptr
+};
+
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &pkt_num_api.base,
+ nullptr
+};
+
c = config.max;
mix_str(a,b,c,get_name());
- final(a,b,c);
+ finalize(a,b,c);
return c;
}
add_example_library(alert_ex loggers alert_ex.cc)
+add_example_library(alert_unixsock loggers alert_unixsock.cc)
+add_example_library(log_null loggers log_null.cc)
install (
FILES alert.lua
libalert_ex_la_LDFLAGS = -export-dynamic -shared
libalert_ex_la_SOURCES = alert_ex.cc
+loglib_LTLIBRARIES += libalert_unixsock.la
+libalert_unixsock_la_CXXFLAGS = $(AM_CXXFLAGS)
+libalert_unixsock_la_LDFLAGS = -export-dynamic -shared
+libalert_unixsock_la_SOURCES = alert_unixsock.cc
+
+loglib_LTLIBRARIES += liblog_null.la
+liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS)
+liblog_null_la_LDFLAGS = -export-dynamic -shared
+liblog_null_la_SOURCES = log_null.cc
+
dist_loglib_SCRIPTS = alert.lua
AM_CXXFLAGS = @AM_CXXFLAGS@
#include "main/snort_debug.h"
#include "framework/logger.h"
#include "framework/module.h"
+#include "detection/signature.h"
#include "events/event.h"
#include "protocols/packet.h"
-#include "parser/parser.h"
#include "utils/util.h"
-#include "packet_io/sfdaq.h"
#define UNSOCK_FILE "snort_alert"
if (p && p->pkt)
{
- uint32_t snaplen = DAQ_GetSnapLen();
- memmove( (void*)&us.alert.pkth, (const void*)p->pkth,
- sizeof(us.alert.pkth));
- memmove(us.alert.pkt, (const void*)p->pkt,
- us.alert.pkth.caplen > snaplen ? snaplen : us.alert.pkth.caplen);
+ memmove( (void*)&us.alert.pkth, (const void*)p->pkth, sizeof(us.alert.pkth));
+ memmove(us.alert.pkt, (const void*)p->pkt, us.alert.pkth.caplen);
}
else
- us.alert.val|=NOPACKET_STRUCT;
+ us.alert.val |= NOPACKET_STRUCT;
if (msg)
{
unix_sock_dtor
};
-#ifdef BUILDING_SO
SO_PUBLIC const BaseApi* snort_plugins[] =
{
&unix_sock_api.base,
nullptr
};
-#else
-const BaseApi* alert_unix_sock = &unix_sock_api.base;
-#endif
#include "framework/module.h"
#define s_name "log_null"
-#define s_help "support for null encapsulation"
+#define s_help "disable logging of packets"
//-------------------------------------------------------------------------
// log_null module
null_dtor
};
-#ifdef BUILDING_SO
SO_PUBLIC const BaseApi* snort_plugins[] =
{
&null_api.base,
nullptr
};
-#else
-const BaseApi* log_null = &null_api.base;
-#endif
liblowmem_la_SOURCES = \
lowmem.cc \
lowmem_q.cc \
-pat_stats.cc \
sfksearch.cc \
sfksearch.h \
trie_api.cc
{ return true; }
virtual bool set(const char*, Value&, SnortConfig*)
- { return !get_parameters(); }
+ { return false; }
// ips events:
virtual unsigned get_gid() const
void ErrorMessageThrottled(ThrottleInfo*,const char*, ...) __attribute__((format (printf, 2, 3)));
// FIXIT-M do not call FatalError() during runtime
-NORETURN void FatalError(const char*, ...) __attribute__((format (printf, 1, 2)));
+SO_PUBLIC NORETURN void FatalError(const char*, ...) __attribute__((format (printf, 1, 2)));
SO_PUBLIC void PrintPacketData(const uint8_t*, const uint32_t);
SO_PUBLIC char* ObfuscateIpToText(const sfip_t*);
alert_fast.cc
alert_full.cc
alert_syslog.cc
- alert_unixsock.cc
log_hext.cc
- log_null.cc
log_pcap.cc
unified2.cc
unified2_common.h
add_shared_library(alert_fast loggers alert_fast.cc)
add_shared_library(alert_full loggers alert_full.cc)
add_shared_library(alert_syslog loggers alert_syslog.cc)
- add_shared_library(alert_unixsock loggers alert_unixsock.cc)
add_shared_library(log_hext loggers log_hext.cc)
- add_shared_library(log_null loggers log_null.cc)
add_shared_library(log_pcap loggers log_pcap.cc)
