-- tweaked main loop
-- added module 1-line help
-- latest from josh
+-- added plugin 1-line help (should be same as module, if plugin has module)
117
-- added --stdin-rules
// yes, macros are necessary. The API and class constructor require different strings.
#define CD_PIM_NAME "pim"
+#define CD_PIM_HELP "support for protocol independent multicast"
class PimCodec : public Codec
{
{
PT_CODEC,
CD_PIM_NAME,
+ CD_PIM_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
{
PT_CODEC,
TR_NAME,
+ TR_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_INSPECTOR,
s_name,
+ s_help,
INSAPI_PLUGIN_V0,
0,
nullptr,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_SEARCH_ENGINE,
"lowmem",
+ "Keyword Trie (low memory, moderate performance) MPSE",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
s_name,
+ "Keyword Trie (low memory, moderate performance) MPSE with queued events",
SEAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_SO_RULE,
"3|18758",
+ "SO rule example",
IPSAPI_PLUGIN_V0,
8,
nullptr,
static const char* s_name = "react";
+static const char* s_help =
+ "send response to client and terminate session";
+
static THREAD_LOCAL ProfileStats reactPerfStats;
static const char* MSG_KEY = "<>";
// module
//-------------------------------------------------------------------------
-static const Parameter react_params[] =
+static const Parameter s_params[] =
{
{ "msg", Parameter::PT_IMPLIED, nullptr, nullptr,
" use rule message in response page" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* react_help =
- "send response to client and terminate session";
-
class ReactModule : public Module
{
public:
- ReactModule() : Module(s_name, react_help, react_params) { };
+ ReactModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool set(const char*, Value&, SnortConfig*);
{
PT_IPS_ACTION,
s_name,
+ s_help,
ACTAPI_PLUGIN_V0,
0,
mod_ctor,
static const char* s_name = "reject";
+static const char* s_help =
+ "terminate session with TCP reset or ICMP unreachable";
+
static THREAD_LOCAL ProfileStats rejPerfStats;
class RejectAction : public IpsAction
// module
//-------------------------------------------------------------------------
-static const Parameter rej_params[] =
+static const Parameter s_params[] =
{
{ "reset", Parameter::PT_ENUM, "source|dest|both", nullptr,
"send tcp reset to one or both ends" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* rej_help =
- "terminate session with TCP reset or ICMP unreachable";
-
class RejectModule : public Module
{
public:
- RejectModule() : Module(s_name, rej_help, rej_params) { };
+ RejectModule() : Module(s_name, s_help, s_params) { };
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
PT_IPS_ACTION,
s_name,
+ s_help,
ACTAPI_PLUGIN_V0,
0,
mod_ctor,
static const char* s_name = "rewrite";
+static const char* s_help =
+ "overwrite packet contents";
+
// FIXIT-L ips_replace.cc should part of this lib
// FIXIT-L enforce that a rule with a replace option has a replace action
// (and vice-versa)
// replace module
//-------------------------------------------------------------------------
-static const Parameter rep_params[] =
+static const Parameter s_params[] =
{
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* rep_help =
- "overwrite packet contents";
-
class ReplaceModule : public Module
{
public:
- ReplaceModule() : Module(s_name, rep_help, rep_params) { };
+ ReplaceModule() : Module(s_name, s_help, s_params) { };
bool set(const char*, Value&, SnortConfig*);
bool begin(const char*, int, SnortConfig*);
bool end(const char*, int, SnortConfig*);
{
PT_IPS_ACTION,
s_name,
+ s_help,
ACTAPI_PLUGIN_V0,
0,
mod_ctor,
#include "protocols/packet.h"
#include "codecs/ip/ip_util.h"
+#define CD_AUTH_NAME "auth"
+#define CD_AUTH_HELP "support for IP authentication header"
+
namespace
{
-#define CD_AUTH_NAME "auth"
-
static const RuleMap auth_rules[] =
{
{ DECODE_AUTH_HDR_TRUNC, "(" CD_AUTH_NAME ") Truncated authentication header"},
{ 0, nullptr }
};
-static const char* s_help =
- "support for IP authentication header";
-
class AuthModule : public DecodeModule
{
public:
- AuthModule() : DecodeModule(CD_AUTH_NAME, s_help) {}
+ AuthModule() : DecodeModule(CD_AUTH_NAME, CD_AUTH_HELP) {}
const RuleMap* get_rules() const
{ return auth_rules; }
{
PT_CODEC,
CD_AUTH_NAME,
+ CD_AUTH_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "detection/fpdetect.h"
#include "codecs/ip/ip_util.h"
+#define CD_DSTOPTS_NAME "ipv6_dst_opts"
+#define CD_DSTOPTS_HELP "support for ipv6 destination options"
namespace
{
-#define CD_DSTOPTS_NAME "ipv6_dst_opts"
-
class Ipv6DSTOptsCodec : public Codec
{
public:
{
PT_CODEC,
CD_DSTOPTS_NAME,
+ CD_DSTOPTS_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "protocols/protocol_ids.h"
#include "codecs/ip/ip_util.h"
+#define CD_ESP_NAME "esp"
+#define CD_ESP_HELP "support for encapsulating security payload"
+
namespace
{
-
-#define CD_ESP_NAME "esp"
-
static const RuleMap esp_rules[] =
{
{ DECODE_ESP_HEADER_TRUNC, "(" CD_ESP_NAME ") truncated Encapsulated Security Payload (ESP) header" },
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* esp_help =
- "support for encapsulating security payload";
-
class EspModule : public DecodeModule
{
public:
- EspModule() : DecodeModule(CD_ESP_NAME, esp_help, esp_params) {}
