added default bindings for stream only configs

diff --git a/ChangeLog b/ChangeLog
index 4efd64427a027e0c87866c1951b53b0c88028282..1bd4c0113581a56637300e7925e57c0c641c5864 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -10,6 +10,7 @@
 -- new_http_inspect now gid 219 and other Tom Tweaks
 -- new_http_inspect reactiveated (no longer REG_TEST only)
 -- ip defrag fixes from Josh
+-- added default bindings for stream only configs
 
 126
 -- pulled latest from tom

diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index 013fae904ea08ac90b8f69fd8a42d6017497b0db..7a7e70ee63a4f492adb2f48e0a26e13b40fe6693 100644 (file)
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -59,7 +59,7 @@ using namespace std;
 struct PHGlobal
 {
     const InspectApi& api;
-    bool init;
+    bool init;  // call api.pinit()
 
     PHGlobal(const InspectApi& p) : api(p)
     { init = true; };
@@ -71,9 +71,10 @@ struct PHGlobal
 struct PHClass
 {
     const InspectApi& api;
+    bool init;  // call pin->tinit()
 
-    PHClass(const InspectApi& p) : api(p) { };
-    ~PHClass() { };
+    PHClass(const InspectApi& p) : api(p)
+    { init = true; };
 
     static bool comp (PHClass* a, PHClass* b)
     { return ( a->api.type < b->api.type ); };
@@ -408,10 +409,14 @@ void InspectorManager::free_inspector(Inspector* p)
     p->get_api()->dtor(p);
 }
 
-InspectSsnFunc InspectorManager::get_session(const char* key)
+InspectSsnFunc InspectorManager::get_session(uint16_t proto)
 {
-    const InspectApi* api = get_plugin(key);
-    return api ? api->ssn : nullptr;
+    for ( auto* p : s_handlers )
+    {
+        if ( p->api.type == IT_STREAM && p->api.proto_bits == proto && !p->init )
+            return p->api.ssn;
+    }
+    return nullptr;
 } 
 
 //-------------------------------------------------------------------------
@@ -432,7 +437,7 @@ void InspectorManager::delete_config (SnortConfig* sc)
     sc->framework_config = nullptr;
 }
 
-static PHClass* GetClass(const char* keyword, FrameworkConfig* fc)
+static PHClass* get_class(const char* keyword, FrameworkConfig* fc)
 {
     for ( auto* p : fc->clist )
         if ( !strcmp(p->api.base.name, keyword) )
@@ -467,7 +472,11 @@ void InspectorManager::thread_init(SnortConfig* sc)
     if ( pi && pi->framework_policy )
     {
         for ( auto* p : pi->framework_policy->ilist )
-            p->handler->tinit();
+            if ( p->pp_class.init )
+            {
+                p->handler->tinit();
+                p->pp_class.init = false;
+            }
     }
 }
 
@@ -478,7 +487,11 @@ void InspectorManager::thread_term(SnortConfig* sc)
     if ( pi && pi->framework_policy )
     {
         for ( auto* p : pi->framework_policy->ilist )
-            p->handler->tterm();
+            if ( !p->pp_class.init )
+            {
+                p->handler->tterm();
+                p->pp_class.init = true;
+            }
     }
 
     for ( auto* p : sc->framework_config->clist )
@@ -501,7 +514,7 @@ void InspectorManager::instantiate(
     // since given api and mod
     const char* keyword = api->base.name;
 
-    PHClass* ppc = GetClass(keyword, fc);
+    PHClass* ppc = get_class(keyword, fc);
 
     if ( !ppc )
         ParseError("unknown inspector: '%s'.", keyword);
@@ -560,7 +573,7 @@ static bool configure(SnortConfig* sc, FrameworkPolicy* fp)
     sort(fp->ilist.begin(), fp->ilist.end(), PHInstance::comp);
     fp->vectorize();
 
