updated help

diff --git a/ChangeLog b/ChangeLog
index d1928a1047efe4a77581854be25b1d9bc947cb43..e45a9162bbbd8c8df7fe77b0b8ef36608e5e00ff 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+109
+-- changed --help to give overview of help
+-- fixed stream_ip alerts (defrag -> stream_ip)
+
 108
 -- added IpsAction for ips rule action plugins
 -- renamed various api *init() and *term() for consistency and possible

diff --git a/src/parser/cmd_line.cc b/src/parser/cmd_line.cc
index af9a6d34dd58f51d8edd1a8be931831dfedb47f0..df6a00ab264d06676774ac9e66109fbef8a6e12e 100644 (file)
--- a/src/parser/cmd_line.cc
+++ b/src/parser/cmd_line.cc
@@ -69,8 +69,40 @@ static char* snort_conf_dir = nullptr;
 const char* get_snort_conf() { return lua_conf; }
 const char* get_snort_conf_dir() { return snort_conf_dir; }
 
-static void show_usage(const char* program_name);
-static void show_options(const char* pfx);
+static void help_args(const char* pfx);
+
+static const char* snort_help =
+"Snort has several options to get more help:\n"
+"\n"
+"--help this overview of help\n"
+"--help-builtin <module prefix> output matching builtin rules\n"
+"--help-buffers output available inspection buffers\n"
+"--help-commands <module prefix> output matching commands\n"
+"--help-config <module prefix> output matching config options\n"
+"--help-gids <module prefix> output matching generators\n"
+"--help-module output description of given module\n"
+"--help-options <option prefix> output matching command line option quick help\n"
+"--help-signals dump available control signals\n"
+"--list-modules list all known modules\n"
+"--list-plugins list all known modules\n"
+"--markup output help in asciidoc compatible format\n"
+"\n"
+"--help* and --list* options preempt other processing so should be last on the\n"
+"command line since any following options are ignored.  To ensure options like\n"
+"--plugin-path take effect, place them ahead of the help or list options.\n"
+"\n"
+"Options that filter output based on a matching prefix, such as --help-config\n"
+"won't output anything if there is no match.  If no prefix is given, everything\n"
+"matches.\n"
+"\n"
+"Parameters are given with this format:\n"
+"\n"
+"    type name = default: help { range }\n"
+"\n"
+"If a name starts with * it is positional; these are used in IPS rule options.\n"
+"The name should not be included in the rule.  If the name ends with [] it is a\n"
+"list item and can be repeated.\n"
+;
 
 //-------------------------------------------------------------------------
 // private methods
@@ -238,20 +270,28 @@ static void config_daemon_restart(SnortConfig* sc, const char* val)
     config_daemon(sc, val);
 }
 
-static void config_usage(SnortConfig*, const char* val)
+//-------------------------------------------------------------------------
+
+static void help_basic(SnortConfig*, const char*)
+{
+    fprintf(stdout, "Snort help: %s", snort_help);
+    exit(0);
+}
+
+static void help_usage(SnortConfig*, const char* val)
 {
-    show_usage("snort");
-    show_options(val);
+    fprintf(stdout, "USAGE: %s [-options] <filter options>\n", "snort");
+    help_args(val);
     exit(1);
 }
 
-static void config_help_options(SnortConfig*, const char* val)
+static void help_options(SnortConfig*, const char* val)
 {
-    show_options(val);
+    help_args(val);
     exit(0);
 }
 
-static void config_help_signals(SnortConfig*, const char*)
+static void help_signals(SnortConfig*, const char*)
 {
     help_signals();
     exit(0);
@@ -300,12 +340,12 @@ static void show_help(SnortConfig* sc, const char* val, HelpType ht)
     exit(0);
 }
 
-static void config_help(SnortConfig* sc, const char* val)
+static void help_config(SnortConfig* sc, const char* val)
 {
     show_help(sc, val, HT_CFG);
 }
 
-static void config_help_commands(SnortConfig* sc, const char* val)
+static void help_commands(SnortConfig* sc, const char* val)
 {
     show_help(sc, val, HT_CMD);
 }
@@ -315,32 +355,32 @@ static void config_markup(SnortConfig*, const char*)
     Markup::enable();
 }
 
