service_inspectors/dns/libdns.a \
service_inspectors/ftp_telnet/libftp_telnet.a \
service_inspectors/gtp/libgtp_inspect.a \
+service_inspectors/http_inspect/libhttp_inspect.a \
service_inspectors/modbus/libmodbus.a \
service_inspectors/nhttp_inspect/libnhttp_inspect.a \
service_inspectors/rpc_decode/librpc_decode.a \
stream/file/libstream_file.a \
stream/libstream_paf.a \
mime/libmime.a \
-service_inspectors/http_inspect/libhttp_inspect.a \
$(pig_list) \
ips_options/libips_options.a \
search_engines/libsearch_engines.a \
static uint8_t File_Decomp_Buffer[DECODE_BLEN];
+void keep_decomp_lib() { }
+
/* Look for possible sig at the current payload location.
Do NOT beyond the current location (initial Next_In). */
static fd_status_t Locate_Sig_Here(fd_session_p_t SessionPtr)
//--------------------------------------------------------------------------
// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 2003-2013 Sourcefire, Inc.
//
// This program is free software; you can redistribute it and/or modify it
// under the terms of the GNU General Public License Version 2 as published
/* API Functions */
+void keep_decomp_lib(); // FIXIT-L eliminate; required to keep symbols for dyn plugins
+
/* Create a new decompression session object */
fd_session_p_t SO_PUBLIC File_Decomp_New();
if (SnortConfig::output_char_data())
{
LogCharData(log, (const char*)p->data, p->dsize);
- if (!IsJSNormData(p->flow))
- {
- TextLog_Print(log, "%s\n", "Normalized JavaScript for this packet");
- LogCharData(log, (const char*)g_file_data.data, g_file_data.len);
- }
- else if (!IsGzipData(p->flow))
+
+ if ( g_file_data.len > 0 )
{
- TextLog_Print(log, "%s\n", "Decompressed Data for this packet");
+ TextLog_Print(log, "%s\n", "File data");
LogCharData(log, (const char*)g_file_data.data, g_file_data.len);
}
}
else
{
LogNetData(log, p->data, p->dsize, p);
- if (!IsJSNormData(p->flow))
- {
- TextLog_Print(log, "%s\n", "Normalized JavaScript for this packet");
- LogNetData(log, g_file_data.data, g_file_data.len, p);
- }
- else if (!IsGzipData(p->flow))
+
+ if ( g_file_data.len > 0 )
{
- TextLog_Print(log, "%s\n", "Decompressed Data for this packet");
+ TextLog_Print(log, "%s\n", "File data");
LogNetData(log, g_file_data.data, g_file_data.len, p);
}
}
#include <netinet/in.h>
#include <sys/stat.h>
+#include "decompress/file_decomp.h"
#include "detection/detect.h"
#include "detection/detection_util.h"
#include "detection/fp_config.h"
#include "target_based/sftarget_reader.h"
#include "time/packet_time.h"
#include "time/periodic.h"
+#include "utils/kmap.h"
#include "utils/util.h"
+#include "utils/util_utf.h"
+#include "utils/util_jsnorm.h"
#ifdef PIGLET
#include "piglet/piglet.h"
set_quick_exit(false);
+ keep_utf_lib();
+ keep_kmap_lib();
+ keep_decomp_lib();
+ keep_jsnorm_lib();
+
TimeStart();
}
#define MAX_DEPTH 65535
#define MIN_DEPTH -1
-class DecodeConfig
+class SO_PUBLIC DecodeConfig
{
public:
void set_ignore_data(bool);
hi_ui_iis_unicode_map.cc hi_ui_iis_unicode_map.h \
hi_util.h
-# can't be linked dynamically yet
-#if STATIC_INSPECTORS
+if STATIC_INSPECTORS
noinst_LIBRARIES = libhttp_inspect.a
libhttp_inspect_a_SOURCES = $(file_list)
-#else
-#shlibdir = $(pkglibdir)/inspectors
-#shlib_LTLIBRARIES = libhttp_inspect.la
-#libhttp_inspect_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
-#libhttp_inspect_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared
-#libhttp_inspect_la_SOURCES = $(file_list)
-#endif
+else
+shlibdir = $(pkglibdir)/inspectors
+shlib_LTLIBRARIES = libhttp_inspect.la
+libhttp_inspect_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO
+libhttp_inspect_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared
+libhttp_inspect_la_SOURCES = $(file_list)
+endif
nullptr // reset
};
-// can't be linked dynamically yet
-//#ifdef BUILDING_SO
-//SO_PUBLIC const BaseApi* snort_plugins[] =
-//{
-// &hg_api.base,
-// &hi_api.base,
-// nullptr
-//};
-//#else
+#ifdef BUILDING_SO
+SO_PUBLIC const BaseApi* snort_plugins[] =
+{
+ &hg_api.base,
+ &hi_api.base,
+ nullptr
+};
+#else
const BaseApi* sin_http_global = &hg_api.base;
const BaseApi* sin_http_inspect = &hi_api.base;
-//#endif
+#endif
#endif
#include "framework/inspector.h"
-extern const BaseApi* sin_http_global;
-extern const BaseApi* sin_http_inspect;
extern const BaseApi* sin_imap;
extern const BaseApi* sin_pop;
extern const BaseApi* sin_smtp;
extern const BaseApi* sin_ftp_server;
extern const BaseApi* sin_ftp_data;
extern const BaseApi* sin_gtp;
+extern const BaseApi* sin_http_global;
+extern const BaseApi* sin_http_inspect;
extern const BaseApi* sin_modbus;
extern const BaseApi* sin_nhttp;
extern const BaseApi* sin_rpc_decode;
const BaseApi* service_inspectors[] =
{
- sin_http_global,
- sin_http_inspect,
sin_imap,
sin_pop,
sin_smtp,
sin_ftp_server,
sin_ftp_data,
sin_gtp,
+ sin_http_global,
+ sin_http_inspect,
sin_modbus,
sin_nhttp,
sin_rpc_decode,
#include "utils/util.h"
-/*
-*
-*/
+void keep_kmap_lib() { }
+
KMAP* KMapNew(KMapUserFreeFunc userfree)
{
KMAP* km = (KMAP*)snort_calloc(sizeof(KMAP));
int nocase;
} KMAP;
+void keep_kmap_lib(); // FIXIT-L eliminate; required to keep symbols for dyn plugins
+
SO_PUBLIC KMAP* KMapNew(KMapUserFreeFunc userfree);
SO_PUBLIC void KMapDelete(KMAP* km);
#define ANY '\0'
+void keep_jsnorm_lib() { }
+
typedef enum
{
PNORM_ACT_DQUOTES,
uint16_t alerts;
} JSState;
+void keep_jsnorm_lib(); // FIXIT-L eliminate; required to keep symbols for dyn plugins
+
SO_PUBLIC void InitJSNormLookupTable();
SO_PUBLIC int JSNormalizeDecode(
#define DSTATE_THIRD 2
#define DSTATE_FOURTH 3
+void keep_utf_lib() { }
+
/* init a new decode_utf_state_t */
int init_decode_utf_state(decode_utf_state_t* p)
{
int charset;
};
+void keep_utf_lib(); // FIXIT-L eliminate; required to keep symbols for dyn plugins
+
// Init & Terminate functions for decode_utf_state_t
SO_PUBLIC int init_decode_utf_state(decode_utf_state_t*);
SO_PUBLIC int term_decode_utf_state(decode_utf_state_t*);