All subtypes of Connector have a 'direction' configuration element and a
'connector' element. The 'connector' string is the key used to identify the
-element for sidechannel configiration. The 'direction' element may have a
+element for sidechannel configuration. The 'direction' element may have a
default value, for instance TcpConnector's are 'duplex'.
FileConnector configuration adds two additional element:
-* name = string - used as part of the messsage file name
+* name = string - used as part of the message file name
* format = 'text' or 'binary' - FileConnector supports two file types
==== TCP
-dce_tcp inspector supports defragementation, reassembling, and policy that is
+dce_tcp inspector supports defragmentation, reassembling, and policy that is
similar to SMB.
==== UDP
-dce_udp is a very simple inspector that only supports defragementation
+dce_udp is a very simple inspector that only supports defragmentation
==== Rule Options
magic = { { content = "| 47 49 46 38 39 61 |",offset = 0 } } },
The previous two rules define GIF format, because two file magics are
-different. File magics are specifed by content and offset, which look
+different. File magics are specified by content and offset, which look
at content at particular file offset to identify the file type. In this
case, two magics look at the beginning of the file. You can use character
if it is printable or hex value in between "|".
-HighAvailability (or HA) is a Snort module that provides state coherancy
+HighAvailability (or HA) is a Snort module that provides state coherency
between two partner snort instances. It uses SideChannel for messaging.
There can be multiple types of HA within Snort and Snort plugins. HA
in URI paths.
backslash_to_slash is a tweak to path simplification for servers that allow
-directories to be separated by backslashs:
+directories to be separated by backslashes:
/this/is/the/normal/way/to/write/a/path
cookie headers Cookie and Set-Cookie. http_raw_header includes the
unmodified header names and values as they appeared in the original
message. http_header is the same except percent encodings are removed and
-pathes are simplified exactly as if the headers were a URI.
+paths are simplified exactly as if the headers were a URI.
In most cases specifying individual headers creates a more efficient and
accurate rule. It is recommended that new rules be written using individual
These are the unmodified first header line of the HTTP request and response
messages respectively. These rule options are a safety valve in case you
need to do something you cannot otherwise do. In most cases it is better to
-use a rule option for a specifc part of the first header line. For a
+use a rule option for a specific part of the first header line. For a
request message those are http_method, http_raw_uri, and http_version. For
a response message those are http_version, http_stat_code, and
http_stat_msg.
accessing the statistics generated in this format has been included for
convenience (see fbstreamer in tools). This tool generates a YAML array of
records found, allowing the data to be read by humans or passed into other
-analysis tools. For information on working direclty with the Flatbuffers file
+analysis tools. For information on working directly with the Flatbuffers file
format used by Performance monitor, see the developer notes for Performance
monitor or the code provided for fbstreamer.
The SideChannel configuration mostly serves to map a port number to a Connector
or set of connectors. Each port mapping can have at most one transmit plus
one receive connector or one duplex connector. Multiple SideChannel's
-may be configured and instatiated to support multiple applications.
+may be configured and instantiated to support multiple applications.
-An example SideChannel configuration along with the corresponing Connector
+An example SideChannel configuration along with the corresponding Connector
configuration:
side_channel =
* Snort2Lua currently does not handle variables well. First, that means
variables will not always be parsed correctly. Second, sometimes a
-variables value will be outoput in the lua file rather than a variable
+variables value will be output in the lua file rather than a variable
For instance, if Snort2Lua attempted to convert the line
-'include $RULE_PATH/example.rule', the output may ouput
+'include $RULE_PATH/example.rule', the output may output
'include /etc/rules/example.rule' instead.
* When Snort2Lua parses a ‘binding’ configuration file, the rules and
* If a rule's action is a custom ruletype, that rule action will be silently
converted to the rultype's 'type'. No warnings or errors are currently
-emmitted. Additionally, the custom ruletypes outputs will be silently
+emitted. Additionally, the custom ruletypes outputs will be silently
discarded.
* If the original configuration contains a binding that points to another
multiple error returns. The C-style use of zero for success and -1 for
error is less readable and often leads to messy code that either ignores
the various errors anyway or needlessly and ineffectively tries to do
- something aobut them. Generally that code is not updated if new errors
+ something about them. Generally that code is not updated if new errors
are added.
=== Macros (aka defines)
/*
* DSAP != SSAP != 0xAA .. either we are having frame which doesn't
* carry IP datagrams or has RIF information present. We assume
- * lattest ...
+ * the latter ...
*/
if (cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) +
uint32_t nethdr; /* network header offset. (ip etc...) */
uint32_t transhdr; /* transport header offset (tcp/udp/icmp ..) */
uint32_t data;
- uint32_t val; /* which fields are valid. (NULL could be
- * valids also) */
+ uint32_t val; /* which fields are valid. (NULL could be valid also) */
/* Packet struct --> was null */
#define NOPACKET_STRUCT 0x1
/* no transport headers in packet */
* - use for token testing after parsing the language tokens using lex or the like.
*
* Keyword-Search: searches the input text for one of multiple keywords,
-* and supports case sensitivite and case insensitive patterns.
+* and supports case sensitive and case insensitive patterns.
*/
#include "sfksearch.h"
else
{
/*
- * Start a new sibling bracnch to finish this Keyword
+ * Start a new sibling branch to finish this Keyword
*/
root->sibling= KTrieCreateNode(ts);
if ( !root->sibling )
}
/*
- * Initialze the Bad Character shift table.
+ * Initialize the Bad Character shift table.
*/
for ( int i = 0; i < KTRIE_ROOT_NODES; i++ )
{
extern const BaseApi* cd_ipv4[]; // static due to dependence on fpdetect
extern const BaseApi* cd_hopopts[]; // static to ensure the symbols CheckIPV6HopOptions
- // and CheckIPv6ExtensionOrder the final executuable.
+ // and CheckIPv6ExtensionOrder the final executable.
extern const BaseApi* cd_tcp[]; // static because only file that specific functions
- // (symbols will be removed from final executabel)
+ // (symbols will be removed from final executable)
#ifdef STATIC_CODECS
extern const BaseApi* cd_ah[];
};
constexpr uint8_t MIN_AUTH_LEN = 16; // this is in minimum number of bytes ...
-// no relatino to the AuthHdr.len field.
+// no relation to the AuthHdr.len field.
} // anonymous namespace
void AuthCodec::get_protocol_ids(std::vector<ProtocolId>& v)
data.decode_flags |= DECODE_RF;
#endif
- // three least signifigant bits are all flags
+ // three least significant bits are all flags
const uint16_t frag_offset = ip6frag_hdr->off();
if (frag_offset || (snort.decode_flags & DECODE_MF))
break;
case icmp::IcmpType::ROUTER_ADVERTISE:
- TextLog_Print(log, "ROUTER ADVERTISMENT: "
+ TextLog_Print(log, "ROUTER ADVERTISEMENT: "
"Num addrs: %d Addr entry size: %d Lifetime: %u",
icmph->s_icmp_num_addrs, icmph->s_icmp_wpa,
ntohs(icmph->s_icmp_lifetime));
if ((tot_len + 1) >= o_len)
code = tcp::OPT_TRUNC;
- /* RFC sez that we MUST have atleast this much data */
+ /* RFC says that we MUST have at least this much data */
else if (option->len < 2)
code = tcp::OPT_BADLEN;
else if ((ntohl(ip6h->ip6_dst.u6_addr32[3]) >= 0x80000000) &&
(ntohl(ip6h->ip6_dst.u6_addr32[3]) <= 0xFFFFFFFF))
{
- return; // Dynamiclly allocated by hosts when needed
+ return; // Dynamically allocated by hosts when needed
}
else
{
}
else /* expected_len < 0 (i.e. variable length) */
{
- /* RFC sez that we MUST have atleast this much data */
+ /* RFC says that we MUST have at least this much data */
if (opt->len < 2)
return tcp::OPT_BADLEN;
bool UdpCodec::encode(const uint8_t* const raw_in, const uint16_t /*raw_len*/,
EncState& enc, Buffer& buf, Flow*)
{
- // If we enter this function, this packe is some sort of tunnel.
+ // If we enter this function, this packet is some sort of tunnel.
if (!buf.allocate(udp::UDP_HEADER_LEN))
return false;
* is to either include all of the checksum details in a header,
* or ensure I include these symbols for every linker which
* can be used. Obviously, setting correct linker flags is
- * signifigantly more difficult, so these functions will all
+ * significantly more difficult, so these functions will all
* stay in a header file
*/
/*
* IT IS HIGHLY RECOMMENDED to use the above API. Rathern than calling
- * any of of the following recomendations directly
+ * any of of the following recommendations directly
*/
namespace detail
{
const CiscoMetaDataOpt* cmd_options =
reinterpret_cast<const CiscoMetaDataOpt*>(raw.data + sizeof(CiscoMetaDataHdr));
// validate options, lengths, and SGTs
- cmdh_rem_len -= sizeof(CiscoMetaDataHdr) + sizeof(uint16_t); //2 octects for ethertype
+ cmdh_rem_len -= sizeof(CiscoMetaDataHdr) + sizeof(uint16_t); //2 octets for ethertype
if(cmdh_rem_len == 0)
cmd_options = nullptr;
// *** NOTE: THE CODEC AND MODULE HAVE A DIFFERENT NAME!
// since the module is only creating a rule stub and is NOT
-// used for configurtion, it doesn't matter. However, if you want to use the module
+// used for configuration, it doesn't matter. However, if you want to use the module
// for configuration, ensure the names are identical before continuing!
static Module* mod_ctor()
{ return new PPPoEModule; }
#include "framework/codec.h"
#define CD_DEFAULT_NAME "unknown"
-#define CD_DEFAULT_HELP "support for unkown protocols"
+#define CD_DEFAULT_HELP "support for unknown protocols"
namespace
{
#include "packet_io/active.h"
#define CD_GTP_NAME "gtp"
-#define CD_GTP_HELP "support for general-packet-radio-service tunnelling protocol"
+#define CD_GTP_HELP "support for general-packet-radio-service tunneling protocol"
namespace
{
TextLog_NewLine(text_log);
TextLog_Puts(text_log, "\tIPv4\n\t\t");
- // COPIED DIRECTLY FROM ipv4 CODEC. This is specificially replicated since
+ // COPIED DIRECTLY FROM ipv4 CODEC. This is specifically replicated since
// the two are not necessarily the same.