-static void config_help_gids(SnortConfig* sc, const char* val)
+static void help_gids(SnortConfig* sc, const char* val)
 {
     show_help(sc, val, HT_GID);
 }
 
-static void config_help_buffers(SnortConfig* sc, const char* val)
+static void help_buffers(SnortConfig* sc, const char* val)
 {
     show_help(sc, val, HT_BUF);
 }
 
-static void config_help_builtin(SnortConfig* sc, const char* val)
+static void help_builtin(SnortConfig* sc, const char* val)
 {
     show_help(sc, val, HT_IPS);
 }
 
-static void config_help_module(SnortConfig* sc, const char* val)
+static void help_module(SnortConfig* sc, const char* val)
 {
     show_help(sc, val, HT_MOD);
 }
 
-static void config_list_modules(SnortConfig* sc, const char* val)
+static void list_modules(SnortConfig* sc, const char* val)
 {
     show_help(sc, val, HT_LST);
 }
 
-static void config_list_plugins(SnortConfig* sc, const char* val)
+static void list_plugins(SnortConfig* sc, const char* val)
 {
     show_help(sc, val, HT_PLG);
 }
@@ -633,7 +673,7 @@ static ConfigFunc spec_opts[] =
 
     // stuff we do now because we are going to quit anyway
     { "W", config_show_interfaces, "" },
-    { "?", config_usage, "" },
+    { "?", help_usage, "" },
 
     { nullptr, nullptr, nullptr }
 };
@@ -795,37 +835,37 @@ static ConfigFunc basic_opts[] =
     { "enable-inline-test", config_inline_test,
       "enable Inline-Test Mode Operation" },
 
-    { "help", config_help_options,
-      "<option prefix> output matching command line option quick help" },
+    { "help", help_basic,
+      "overview of help" },
 
-    { "help-builtin", config_help_builtin,
+    { "help-builtin", help_builtin,
       "<module prefix> output matching builtin rules" },
 
-    { "help-buffers", config_help_buffers,
+    { "help-buffers", help_buffers,
       "output available inspection buffers" },
 
-    { "help-commands", config_help_commands,
+    { "help-commands", help_commands,
       "<module prefix> output matching commands" },
 
-    { "help-config", config_help,
+    { "help-config", help_config,
       "<module prefix> output matching config options" },
 
-    { "help-gids", config_help_gids,
+    { "help-gids", help_gids,
       "<module prefix> output matching generators" },
 
-    { "help-module", config_help_module,
+    { "help-module", help_module,
       "output description of given module" },
 
-    { "help-options", config_help_options,
-      "<option prefix> (same as --help)" },
+    { "help-options", help_options,
+      "<option prefix> output matching command line option quick help" },
 
-    { "help-signals", config_help_signals,
+    { "help-signals", help_signals,
       "dump available control signals" },
 
-    { "list-modules", config_list_modules,
+    { "list-modules", list_modules,
       "list all known modules" },
 
-    { "list-plugins", config_list_plugins,
+    { "list-plugins", list_plugins,
       "list all known modules" },
 
     { "lua", config_lua,
@@ -913,6 +953,29 @@ static ConfigFunc basic_opts[] =
     { nullptr, nullptr, nullptr }
 };
 
+static void help_args(const char* pfx)
+{
+    ConfigFunc* p = basic_opts;
+    unsigned n = pfx ? strlen(pfx) : 0;
+
+    while ( p->name )
+    {
+        if ( p->help && (!n || !strncasecmp(p->name, pfx, n)) )
+        {
+            cout << Markup::item();
+            cout << Markup::emphasis_on();
+
+            const char* prefix = strlen(p->name) > 1 ? "--" : "-";
+            cout << prefix << p->name;
+            cout << Markup::emphasis_off();
+
+            cout << " " << p->help;
+            cout << endl;
+        }
+        ++p;
+    }
+}
+
 static void check_flags(SnortConfig* sc)
 {
     if ((sc->run_flags & RUN_FLAG__TEST) &&
@@ -986,36 +1049,6 @@ SnortConfig* ParseCmdLine(int argc, char* argv[])
 
