fix plain file processing

update location of dnet
fix breakloop in file daq
update usage and bug list
move hext logger from extra to main source tree
fix detection of stream_user and stream_file data

diff --git a/configure.ac b/configure.ac
index 9f021ef75831e3426276eb260396ed4bcc8bed43..6ba2705d7e9a2b8c4d0a8bd956a247fb820eb11d 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -696,7 +696,7 @@ AC_CHECK_HEADERS(dumbnet.h,,DUMBNET_H="no")
 if test "x$DNET_H" = "xno" -a "x$DUMBNET_H" = "xno"; then
     echo
     echo "   ERROR:  dnet header not found, go get it from"
-    echo "   http://code.google.com/p/libdnet/ or use the --with-dnet-*"
+    echo "   https://github.com/dugsong/libdnet.git or use the --with-dnet-*"
     echo "   options, if you have it installed in an unusual place"
     exit
 fi

diff --git a/daqs/daq_file.c b/daqs/daq_file.c
index 1b5730fd212ef6f6e41963062d5e505e35458e80..c39778302b47b17c4a4defe9a7ac0b83e40b04d9 100644 (file)
--- a/daqs/daq_file.c
+++ b/daqs/daq_file.c
@@ -273,7 +273,7 @@ static int file_daq_acquire (
     int hit = 0, miss = 0;
     impl->stop = 0;
 
-    while ( hit < cnt || cnt <= 0 )
+    while ( (hit < cnt || cnt <= 0) && !impl->stop )
     {
         int status = file_daq_process(impl, callback, user);
 
@@ -285,7 +285,7 @@ static int file_daq_acquire (
         else if ( status < 0 )
             return status;
 
-        else if ( ++miss == 2 || impl->stop )
+        else if ( ++miss == 2 )
             break;
     }
     return DAQ_SUCCESS;

diff --git a/doc/bugs.txt b/doc/bugs.txt
index d55baabe6c9b9f5fa430cfb6526e7d04889727eb..c231370a3d1c807ecfe5d198c16af3bd04e32a8f 100644 (file)
--- a/doc/bugs.txt
+++ b/doc/bugs.txt
@@ -34,8 +34,11 @@ saves the correct version.
 
     ERROR: invalid perf_monitor.max_file_size = 4.29497e+09
 
-* Using -L when -c is also used will not actually log; nor will it warn or
-  error out.  This is likely to confuse.
+* When using -c and -L together, the last on the command line wins (-c -L
+  will dump; -L -c will analyze).
+
+* Modules instantiated by command line only will not get default settings
+  unless hard-coded.  This notably applies to -A and -L options.
 
 
 ==== Rules

diff --git a/doc/start.txt b/doc/start.txt
index b0b3a28c594cc8bcaafa6cd69d510ad900d84420..a57431172643b6fc1dfef39c42967e6e60a453c7 100644 (file)
--- a/doc/start.txt
+++ b/doc/start.txt
@@ -11,7 +11,7 @@ Required:
 
 * daq from http://www.snort.org for packet IO
 
-* dnet from http://code.google.com/p/libdnet/ for network utility functions
+* dnet from https://github.com/dugsong/libdnet.git for network utility functions
 
 * LuaJIT from http://luajit.org for configuration and scripting
 

diff --git a/doc/usage.txt b/doc/usage.txt
index 04cd1366dc20621f8296babfe17afe1a4b69c7c2..ea788d61f7d51f5d9048aa8da3968c0bd4a5c827 100644 (file)
--- a/doc/usage.txt
+++ b/doc/usage.txt
@@ -181,8 +181,7 @@ default to stdout.  These options can be combined.
 Process hext packets from stdin:
 
     snort -c $my_path/etc/snort/snort.lua \
-        --plugin-path $my_path/lib/snort_extra \
-        --daq-dir $my_path/lib/snort_extra/daqs --daq hext -i tty << END
+        --daq-dir $my_path/lib/snort/daqs --daq hext -i tty << END
     $packet 10.1.2.3 48620 -> 10.9.8.7 80
     "GET / HTTP/1.1\r\n"
     "Host: localhost\r\n"
@@ -192,30 +191,27 @@ Process hext packets from stdin:
 Process raw ethernet from hext file:
 
     snort -c $my_path/etc/snort/snort.lua \
-        --plugin-path $my_path/lib/snort_extra \
-        --daq-dir $my_path/lib/snort_extra/daqs --daq hext \
+        --daq-dir $my_path/lib/snort/daqs --daq hext \
         --daq-var dlt=1 -r <hext-file>
 