// FIXIT-H this does NOT obfuscate correctly
if ( sock_fd < 0 )
{
- ErrorMessage("TcpConnector: tranmitting to a closed socket\n");
+ ErrorMessage("TcpConnector: transmitting to a closed socket\n");
delete tmsg;
return false;
}
at least MAX_SIG_LENGTH bytes in the output buffer. This assumption
is valid for the current implementation where the signature only
occurs at the beginning of the file. For the generic case of the sig
- begin embedded with the file, the seach will need to modified.*/
+ begin embedded with the file, the search will need to modified.*/
while ( 1 )
{
/* if we get to the end of the sig table (or the table is empty),
FILE_COMPRESSION_TYPE_MAX
};
-/* Potential decompression modes, passed in at initalization time. */
+/* Potential decompression modes, passed in at initialization time. */
#define FILE_SWF_LZMA_BIT (0x00000001)
#define FILE_SWF_ZLIB_BIT (0x00000002)
#define FILE_PDF_DEFL_BIT (0x00000004)
}
/* If available, get N bytes from the input queue. All N must be
- availble for this call to succeed. */
+ available for this call to succeed. */
inline bool Get_N(fd_session_p_t SessionPtr, uint8_t** c, uint16_t N)
{
if ( (SessionPtr->Next_In != NULL) && (SessionPtr->Avail_In >= N) )
}
/* Parse the buffered Filter_Spec and create a stream decompression
- mode and/or event alerts. Return File_Decomp_OK if successfui.
+ mode and/or event alerts. Return File_Decomp_OK if successful.
Return File_Decomp_Error for a parsing error. */
static fd_status_t Process_Filter_Spec(fd_session_p_t SessionPtr)
{
fd_PDF_Parse_p_t p = &(SessionPtr->PDF->Parse);
/* The parser starts in the P_COMMENT state we start
parsing the file just after the signature is located
- and the signature is syntactially a comment. */
+ and the signature is syntactically a comment. */
p->State = P_COMMENT;
p->Parse_Stack_Index = 0; // Stack is empty
}
if ( p->State != P_XREF )
{
p->Sub_State = P_XREF_TOKEN;
- p->Elem_Index = 1; // Aready matched the first char in START state
+ p->Elem_Index = 1; // already matched the first char in START state
p->State = P_XREF;
Xref_Tok = (uint8_t*)((c == TOK_XRF_XREF[0]) ? TOK_XRF_XREF : TOK_XRF_STARTXREF);
return( File_Decomp_OK );
return( File_Decomp_OK );
}
-/* After processing a stream, close the decompession engine
+/* After processing a stream, close the decompression engine
and return the state of the parser. */
static fd_status_t Close_Stream(fd_session_p_t SessionPtr)
{
}
// FIXIT-M restrict detect to current ip layer
- // Curently, if a rule is found on any IP layer, we perform the detect routine
+ // Currently, if a rule is found on any IP layer, we perform the detect routine
// on the entire packet. Instead, we should only perform detect on that layer!!
switch ( p->type() )
{
*
* PORT_RULE_MAP -> srcPortGroup,dstPortGroup,genericPortGroup
* PortGroup -> pgPatData, pgPatDataUri (acsm objects), (also rule_node lists 1/rule,
- * not neeed). each rule content added to an acsm object has a PMX data ptr
+ * not needed). each rule content added to an acsm object has a PMX data ptr
* associated with it.
* RULE_NODE -> iRuleNodeID (used for bitmap object index)
* PMX -> RULE_NODE(->otn), PatternMatchData
* Implementation:
*
* Each PortList Object will be translated into a PortGroup, then pointed to by the
- * PortGroup array in the PORT_RULE_MAP for the procotocol
+ * PortGroup array in the PORT_RULE_MAP for the protocol
*
* protocol = tcp, udp, ip, icmp - one port_rule_map for each of these protocols
* { create a port_rule_map
/*
** Build a Pattern group for the Uri-Content rules in this group
**
-** The patterns added for each rule must be suffcient so if we find any of them
+** The patterns added for each rule must be sufficient so if we find any of them
** we proceed to fully analyze the OTN and RTN against the packet.
**
*/
// pattern matcher as is since the content won't be evaluated as a rule
// option.
//
- // 2. negated contents since truncating them could inadvertantly
+ // 2. negated contents since truncating them could inadvertently
// disable evaluation of a rule - the shorter pattern may be found,
// while the unaltered pattern may not be found, disabling inspection
// of a rule we should inspect.
if (bytes < (int)pmd->pattern_size)
{
- /* The patten is all '\0' - use the whole pattern
+ /* The pattern is all '\0' - use the whole pattern
* XXX This potentially hurts the performance boost
* gained by stripping leading zeros */
if (bytes == 0)
}
/*
- * Create the PortGroup for these PortObject2 entitiies
+ * Create the PortGroup for these PortObject2 entities
*
* This builds the 1st pass multi-pattern state machines for
* content and uricontent based on the rules in the PortObjects
* Create port group objects for all port tables
*
* note: any ports are standard PortObjects not PortObject2s so we have to
- * uprade them for the create port group function
+ * upgrade them for the create port group function
*/
static int fpCreatePortGroups(SnortConfig* sc, RulePortTables* p)
{
* For each service we create a PortGroup based on the otn's defined to
* be applicable to that service by the metadata option.
*
- * Then we lookup the protocol/srvc oridinal in the target-based area
+ * Then we lookup the protocol/srvc ordinal in the target-based area
* and assign the PortGroup for the srvc to it.
*
* spg - service port group (lookup should be by service id/tag)
** Add and Event to the appropriate Match Queue: Alert, Pass, or Log.
** This allows us to find multiple events per packet and pick the 'best'
** one. This function also allows us to change the order of alert,
-** pass, and log signatures by cacheing them for decision later.
+** pass, and log signatures by caching them for decision later.
**
** IMPORTANT NOTE:
** fpAddMatch must be called even when the queue has been maxed
if (eval_data.flowbit_failed)
return -1;
- /* If this is for an IP rule set, evalute the rules from
+ /* If this is for an IP rule set, evaluate the rules from
* the inner IP offset as well */
if (eval_data.p->packet_flags & PKT_IP_RULE)
{
const uint8_t* tmp_data = eval_data.p->data;
uint16_t tmp_dsize = eval_data.p->dsize;
- /* clear so we dont keep recursing */
+ /* clear so we don't keep recursing */
eval_data.p->packet_flags &= ~PKT_IP_RULE;
eval_data.p->packet_flags |= PKT_IP_RULE_2ND;
** flag causes any drop/sdrop/reject rules to be loaded as alert rules.
** The default has been to ignore them on parsing.
**
-** If this is less than clear, herese the $.02 version:
+** If this is less than clear, here's the $.02 version:
** default order -> pass drop alert log ( --alert-before-pass reverts
** to -> drop alert pass log ) the 1st action-type of events in the rule
** ordering to be seen gets logged by default the --flush-all-events
for ( i = 0; i < o->iMatchInfoArraySize; i++ )
{
/* bail if were not dumping events in all the action groups,
- * and we've alresady got some events */
+ * and we've already got some events */
if (!SnortConfig::process_all_events() && (tcnt > 0))
return 1;
/*
* We must always sort so if we que 8 and log 3 and they are
* all from the same action group we want them sorted so we get
- * the highest 3 in priority, priority and lenght sort do NOT
+ * the highest 3 in priority, priority and length sort do NOT
* take precedence over 'alert drop pass ...' ordering. If
* order is 'drop alert', and we log 3 for drop alerts do not
* get logged. IF order is 'alert drop', and we log 3 for
**
** FORMAL OUTPUTS
** int - 0 for failed pattern match
-** 1 for sucessful pattern match
+** 1 for successful pattern match
**
*/
static inline int fpEvalHeaderSW(PortGroup* port_group, Packet* p,
"file:%p\n",p->ptrs.sp,p->ptrs.dp,proto_ordinal,proto,(void*)svc,(void*)file);
}
// FIXIT-P put alert service rules with file data fp in alert file group and
- // verfiy ports and service during rule eval to avoid searching file data 2x.
+ // verify ports and service during rule eval to avoid searching file data 2x.
int check_ports = (proto == SNORT_PROTO_USER) ? 2 : 1;
if ( file )
*
* returns
* length - of trimmed pattern
- * buff - ptr to new beggining of trimmed buffer
+ * buff - ptr to new beginning of trimmed buffer
*/
int flp_trim(const char* p, int plen, const char** buff)
{
// FIXIT-L wasting some memory here:
// - this is not used by content option logic directly
// - and only used on current eval (not across packets)
- // (partly mitigated by only allocating if excpetion_flag is set)
+ // (partly mitigated by only allocating if exception_flag is set)
//
/* Set if fast pattern matcher found a content in the packet,
but the rule option specifies a negated content. Only
** NOTES
** 5.15.02 - Initial version of pcrm.c distributed. - Norton/Roelker
**
-** Packet Classificationa and Rule Manager
-**
+** Packet Classification and Rule Manager
**
** A Fast Packet Classification method for Rule and Pattern Matching in SNORT
** --------------------------------------------------------------------------
/*
** The following functions are wrappers to the pcrm routines,
-** that utilize the variables that we have intialized by
+** that utilize the variables that we have initialized by
** calling fpCreateFastPacketDetection(). These functions
** are also used in the file fpdetect.c, where we do lookups
** on the initialized variables.
#define PCRM_H
// Packet Classification-Rule Manager
-// runle groups by source and dest ports as well as any
+// rule groups by source and dest ports as well as any
// (generic refers to any)
#include "ports/port_group.h"
void fpPrintServicePortGroupSummary(SnortConfig*, srmm_table_t*);
int fpCreateServiceMaps(SnortConfig*);
-// Service/Protocol Oridinal To PortGroup table
+// Service/Protocol Ordinal To PortGroup table
typedef std::vector<PortGroup*> PortGroupVector;
struct sopg_table_t
/** Allocate a TagNode
*
- * Alocates a TagNode while guaranteeing that total memory usage remains within TAG_MEMCAP.