add_shared_library(unified2 loggers unified2.cc unified2_common.h)
alert_fast.cc \
alert_full.cc \
alert_syslog.cc \
-alert_unixsock.cc \
log_hext.cc \
-log_null.cc \
log_pcap.cc \
unified2.cc \
unified2_common.h
libalert_syslog_la_LDFLAGS = -export-dynamic -shared
libalert_syslog_la_SOURCES = alert_syslog.cc
-ehlib_LTLIBRARIES += libalert_unixsock.la
-libalert_unixsock_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-libalert_unixsock_la_LDFLAGS = -export-dynamic -shared
-libalert_unixsock_la_SOURCES = alert_unixsock.cc
-
ehlib_LTLIBRARIES += liblog_hext.la
liblog_hext_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
liblog_hext_la_LDFLAGS = -export-dynamic -shared
liblog_hext_la_SOURCES = log_hext.cc
-ehlib_LTLIBRARIES += liblog_null.la
-liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-liblog_null_la_LDFLAGS = -export-dynamic -shared
-liblog_null_la_SOURCES = log_null.cc
-
ehlib_LTLIBRARIES += liblog_pcap.la
liblog_pcap_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
liblog_pcap_la_LDFLAGS = -export-dynamic -shared
extern const BaseApi* alert_fast;
extern const BaseApi* alert_full;
extern const BaseApi* alert_syslog;
-extern const BaseApi* alert_unix_sock;
extern const BaseApi* log_hext;
-extern const BaseApi* log_null;
extern const BaseApi* log_pcap;
extern const BaseApi* eh_unified2;
#endif
const BaseApi* loggers[] =
{
+ // loggers
+ log_codecs,
+
#ifdef LINUX
alert_sf_socket,
#endif
alert_fast,
alert_full,
alert_syslog,
- alert_unix_sock,
+
// loggers
log_hext,
- log_null,
log_pcap,
// both
eh_unified2,
#endif
- // loggers
- log_codecs,
- // both
+
nullptr
};
#include "control/idle_processing.h"
#include "target_based/sftarget_reader.h"
#include "flow/flow_control.h"
+#include "lua/lua.h"
#include "helpers/process.h"
#include "helpers/swapper.h"
#include "time/profiler.h"
// //
//-----------------------------------------------//
-#define BUILD "172"
+#define BUILD "173"
#endif
Active::term();
}
-void Snort::decode_rebuilt_packet(
- Packet* p, const DAQ_PktHdr_t* pkthdr, const uint8_t* pkt,
- Flow* lws)
-{
- SnortEventqPush();
- PacketManager::decode(p, pkthdr, pkt, true);
-
- p->flow = lws;
-
- set_policy(p); // FIXIT-M rebuilt should reuse original bindings from flow
-
- SnortEventqReset();
- SnortEventqPop();
-}
-
void Snort::detect_rebuilt_packet(Packet* p)
{
int tmp_do_detect = do_detect;
static void thread_rotate();
static void capture_packet();
- static void decode_rebuilt_packet(Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt, Flow*);
static void detect_rebuilt_packet(Packet*);
static DAQ_Verdict process_packet(
if ( !flow->service )
::execute(p, fp->network.vec, fp->network.num);
- else if ( flow->clouseau )
+ else if ( flow->clouseau and !p->is_cooked() )
bumble(p);
if ( !p->dsize )
extern THREAD_LOCAL PatMatQStat pmqs;
-void print_pat_stats(const char*, unsigned max);
+SO_PUBLIC void print_pat_stats(const char*, unsigned max);
#endif
public:
RpcDecodeModule();
- bool set(const char*, Value&, SnortConfig*) override
- { return false; }
-
unsigned get_gid() const override
{ return GID_RPC_DECODE; }
wizard->rem_ref();
}
+// FIXIT-M stop search on hit and failure (no possible match)
StreamSplitter::Status MagicSplitter::scan(
Flow* f, const uint8_t* data, uint32_t len,
uint32_t, uint32_t*)
void TcpSession::restart(Packet* p)
{
+ // sanity check since this is called externally
+ assert(p->ptrs.tcph);
+
TcpTracker* talker, *listener;
if (p->packet_flags & PKT_FROM_SERVER)
projects / thirdparty / snort3.git / commitdiff