-    if ( fp->service.num && !fp->binder && InspectorManager::get_wizard() )
+    if ( fp->session.num && !fp->binder )
         instantiate_binder(sc, fp);
 
     return ok;

diff --git a/src/managers/inspector_manager.h b/src/managers/inspector_manager.h
index b44fe0eea6cedec3f7e6ef8622e8055f3f4e7c0a..e5129488a113577f1fa04d75591bedf08f629b04 100644 (file)
--- a/src/managers/inspector_manager.h
+++ b/src/managers/inspector_manager.h
@@ -50,7 +50,7 @@ public:
         const InspectApi*, Module*, SnortConfig*, const char* name = nullptr);
 
     static void free_inspector(Inspector*);
-    static InspectSsnFunc get_session(const char* key);
+    static InspectSsnFunc get_session(uint16_t proto);
 
     static InspectorType get_type(const char* key);
     static Inspector* get_inspector(const char* key, bool dflt_only = false);

diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc
index 7d73c5c52c7473c4ef33d16b1d7a8b1ea5529bb8..7b44b325f8bb817de0147f82bb85b31190e1a708 100644 (file)
--- a/src/stream/base/stream_base.cc
+++ b/src/stream/base/stream_base.cc
@@ -158,22 +158,22 @@ void StreamBase::tinit()
 
     if ( config->tcp_cfg.max_sessions )
     {
-        if ( (f = InspectorManager::get_session("stream_tcp")) )
+        if ( (f = InspectorManager::get_session((uint16_t)PktType::TCP)) )
             flow_con->init_tcp(config->tcp_cfg, f);
     }
     if ( config->udp_cfg.max_sessions )
     {
-        if ( (f = InspectorManager::get_session("stream_udp")) )
+        if ( (f = InspectorManager::get_session((uint16_t)PktType::UDP)) )
             flow_con->init_udp(config->udp_cfg, f);
     }
     if ( config->ip_cfg.max_sessions )
     {
-        if ( (f = InspectorManager::get_session("stream_ip")) )
+        if ( (f = InspectorManager::get_session((uint16_t)PktType::IP)) )
             flow_con->init_ip(config->ip_cfg, f);
     }
     if ( config->icmp_cfg.max_sessions )
     {
-        if ( (f = InspectorManager::get_session("stream_icmp")) )
+        if ( (f = InspectorManager::get_session((uint16_t)PktType::ICMP)) )
             flow_con->init_icmp(config->icmp_cfg, f);
     }
     if ( config->tcp_cfg.max_sessions || config->udp_cfg.max_sessions )

diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc
index f99ff5ea01ec590630b33edc0eee8692ae3c5b40..9957e9e501756f0e142a1667513df3ef0af62948 100644 (file)
--- a/src/stream/icmp/icmp_session.cc
+++ b/src/stream/icmp/icmp_session.cc
@@ -72,7 +72,8 @@ static void IcmpSessionCleanup(Flow *ssn)
 
     ssn->clear();
 
-    icmpStats.released++;
+    if ( ssn->s5_state.session_flags & SSNFLAG_SEEN_SENDER )
+        icmpStats.released++;
 }
 
 static int ProcessIcmpUnreach(Packet *p)
@@ -202,6 +203,7 @@ bool IcmpSession::setup(Packet*)
     ssn_time.tv_sec = 0;
     ssn_time.tv_usec = 0;
     icmpStats.created++;
+    flow->s5_state.session_flags |= SSNFLAG_SEEN_SENDER;
     return true;
 }
 

diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc
index f72adf720348ec5fbfa53a829d3e98c41349aac7..129e9d526b3fa1e1a6069c95b1bafd74eaa2b71a 100644 (file)
--- a/src/stream/tcp/stream_tcp.cc
+++ b/src/stream/tcp/stream_tcp.cc
@@ -141,10 +141,10 @@ static const InspectApi tcp_api =
     },
     IT_STREAM,
     (unsigned)PktType::TCP,
-    nullptr, // buffers
-    nullptr, // service
-    nullptr, // init
-    nullptr, // term
+    nullptr,  // buffers
+    nullptr,  // service
+    nullptr,  // init
+    nullptr,  // term
     tcp_tinit,
     tcp_tterm,
     tcp_ctor,

diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc
index 0f4bca6c6f8569e1515012b912e014880dbef1ab..df8644005e3b0ec39bb5465f0e32e9f560ec5bb6 100644 (file)
--- a/src/stream/udp/udp_session.cc
+++ b/src/stream/udp/udp_session.cc
@@ -69,7 +69,9 @@ static void UdpSessionCleanup(Flow *lwssn)
         CloseStreamSession(&sfBase, SESSION_CLOSED_NORMALLY);
     }
 
-    udpStats.released++;
+    if ( lwssn->s5_state.session_flags & SSNFLAG_SEEN_SENDER )
+        udpStats.released++;
+
     RemoveUDPSession(&sfBase);
 }