+ * Allocates a TagNode while guaranteeing that total memory usage remains within TAG_MEMCAP.
* Least used nodes may be deleted from ssn_tag_cache and host_tag_cache to make space if
* the limit is being exceeded.
*
** 11/1/05 Updates to add support for rules for all events in
** decoders and preprocessors and the detection engine.
** Added support for rule by rule flushing control via
-** metadata. Also added code to check fo an otn for every
+** metadata. Also added code to check for an otn for every
** event (gid,sid pair). This is now required to get events
** to be logged. The decoders and preprocessors are still
** configured independently, which allows them to inspect and
** and GenerateEvent2() for portscan.cc. The GenerateSnortEvent()
** function now finds and otn and calls fpLogEvent.
**
-** Any event that has no otn associated with it's gid,sid pair,
-** will/should not alert, even if the preprocessor or decoiderr is
+** Any event that has no otn associated with it's gid,sid pair
+** will/should not alert, even if the preprocessor or decoder is
** configured to detect an alertable event.
**
** In the future, preporcessor may have an api that gets called
* This function has been updated to find an otn and route the call to fpLogEvent
* if possible. This requires a rule be written for each decoder event,
* and possibly some preporcessor events. The bulk of eventing is handled vie the
- * SnortEventqAdd() and SnortEventLog() functions - whichalready route the events to
+ * SnortEventqAdd() and SnortEventLog() functions - which already route the events to
* the fpLogEvent()function.
*/
uint32_t GenerateSnortEvent(Packet* p, uint32_t gid, uint32_t sid)
// allow file data remains in mempool. Even if a session is closed, the file
// data will stay in the mempool.
// 3) Then file data can be read through file_capture_read()
-// 4) Finally, fila data must be released from mempool file_capture_release()
+// 4) Finally, file data must be released from mempool file_capture_release()
#include <condition_variable>
#include <mutex>
// Store file to disk asynchronously
void store_file_async();
- // Log file capture mempoofile_contentl usage
+ // Log file capture mempool usage
static void print_mem_usage();
// Exit file capture, release all file capture memory etc,
#ifndef FILE_ENFORCER_H
#define FILE_ENFORCER_H
-// If a file transfered through HTTP is blocked, a new session might be created
+// If a file transferred through HTTP is blocked, a new session might be created
// to request the file data left. To block the new session, we use URL and IPs
// to continue blocking the same file.
@param thd Threshold object from sfthd_new()
@param gen_id Generator id
-@param sig_id Signauture id
+@param sig_id Signature id
@param tracking Selects tracking by src ip or by dst ip
-@param type Thresholding type: Limit, Threshold, or Limt+Threshold, Suppress
+@param type Thresholding type: Limit, Threshold, or Limit+Threshold, Suppress
@param priority Assigns a relative priority to this object, higher numbers imply higher priority
@param count Number of events
@param seconds Time duration over which this threshold object acts.
-@param ip IP address, for supression
-@param ip-mask IP mask, applied with ip_mask, for supression
+@param ip IP address, for suppression
+@param ip-mask IP mask, applied with ip_mask, for suppression
@return integer
@retval 0 successfully added the thresholding object
return -10;
}
p = (THD_NODE*)sfthd_item->sfthd_node_list->tail->ndata;
- if (p) /* just to be safe- if thers a tail, there is is node data */
+ if (p) /* just to be safe- if there is a tail, there is is node data */
{
if ( p->type != THD_TYPE_SUPPRESS && config->type != THD_TYPE_SUPPRESS )
{
/* Create a THD_NODE for this THD_ITEM (Object) */
sfthd_node = (THD_NODE*)snort_calloc(sizeof(THD_NODE));
- /* Limit priorities to force supression nodes to highest priority */
+ /* Limit priorities to force suppression nodes to highest priority */
if ( config->priority >= THD_PRIORITY_SUPPRESS )
{
config->priority = THD_PRIORITY_SUPPRESS - 1;
objects is done above.
Suppressions have the highest priority and are at the front of the
- list, the tail node is either a supprssion node or the only pure
+ list, the tail node is either a suppression node or the only pure
thresholding node.
*/
{
@param thd Threshold object from sfthd_new()
@param gen_id Generator id
-@param sig_id Signauture id
+@param sig_id Signature id
@param tracking Selects tracking by src ip or by dst ip
-@param type Thresholding type: Limit, Threshold, or Limt+Threshold, Suppress
+@param type Thresholding type: Limit, Threshold, or Limit+Threshold, Suppress
@param priority Assigns a relative priority to this object, higher numbers imply higher priority
@param count Number of events
@param seconds Time duration over which this threshold object acts.
-@param ip IP address, for supression
-@param ip-mask IP mask, applied with ip_mask, for supression
+@param ip IP address, for suppression
+@param ip-mask IP mask, applied with ip_mask, for suppression
@return integer
@retval 0 successfully added the thresholding object
/*
* Test for a global threshold object
- * we're here cause ther were no threshold objects for this gen_id/sig_id pair
+ * we're here cause there were no threshold objects for this gen_id/sig_id pair
*/
global_test:
The main thresholding data structure.
- Local and global threshold thd_id's are all unqiue, so we use just one
+ Local and global threshold thd_id's are all unique, so we use just one
ip_nodes lookup table
*/
struct THD_STRUCT
a += d[9]; // vlan tag, packet type, & version
b += d[10]; // mpls label
- c += d[11]; // address space id and 16bits of zero'd pad
+ c += d[11]; // address space id and 16bits of zeroed pad
finalize(a, b, c);
state |= (NEW | NEW_SESSION);
pending = NONE_PENDING;
- // Set the initial upate time to now+min_session_lifetime
+ // Set the initial update time to now+min_session_lifetime
packet_gettimeofday(&next_update);
next_update.tv_usec += min_session_lifetime.tv_usec;
if (next_update.tv_usec > USEC_PER_SEC)
if ( (content_end - msg->cursor + 1) < header->length )
{
- ErrorMessage("Consuming HA Update memssage - message too short\n");
+ ErrorMessage("Consuming HA Update message - message too short\n");
break;
}
// DECODE_ENCAP_LAYER for the next layer (and only the next layer).
constexpr uint16_t CODEC_ENCAP_LAYER = (CODEC_SAVE_LAYER | CODEC_UNSURE_ENCAP );
-// used to check ip6 extensino order
+// used to check ip6 extension order
constexpr uint16_t CODEC_ROUTING_SEEN = 0x0008;
// used by icmp4 for alerting
/* Reset before each decode of packet begins */
- /* Codec specific fields. These fields are only relevent to codecs. */
+ /* Codec specific fields. These fields are only relevant to codecs. */
uint16_t proto_bits; /* protocols contained within this packet
-- will be propogated to Snort++ Packet struct*/
uint16_t codec_flags; /* flags used while decoding */
/* The following values have junk values after initialization */
uint8_t ip6_extension_count; /* initialized in cd_ipv6.cc */
uint8_t curr_ip6_extension; /* initialized in cd_ipv6.cc */
- IpProtocol ip6_csum_proto; /* initalized in cd_ipv6.cc. Used for IPv6 checksums */
+ IpProtocol ip6_csum_proto; /* initialized in cd_ipv6.cc. Used for IPv6 checksums */
CodecData(ProtocolId init_prot) : next_prot_id(init_prot), lyr_len(0),
invalid_bytes(0), proto_bits(0), codec_flags(0), ip_layer_cnt(0)
* Main decoding function! Will get called when decoding a packet.
*
* PARAMS:
- * const RawData& = struct containing informatin about the
+ * const RawData& = struct containing information about the
* current packet's raw data
*
* CodecData& = Pass information the PacketManager and other
* like IPv4 (original ipv4 header may contain invalid options
* which we don't want to copy) and GTP have dynamic lengths.
* So, this parameter ensure the encode() function doesn't
- * need to revalidatae and recalculate the length.
+ * need to revalidate and recalculate the length.
* EncState& = The current EncState struct
* Buffer& = the packet which will be sent. All inward layers will already
* be set.
*
- * NOTE: all funtions MUST call the Buffer.allocate() function before
+ * NOTE: all functions MUST call the Buffer.allocate() function before
* manipulating memory.
*/
virtual bool encode(const uint8_t* const /*raw_in */,
}
/* Next row
- Get 1st node in next non-emtoy row/node list */
+ Get 1st node in next non-empty row/node list */
for ( t->crow++; t->crow < t->nrows; t->crow++ )
{
t->cnode = t->table[ t->crow ];
*
* @param h sfhashfcn ptr
* @param hash_fcn user specified hash function
- * @param keycmp_fcn user specified key comparisoin function
+ * @param keycmp_fcn user specified key comparison function
*/
int sfghash_set_keyops(SFGHASH* h,
*
* @param h sfhashfcn ptr
* @param hash_fcn user specified hash function
- * @param keycmp_fcn user specified key comparisoin function
+ * @param keycmp_fcn user specified key comparison function
*/
int sfhashfcn_set_keyops(SFHASHFCN* h,
unsigned (* hash_fcn)(SFHASHFCN* p, unsigned char* d, int n),
*
* Prime number calculation via Table lookups.
*
-* This was implemented for use with the hasing functions
+* This was implemented for use with the hashing functions
* in sfghash, and sfxhash.
*
*/
* This table incorporates a memory manager (memcap.c) to provide a memory cap,
* and an automatic node recovery system for out of memory management. Keys and
* Data are copied into the hash table during the add operation. The data may
- * be allocated and free'd by the user (by setting the datasize to zero ). A
+ * be allocated and freed by the user (by setting the datasize to zero ). A
* user callback is provided to allow the user to do cleanup whenever a node
- * is released, by either the ANR system or the relase() function.