-Process a directory of plain files (ie non-pcap) with 4 threads:
+Process a directory of plain files (ie non-pcap) with 4 threads with 8K
+buffers:
 
     snort -c $my_path/etc/snort/snort.lua \
-        --plugin-path $my_path/lib/snort_extra \
-        --daq-dir $my_path/lib/snort_extra/daqs --daq file \
-        --pcap-dir path/to/files -z 4
+        --daq-dir $my_path/lib/snort/daqs --daq file \
+        --pcap-dir path/to/files -z 4 -s 8192
 
 Bridge two TCP connections on port 8000 and inspect the traffic:
 
     snort -c $my_path/etc/snort/snort.lua \
-        --plugin-path $my_path/lib/snort_extra \
-        --daq-dir $my_path/lib/snort_extra/daqs --daq socket
+        --daq-dir $my_path/lib/snort/daqs --daq socket
 
 
 ==== Logger Alternatives
 
 Dump TCP stream payload in hext mode:
 
-    snort -c $my_path/etc/snort/snort.lua \
-        --plugin-path $my_path/lib/snort_extra -L hext
+    snort -c $my_path/etc/snort/snort.lua -L hext
     
 Output timestamp, pkt_num, proto, pkt_gen, dgm_len, dir, src_ap, dst_ap,
 rule, action for each alert:

diff --git a/extra/src/loggers/CMakeLists.txt b/extra/src/loggers/CMakeLists.txt
index fe217875f100c44eafa041ed09fc7faf2c3e53be..bbe03776585043b0ded9910b37297ae3757a489a 100644 (file)
--- a/extra/src/loggers/CMakeLists.txt
+++ b/extra/src/loggers/CMakeLists.txt
@@ -1,6 +1,5 @@
 
 add_example_library(alert_ex loggers alert_ex.cc)
-add_example_library(log_hext loggers log_hext.cc)
 
 install (
     FILES alert.lua

diff --git a/extra/src/loggers/Makefile.am b/extra/src/loggers/Makefile.am
index 4f7de2c40490a0ad7639b790108891ca826dd637..0f3e46f1e96e22a4685c75b3a75041bdfdc9a091 100644 (file)
--- a/extra/src/loggers/Makefile.am
+++ b/extra/src/loggers/Makefile.am
@@ -6,11 +6,6 @@ libalert_ex_la_CXXFLAGS = $(AM_CXXFLAGS)
 libalert_ex_la_LDFLAGS = -export-dynamic -shared
 libalert_ex_la_SOURCES = alert_ex.cc
 
-loglib_LTLIBRARIES += liblog_hext.la
-liblog_hext_la_CXXFLAGS = $(AM_CXXFLAGS)
-liblog_hext_la_LDFLAGS = -export-dynamic -shared
-liblog_hext_la_SOURCES = log_hext.cc
-
 dist_loglib_SCRIPTS = alert.lua
 
 AM_CXXFLAGS = @AM_CXXFLAGS@

diff --git a/src/detection/fp_create.cc b/src/detection/fp_create.cc
index 83a24208fd500afa7b11b21fca7bdf562dd349c0..68af955851a669249fd049ee2d4a5cbcfe10a3a3 100644 (file)
--- a/src/detection/fp_create.cc
+++ b/src/detection/fp_create.cc
@@ -1864,9 +1864,10 @@ int fpCreateFastPacketDetection(SnortConfig* sc)
     fp_print_service_groups(sc->spgmmTable);
 
     if ( mpse_count )
+    {
         LogLabel("search engine");
-
-    MpseManager::print_mpse_summary(fp->get_search_api());
+        MpseManager::print_mpse_summary(fp->get_search_api());
+    }
 