+ EspModule() : DecodeModule(CD_ESP_NAME, CD_ESP_HELP, esp_params) {}
const RuleMap* get_rules() const
{ return esp_rules; }
{
PT_CODEC,
CD_ESP_NAME,
+ CD_ESP_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "log/text_log.h"
#include "protocols/packet_manager.h"
+#define CD_IPV6_FRAG_NAME "ipv6_frag"
+#define CD_IPV6_FRAG_HELP "support for IPv6 fragment decoding"
namespace
{
-#define CD_IPV6_FRAG_NAME "ipv6_frag"
-
class Ipv6FragCodec : public Codec
{
public:
{
PT_CODEC,
CD_IPV6_FRAG_NAME,
+ CD_IPV6_FRAG_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "log/text_log.h"
#include "protocols/packet_manager.h"
+#define CD_GRE_NAME "gre"
+#define CD_GRE_HELP "support for generic routing encapsulation"
+
namespace
{
-#define CD_GRE_NAME "gre"
-
static const RuleMap gre_rules[] =
{
{ DECODE_GRE_DGRAM_LT_GREHDR, "(" CD_GRE_NAME ") GRE header length > payload length" },
{ 0, nullptr }
};
-static const char* gre_help =
- "support for generic routing encapsulation";
-
class GreModule : public DecodeModule
{
public:
- GreModule() : DecodeModule(CD_GRE_NAME, gre_help) {}
+ GreModule() : DecodeModule(CD_GRE_NAME, CD_GRE_HELP) {}
const RuleMap* get_rules() const
{ return gre_rules; }
{
PT_CODEC,
CD_GRE_NAME,
+ CD_GRE_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "main/snort.h"
#include "detection/fpdetect.h"
+#define CD_HOPOPTS_NAME "ipv6_hop_opts"
+#define CD_HOPOPTS_HELP "support for IPv6 hop options"
+
namespace
{
-#define CD_HOPOPTS_NAME "ipv6_hop_opts"
-
class Ipv6HopOptsCodec : public Codec
{
public:
{
PT_CODEC,
CD_HOPOPTS_NAME,
+ CD_HOPOPTS_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "packet_io/active.h"
#include "log/text_log.h"
-namespace{
-
#define CD_ICMP4_NAME "icmp4"
+#define CD_ICMP4_HELP "support for internet control message protocol v4"
+
+namespace{
static const RuleMap icmp4_rules[] =
{
{ 0, nullptr }
};
-static const char* icmp4_help =
- "support for internet control message protocol v4";
-
class Icmp4Module : public DecodeModule
{
public:
- Icmp4Module() : DecodeModule(CD_ICMP4_NAME, icmp4_help) {}
+ Icmp4Module() : DecodeModule(CD_ICMP4_NAME, CD_ICMP4_HELP) {}
const RuleMap* get_rules() const
{ return icmp4_rules; }
{
PT_CODEC,
CD_ICMP4_NAME,
+ CD_ICMP4_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "packet_io/active.h"
#include "log/text_log.h"
+#define CD_ICMP6_NAME "icmp6"
+#define CD_ICMP6_HELP "support for internet control message protocol v6"
namespace
{
-#define CD_ICMP6_NAME "icmp6"
static const RuleMap icmp6_rules[] =
{
{ DECODE_ICMP6_HDR_TRUNC, "(" CD_ICMP6_NAME ") truncated ICMP6 header" },
{ 0, nullptr }
};
-static const char* icmp6_help =
- "support for internet control message protocol v6";
-
class Icmp6Module : public DecodeModule
{
public:
- Icmp6Module() : DecodeModule(CD_ICMP6_NAME, icmp6_help) {}
+ Icmp6Module() : DecodeModule(CD_ICMP6_NAME, CD_ICMP6_HELP) {}
const RuleMap* get_rules() const
{ return icmp6_rules; }
{
PT_CODEC,
CD_ICMP6_NAME,
+ CD_ICMP6_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "protocols/packet.h"
+#define CD_IGMP_NAME "igmp"
+#define CD_IGMP_HELP "support for internet group management protocol"
+
namespace
{
-
-#define CD_IGMP_NAME "igmp"
-
static const RuleMap igmp_rules[] =
{
{ DECODE_IGMP_OPTIONS_DOS, "(" CD_IGMP_NAME ") DOS IGMP IP Options validation attempt" },
{ 0, nullptr }
};
-static const char* igmp_help =
- "support for internet group management protocol";
-
class IgmpModule : public DecodeModule
{
public:
- IgmpModule() : DecodeModule(CD_IGMP_NAME, igmp_help) {}
+ IgmpModule() : DecodeModule(CD_IGMP_NAME, CD_IGMP_HELP) {}
const RuleMap* get_rules() const
{ return igmp_rules; }
{
PT_CODEC,
CD_IGMP_NAME,
+ CD_IGMP_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "log/text_log.h"
#include "log/log_text.h"
+#define CD_IPV4_NAME "ipv4"
+#define CD_IPV4_HELP "support for internet protocol v4"
+
namespace{
-#define CD_IPV4_NAME "ipv4"
static const RuleMap ipv4_rules[] =
{
{ DECODE_NOT_IPV4_DGRAM, "(" CD_IPV4_NAME ") Not IPv4 datagram" },
{ 0, nullptr }
};
-static const char* ipv4_help =
- "support for internet protocol v4";
-
class Ipv4Module : public DecodeModule
{
public:
- Ipv4Module() : DecodeModule(CD_IPV4_NAME, ipv4_help) {}
+ Ipv4Module() : DecodeModule(CD_IPV4_NAME, CD_IPV4_HELP) {}
const RuleMap* get_rules() const
{ return ipv4_rules; }
{
PT_CODEC,
CD_IPV4_NAME,
+ CD_IPV4_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "protocols/packet_manager.h"
#include "log/text_log.h"
+#define CD_IPV6_NAME "ipv6"
+#define CD_IPV6_HELP "support for internet protocol v6"
+
namespace
{
-#define CD_IPV6_NAME "ipv6"
static const RuleMap ipv6_rules[] =
{
{ DECODE_IPV6_MIN_TTL, "(" CD_IPV6_NAME ") IPv6 packet below TTL limit" },
{ 0, nullptr }
};
-static const char* ipv6_help =
- "support for internet protocol v6";
-
class Ipv6Module : public DecodeModule
{
public:
- Ipv6Module() : DecodeModule(CD_IPV6_NAME, ipv6_help) {}
+ Ipv6Module() : DecodeModule(CD_IPV6_NAME, CD_IPV6_HELP) {}
const RuleMap* get_rules() const
{ return ipv6_rules; }
{
PT_CODEC,
CD_IPV6_NAME,
+ CD_IPV6_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "framework/codec.h"
#include "codecs/codec_events.h"
-namespace
-{
-
// yes, macros are necessary. The API and class constructor require different strings.