+ * is released, by either the ANR system or the release() function.
*
* Users can and should delete nodes when they know they are not needed anymore,
* but this custom table is designed for the case where nodes are allocated
* permanently, we have to limit memory, and we wish to recycle old nodes.
- * Many problems have a natural node ageing paradigm working in our favor,
+ * Many problems have a natural node aging paradigm working in our favor,
* so automated node aging makes sense. i.e. thresholding, tcp state.
*
* This hash table maps keys to data. All keys must be unique.
- * Uniqueness is enforcedby the code.
+ * Uniqueness is enforced by the code.
*
* Features:
*
*/
if ( !hnode && t->anr_flag && t->gtail )
{
- /* Find the oldes node the users willing to let go. */
+ /* Find the oldest node the users willing to let go. */
for (hnode = t->gtail; hnode; hnode = hnode->gprev )
{
if ( t->anrfree ) /* User has provided a permission+release callback function */
*
* Find a Node based on the key, return the node and the index.
* The index is valid even if the return value is nullptr, in which
- * case the index is the corect row in which the node should be
+ * case the index is the correct row in which the node should be
* created.
*
*/
* key users key pointer
* data users data pointer
*
- * eturn integer
+ * return integer
* retval SFXHASH_OK success
* retval SFXHASH_INTABLE already in the table, t->cnode points to the node
* retval SFXHASH_NOMEM not enough memory
}
/* Next row
- Get 1st node in next non-emtoy row/node list */
+ Get 1st node in next non-empty row/node list */
for ( t->crow++; t->crow < t->nrows; t->crow++ )
{
t->cnode = t->table[ t->crow ];
/*
Auto Node Recovery Callback - optional
- This is called to ask the user to kill a node, if it reutrns !0 than the hash
+ This is called to ask the user to kill a node, if it returns !0 than the hash
library does not kill this node. If the user os willing to let the node die,
- the user must do any free'ing or clean up on the node during this call.
+ the user must do any freeing or clean up on the node during this call.
*/
int anrfree(void* key, void* data)
{
struct SFXHASH_NODE
{
- struct SFXHASH_NODE* gnext; // global node list - used for ageing nodes
+ struct SFXHASH_NODE* gnext; // global node list - used for aging nodes
struct SFXHASH_NODE* gprev;
struct SFXHASH_NODE* next; // row node list
struct SFXHASH_NODE* prev;
unsigned find_success;
SFXHASH_NODE* ghead, * gtail; // global - root of all nodes allocated in table
- SFXHASH_NODE* fhead, * ftail; // list of free nodes, which are recyled
+ SFXHASH_NODE* fhead, * ftail; // list of free nodes, which are recycled
SFXHASH_NODE* gnode; // gfirst/gnext node ptr */
int recycle_nodes; // recycle nodes. Nodes are not freed, but are used for
// subsequent new nodes
* the new node. anr_tries indicates # of ANR tries.*/
unsigned anr_tries;
- unsigned anr_count; // # ANR ops performaed
+ unsigned anr_count; // # ANR ops performed
int anr_flag; // 0=off, !0=on
SFXHASH_FREE_FCN anrfree;
inline unsigned sfxhash_find_total(SFXHASH* t)
{ return t->find_success + t->find_fail; }
-// Get the # unsucessful finds
+// Get the # unsuccessful finds
inline unsigned sfxhash_find_fail(SFXHASH* t)
{ return t->find_fail; }
-// Get the # sucessful finds
+// Get the # successful finds
inline unsigned sfxhash_find_success(SFXHASH* t)
{ return t->find_success; }
CHECK(false == lru_cache.find(3, data));
// Verify that insert will replace data if key exists already.
- lru_cache.insert(1, "newone");
+ lru_cache.insert(1, "new one");
CHECK(true == lru_cache.find(1, data));
- CHECK("newone" == data);
+ CHECK("new one" == data);
// Verify current number of entries in cache.
CHECK(3 == lru_cache.size());
// Verify that the data is in LRU order.
auto vec = lru_cache.get_all_data();
CHECK(3 == vec.size());
- CHECK((vec[0] == std::make_pair(1, std::string("newone"))));
+ CHECK((vec[0] == std::make_pair(1, std::string("new one"))));
CHECK((vec[1] == std::make_pair(2, std::string("two"))));
CHECK((vec[2] == std::make_pair(0, std::string("zero"))));
}
lru_cache.find(8, data); // Misses now that they're removed.
lru_cache.find(9, data);
- lru_cache.remove(100); // Removing a non-existant entry does not
+ lru_cache.remove(100); // Removing a non-existent entry does not
// increase remove count.
lru_cache.clear();
#include "sfip/sf_ip.h"
// FIXIT-M For now this emulates the Snort++ attribute table.
-// Need to add in sfrnaincludes/host_tracker.h data eventually.
+// Need to add in host_tracker.h data eventually.
typedef uint16_t Port;
typedef uint16_t Protocol;
** BitStringOverflow::
*/
/**
-** The neccessary info to detect possible bitstring overflows. Thanks
+** The necessary info to detect possible bitstring overflows. Thanks
** once again to microsoft for keeping us in business.
**
** @return integer
/*
** Here's what this does.
**
- ** There is a vulnerablity in the MSASN1 library when decoding
+ ** There is a vulnerability in the MSASN1 library when decoding
** a double (real) type. If the encoding is ASCII (specified by
** not setting bit 7 or 8), and the buffer is greater than 256,
** then you overflow the array in the function.
}
/*
- ** Set this varible here, so we can set the data_len for
+ ** Set this variable here, so we can set the data_len for
** indeterminate constructs.
*/
uiRawLen = asn1data.end - asn1data.data;
/*
** This is where we decode the ASN.1 constructs. We do while()
** because we may have back to back constructs. We bail on the
- ** first indentifier that isn't a construct.
+ ** first identifier that isn't a construct.
*/
while (cur && cur->ident.flag == SF_ASN1_FLAG_CONSTRUCT)
{
* This method will read either a big or little endian value in binary
* data from the packet and return an uint32_t value.
*
- * @param endianess value to read the byte as
+ * @param endianness value to read the byte as
* @param bytes_to_grab how many bytes should we grab from the packet
* @param data pointer to where to grab the data from
* @param start pointer to start range of buffer
*
* @returns 0 on success, otherwise failure
*/
-int byte_extract(int endianess, int bytes_to_grab, const uint8_t* ptr,
+int byte_extract(int endianness, int bytes_to_grab, const uint8_t* ptr,
const uint8_t* start, const uint8_t* end,
uint32_t* value)
{
- if (endianess != ENDIAN_LITTLE && endianess != ENDIAN_BIG)
+ if (endianness != ENDIAN_LITTLE && endianness != ENDIAN_BIG)
{
/* we only support 2 byte formats */
return -2;
*value = (*ptr) & 0xFF;
break;
case 2:
- if (endianess == ENDIAN_LITTLE)
+ if (endianness == ENDIAN_LITTLE)
{
*value = (*ptr) & 0xFF;
*value |= (*(ptr + 1) & 0xFF) << 8;
}
break;
case 3:
- if (endianess == ENDIAN_LITTLE)
+ if (endianness == ENDIAN_LITTLE)
{
*value = (*ptr) & 0xFF;
*value |= ((*(ptr + 1)) & 0xFF) << 8;
}
break;
case 4:
- if (endianess == ENDIAN_LITTLE)
+ if (endianness == ENDIAN_LITTLE)
{
*value = (*ptr) & 0xFF;
*value |= ((*(ptr + 1)) & 0xFF) << 8;
const uint8_t* start, const uint8_t* end, uint32_t* value);
SO_PUBLIC int byte_extract(
- int endianess, int bytes_to_grab, const uint8_t* ptr,
+ int endianness, int bytes_to_grab, const uint8_t* ptr,
const uint8_t* start, const uint8_t* end, uint32_t* value);
SO_PUBLIC void set_byte_order(uint8_t& order, uint8_t flag, const char* opt);
uint8_t relative_flag;
uint8_t data_string_convert_flag;
uint8_t align;
- uint8_t endianess;
+ uint8_t endianness;
uint32_t base;
uint32_t multiplier;
uint32_t bitmask_val;
a += (data->relative_flag << 24 |
data->data_string_convert_flag << 16 |
data->align << 8 |
- data->endianess);
+ data->endianness);
b += data->multiplier;
c += data->var_number;
(left->relative_flag == right->relative_flag) &&
(left->data_string_convert_flag == right->data_string_convert_flag) &&
(left->align == right->align) &&
- (left->endianess == right->endianess) &&
+ (left->endianness == right->endianness) &&
(left->base == right->base) &&
(left->multiplier == right->multiplier) &&
(left->var_number == right->var_number) &&
if (ptr < start || ptr >= end)
return DETECTION_OPTION_NO_MATCH;
- uint8_t endian = data->endianess;
- if (data->endianess == ENDIAN_FUNC)
+ uint8_t endian = data->endianness;
+ if (data->endianness == ENDIAN_FUNC)
{
if (!p->endianness ||
!p->endianness->get_offset_endianness(ptr - p->data, endian))
}
}
- /* mulitply */
+ /* multiply */
*value *= data->multiplier;
/* align to next 32-bit or 16-bit boundary */
bool ExtractModule::end(const char*, int, SnortConfig*)
{
- if ( !data.endianess )
- data.endianess = ENDIAN_BIG;
+ if ( !data.endianness )
+ data.endianness = ENDIAN_BIG;
return ByteExtractVerify(&data);
}
data.multiplier = v.get_long();
else if ( v.is("big") )
- set_byte_order(data.endianess, ENDIAN_BIG, "byte_extract");
+ set_byte_order(data.endianness, ENDIAN_BIG, "byte_extract");
else if ( v.is("little") )
