russ - cleanup some comments; build 150

diff --git a/ChangeLog b/ChangeLog
index 779cfdffff6f97d1dd55d37a7d71a5e96d7f2f27..eedd85f42bc6d61dbb4993233e0560ebd17a79fb 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,4 @@
-Pending - build 150
+15/04/30 - build 150
 
 -- additional refactoring and cleanup
 -- fix http_inspect mpse search

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 06107f3b364919f10e495f685f8631c892f09aa0..24a4d166699a97a1917ac9e622ca0bb3a4d52be4 100644 (file)
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -564,7 +564,7 @@ void Ipv4Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
 {
     const IP4Hdr* const ip4h = reinterpret_cast<const IP4Hdr*>(raw_pkt);
 
-    // FIXIT-H  -->  This does NOT obfuscate correctly
+    // FIXIT-L  -->  This does NOT obfuscate correctly
     if (SnortConfig::obfuscate())
     {
         TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");

diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index f8040ba79b9ae65db0bf537189bc37dedc63f94c..48d96677005f1efff2c3a652952aa7251dc03fe4 100644 (file)
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -530,7 +530,7 @@ void Ipv6Codec::log(TextLog* const text_log, const uint8_t* raw_pkt,
 {
     const ip::IP6Hdr* const ip6h = reinterpret_cast<const ip::IP6Hdr*>(raw_pkt);
 
-    // FIXIT-H  -->  This does NOT obfuscate correctly
+    // FIXIT-L  -->  This does NOT obfuscate correctly
     if (SnortConfig::obfuscate())
     {
         TextLog_Print(text_log, "x:x:x:x::x:x:x:x -> x:x:x:x::x:x:x:x");

diff --git a/src/codecs/misc/cd_icmp4_ip.cc b/src/codecs/misc/cd_icmp4_ip.cc
index 3e9bb074918ae5d54a4eb74bb7e51c016d65eba1..94503d6898bc31c7cd935f38dc2ae18d818925bc 100644 (file)
--- a/src/codecs/misc/cd_icmp4_ip.cc
+++ b/src/codecs/misc/cd_icmp4_ip.cc
@@ -153,7 +153,7 @@ void Icmp4IpCodec::log(TextLog* const text_log, const uint8_t* raw_pkt,
     // COPIED DIRECTLY FROM ipv4 CODEC.  This is specificially replicated since
     //      the two are not necessarily the same.
 
-    // FIXIT-H  -->  This does NOT obfuscate correctly
+    // FIXIT-L  -->  This does NOT obfuscate correctly
     if (SnortConfig::obfuscate())
     {
         TextLog_Print(text_log, "xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx");

diff --git a/src/main/build.h b/src/main/build.h
index 31a46f41a2faa6e344059b08358fec25247c5149..a76785c6a48ee2d7ea5e71f5605b4007f073428e 100644 (file)
--- a/src/main/build.h
+++ b/src/main/build.h
@@ -7,5 +7,5 @@
 //                                               //
 //-----------------------------------------------//
 
-#define BUILD "149"
+#define BUILD "150"
 

diff --git a/src/managers/action_manager.cc b/src/managers/action_manager.cc
index f837e9949a5776202b829e57e0c66652c8a3f269..e2afb9d32cd5ad142fe73145fcea9fd2440f8cd2 100644 (file)
--- a/src/managers/action_manager.cc
+++ b/src/managers/action_manager.cc
@@ -37,7 +37,7 @@ using namespace std;
 struct Actor
 {
     const ActionApi* api;
-    IpsAction* act;  // FIXIT-H must move to SnortConfig for reload?
+    IpsAction* act;
 
     Actor(const ActionApi* p)
     { api = p; act = nullptr; }
@@ -88,7 +88,7 @@ static void store(const ActionApi* api, IpsAction* act)
     for ( auto& p : s_actors )
         if ( p.api == api )
         {
-            //assert(!p.act);  FIXIT-H memory leak on reload
+            //assert(!p.act);  FIXIT-H memory leak on reload; move to SnortConfig?
             p.act = act;
             break;
         }

diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/src/service_inspectors/http_inspect/hi_module.cc
index 390bdd29bcaba9c6f094dffd48afcf389e5c71d7..b3e6721698691a676261df738b0d259a629deb8a 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_module.cc
+++ b/src/service_inspectors/http_inspect/hi_module.cc
@@ -26,6 +26,7 @@
 #include "hi_events.h"
 #include "hi_cmd_lookup.h"
 #include "hi_ui_iis_unicode_map.h"
+#include "decompress/file_decomp.h"
 #include "utils/util.h"
 