#define CD_MOBILE_NAME "mobility"
+#define CD_MOBILE_HELP "support for mobility"
+
+namespace
+{
class MobilityCodec : public Codec
{
virtual void get_protocol_ids(std::vector<uint16_t>&);
virtual bool decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
Packet *, uint16_t &lyr_len, uint16_t &next_prot_id);
-
};
const uint16_t IPPROTO_ID_MOBILITY = 55;
{
PT_CODEC,
CD_MOBILE_NAME,
+ CD_MOBILE_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
{
#define CD_NO_NEXT_NAME "ipv6_no_next"
+#define CD_NO_NEXT_HELP "sentinel codec"
class Ipv6NoNextCodec : public Codec
{
{
PT_CODEC,
CD_NO_NEXT_NAME,
+ CD_NO_NEXT_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
{
#define CD_PGM_NAME "pgm"
+#define CD_PGM_HELP "support for pragmatic general multicast"
static const RuleMap pgm_rules[] =
{
{ 0, nullptr }
};
-static const char* pgm_help =
- "support for pragmatic general multicast";
-
class PgmModule : public DecodeModule
{
public:
- PgmModule() : DecodeModule(CD_PGM_NAME, pgm_help) {}
+ PgmModule() : DecodeModule(CD_PGM_NAME, CD_PGM_HELP) {}
const RuleMap* get_rules() const
{ return pgm_rules; }
{
PT_CODEC,
CD_PGM_NAME,
+ CD_PGM_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "protocols/ipv6.h"
#include "codecs/ip/ip_util.h"
+#define CD_IPV6_ROUTING_NAME "ipv6_routing"
+#define CD_IPV6_ROUTING_HELP "support for IPv6 routing extension"
+
namespace
{
-#define CD_IPV6_ROUTING_NAME "ipv6_routing"
-
class Ipv6RoutingCodec : public Codec
{
public:
{
PT_CODEC,
CD_IPV6_ROUTING_NAME,
+ CD_IPV6_ROUTING_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
// yes, macros are necessary. The API and class constructor require different strings.
#define CD_SUN_ND_NAME "sun_nd"
+#define CD_SUN_ND_HELP "support for Sun ND"
class SunNdCodec : public Codec
{
{
PT_CODEC,
CD_SUN_ND_NAME,
+ CD_SUN_ND_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "framework/codec.h"
#include "codecs/codec_events.h"
-namespace{
-
#define CD_SWIPE_NAME "swipe"
+#define CD_SWIPE_HELP "support for Swipe"
+namespace{
class SwipeCodec : public Codec
{
{
PT_CODEC,
CD_SWIPE_NAME,
+ CD_SWIPE_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "log/log.h"
#include "protocols/packet_manager.h"
+#define CD_TCP_NAME "tcp"
+#define CD_TCP_HELP "support for transmission control protocol"
namespace
{
-
-#define CD_TCP_NAME "tcp"
-
static const RuleMap tcp_rules[] =
{
{ DECODE_TCP_DGRAM_LT_TCPHDR, "(" CD_TCP_NAME ") TCP packet len is smaller than 20 bytes" },
{ 0, nullptr }
};
-static const char* tcp_help =
- "support for transmission control protocol";
-
class TcpModule : public DecodeModule
{
public:
- TcpModule() : DecodeModule(CD_TCP_NAME, tcp_help) {}
+ TcpModule() : DecodeModule(CD_TCP_NAME, CD_TCP_HELP) {}
const RuleMap* get_rules() const
{ return tcp_rules; }
{
PT_CODEC,
CD_TCP_NAME,
+ CD_TCP_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "parser/config_file.h"
#include "codecs/ip/ip_util.h"
+#define CD_UDP_NAME "udp"
+#define CD_UDP_HELP "support for user datagram protocol"
namespace
{
-
-#define CD_UDP_NAME "udp"
static const Parameter udp_params[] =
{
{ "deep_teredo_inspection", Parameter::PT_BOOL, nullptr, "false",
{ 0, nullptr }
};
-static const char* udp_help =
- "support for user datagram protocol";
-
class UdpModule : public DecodeModule
{
public:
- UdpModule() : DecodeModule(CD_UDP_NAME, udp_help, udp_params) {}
+ UdpModule() : DecodeModule(CD_UDP_NAME, CD_UDP_HELP, udp_params) {}
const RuleMap* get_rules() const
{ return udp_rules; }
{
PT_CODEC,
CD_UDP_NAME,
+ CD_UDP_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "protocols/packet.h"
#include "log/text_log.h"
+#define CD_ARP_NAME "arp"
+#define CD_ARP_HELP "support for address resolution protocol"
+
namespace
{
-#define CD_ARP_NAME "arp"
-
static const RuleMap arp_rules[] =
{
{ DECODE_ARP_TRUNCATED, "(" CD_ARP_NAME ") Truncated ARP" },
{ 0, nullptr }
};
-static const char* arp_help =
- "support for address resolution protocol";
-
class ArpModule : public DecodeModule
{
public:
- ArpModule() : DecodeModule(CD_ARP_NAME, arp_help) {}
+ ArpModule() : DecodeModule(CD_ARP_NAME, CD_ARP_HELP) {}
const RuleMap* get_rules() const
{ return arp_rules; }
{
PT_CODEC,
CD_ARP_NAME,
+ CD_ARP_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "protocols/protocol_ids.h"
#include "protocols/eapol.h"
+#define CD_EAPOL_NAME "eapol"
+#define CD_EAPOL_HELP "support for extensible authentication protocol over LAN"
namespace
{
-#define CD_EAPOL_NAME "eapol"
static const RuleMap eapol_rules[] =
{
{ DECODE_EAPOL_TRUNCATED, "(" CD_EAPOL_NAME ") Truncated EAP Header" },
{ 0, nullptr }
};
-static const char* eapol_help =
- "support for extensible authentication protocol over LAN";
-
class EapolModule : public DecodeModule
{
public:
- EapolModule() : DecodeModule(CD_EAPOL_NAME, eapol_help) {}
+ EapolModule() : DecodeModule(CD_EAPOL_NAME, CD_EAPOL_HELP) {}
const RuleMap* get_rules() const
{ return eapol_rules; }
{
PT_CODEC,
CD_EAPOL_NAME,
+ CD_EAPOL_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "codecs/sf_protocols.h"
#include "protocols/packet.h"
+#define CD_ERSPAN2_NAME "erspan2"
+#define CD_ERSPAN2_HELP "support for encapsulated remote switched port analyzer - type 2"
+
namespace
{
-#define CD_ERSPAN2_NAME "erspan2"
-
static const RuleMap erspan2_rules[] =
{
{ DECODE_ERSPAN_HDR_VERSION_MISMATCH, "(codec_erspan) ERSpan Header version mismatch" },
{ 0, nullptr }
};
-static const char* erspan2_help =
- "support for encapsulated remote switched port analyzer - type 2";
-
class Erspan2Module : public DecodeModule
{
public:
- Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME, erspan2_help) {}
+ Erspan2Module() : DecodeModule(CD_ERSPAN2_NAME, CD_ERSPAN2_HELP) {}
const RuleMap* get_rules() const
{ return erspan2_rules; }
{
PT_CODEC,
CD_ERSPAN2_NAME,
+ CD_ERSPAN2_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "codecs/sf_protocols.h"
#include "protocols/packet.h"
+#define CD_ERSPAN3_NAME "erspan3"
+#define CD_ERSPAN3_HELP "support for encapsulated remote switched port analyzer - type 3"
namespace
{
-#define CD_ERSPAN3_NAME "erspan3"
static const RuleMap erspan3_rules[] =
{
{ DECODE_ERSPAN3_DGRAM_LT_HDR, "(" CD_ERSPAN3_NAME ") captured < ERSpan Type3 Header Length" },
{ 0, nullptr }
};
-static const char* erspan3_help =
- "support for encapsulated remote switched port analyzer - type 3";
-
class Erspan3Module : public DecodeModule
{
public:
- Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME, erspan3_help) {}
+ Erspan3Module() : DecodeModule(CD_ERSPAN3_NAME, CD_ERSPAN3_HELP) {}
const RuleMap* get_rules() const
{ return erspan3_rules; }
{
PT_CODEC,
CD_ERSPAN3_NAME,
+ CD_ERSPAN3_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "main/snort.h"
#include "log/text_log.h"
+#define CD_MPLS_NAME "mpls"
+#define CD_MPLS_HELP "support for multiprotocol label switching"
+
namespace
{
-#define CD_MPLS_NAME "mpls"
static const Parameter mpls_params[] =
{
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-
// rules which will loaded into snort.