- set_byte_order(data.endianess, ENDIAN_LITTLE, "byte_extract");
+ set_byte_order(data.endianness, ENDIAN_LITTLE, "byte_extract");
else if ( v.is("dce") )
- set_byte_order(data.endianess, ENDIAN_FUNC, "byte_extract");
+ set_byte_order(data.endianness, ENDIAN_FUNC, "byte_extract");
else if ( v.is("string") )
{
* ["dce"]: let the DCE/RPC 2 preprocessor determine the byte order of the
* value to be converted
* ["string"]: converted bytes represented as a string needing conversion
- * ["hex"]: converted string data is represented in hexidecimal
+ * ["hex"]: converted string data is represented in hexadecimal
* ["dec"]: converted string data is represented in decimal
* ["oct"]: converted string data is represented in octal
* ["align"]: round the number of converted bytes up to the next
- * 32-bit boundry
+ * 32-bit boundary
* ["post_offset"]: number of bytes to adjust after applying
* ["from beginning"]: Skip forward from the beginning of the packet
* payload instead of from the current position in
uint8_t data_string_convert_flag;
uint8_t from_beginning_flag;
uint8_t align_flag;
- uint8_t endianess;
+ uint8_t endianness;
uint32_t base;
uint32_t multiplier;
int32_t post_offset;
data->data_string_convert_flag << 16 |
data->from_beginning_flag << 8 |
data->align_flag);
- b += data->endianess;
+ b += data->endianness;
c += data->multiplier;
mix(a,b,c);
( left->data_string_convert_flag == right->data_string_convert_flag) &&
( left->from_beginning_flag == right->from_beginning_flag) &&
( left->align_flag == right->align_flag) &&
- ( left->endianess == right->endianess) &&
+ ( left->endianness == right->endianness) &&
( left->base == right->base) &&
( left->multiplier == right->multiplier) &&
( left->post_offset == right->post_offset) &&
uint32_t jump = 0;
uint32_t payload_bytes_grabbed = 0;
- uint8_t endian = bjd->endianess;
+ uint8_t endian = bjd->endianness;
if (endian == ENDIAN_FUNC)
{
if (bjd->multiplier)
jump *= bjd->multiplier;
- // if we need to align on 32-bit boundries, round up to the next 32-bit value
+ // if we need to align on 32-bit boundaries, round up to the next 32-bit value
if (bjd->align_flag)
{
if ((jump % 4) != 0)
return false;
}
}
- if ( !data.endianess )
- data.endianess = ENDIAN_BIG;
+ if ( !data.endianness )
+ data.endianness = ENDIAN_BIG;
if (data.from_beginning_flag && data.from_end_flag)
{
data.post_offset = v.get_long();
else if ( v.is("big") )
- set_byte_order(data.endianess, ENDIAN_BIG, "byte_jump");
+ set_byte_order(data.endianness, ENDIAN_BIG, "byte_jump");
else if ( v.is("little") )
- set_byte_order(data.endianess, ENDIAN_LITTLE, "byte_jump");
+ set_byte_order(data.endianness, ENDIAN_LITTLE, "byte_jump");
else if ( v.is("dce") )
- set_byte_order(data.endianess, ENDIAN_FUNC, "byte_jump");
+ set_byte_order(data.endianness, ENDIAN_FUNC, "byte_jump");
else if ( v.is("string") )
{
*
* Purpose:
* Test a byte field against a specific value (with opcode). Capable
- * of testing binary values or converting represenative byte strings
+ * of testing binary values or converting representative byte strings
* to their binary equivalent and testing them.
*
*
* ["big"]: process data as big endian (default)
* ["little"]: process data as little endian
* ["string"]: converted bytes represented as a string needing conversion
- * ["hex"]: converted string data is represented in hexidecimal
+ * ["hex"]: converted string data is represented in hexadecimal
* ["dec"]: converted string data is represented in decimal
* ["oct"]: converted string data is represented in octal
* ["bitmask"]: applies the AND operator on the bytes converted. The
uint8_t not_flag;
uint8_t relative_flag;
uint8_t data_string_convert_flag;
- uint8_t endianess;
+ uint8_t endianness;
uint32_t base;
uint32_t bitmask_val;
int8_t cmp_value_var;
b += (data->not_flag << 24 |
data->relative_flag << 16 |
data->data_string_convert_flag << 8 |
- data->endianess);
+ data->endianness);
c += data->base;
mix(a,b,c);
( left->not_flag == right->not_flag) &&
( left->relative_flag == right->relative_flag) &&
( left->data_string_convert_flag == right->data_string_convert_flag) &&
- ( left->endianess == right->endianess) &&
+ ( left->endianness == right->endianness) &&
( left->base == right->base) &&
( left->cmp_value_var == right->cmp_value_var) &&
( left->offset_var == right->offset_var) &&
const uint8_t* start_ptr = btd->relative_flag ? c.start() : c.buffer();
start_ptr += offset;
- uint8_t endian = btd->endianess;
+ uint8_t endian = btd->endianness;
if (endian == ENDIAN_FUNC)
{
if (!p->endianness ||
return false;
}
}
- if ( !data.endianess )
- data.endianess = ENDIAN_BIG;
+ if ( !data.endianness )
+ data.endianness = ENDIAN_BIG;
if (numBytesInBitmask(data.bitmask_val) > data.bytes_to_compare)
{
data.relative_flag = 1;
else if ( v.is("big") )
- set_byte_order(data.endianess, ENDIAN_BIG, "byte_test");
+ set_byte_order(data.endianness, ENDIAN_BIG, "byte_test");
else if ( v.is("little") )
- set_byte_order(data.endianess, ENDIAN_LITTLE, "byte_test");
+ set_byte_order(data.endianness, ENDIAN_LITTLE, "byte_test");
else if ( v.is("dce") )
- set_byte_order(data.endianess, ENDIAN_FUNC, "byte_test");
+ set_byte_order(data.endianness, ENDIAN_FUNC, "byte_test");
else if ( v.is("string") )
{
return CVS_NO_ALERT;
DebugFormat(DEBUG_IPS_OPTION, "CVS command\n"
- " comand: %.*s\n"
+ " command: %.*s\n"
"argument: %.*s\n",
command.cmd_str_len, (char*)command.cmd_str,
command.cmd_arg == NULL ? 4 : command.cmd_arg_len,
fptr = rule;
- /* make sure there is atleast a split pointer */
+ /* make sure there is at least a split pointer */
if (fptr == NULL)
{
ParseError("flags missing in TCP flag rule");
default:
ParseError(
"bad TCP flag = '%c'"
- "Valid otions: UAPRSFCE or 0 for NO flags (e.g. NULL scan),"
+ "Valid options: UAPRSFCE or 0 for NO flags (e.g. NULL scan),"
" and !, + or * for modifiers",
*fptr);
return;
fptr = rule;
- /* make sure there is atleast a split pointer */
+ /* make sure there is at least a split pointer */
if (fptr == NULL)
{
ParseError("flags missing in TCP flag rule");
idx->tcp_mask |= R_ECE; /* ECN echo, RFC 3168 */
break;
default:
- ParseError("bad TCP flag = '%c'. Valid otions: UAPRSFCE", *fptr);
+ ParseError("bad TCP flag = '%c'. Valid options: UAPRSFCE", *fptr);
return;
}
switch ( bit_string.at( a ) )
{
- case 'd': // dont fragment
+ case 'd': // don't fragment
case 'D':
set_dont_fragment_bit();
break;
DebugMessage(DEBUG_IPS_OPTION, "CheckIpOptions:");
if ( !p->is_ip4() )
- // if error occured while ip header
+ // if error occurred while ip header
// was processed, return 0 automatically.
return DETECTION_OPTION_NO_MATCH;
/* sp_isdataat
*
* Purpose:
- * Test a specific byte to see if there is data. (Basicly, rule keyword
+ * Test a specific byte to see if there is data. (Basically, rule keyword
* into inBounds)
*
* Arguments:
pcre* re; /* compiled regex */
pcre_extra* pe; /* studied regex foo */
bool free_pe;
- int options; /* sp_pcre specfic options (relative & inverse) */
+ int options; /* sp_pcre specific options (relative & inverse) */
char* expression;
};
// exactly correct is obviated and thus the need to reload as well.
/* Since SO rules are loaded 1 time at startup, regardless of
- * configuraton, we won't pcre_capture count again, so save the max. */
+ * configuration, we won't pcre_capture count again, so save the max. */
static int s_ovector_max = 0;
// this is a temporary value used during parsing and set in snort conf
if ((options & PCRE_ANCHORED) && !(options & PCRE_MULTILINE))
{
- /* This means that this pcre rule option shouldn't be reevaluted
+ /* This means that this pcre rule option shouldn't be reevaluated
* even if any of it's relative children should fail to match.
* It is anchored to the cursor set by the previous cursor setting
* rule option */
* @param len size of buffer
* @param found_offset pointer to an integer so that we know where the search ended
*
- * *found_offset will be set to -1 when the find is unsucessful OR the routine is inverted
+ * *found_offset will be set to -1 when the find is unsuccessful OR the routine is inverted
*
* @return 1 when we find the string, 0 when we don't (unless we've been passed a flag to invert)
*/
* This plugin can take two arguments:
* printable => only log the "printable" ASCII characters.
* all => log all traffic in the session, logging non-printable
- * chars in "\xNN" hexidecimal format
+ * chars in "\xNN" hexadecimal format
*
* Effect:
*
{
if ((*idx > 0x1f && *idx < 0x7f) || *idx == 0x0a || *idx == 0x0d)
{
- /* Escape all occurences of '\' */
+ /* Escape all occurrences of '\' */
if (*idx == '\\')
fputc('\\', fp);
fputc(*idx, fp);
/*--------------------------------------------------------------------
* Function: Log2ndHeader(TextLog* , Packet p)
*
- * Purpose: Log2ndHeader -- prints second layber header info.
+ * Purpose: Log2ndHeader -- prints second layer header info.