 //-------------------------------------------------------------------------
@@ -262,10 +263,6 @@ bool HttpInspectModule::end(const char* fqn, int, SnortConfig*)
 // You must make a parallel change in Http_Server_Module::Begin().
 #define default_non_rfc_chars "0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07"
 
-// FIXIT-L refactor params to create a profile table so that user can define
-// different profiles (like above) and use those.  rename existing profile
-// to profile_type.
-
 static const Parameter hi_profile_server_params[] =
 {
     { "apache_whitespace", Parameter::PT_BOOL, nullptr, "false",
@@ -280,7 +277,6 @@ static const Parameter hi_profile_server_params[] =
     { "chunk_length", Parameter::PT_INT, "1:", "500000",
       "alert on chunk lengths greater than specified" },
 
-    // FIXIT-M this is backwards: 0 should mean nothing; -1 all
     { "client_flow_depth", Parameter::PT_INT, "-1:1460", "0",
       "raw request payload to inspect" },
 
@@ -356,11 +352,10 @@ static const Parameter hi_server_params[] =
       "don't alert on proxy use for this server" },
 
     { "decompress_pdf", Parameter::PT_BOOL, nullptr, "false",
-      "????" }, // FIXIT-M need to figure out this parameter format and implement it
+      "enable decompression of the compressed portions of PDF files" },
 
     { "decompress_swf", Parameter::PT_BOOL, nullptr, "false",
-      "????" }, // FIXIT-M need to figure out this parameter format and implement it with deflate
-                // and lzma
+      "enable decompression of SWF (Adobe Flash content)" },
 
     { "enable_cookies", Parameter::PT_BOOL, nullptr, "true",
       "extract cookies" },
@@ -419,8 +414,14 @@ static const Parameter hi_server_params[] =
     { "unlimited_decompress", Parameter::PT_BOOL, nullptr, "true",
       "decompress across multiple packets" },
 
+    // FIXIT-M need to implement xff header customization like:
+    // {
+    //     { name = 'x-forwarded-highest-priority', priority = 1 },
+    //     { name = 'x-forwarded-second-highest-priority', priority = 2 },
+    //     { name = 'x-forwarded-lowest-priority-custom', priority = 3 }
+    // }
     { "xff_headers", Parameter::PT_BOOL, nullptr, "false",
-      "????" }, // FIXIT-M need to figure out this parameter format and implement it
+      "not implemented" },
 
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -496,13 +497,13 @@ bool HttpServerModule::set(const char*, Value& v, SnortConfig*)
         server->iis_unicode_codepage = v.get_long();
 
     else if ( v.is("decompress_pdf") )
-        ;                               // FIXIT-M need to figure this out and implement it
+        server->file_decomp_modes |= (FILE_PDF_DEFL_BIT | FILE_REVERT_BIT);
 
     else if ( v.is("decompress_swf") )
-        ;                               // FIXIT-M need to figure this out and implement it
-                                        // including #define DECOMPRESS_DEFLATE "deflate" and
-                                        // including #define DECOMPRESS_LZMA "lzma"
-
+    {
+        server->file_decomp_modes |= (FILE_SWF_ZLIB_BIT | FILE_REVERT_BIT);
+        server->file_decomp_modes |= (FILE_SWF_LZMA_BIT | FILE_REVERT_BIT);
+    }
     else if ( v.is("directory") )
         server->directory.on = v.get_bool();
 
@@ -621,7 +622,7 @@ bool HttpServerModule::set(const char*, Value& v, SnortConfig*)
         v.get_bits(server->whitespace);
 
     else if ( v.is("xff_headers") )
-        ;                            // FIXIT-M need to figure this out and implement it
+        ;
 
     else
         return false;