// You can now reference these rules by calling a codec_event
// in your main codec's functions
{ 0, nullptr }
};
-static const char* mpls_help =
- "support for multiprotocol label switching";
-
class MplsModule : public DecodeModule
{
public:
- MplsModule() : DecodeModule(CD_MPLS_NAME, mpls_help, mpls_params) {};
+ MplsModule() : DecodeModule(CD_MPLS_NAME, CD_MPLS_HELP, mpls_params) {};
const RuleMap* get_rules() const
{ return mpls_rules; }
{
PT_CODEC,
CD_MPLS_NAME,
+ CD_MPLS_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "snort.h"
#include "codecs/sf_protocols.h"
+#define CD_PPPENCAP_NAME "ppp_encap"
+#define CD_PPPENCAP_HELP "support for point-to-point encapsulation"
+
namespace
{
-#define CD_PPPENCAP_NAME "ppp_encap"
-
class PppEncap : public Codec
{
public:
{
PT_CODEC,
CD_PPPENCAP_NAME,
+ CD_PPPENCAP_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
const uint16_t ETHERNET_TYPE_PPPoE_DISC = 0x8863; /* discovery stage */
#define CD_PPPOEPKT_DISC_NAME "pppoe_disc"
+#define CD_PPPOEPKT_DISC_HELP "support for point-to-point discovery"
class PPPoEDiscCodec : public Codec
{
{
PT_CODEC,
CD_PPPOEPKT_DISC_NAME,
+ CD_PPPOEPKT_DISC_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#define CD_PPPOEPKT_SESS_NAME "pppoe_sess"
+#define CD_PPPOEPKT_SESS_HELP "support for point-to-point session"
const uint16_t ETHERNET_TYPE_PPPoE_SESS = 0x8864; /* session stage */
{
PT_CODEC,
CD_PPPOEPKT_SESS_NAME,
+ CD_PPPOEPKT_SESS_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
{
#define CD_TRANSBRIDGE_NAME "trans_bridge"
+#define CD_TRANSBRIDGE_HELP "support for trans-bridging"
class TransbridgeCodec : public Codec
{
{
PT_CODEC,
CD_TRANSBRIDGE_NAME,
+ CD_TRANSBRIDGE_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "protocols/packet_manager.h"
#include "log/text_log.h"
+#define CD_VLAN_NAME "vlan"
+#define CD_VLAN_HELP "support for virtual local area network"
+
namespace
{
-#define CD_VLAN_NAME "vlan"
static const RuleMap vlan_rules[] =
{
{ DECODE_BAD_VLAN, "(" CD_VLAN_NAME ") Bad VLAN Frame" },
{ 0, nullptr }
};
-static const char* vlan_help =
- "support for virtual local area network";
-
class VlanModule : public DecodeModule
{
public:
- VlanModule() : DecodeModule(CD_VLAN_NAME, vlan_help) {}
+ VlanModule() : DecodeModule(CD_VLAN_NAME, CD_VLAN_HELP) {}
const RuleMap* get_rules() const
{ return vlan_rules; }
{
PT_CODEC,
CD_VLAN_NAME,
+ CD_VLAN_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "framework/codec.h"
#include "protocols/protocol_ids.h"
+#define CD_DEFAULT_NAME "unknown"
+#define CD_DEFAULT_HELP "support for unkown protocols"
+
namespace
{
-#define CD_DEFAULT_NAME "unknown"
-
class DefaultCodec : public Codec
{
public:
{
PT_CODEC,
CD_DEFAULT_NAME,
+ CD_DEFAULT_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "protocols/protocol_ids.h"
#include "codecs/decode_module.h"
+#define CD_GTP_NAME "gtp"
+#define CD_GTP_HELP "support for general-packet-radio-service tunnelling protocol"
+
namespace
{
-#define CD_GTP_NAME "gtp"
-
static const RuleMap gtp_rules[] =
{
{ DECODE_GTP_MULTIPLE_ENCAPSULATION, "(" CD_GTP_NAME ") Two or more GTP encapsulation layers present" },
{ 0, nullptr }
};
-static const char* gtp_help =
- "support for general-packet-radio-service tunnelling protocol";
-
class GtpModule : public DecodeModule
{
public:
- GtpModule() : DecodeModule(CD_GTP_NAME, gtp_help) {};
+ GtpModule() : DecodeModule(CD_GTP_NAME, CD_GTP_HELP) {};
const RuleMap* get_rules() const
{ return gtp_rules; }
{
PT_CODEC,
CD_GTP_NAME,
+ CD_GTP_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
{
#define ICMP4_IP_NAME "icmp4_ip"
+#define ICMP4_IP_HELP "support for IP in ICMPv4"
class Icmp4IpCodec : public Codec
{
{
PT_CODEC,
ICMP4_IP_NAME,
+ ICMP4_IP_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr, // module constructor
#include "codecs/codec_events.h"
-namespace
-{
-
// yes, macros are necessary. The API and class constructor require different strings.