*
* Arguments: log => pointer to TextLog to print to
*
break;
case ICMP_ROUTER_ADVERTISE:
- TextLog_Print(log, "ROUTER ADVERTISMENT: "
+ TextLog_Print(log, "ROUTER ADVERTISEMENT: "
"Num addrs: %d Addr entry size: %d Lifetime: %u",
p->ptrs.icmph->s_icmp_num_addrs, p->ptrs.icmph->s_icmp_wpa,
ntohs(p->ptrs.icmph->s_icmp_lifetime));
* Adam Keeton
*
* 09/26/06
- * This file is litterally unified.c converted to write unified2
+ * This file is literally unified.c converted to write unified2
*
*/
((ffstatus = fflush(u2.stream)) != 0))
{
/* errno is saved just to avoid other intervening calls
- * (e.g. ErrorMessage) potentially reseting it to something else. */
+ * (e.g. ErrorMessage) potentially resetting it to something else. */
int error = errno;
int max_retries = 3;
}
#endif
#ifdef UNIT_TEST
- // FIXIT-M X we should move this out of set_mode and not do Snort bringup/teardown at all
+ // FIXIT-M X we should move this out of set_mode and not do Snort bring up/teardown at all
if ( catch_enabled() )
{
main_exit_code = catch_test();
//-------------------------------------------------------------------------
// FIXIT-L may be inlined at some point; on lockdown for now
-// FIXIT-L SO_PUBLIC requierd because SnortConfig::inline_mode(), etc. uses the function
+// FIXIT-L SO_PUBLIC required because SnortConfig::inline_mode(), etc. uses the function
SO_PUBLIC NetworkPolicy* get_network_policy();
SO_PUBLIC InspectionPolicy* get_inspection_policy();
SO_PUBLIC IpsPolicy* get_ips_policy();
srmm_table_t* srmmTable = nullptr; /* srvc rule map master table */
srmm_table_t* spgmmTable = nullptr; /* srvc port_group map master table */
- sopg_table_t* sopgTable = nullptr; /* service-oridnal to port_group table */
+ sopg_table_t* sopgTable = nullptr; /* service-ordinal to port_group table */
SFXHASH* detection_option_hash_table = nullptr;
SFXHASH* detection_option_tree_hash_table = nullptr;
void free_rule_state_list();
//------------------------------------------------------
- // Static convenience accesor methods
+ // Static convenience accessor methods
static long int get_mpls_stack_depth()
{ return snort_conf->mpls_stack_depth; }
/*
* Begin search from index 1. 0 is a special case in that it is the default
* codec and is actually a duplicate. i.e., we can find the 0 indexed
- * codec somehwere else in the array too.
+ * codec somewhere else in the array too.
*
- * Returns: 0 on failure, induex on success
+ * Returns: 0 on failure, index on success
*/
uint8_t CodecManager::get_codec(const char* const keyword)
{
if (wrap.api->pterm)
{
wrap.api->pterm();
- wrap.init = false; // Future proofing this functin.
+ wrap.init = false; // Future proofing this function.
}
uint8_t index = get_codec(wrap.api->base.name);
if ( s_rand )
rand_close(s_rand);
- // rand_open() can yield valgriind errors because the
+ // rand_open() can yield valgrind errors because the
// starting seed may come from "random stack contents"
// (see man 3 dnet)
s_rand = rand_open();
/*
* Private helper functions. These are all declared here
- * because they need access to private varaibles.
+ * because they need access to private variables.
*/
// Private struct defined in an anonymous namespace.
bool found = set_var(fqn, v);
if ( !found && !ignored(fqn) )
- ParseWarning(WARN_SYMBOLS, "uknown symbol %s", fqn);
+ ParseWarning(WARN_SYMBOLS, "unknown symbol %s", fqn);
return found;
}
{
preemptive_threshold = memory::calculate_threshold(thread_cap, config.threshold);
DebugFormat(DEBUG_MEMORY,
- "per-thread pre-emptive action threshold set to %zu\n", preemptive_threshold);
+ "per-thread preemptive action threshold set to %zu\n", preemptive_threshold);
}
}
}
}
-/* Accumulate EOL seperated headers, one or more at a time */
+/* Accumulate EOL separated headers, one or more at a time */
int MailLogState::log_email_hdrs(const uint8_t* start, int length)
{
int log_avail = 0;
static const char* boundary_str = "boundary=";
-/* Save the bounday string into paf state*/
+/* Save the boundary string into paf state*/
static inline bool store_boundary(MimeDataPafInfo* data_info, uint8_t val)
{
if (!data_info->boundary_search)
return false;
}
-/* check the bounday string in the mail body*/
+/* check the boundary string in the mail body*/
static inline bool check_boundary(MimeDataPafInfo* data_info, uint8_t data)
{
/* Search for boundary signature "--"*/
switch (data_info->data_state)
{
case MIME_PAF_FINDING_BOUNDARY_STATE:
- /* Search for boundary Store bounday string in PAF state*/
+ /* Search for boundary Store boundary string in PAF state*/
if (store_boundary(data_info, data))
{
/* End of boundary, move to MIME_PAF_FOUND_BOUNDARY_STATE*/
- DebugFormat(DEBUG_FILE, "Create boudary string: %s\n", data_info->boundary);
+ DebugFormat(DEBUG_FILE, "Create boundary string: %s\n", data_info->boundary);
data_info->data_state = MIME_PAF_FOUND_BOUNDARY_STATE;
}
break;
if (check_boundary(data_info, data))
{
/* End of boundary, move to MIME_PAF_FOUND_BOUNDARY_STATE*/
- DebugFormat(DEBUG_FILE, "Found Boudary string: %s\n", data_info->boundary);
+ DebugFormat(DEBUG_FILE, "Found boundary string: %s\n", data_info->boundary);
return true;
}
break;
/* check if we're in a content-type header and not folding. if so we have the whole
* header line/lines for content-type - see if we got a multipart with boundary
* we don't check each folded line, but wait until we have the complete header
- * because boundary=BOUNDARY can be split across mulitple folded lines before
+ * because boundary=BOUNDARY can be split across multiple folded lines before
* or after the '=' */
if ((state_flags &
(MIME_FLAG_IN_CONTENT_TYPE | MIME_FLAG_FOLDING)) == MIME_FLAG_IN_CONTENT_TYPE)
#define APPID_SESSION_HTTP_SESSION (1ULL << 13)
/**Service protocol was detected */
#define APPID_SESSION_SERVICE_DETECTED (1ULL << 14)
-/**Finsihed with client app detection */
+/**Finished with client app detection */
#define APPID_SESSION_CLIENT_DETECTED (1ULL << 15)
/**Flow is a data connection not a service */
#define APPID_SESSION_NOT_A_SERVICE (1ULL << 16)
//--------------------------------------------------------------------------
// appid_module.cc author Steve Chew <stechew@cisco.com>
-// Created on: Auguest 18, 2016
+// Created on: August 18, 2016
#ifdef HAVE_CONFIG_H
#include "config.h"
/**Total number of parts.*/
uint32_t partTotal;
- /**Uniq non-zero identifier to tie parts of a multi-part patterns together. */
+ /**Unique non-zero identifier to tie parts of a multi-part patterns together. */
uint32_t patternId;
tPatternNode* nextPattern;
}
/**tMlmpPattern comparator: compares patterns based on pattern, patternSize. This will
- * result in alphabatical order. Notice that patternId is ignored here.
+ * result in alphabetical order. Notice that patternId is ignored here.
*/
static int compareMlmpPatterns(const void* p1, const void* p2)
{
}
fd->pos++;
break;
- /* cheeck any 2 bytes fisrt */
+ /* check any 2 bytes first */
case TIMBUKTU_STATE_ANY_MESSAGE_LEN:
fd->pos++;
if (fd->pos >= MAX_ANY_SIZE)
add_app(args.asd, APP_ID_NONE, APP_ID_DNS, nullptr);
service_inprocess(args.asd, args.pkt, args.dir);
// FIXIT - incrementing stat early so its counted in case of blocks... not great solution
- // refer to this PR for more details on the issue and possible soluitons:
+ // refer to this PR for more details on the issue and possible solutions:
// https://bitbucket-eng-rtp1.cisco.com/bitbucket/projects/SNORT/repos/snort3/pull-requests/779/overview
appid_stats.dns_udp_flows++;
return APPID_INPROCESS;
// FIXIT-M - the comments and code below for service_get_service_id don't appear to be useful
// the ud->server.service_id field is set to APP_ID_UNKNOWN at init time and never updated
// is this function ever used?
-/**design: dont store service_id in detector structure since a single detector
+/**design: don't store service_id in detector structure since a single detector
* can get service_id for multiple protocols. For example SIP which gets Id for RTP and
* SIP services.
*/
return 1;
}
-/**Get packet direction. A flow/session maintains initiater and responder sides. A packet direction
- * is determined wrt to the original initiater.
+/**Get packet direction. A flow/session maintains initiator and responder sides. A packet direction
+ * is determined wrt to the original initiator.
*
* @param Lua_State* - Lua state variable.
* @param detector/stack - detector object
* @param Lua_State* - Lua state variable.
* @param detector/stack - detector object
* @param pattern/stack - pattern to be matched.
- * @param patternLenght/stack - length of pattern
+ * @param patternLength/stack - length of pattern
* @param offset/stack - offset into packet payload where matching should start.
*
* @return int - Number of group matches. May be 1 if successful, and 0 if error is encountered.
* @param Lua_State* - Lua state variable.
* @param detector/stack - detector object
* @return int - Number of elements on stack, which is 1 if successful, 0 otherwise.
- * @return IPv4/stack - Source IPv4 addresss.
+ * @return IPv4/stack - Source IPv4 address.
*/
static int detector_get_packet_src_addr(lua_State* L)
{
* @param Lua_State* - Lua state variable.
* @param detector/stack - detector object
* @return int - Number of elements on stack, which is 1 if successful, 0 otherwise.
- * @return IPv4/stack - destination IPv4 addresss.
+ * @return IPv4/stack - destination IPv4 address.