     if ( fp->get_num_patterns_truncated() )
         LogMessage("%25.25s: %-12u\n", "truncated patterns", fp->get_num_patterns_truncated());

diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc
index dc3c70aa1ca105eeb71515f72a1474a661548f92..51a1012f018532745444c9f02f0305151d0e675d 100644 (file)
--- a/src/detection/fp_detect.cc
+++ b/src/detection/fp_detect.cc
@@ -1304,7 +1304,7 @@ int fpEvalPacket(Packet* p)
         break;
 
     case PktType::FILE:
-        fpEvalHeaderSvc(p, omd, SNORT_PROTO_FILE);
+        fpEvalHeaderSvc(p, omd, SNORT_PROTO_USER);
         break;
 
     default:

diff --git a/src/loggers/CMakeLists.txt b/src/loggers/CMakeLists.txt
index a6a281fe6628f81a41b5b905ac9d93694160c4ae..e26616769c0e6781238e1691dd049c7dfc7d68c0 100644 (file)
--- a/src/loggers/CMakeLists.txt
+++ b/src/loggers/CMakeLists.txt
@@ -12,6 +12,7 @@ set (PLUGIN_LIST
     alert_full.cc
     alert_syslog.cc
     alert_unixsock.cc
+    log_hext.cc
     log_null.cc
     log_pcap.cc
     unified2.cc
@@ -44,6 +45,7 @@ else (STATIC_LOGGERS)
     add_shared_library(alert_full loggers alert_full.cc)
     add_shared_library(alert_syslog loggers alert_syslog.cc)
     add_shared_library(alert_unixsock loggers alert_unixsock.cc)
+    add_shared_library(log_hext loggers log_hext.cc)
     add_shared_library(log_null loggers log_null.cc)
     add_shared_library(log_pcap loggers log_pcap.cc)
     add_shared_library(unified2 loggers unified2.cc unified2_common.h)

diff --git a/src/loggers/Makefile.am b/src/loggers/Makefile.am
index 5a52ef231eb34b45b0842b7f4ced46ed8408d367..2e4ac58b3b57ee1b60ff60620adedb7bfcbf15ca 100644 (file)
--- a/src/loggers/Makefile.am
+++ b/src/loggers/Makefile.am
@@ -12,6 +12,7 @@ alert_fast.cc \
 alert_full.cc \
 alert_syslog.cc \
 alert_unixsock.cc \
+log_hext.cc \
 log_null.cc \
 log_pcap.cc \
 unified2.cc \
@@ -52,6 +53,11 @@ libalert_unixsock_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
 libalert_unixsock_la_LDFLAGS = -export-dynamic -shared
 libalert_unixsock_la_SOURCES = alert_unixsock.cc
 
+ehlib_LTLIBRARIES += liblog_hext.la
+liblog_hext_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+liblog_hext_la_LDFLAGS = -export-dynamic -shared
+liblog_hext_la_SOURCES = log_hext.cc
+
 ehlib_LTLIBRARIES += liblog_null.la
 liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
 liblog_null_la_LDFLAGS = -export-dynamic -shared

diff --git a/extra/src/loggers/log_hext.cc b/src/loggers/log_hext.cc
similarity index 98%
rename from extra/src/loggers/log_hext.cc
rename to src/loggers/log_hext.cc
index b35eb4eace25187a646b59ce030a5019d84aa07c..c1cd6322e997fc7264f5c23910fe20d18b7c4166 100644 (file)
--- a/extra/src/loggers/log_hext.cc
+++ b/src/loggers/log_hext.cc
@@ -172,7 +172,7 @@ bool HextModule::begin(const char*, int, SnortConfig*)
     raw = false;
     limit = 0;
     units = 0;
-    width = 0;
+    width = 20;
     return true;
 }
 
@@ -276,9 +276,13 @@ static const LogApi hext_api =
     hext_dtor
 };
 