//
// this macros is defined in the module to ensure identical names. However,
#define ICMP6_IP_NAME "icmp6_ip"
#endif
+#define ICMP6_IP_HELP "support for IP in ICMPv6"
+
+namespace
+{
+
class Icmp6IpCodec : public Codec
{
public:
{
PT_CODEC,
ICMP6_IP_NAME,
+ ICMP6_IP_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr, // module constructor
#include "log/text_log.h"
#include "protocols/packet_manager.h"
-namespace
-{
-
// yes, macros are necessary. The API and class constructor require different strings.
//
// this macros is defined in the module to ensure identical names. However,
// if you don't want a module, define the name here.
#define LLC_NAME "llc"
+#define LLC_HELP "support for logical link control"
-
+namespace
+{
class LlcCodec : public Codec
{
{
PT_CODEC,
LLC_NAME,
+ LLC_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "protocols/teredo.h"
#include "protocols/protocol_ids.h"
+#define CD_TEREDO_NAME "teredo"
+#define CD_TEREDO_HELP "support for teredo"
+
namespace
{
-#define CD_TEREDO_NAME "teredo"
-
class TeredoCodec : public Codec
{
public:
{
PT_CODEC,
CD_TEREDO_NAME,
+ CD_TEREDO_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "codecs/sf_protocols.h"
#include "log/text_log.h"
+#define CD_ETH_NAME "eth"
+#define CD_ETH_HELP "support for ethernet protocol"
+
namespace
{
-#define CD_ETH_NAME "eth"
static const RuleMap eth_rules[] =
{
{ DECODE_ETH_HDR_TRUNC, "(" CD_ETH_NAME ") truncated eth header" },
{ 0, nullptr }
};
-static const char* eth_help =
- "support for ethernet protocol";
-
class EthModule : public DecodeModule
{
public:
- EthModule() : DecodeModule(CD_ETH_NAME, eth_help) {}
+ EthModule() : DecodeModule(CD_ETH_NAME, CD_ETH_HELP) {}
const RuleMap* get_rules() const
{ return eth_rules; }
{
PT_CODEC,
CD_ETH_NAME,
+ CD_ETH_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "protocols/linux_sll.h"
#include "main/snort.h"
+#define CD_LINUX_SLL_NAME "linux_sll"
+#define CD_LINUX_SLL_HELP "support for Linux SLL"
namespace
{
-#define CD_LINUX_SSL_NAME "linux_sll"
-
class LinuxSllCodec : public Codec
{
public:
- LinuxSllCodec() : Codec(CD_LINUX_SSL_NAME){};
+ LinuxSllCodec() : Codec(CD_LINUX_SLL_NAME){};
~LinuxSllCodec() {};
{
{
PT_CODEC,
- CD_LINUX_SSL_NAME,
+ CD_LINUX_SLL_NAME,
+ CD_LINUX_SLL_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include <pcap.h>
+#define CD_NULL_NAME "null"
+#define CD_NULL_HELP "support for null encapsulation"
+
namespace
{
-#define CD_NULL_NAME "null"
-
class NullCodec : public Codec
{
public:
{
PT_CODEC,
CD_NULL_NAME,
+ CD_NULL_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "framework/codec.h"
#include "main/snort.h"
-
-
-namespace
-{
-
// yes, macros are necessary. The API and class constructor require different strings.
//
// this macros is defined in the module to ensure identical names. However,
#define PPP_NAME "ppp"
#endif
+#define PPP_HELP "support for point-to-point encapsulation"
+
+namespace
+{
+
class PPPCodec : public Codec
{
public:
{
PT_CODEC,
PPP_NAME,
+ PPP_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr, // mod_ctor
#include "protocols/protocol_ids.h"
#include <pcap.h>
+#define CD_RAW4_NAME "raw4"
+#define CD_RAW4_HELP "support for unencapsulated IPv4"
namespace
{
-#define CD_RAW4_NAME "raw4"
-
class Raw4Codec : public Codec
{
public:
{
PT_CODEC,
CD_RAW4_NAME,
+ CD_RAW4_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "protocols/protocol_ids.h"
#include <pcap.h>
+#define CD_RAW6_NAME "raw6"
+#define CD_RAW6_HELP "support for unencapsulated IPv6"
namespace
{
-#define CD_RAW6_NAME "raw6"
-
class Raw6Codec : public Codec
{
public:
{
PT_CODEC,
CD_RAW6_NAME,
+ CD_RAW6_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr,
#include "log/log.h"
#endif
+#define CD_WLAN_NAME "wlan"
+#define CD_WLAN_HELP "support for wireless local area network protocol"
+
namespace
{
-#define CD_WLAN_NAME "wlan"
static const RuleMap wlan_rules[] =
{
{ DECODE_BAD_80211_ETHLLC, "(" CD_WLAN_NAME ") Bad 802.11 LLC header" },
{ 0, nullptr }
};
-static const char* wlan_help =
- "support for wireless local area network protocol";
-
class WlanCodecModule : public DecodeModule
{
public:
- WlanCodecModule() : DecodeModule(CD_WLAN_NAME, wlan_help) {}
+ WlanCodecModule() : DecodeModule(CD_WLAN_NAME, CD_WLAN_HELP) {}
const RuleMap* get_rules() const
{ return wlan_rules; }
{
PT_CODEC,
CD_WLAN_NAME,
+ CD_WLAN_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor,
#include "framework/codec.h"
+#ifndef I4L_RAW_IP_NAME
+#define I4L_RAW_IP_NAME "i4l_raw_ip"
+#endif
+
+#define I4L_RAW_IP_HELP "support for I4L IP"
namespace
{
-
-#ifndef I4L_RAW_IP
-#define I4L_RAW_IP "i4l_raw_ip"
-#endif
-
class I4LRawIpCodec : public Codec
{
public:
- I4LRawIpCodec() : Codec(I4L_RAW_IP){};
+ I4LRawIpCodec() : Codec(I4L_RAW_IP_NAME){};
~I4LRawIpCodec() {};
{
{
PT_CODEC,
- I4L_RAW_IP,
+ I4L_RAW_IP_NAME,
+ I4L_RAW_IP_HELP,
CDAPI_PLUGIN_V0,
0,
nullptr, // mod_ctor
#include "framework/module.h"
#include "log/text_log.h"
-namespace
-{
-
// yes, macros are necessary. The API and class constructor require different strings.