*/
static int detector_get_packet_dst_addr(lua_State* L)
{
give a local callback function, which will do demuxing and
then call lua callback function. */
- /*mpse library does not hold reference to pattern therefore we dont need to allocate it. */
+ /*mpse library does not hold reference to pattern therefore we don't need to allocate it. */
if ( protocol == IpProtocol::TCP)
ClientDiscovery::get_instance().register_tcp_pattern(ud, (const uint8_t*)pattern,
pattern->pattern_size = (int)pattern_size;
pattern->appId = appId;
- // for apps that should not show up in 4.10 and ealier, we cannot include an entry in
+ // for apps that should not show up in 4.10 and earlier, we cannot include an entry in
// the legacy client app or payload tables. We will use the appId instead. This is only for
// user-agents that ID clients. if you want a user-agent to ID a payload, include it in the
// payload database. If you want a host pattern ID, use the other API.
return 0;
}
-/*Lua should inject patterns in <clienAppId, clientVersion, multi-Pattern> format. */
+/*Lua should inject patterns in <clientAppId, clientVersion, multi-Pattern> format. */
static int detector_add_sip_user_agent(lua_State* L)
{
int index = 1;
assert(!(*UserData<LuaDetector>::check(L, DETECTOR, index))->validate_params.pkt);
uint32_t service_app_id = lua_tointeger(L, ++index);
- uint32_t clienAppId = lua_tointeger(L, ++index);
+ uint32_t clientAppId = lua_tointeger(L, ++index);
uint32_t payload_app_id = lua_tointeger(L, ++index);
/* Verify that host pattern is a valid string */
DetectorAppUrlPattern* pattern =
(DetectorAppUrlPattern*)snort_calloc(sizeof(DetectorAppUrlPattern));
pattern->userData.service_id = service_app_id;
- pattern->userData.client_app = clienAppId;
+ pattern->userData.client_app = clientAppId;
pattern->userData.payload = payload_app_id;
pattern->userData.appId = APP_ID_NONE;
pattern->userData.query.pattern = nullptr;
AppInfoManager& app_info_manager = AppInfoManager::get_instance();
app_info_manager.set_app_info_active(service_app_id);
- app_info_manager.set_app_info_active(clienAppId);
+ app_info_manager.set_app_info_active(clientAppId);
app_info_manager.set_app_info_active(payload_app_id);
return 0;
* IPPROTO_UDP/DC.ipproto.udp (17)).
* @param port/stack - port number to register.
* @param pattern/stack - pattern to be matched.
- * @param patternLenght/stack - length of pattern
+ * @param patternLength/stack - length of pattern
* @param offset/stack - offset into packet payload where matching should start.
* @param appId/stack - App ID to use for this detector.
* @return int - Number of elements on stack, which is always 0.
* IPPROTO_UDP/DC.ipproto.udp (17)).
* @param port/stack - port number to register.
* @param pattern/stack - pattern to be matched.
- * @param patternLenght/stack - length of pattern
+ * @param patternLength/stack - length of pattern
* @param offset/stack - offset into packet payload where matching should start.
* @param appId/stack - App ID to use for this detector.
* @return int - Number of elements on stack, which is always 0.
return 0;
}
-/*Lua should inject patterns in <clienAppId, clientVersion, multi-Pattern> format. */
+/*Lua should inject patterns in <clientAppId, clientVersion, multi-Pattern> format. */
static int detector_add_sip_server(lua_State* L)
{
int index = 1;
* If in future, one needs to free any of these buffers then one should consider
* references to detector buffer in ServiceDetector stored in flows and hostServices
* data structures. Other detectors at this time create one static instance for the
- * lifetime of RNA, and therefore we have adopted the same principle for Lua Detecotors.
+ * lifetime of RNA, and therefore we have adopted the same principle for Lua Detectors.
*/
static int Detector_gc(lua_State*)
{
{
// Runtime Lua errors are suppressed in production code since detectors are written for
// efficiency and with defensive minimum checks. Errors are dealt as exceptions
- // that dont impact processing by other detectors or future packets by the same detector.
+ // that don't impact processing by other detectors or future packets by the same detector.
ErrorMessage("lua detector %s: error validating %s\n",
package_info.name.c_str(), lua_tostring(my_lua_state, -1));
validate_params.pkt = nullptr;
}
else
{
- DebugMessage(DEBUG_LOG, "hostServiceTrackerModule.setHosServiceTrackerSize not found");
+ DebugMessage(DEBUG_LOG, "hostServiceTrackerModule.setHostServiceTrackerSize not found");
}
lua_pop(L, 1);
* returned. The list itself is saved in ServiceDiscoveryState. If
* appId is already identified, then use it instead of searching again. RNA will capability
* to try out other inferior matches. If appId is unknown i.e. searched and not found by FRE then
- * dont do any pattern match. This is a way degrades RNA detector selection if FRE is running on
+ * don't do any pattern match. This is a way degrades RNA detector selection if FRE is running on
* this sensor.
*/
void ServiceDiscovery::match_services_by_pattern(AppIdSession* asd, const Packet* pkt, IpProtocol
if (asd.tp_app_id > APP_ID_NONE)
{
//tp has positively identified appId, Dig deeper only if sourcefire
- // detector identifies additional information or flow is UDP reveresed.
+ // detector identifies additional information or flow is UDP reversed.
AppInfoTableEntry* entry = asd.app_info_mgr->get_app_info_entry(asd.tp_app_id);
if ( entry && entry->service_detector &&
( ( entry->flags & APPINFO_FLAG_SERVICE_ADDITIONAL ) ||
//ignore packets while encryption is on in explicit mode. In future, this will be changed
//to direct traffic to SSL detector to extract payload from certs. This will require
- // manintaining
+ // maintaining
//two detector states at the same time.
if (asd->get_session_flags(APPID_SESSION_ENCRYPTED))
{
case 225: /* data connection open */
case 226: /* Transfer complete */
case 227: /*entering passive mode */
- case 230: /*user loggined */
+ case 230: /*user logged in */
case 250: /* CWD command successful */
case 257: /* PATHNAME created */
case 331: /* login ok need password */
case 332: /*new account for login */
- case 350: /*requested file action pending futher information */
+ case 350: /*requested file action pending further information */
case 450: /*requested file action not taken */
case 451: /*requested file action aborted */
case 452: /*requested file action not taken not enough space */
case 500: /*syntax error */
- case 501: /*not recognozed */
- case 502: /*not recognozed */
+ case 501: /*not recognized */
+ case 502: /*not recognized */
case 503: /*bad sequence of commands */
case 504: /*command not implemented */
case 530: /*login incorrect */
{
user_name_len = user_original - srv_original - start_index;
user_name_bkp = (char*)(srv_original + start_index);
- /* Non-Printable characters in the begining */
+ /* Non-Printable characters in the beginning */
while (user_index < user_name_len)
{
}
else
{
- /* Something we dont care about... */
+ /* Something we don't care about... */
ADVANCE_DATA(field_len);
if (!skip_property_value(&data, &size))
goto parse_rtmp_message_fail;
unsigned detract_count = 0;
SfIp last_detract;
- // consecutive incompatible flows - incompatibile means client packet did not match.
+ // consecutive incompatible flows - incompatible means client packet did not match.
unsigned invalid_client_count = 0;
/**IP address of client in last flow that was declared incompatible. If client IP address is
- * different everytime, then consecutive incompatible status indicate that flow is not using
+ * different every time, then consecutive incompatible status indicate that flow is not using
* specific service.
*/
SfIp last_invalid_client;
* arpspoof: -unicast
*
* WARNING: this can generate false positives as Linux systems send unicast
- * ARP requests repetatively for entries in their cache.
+ * ARP requests repetitively for entries in their cache.
*
* This plugin also takes a list of IP addresses and MAC address in the form:
* arpspoof_detect_host: 10.10.10.10 29:a2:9a:29:a2:9a
{ "icmp6_echo", "icmp6 echo normalizations" },
{ "tcp_syn_options", "SYN only options cleared from non-SYN packets" },
{ "tcp_options", "packets with options cleared" },
- { "tcp_paddding", "packets with padding cleared" },
+ { "tcp_padding", "packets with padding cleared" },
{ "tcp_reserved", "packets with reserved bits cleared" },
{ "tcp_nonce", "packets with nonce bit cleared" },
{ "tcp_urgent_ptr", "packets without data with urgent pointer cleared" },
//-----------------------------------------------------------------------
// we assume here that the decoder has not pushed ip6 option extension
-// headers unless the basic sizing is correct (size = N*8 octetes, N>0).
+// headers unless the basic sizing is correct (size = N*8 octets, N>0).
struct ExtOpt
{
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
//--------------------------------------------------------------------------
-// packet_cpture.cc author Carter Waxman <cwaxman@cisco.com>
+// packet_capture.cc author Carter Waxman <cwaxman@cisco.com>
#ifdef HAVE_CONFIG_H
#include "config.h"
//
// This class defines the data gathering layer of perfmon. PerfMonitor will
-// create an instance of each configued class for each packet processing
+// create an instance of each configured class for each packet processing
// thread. Subclasses of PerfTrackers should implement or call the following
// methods, leaving the others for internal use by PerfMonitor:
//
// reset() - perform initialization after the output handle has been opened.
//
-// update(Packet*) - update statistics basied on the current packet.
+// update(Packet*) - update statistics based on the current packet.
//
// process(bool) - summarize data and report. This is called after the
// reporting thresholds have been reached.
These can all be handled via the CIDR block notation : IP/MaskBits
We use collections (lists) of cidr blocks to represent address blocks
- and indivdual addresses.
+ and individual addresses.
For a single IPAddress the implied Mask is 32 bits,or 255.255.255.255, or 0xffffffff, or -1.
These can all be handled via the CIDR block notation : IP/MaskBits
We use collections (lists) of cidr blocks to represent address blocks
- and indivdual addresses.
+ and individual addresses.
For a single IPAddress the implied Mask is 32 bits,or
255.255.255.255, or 0xffffffff, or -1.
*/
PacketManager::encode_update(g_tmp_pkt);
- // FIXIT-L IP4 is gauranteed to have been set in update(). Is IP6() also gauranteed?