 //-------------------------------------------------------------------------
 
-static void show_options(const char* pfx)
-{
-    ConfigFunc* p = basic_opts;
-    unsigned n = pfx ? strlen(pfx) : 0;
-
-    while ( p->name )
-    {
-        if ( p->help && (!n || !strncasecmp(p->name, pfx, n)) )
-        {
-            cout << Markup::item();
-            cout << Markup::emphasis_on();
-
-            const char* prefix = strlen(p->name) > 1 ? "--" : "-";
-            cout << prefix << p->name;
-            cout << Markup::emphasis_off();
-
-            cout << " " << p->help;
-            cout << endl;
-        }
-        ++p;
-    }
-}
-
-static void show_usage(const char *program_name)
-{
-    fprintf(stdout, "USAGE: %s [-options] <filter options>\n", program_name);
-}
-
-//-------------------------------------------------------------------------
-
 void set_daemon_args(int argc, char* argv[])
 {
     for ( int i = 1; i < argc; ++i )

diff --git a/src/stream/ip/ip_module.cc b/src/stream/ip/ip_module.cc
index a9778ab9b1c52a6d940d552e4411b8c43c22da3f..3ccc301c1b1b8d7689f66e38dda64b5dda6a1070 100644 (file)
--- a/src/stream/ip/ip_module.cc
+++ b/src/stream/ip/ip_module.cc
@@ -30,45 +30,45 @@ using namespace std;
 #include "stream/stream.h"
 
 #define DEFRAG_IPOPTIONS_STR \
-    "(defrag) Inconsistent IP Options on Fragmented Packets"
+    "(stream_ip) Inconsistent IP Options on Fragmented Packets"
 
 #define DEFRAG_TEARDROP_STR \
-    "(defrag) Teardrop attack"
+    "(stream_ip) Teardrop attack"
 
 #define DEFRAG_SHORT_FRAG_STR \
-    "(defrag) Short fragment, possible DoS attempt"
+    "(stream_ip) Short fragment, possible DoS attempt"
 
 #define DEFRAG_ANOMALY_OVERSIZE_STR \
-    "(defrag) Fragment packet ends after defragmented packet"
+    "(stream_ip) Fragment packet ends after defragmented packet"
 
 #define DEFRAG_ANOMALY_ZERO_STR \
-    "(defrag) Zero-byte fragment packet"
+    "(stream_ip) Zero-byte fragment packet"
 
 #define DEFRAG_ANOMALY_BADSIZE_SM_STR \
-    "(defrag) Bad fragment size, packet size is negative"
+    "(stream_ip) Bad fragment size, packet size is negative"
 
 #define DEFRAG_ANOMALY_BADSIZE_LG_STR \
-    "(defrag) Bad fragment size, packet size is greater than 65536"
+    "(stream_ip) Bad fragment size, packet size is greater than 65536"
 
 #define DEFRAG_ANOMALY_OVLP_STR \
-    "(defrag) Fragmentation overlap"
+    "(stream_ip) Fragmentation overlap"
 
 #if 0  // OBE
 #define DEFRAG_IPV6_BSD_ICMP_FRAG_STR
-    "(defrag) IPv6 BSD mbufs remote kernel buffer overflow"
+    "(stream_ip) IPv6 BSD mbufs remote kernel buffer overflow"
 
 #define DEFRAG_IPV6_BAD_FRAG_PKT_STR
-    "(defrag) Bogus fragmentation packet. Possible BSD attack"
+    "(stream_ip) Bogus fragmentation packet. Possible BSD attack"
 #endif
 
 #define DEFRAG_MIN_TTL_EVASION_STR \
-    "(defrag) TTL value less than configured minimum, not using for reassembly"
+    "(stream_ip) TTL value less than configured minimum, not using for reassembly"
 
 #define DEFRAG_EXCESSIVE_OVERLAP_STR \
-    "(defrag) Excessive fragment overlap"
+    "(stream_ip) Excessive fragment overlap"
 
 #define DEFRAG_TINY_FRAGMENT_STR \
-    "(defrag) Tiny fragment"
+    "(stream_ip) Tiny fragment"
 
 FragEngine::FragEngine()
 { memset(this, 0, sizeof(*this)); }