//
// this macros is defined in the module to ensure identical names. However,
// if you don't want a module, define the name here.
#define CODEC_NAME "name"
+#define CODEC_NAME "one line help for this codec"
-
-
+namespace
+{
// inherit from DecodeModule rather than Module so the GID for
// all codecs are identical. Additionally, all of the SIDS are
{
PT_CODEC,
CODEC_NAME,
+ CODEC_HELP,
CDAPI_PLUGIN_V0,
0,
mod_ctor, // module constructor ( see function for details )
{
PlugType type;
const char* name;
+ const char* help;
unsigned api_version;
unsigned version;
ModNewFunc mod_ctor;
static const char* s_name = "ack";
+static const char* s_help =
+ "rule option to match on TCP ack numbers";
+
static THREAD_LOCAL ProfileStats tcpAckPerfStats;
class TcpAckOption : public IpsOption
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "rule option to match on TCP ack numbers";
-
class AckModule : public Module
{
public:
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
static const char* s_name = "asn1";
+static const char* s_help =
+ "rule option for asn1 detection";
+
class Asn1Option : public IpsOption
{
public:
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "rule option for asn1 detection";
-
class Asn1Module : public Module
{
public:
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
static const char* s_name = "base64_decode";
+static const char* s_help =
+ "rule option to decode base64 data - must be used with base64_data option";
+
//-------------------------------------------------------------------------
// base64_decode
//-------------------------------------------------------------------------
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "rule option to decode base64 data - must be used with base64_data option";
-
class B64DecodeModule : public Module
{
public:
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
//-------------------------------------------------------------------------
static const char* s_data_name = "base64_data";
+static const char* s_data_help = "set detection cursor to decoded Base64 data";
class Base64DataOption : public IpsOption
{
{
PT_IPS_OPTION,
s_data_name,
+ s_data_help,
IPSAPI_PLUGIN_V0,
0,
nullptr,
static const char* s_name = "bufferlen";
+static const char* s_help =
+ "rule option to check length of current buffer";
+
static THREAD_LOCAL ProfileStats lenCheckPerfStats;
class LenOption : public IpsOption
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "rule option to check length of current buffer";
-
class LenModule : public Module
{
public:
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
static const char* s_name = "byte_extract";
+static const char* s_help =
+ "rule option to convert data to an integer variable";
+
#define MAX_BYTES_TO_GRAB 4
typedef struct _ByteExtractData
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "rule option to convert data to an integer variable";
-
class ExtractModule : public Module
{
public:
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ uri_help,
IPSAPI_PLUGIN_V0,
0,
uri_mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ cb_help,
IPSAPI_PLUGIN_V0,
0,
client_body_mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ meth_help,
IPSAPI_PLUGIN_V0,
0,
method_mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ cookie_help,
IPSAPI_PLUGIN_V0,
0,
cookie_mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ stat_code_help,
IPSAPI_PLUGIN_V0,
0,
stat_code_mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ stat_msg_help,
IPSAPI_PLUGIN_V0,
0,
stat_msg_mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ raw_uri_help,
IPSAPI_PLUGIN_V0,
0,
raw_uri_mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ raw_header_help,
IPSAPI_PLUGIN_V0,
0,
raw_header_mod_ctor,
{
PT_IPS_OPTION,
IPS_OPT,
+ raw_cookie_help,
IPSAPI_PLUGIN_V0,
0,
raw_cookie_mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
"tbd",
+ "Lua JIT script for IPS rule option",
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
"luajit",
+ "Lua JIT script for logging events",
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
LOG_CODECS_NAME,
+ LOG_CODECS_HELP,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
#include "framework/module.h"
#include "snort.h"
+static const char* s_name = "log_null";
+static const char* s_help = "support for null encapsulation";
+
//-------------------------------------------------------------------------
// log_null module
//-------------------------------------------------------------------------
{
{
PT_LOGGER,
- "log_null",
+ s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
nullptr, // mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_LOGGER,
s_name,
+ s_help,
LOGAPI_PLUGIN_V0,
0,
mod_ctor,
#include "arp_module.h"
-static const char* s_name = MOD_NAME;
-
-static const char* s_help =
- "detect ARP attacks and anomalies";
-
#define ARPSPOOF_UNICAST_ARP_REQUEST_STR \
"(arp_spoof) Unicast ARP request"
#define ARPSPOOF_ETHERFRAME_ARP_MISMATCH_SRC_STR \
//-------------------------------------------------------------------------
ArpSpoofModule::ArpSpoofModule() :
- Module(s_name, s_help, s_params)
+ Module(MOD_NAME, MOD_HELP, s_params)
{
config = new ArpSpoofConfig;
config->check_overwrite = false;
#include "main/thread.h"
#define MOD_NAME "arp_spoof"
+#define MOD_HELP "detect ARP attacks and anomalies"
#define GID_ARP_SPOOF 112
{
PT_INSPECTOR,
MOD_NAME,
+ MOD_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
nullptr
};
-static const char* s_name = "binder";
-
-static const char* s_help =
- "configure processing based on CIDRs, ports, services, etc.";
-
//-------------------------------------------------------------------------
// binder module
//-------------------------------------------------------------------------
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-BinderModule::BinderModule() : Module(s_name, s_help, s_params)
+BinderModule::BinderModule() : Module(BIND_NAME, BIND_HELP, s_params)
{ work = nullptr; }
BinderModule::~BinderModule()
bool BinderModule::begin(const char* fqn, int idx, SnortConfig*)
{
- if ( idx && !strcmp(fqn, s_name) )
+ if ( idx && !strcmp(fqn, BIND_NAME) )
work = new Binding;
return true;
bool BinderModule::end(const char* fqn, int idx, SnortConfig*)
{
- if ( idx && !strcmp(fqn, s_name) )
+ if ( idx && !strcmp(fqn, BIND_NAME) )
{
bindings.push_back(work);
work = nullptr;
#include "framework/module.h"
#include "main/thread.h"
+#define BIND_NAME "binder"
+#define BIND_HELP "configure processing based on CIDRs, ports, services, etc."