+#ifdef BUILDING_SO
 SO_PUBLIC const BaseApi* snort_plugins[] =
 {
     &hext_api.base,
     nullptr
 };
+#else
+const BaseApi* log_hext = &hext_api.base;
+#endif
 

diff --git a/src/loggers/loggers.cc b/src/loggers/loggers.cc
index df6ffd939877ffd6776b9630042840d03dc5e57f..cf50d1d0c04061273e1d6e88efe28c710f3187ad 100644 (file)
--- a/src/loggers/loggers.cc
+++ b/src/loggers/loggers.cc
@@ -38,6 +38,7 @@ extern const BaseApi* alert_fast;
 extern const BaseApi* alert_full;
 extern const BaseApi* alert_syslog;
 extern const BaseApi* alert_unix_sock;
+extern const BaseApi* log_hext;
 extern const BaseApi* log_null;
 extern const BaseApi* log_pcap;
 extern const BaseApi* eh_unified2;
@@ -57,6 +58,7 @@ const BaseApi* loggers[] =
     alert_syslog,
     alert_unix_sock,
     // loggers
+    log_hext,
     log_null,
     log_pcap,
 

diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc
index d173b19f0a2a874b980a599711fa35de0b73c939..f71bf25070e195939d10b9d3f3858729516dd7ef 100644 (file)
--- a/src/protocols/packet.cc
+++ b/src/protocols/packet.cc
@@ -137,6 +137,9 @@ const char* Packet::get_pseudo_type() const
     case PSEUDO_PKT_TCP:
         return "stream_tcp";
 
+    case PSEUDO_PKT_USER:
+        return "stream_user";
+
     case PSEUDO_PKT_DCE_RPKT:
         return "dce2_rpc_reass";
 

diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 87c21d8138bc211b685b4f2ec3b0aac80ae02297..d6efc1f5b7a5b96f99c5ce5f1393aa55f3dfe4e2 100644 (file)
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -99,6 +99,7 @@ enum PseudoPacketType
 {
     PSEUDO_PKT_IP,
     PSEUDO_PKT_TCP,
+    PSEUDO_PKT_USER,
     PSEUDO_PKT_DCE_RPKT,
     PSEUDO_PKT_DCE_SEG,
     PSEUDO_PKT_DCE_FRAG,

diff --git a/src/stream/file/file_session.cc b/src/stream/file/file_session.cc
index b0926b7973b299fbbf8d91de87d7c73d739be955..d5df7acb436c4bcac348d4d07ba36f4affa3a4a6 100644 (file)
--- a/src/stream/file/file_session.cc
+++ b/src/stream/file/file_session.cc
@@ -28,6 +28,7 @@
 #include "time/profiler.h"
 #include "packet_io/sfdaq.h"
 #include "detection/detection_util.h"
+#include "target_based/snort_protocols.h"
 
 #include "stream_file.h"
 #include "file_module.h"
@@ -73,6 +74,7 @@ int FileSession::process(Packet* p)
     PROFILE_VARS;
     MODULE_PROFILE_START(file_ssn_stats);
 
+    p->flow->ssn_state.application_protocol = SNORT_PROTO_USER;
     StreamFileConfig* c = get_file_cfg(p->flow->ssn_server);
     file_api->file_process(p->flow, (uint8_t*)p->data, p->dsize, position(p), c->upload, false);
     set_file_data((uint8_t*)p->data, p->dsize);

diff --git a/src/stream/user/user_session.cc b/src/stream/user/user_session.cc
index acb0113b56c59343a12904b6d3871fe7a2189a18..df44b295688d85e74be660c2f7bcbde182fceace 100644 (file)
--- a/src/stream/user/user_session.cc
+++ b/src/stream/user/user_session.cc
@@ -151,8 +151,9 @@ void UserTracker::detect(const Packet* p, const StreamBuffer* sb, uint32_t flags
 
     up.proto_bits = p->proto_bits;
     up.application_protocol_ordinal = p->application_protocol_ordinal;
+    up.pseudo_type = PSEUDO_PKT_USER;
 
-    up.packet_flags = flags | PKT_REBUILT_STREAM;
+    up.packet_flags = flags | PKT_REBUILT_STREAM | PKT_PSEUDO;
     up.packet_flags |= (p->packet_flags & (PKT_FROM_CLIENT|PKT_FROM_SERVER));
     up.packet_flags |= (p->packet_flags & (PKT_STREAM_EST|PKT_STREAM_UNEST_UNI));