+
struct BindStats
{
PegCount packets;
#include "utils/stats.h"
#include "log/messages.h"
-static const char* mod_name = "binder";
-
THREAD_LOCAL ProfileStats bindPerfStats;
//-------------------------------------------------------------------------
{
{
PT_INSPECTOR,
- mod_name,
+ BIND_NAME,
+ BIND_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
// normalize parameters
//-------------------------------------------------------------------------
-static const char* s_name = "normalize";
-
-static const char* s_help =
- "packet scrubbing for inline mode";
-
NormalizeModule::NormalizeModule() :
- Module(s_name, s_help, s_params)
+ Module(NORM_NAME, NORM_HELP, s_params)
{
memset(&config, 0, sizeof(config));
}
bool NormalizeModule::begin(const char* fqn, int, SnortConfig*)
{
- if ( !strcmp(fqn, s_name) )
+ if ( !strcmp(fqn, NORM_NAME) )
{
NetworkPolicy* policy = get_network_policy();
#include "framework/module.h"
#include "norm.h"
+#define NORM_NAME "normalizer"
+#define NORM_HELP "packet scrubbing for inline mode"
+
extern THREAD_LOCAL ProfileStats norm_perf_stats;
class NormalizeModule : public Module
#define PROTO_BITS (PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP)
-static const char* name = "normalize";
-
THREAD_LOCAL ProfileStats norm_perf_stats;
//-------------------------------------------------------------------------
{
{
PT_INSPECTOR,
- name,
+ NORM_NAME,
+ NORM_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
// perf attributes
//-------------------------------------------------------------------------
-static const char* s_name = "perf_monitor";
-
-static const char* s_help =
- "performance monitoring and flow statistics collection";
-
PerfMonModule::PerfMonModule() :
- Module(s_name, s_help, s_params)
+ Module(PERF_NAME, PERF_HELP, s_params)
{ }
ProfileStats* PerfMonModule::get_profile() const
#include "perf.h"
#include "framework/module.h"
+#define PERF_NAME "perf_monitor"
+#define PERF_HELP "performance monitoring and flow statistics collection"
+
extern THREAD_LOCAL SimpleStats pmstats;
extern THREAD_LOCAL ProfileStats perfmonStats;
THREAD_LOCAL SFPERF* perfmon_config = nullptr;
-static const char* mod_name = "perf_monitor";
-
THREAD_LOCAL SimpleStats pmstats;
THREAD_LOCAL ProfileStats perfmonStats;
{
{
PT_INSPECTOR,
- mod_name,
+ PERF_NAME,
+ PERF_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
// FIXIT-L use fixed base file name
config->logfile = SnortStrdup("portscan.log");
- global = (PsData*)DataManager::acquire(PS_GLOBAL, sc);
+ global = (PsData*)DataManager::acquire(PSG_NAME, sc);
config->common = global->data;
return true;
}
{
{
PT_DATA,
- PS_GLOBAL,
+ PSG_NAME,
+ PSG_HELP,
PDAPI_PLUGIN_V0,
0,
gmod_ctor,
{
{
PT_INSPECTOR,
- PS_MODULE,
+ PS_NAME,
+ PS_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
// port_scan module
//-------------------------------------------------------------------------
-static const char* ps_name = "port_scan";
-
-static const char* ps_help =
- "port scan detection";
-
PortScanModule::PortScanModule() :
- Module(ps_name, ps_help, ps_params)
+ Module(PS_NAME, PS_HELP, ps_params)
{
config = nullptr;
}
// port_scan module
//-------------------------------------------------------------------------
-static const char* psg_name = "port_scan_global";
-static const char* psg_help =
- "shared settings for port_scan inspectors";
-
static const Parameter psg_params[] =
{
{ "memcap", Parameter::PT_INT, "1:", "1048576",
};
PortScanGlobalModule::PortScanGlobalModule() :
- Module(psg_name, psg_help, psg_params)
+ Module(PSG_NAME, PSG_HELP, psg_params)
{
common = nullptr;
}
#include "ps_detect.h"
#include "main/thread.h"
-#define PS_MODULE "port_scan"
-#define PS_GLOBAL "port_scan_global"
+#define PS_NAME "port_scan"
+#define PS_HELP "port scan detection"
+
+#define PSG_NAME "port_scan_global"
+#define PSG_HELP "shared settings for port_scan inspectors"
extern THREAD_LOCAL SimpleStats spstats;
extern THREAD_LOCAL ProfileStats psPerfStats;
{
PT_SEARCH_ENGINE,
"ac_banded",
+ "Aho-Corasick Banded (high memory, moderate performance)",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
"ac_bnfa",
+ "Aho-Corasick Binary NFA (low memory, high performance) MPSE",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
"ac_bnfa_q",
+ "Aho-Corasick Binary NFA (low memory, high performance) with queued events",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
"ac_full",
+ "Aho-Corasick Full (high memory, best performance)",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
"ac_full_q",
+ "Aho-Corasick Full (high memory, best performance) with queued events",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
"ac_sparse",
+ "Aho-Corasick Sparse (high memory, moderate performance) MPSE",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
"ac_sparse_bands",
+ "Aho-Corasick Sparse-Banded (high memory, moderate performance) MPSE",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
"ac_std",
+ "Aho-Corasick Full (high memory, best performance) MPSE",
SEAPI_PLUGIN_V0,
0,
nullptr,
{
PT_SEARCH_ENGINE,
"intel_cpm",
+ "Intel CPM library",
SEAPI_PLUGIN_V0,
0,
nullptr,
static const char* s_name = "back_orifice";
+static const char* s_help =
+ "back orifice detection";
+
/* global keyvalue for the BoRand() function */
static THREAD_LOCAL long holdrand = 1L;
{ 0, nullptr }
};
-static const char* s_help =
- "back orifice detection";
-
class BoModule : public Module
{
public:
{
PT_INSPECTOR,
s_name,
+ s_help,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
static const char* client_key = "ftp_client";
static const char* server_key = "ftp_server";
+static const char* client_help = "FTP inspector client module";
+static const char* server_help = "FTP inspector server module";
+
THREAD_LOCAL ProfileStats ftpPerfStats;
THREAD_LOCAL SimpleStats ftstats;
{
PT_DATA,
client_key,
+ client_help,
MODAPI_PLUGIN_V0,
0,
fc_mod_ctor,
{
PT_INSPECTOR,
server_key,
+ server_help,
INSAPI_PLUGIN_V0,
0,
fs_mod_ctor,
{
PT_INSPECTOR,
s_name,
+ s_help,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
#include "framework/inspector.h"
#include "utils/sfsnprintfappend.h"
-static const char* tn_name = "telnet";
-
THREAD_LOCAL ProfileStats telnetPerfStats;
THREAD_LOCAL SimpleStats tnstats;
{
{
PT_INSPECTOR,
- tn_name,
+ TEL_NAME,
+ TEL_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
using namespace std;
-static const char* s_name = "telnet";
-
-static const char* s_help =
- "telnet inspector";
-
//-------------------------------------------------------------------------
// telnet module
//-------------------------------------------------------------------------
};
TelnetModule::TelnetModule() :
- Module(s_name, s_help, s_params)
+ Module(TEL_NAME, TEL_HELP, s_params)
{
conf = nullptr;
}
#define TELNET_ENCRYPTED 2
#define TELNET_SB_NO_SE 3
+#define TEL_NAME "telnet"
+#define TEL_HELP "telnet inspection and normalization"
+
struct SnortConfig;
extern THREAD_LOCAL SimpleStats tnstats;
#define GLOBAL_KEYWORD "http_inspect"
#define SERVER_KEYWORD "http_server"
+#define GLOBAL_HELP "shared HTTP inspector settings"
+#define SERVER_HELP "main HTTP inspector module"
+
extern THREAD_LOCAL ProfileStats hiPerfStats;
class HttpInspectModule : public Module
{
PT_DATA,
GLOBAL_KEYWORD,
+ GLOBAL_HELP,
MODAPI_PLUGIN_V0,
0,
hg_mod_ctor,
{
PT_INSPECTOR,
SERVER_KEYWORD,
+ SERVER_HELP,
INSAPI_PLUGIN_V0,
0,
hs_mod_ctor,
#include "nhttp_api.h"
const char* NHttpApi::nhttp_my_name = "nhttp_inspect";
+const char* NHttpApi::nhttp_help = "the new HTTP inspector!";
void NHttpApi::nhttp_init()
{
{
PT_INSPECTOR,
NHttpApi::nhttp_my_name,
+ NHttpApi::nhttp_help,
INSAPI_PLUGIN_V0,
0,
NHttpApi::nhttp_mod_ctor,
static Module* nhttp_mod_ctor() { return new NHttpModule; };
static void nhttp_mod_dtor(Module* m) { delete m; };
static const char* nhttp_my_name;
+ static const char* nhttp_help;
static void nhttp_init();
static void nhttp_term() {};
static Inspector* nhttp_ctor(Module* mod);
static THREAD_LOCAL uint32_t rpc_memory = 0;
static const char* mod_name = "rpc_decode";
+static const char* mod_help = "RPC inspector";
THREAD_LOCAL ProfileStats rpcdecodePerfStats;
THREAD_LOCAL SimpleStats rdstats;
{
PT_INSPECTOR,
mod_name,
+ mod_help,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
#include "wizard.h"
#include "magic.h"
-static const char* s_name = "wizard";
-static const char* s_help =
- "inspector that implements port-independent protocol identification";
-
//-------------------------------------------------------------------------
// wizard module
//-------------------------------------------------------------------------
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-WizardModule::WizardModule() : Module(s_name, s_help, s_params)
+WizardModule::WizardModule() : Module(WIZ_NAME, WIZ_HELP, s_params)
{
c2s_hexes = nullptr;
s2c_hexes = nullptr;
#include "framework/module.h"
#include "main/thread.h"
+#define WIZ_NAME "wizard"
+#define WIZ_HELP "inspector that implements port-independent protocol identification"
+
extern const char* wiz_pegs[];
extern THREAD_LOCAL struct WizStats tstats;
extern THREAD_LOCAL ProfileStats wizPerfStats;
#include "utils/stats.h"
#include "log/messages.h"
-static const char* mod_name = "wizard";
-
THREAD_LOCAL ProfileStats wizPerfStats;
struct WizStats
{
{
PT_INSPECTOR,
- mod_name,
+ WIZ_NAME,
+ WIZ_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_INSPECTOR,
MOD_NAME,
+ MOD_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "base stream inspector for flow tracking";
-
StreamModule::StreamModule() :
- Module(MOD_NAME, s_help, s_params)
+ Module(MOD_NAME, MOD_HELP, s_params)
{
proto = &stream_cfg.ip_cfg;
}
//-------------------------------------------------------------------------
#define MOD_NAME "stream"
+#define MOD_HELP "common flow tracking"
struct StreamConfig
{
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "stream inspector for ICMP flow tracking";
-
StreamIcmpModule::StreamIcmpModule() :
- Module(MOD_NAME, s_help, s_params)
+ Module(MOD_NAME, MOD_HELP, s_params)
{
config = nullptr;
}
//-------------------------------------------------------------------------
#define MOD_NAME "stream_icmp"
+#define MOD_HELP "stream inspector for ICMP flow tracking"
struct StreamIcmpConfig;
{
PT_INSPECTOR,
MOD_NAME,
+ MOD_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "stream inspector for IP flow tracking";
-
StreamIpModule::StreamIpModule() :
- Module(MOD_NAME, s_help, s_params)
+ Module(MOD_NAME, MOD_HELP, s_params)
{
config = nullptr;
}
//-------------------------------------------------------------------------
#define MOD_NAME "stream_ip"
+#define MOD_HELP "stream inspector for IP flow tracking and defragmentation"
struct StreamIpConfig;
{
PT_INSPECTOR,
MOD_NAME,
+ MOD_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
reassemble_mod_ctor,
{
PT_IPS_OPTION,
s_name,
+ s_help,
IPSAPI_PLUGIN_V0,
0,
size_mod_ctor,
{
PT_INSPECTOR,
MOD_NAME,
+ MOD_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
{ 0, nullptr }
};
-static const char* s_help =
- "stream inspector for TCP flow tracking and stream normalization and reassembly";
-
StreamTcpModule::StreamTcpModule() :
- Module(MOD_NAME, s_help, s_params)
+ Module(MOD_NAME, MOD_HELP, s_params)
{
config = nullptr;
}
//-------------------------------------------------------------------------
#define MOD_NAME "stream_tcp"
+#define MOD_HELP "stream inspector for TCP flow tracking and stream normalization and reassembly"
struct SnortConfig;
struct StreamTcpConfig;
{
PT_INSPECTOR,
MOD_NAME,
+ MOD_HELP,
INSAPI_PLUGIN_V0,
0,
mod_ctor,
{ nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
};
-static const char* s_help =
- "stream inspector for UDP flow tracking";
-
StreamUdpModule::StreamUdpModule() :
- Module(MOD_NAME, s_help, s_params)
+ Module(MOD_NAME, MOD_HELP, s_params)
{
config = nullptr;
}
//-------------------------------------------------------------------------
#define MOD_NAME "stream_udp"
+#define MOD_HELP "stream inspector for UDP flow tracking"
struct StreamUdpConfig;
projects / thirdparty / snort3.git / commitdiff