+ // FIXIT-L IP4 is guaranteed to have been set in update(). Is IP6() also guaranteed?
if (g_tmp_pkt->ptrs.ip_api.is_ip6())
((ip::IP6Hdr*)g_tmp_pkt->ptrs.ip_api.get_ip6h())->set_len((uint16_t)ip_size);
memset(&ps_pkt, 0x00, sizeof(PS_PKT)); // FIXIT-P don't zap unless necessary
ps_pkt.pkt = (void*)p;
- /* See if there is already an exisiting node in the hash table */
+ /* See if there is already an existing node in the hash table */
ps_detect(&ps_pkt);
if (ps_pkt.scanner && ps_pkt.scanner->proto.alerts &&
}
}
/*
- ** We only get here on the server's response to the intial
+ ** We only get here on the server's response to the initial
** client connection.
**
** That's why we use the sp, because that's the port that is
** ps_tracker_update::
*/
/**
-** At this point, we should only be looking at tranport protocols
+** At this point, we should only be looking at transport protocols
** that we want to. For instance, if we aren't doing UDP portscans
** then we won't see UDP packets here because they were ignored.
**
return daq_modify_flow(daq_mod, daq_hand, hdr, &mod);
}
-// FIXIT-L X Add Snort flag defitions for callers to use and translate/pass them through to the DAQ module
+// FIXIT-L X Add Snort flag definitions for callers to use and translate/pass them through to
+// the DAQ module
int SFDAQInstance::add_expected(const Packet* ctrlPkt, const SfIp* cliIP, uint16_t cliPort,
const SfIp* srvIP, uint16_t srvPort, IpProtocol protocol, unsigned timeout_ms, unsigned /* flags */)
{
{
SOURCE_FILE_LIST, // a file containing a list of sources
SOURCE_LIST, // a list of sources (eg from cmd line)
- SOURCE_DIR // a directory of sources; often used wiht filter
+ SOURCE_DIR // a directory of sources; often used with filter
};
static void set_loop_count(long int c)
{
const char* path_sep = strrchr(file, '/');
- /* is there a directory seperator in the filename */
+ /* is there a directory separator in the filename */
if (path_sep != NULL)
{
path_sep++; /* include path separator */
* char *
* The string to be split
* char *
- * A string of token seperaters
+ * A string of token separators
* int
* The maximum number of tokens to be returned. A value
* of 0 means to get them all.
* Place to store the number of tokens returned
* char
* The "escape metacharacter", treat the character after
- * this character as a literal and "escape" a seperator.
+ * this character as a literal and "escape" a separator.
*
* Note if max_toks is reached, the last tok in the returned
* token array will possibly have separator characters in it.
}
/* Last character was not a separator character so we've got
- * one more tok. Unescape escaped sepatator charactors */
+ * one more tok. Unescape escaped separator characters */
if (toks != toks_alloc)
{
retstr = (char**)snort_calloc(cur_tok + 1, sizeof(char*));
{
case POPERR_NO_NAME: return "no name";
case POPERR_NO_ENDLIST_BRACKET: return "no end of list bracket."
- " Elements must be comma seperated,"
- " and no spaces may appear between"
- " brackets.";
+ " Elements must be comma separated, and no spaces may appear between brackets.";
case POPERR_NOT_A_NUMBER: return "not a number";
case POPERR_EXTRA_BRACKET: return "extra list bracket";
case POPERR_NO_DATA: return "no data";
{
DebugFormat(DEBUG_PORTLISTS,
"parser.c: already have '%s' as a PortObject - "
- "calling PortObjectFree(portbject) line=%d\n",port_str,__LINE__);
+ "calling PortObjectFree(portobject) line=%d\n",port_str,__LINE__);
PortObjectFree(portobject);
portobject = pox;
}
DebugFormat(DEBUG_PORTLISTS,"Rule-PortVar Parsed: %s \n",port_str);
/* !ports - port lists can be mixed 80:90,!82,
- * so the old NOT flag is depracated for port lists
+ * so the old NOT flag is deprecated for port lists
*/
/* set up any any flags */
}
}
- /* The IPs in the test node get free'd in ProcessHeadNode if there is
- * already a matching RTN. The portobjects will get free'd when the
- * port var table is free'd */
+ /* The IPs in the test node get freed in ProcessHeadNode if there is
+ * already a matching RTN. The portobjects will get freed when the
+ * port var table is freed */
RuleTreeNode* new_rtn = ProcessHeadNode(sc, &rtn, rtn.listhead);
addRtnToOtn(otn, new_rtn);
if ( mergeDuplicateOtn(sc, otn_dup, otn, new_rtn) )
{
/* We are keeping the old/dup OTN and trashing the new one
- * we just created - it's free'd in the remove dup function */
+ * we just created - it's freed in the remove dup function */
return nullptr;
}
}
otn = (OptTreeNode*)hashNode->data;
/* Autogenerated OTNs along with their respective pseudo RTN
- * will get cleaned up when the OTN is free'd */
+ * will get cleaned up when the OTN is freed */
if (otn->generated)
continue;
*
* Function: OrderRuleLists
*
- * Purpose: Orders the rule lists into the specefied order.
+ * Purpose: Orders the rule lists into the specified order.
*
* Returns: void function
*
*
* Purpose: ParseErrors if the a variable name is redefined across variable
* types. Enforcing this mutual exclusion prevents the
- * catatrophe where the variable lookup fall-through (see VarSearch)
+ * catastrophe where the variable lookup fall-through (see VarSearch)
* finds an unintended variable from the wrong table. Note: VarSearch
* is only necessary for ExpandVars.
*
/* Verify a variable by this name is not already used as either a
* portvar or regular var. Enforcing this mutual exclusion prevents the
- * catatrophe where the variable lookup fall-through (see VarSearch)
+ * catastrophe where the variable lookup fall-through (see VarSearch)
* finds an unintended variable from the wrong table. Note: VarSearch
* is only necessary for ExpandVars. */
DisallowCrossTableDuplicateVars(sc, name, VAR_TYPE__IPVAR);
sfip_var_t* var;
// XXX-IPv6 This function should never be used if IP6 support is enabled!
-// Infact it won't presently even work for IP variables since the raw ASCII
+// In fact it won't presently even work for IP variables since the raw ASCII
// value is never stored, and is never meant to be used.
if ((var = sfvt_lookup_var(ip_vartable, name)) == NULL)
void AddVarToTable(SnortConfig* sc, const char* name, const char* value)
{
- //TODO: snort.cfg and rules should use PortVar instead ...this allows compatability for now.
+ //TODO: snort.cfg and rules should use PortVar instead ...this allows compatibility for now.
if (strstr(name, "_PORT") || strstr(name, "PORT_"))
{
DebugMessage(DEBUG_CONFIGRULES,"PortVar\n");
{
Lua::Args args(L);
- // FIXIT-M this hacky arg offset stuff is for backwards compatibilty
+ // FIXIT-M this hacky arg offset stuff is for backwards compatibility
// it will be removed in later updates
int off = 0;
// FIXIT-H a lot of users keep references to this data. Need to prevent
// Lua's garbage collection from destroying RawBuffer while other C++ types
-// are using the data (unbeknowest to Lua). Add a container data type
+// are using the data (unbeknownst to Lua). Add a container data type
// which hold ref counts to RawBuffer and only frees when the ref count is
// zero.
* 1) check if it's in the plx table-mhashx, this uses the list of
* addresses of the Input PortObjects as it's key, not the ports.
* This is quick and does not require assembling/merging the port
- * objects intoa PortObject2 1st.
+ * objects into a PortObject2 1st.
* 2) if found were done, otherwise
* 3) make a merged PortObject2
* 4) Try adding the PortObject2 to it's table - mhash
* 5) Create a plx object
* 6) Add the plx object to the plx Table
* 1) if it's already in the object - fail this contradicts 1)
- * 7) return the create PortObject2, or the one retrived from the
+ * 7) return the create PortObject2, or the one retrieved from the
* PortObject table.
*
* pol - list of input PortObject pointers
/*
Prints the original (normalized) PortGroups and
- as sepcified by the user
+ as specified by the user
*/
void PortTablePrintUserRules(PortTable* p)
{
constexpr uint32_t ICMP_BASE_LEN = 4;
constexpr uint8_t ICMP_UNREACH_DATA_LEN = 8;
-// do NOT add 'ICMP_' to the begining of these const because they
+// do NOT add 'ICMP_' to the beginning of these const because they
// will overlap with dnet macros
//enum class IcmpType : std::uint8_t {
PREC_VIOLATION = 14,
PREC_CUTOFF = 15,
- /* Code for ICMP Source Quence (4) */
+ /* Code for ICMP Source Quench (4) */
SOURCE_QUENCH_CODE = 0,
/* Codes for an ICMP Redirect (5) */
/* Codes for ICMP Echo (8) */
ECHO_CODE = 0,
- /* Codes for ICMP time excceeded (11) */
+ /* Codes for ICMP time exceeded (11) */
TIMEOUT_TRANSIT = 0,
TIMEOUT_REASSY = 1,
constexpr uint8_t IP4_RESERVED = 0x0F; // ms nibble
constexpr uint8_t IP4_LOOPBACK = 0x7F; // msb
-// This must be a standard layour struct!
+// This must be a standard layer struct!
struct IP4Hdr
{
uint8_t ip_verhl; /* version & header length */
};
/*
- * relly creative name ... right
- * Use IpOptionIter ... this is the placehold
+ * really creative name ... right
+ * Use IpOptionIter ... this is the placeholder
*/
class SO_PUBLIC IpOptionIteratorIter
{
bool operator!=(const IpOptionIteratorIter& rhs)
{ return opt != rhs.opt; }
- // I'd suggest just using IpOptionIterator and completley ignoring this
+ // I'd suggest just using IpOptionIterator and completely ignoring this
// horror of a ++ operation.
IpOptionIteratorIter& operator++()
{
};
/*
- * relly creative name ... right
+ * really creative name ... right
* Use IP ranged for loop rather than calling this directly.
* i.e.,
* IpOptionIter iter(ip4h, p)
/* If you already know the validated option length (for instance,
* if you are in a decode() method), then call this constructor.
* You MUST validate the a;; ip_options within len before
- * using this constuctor*/
+ * using this constructor*/
IpOptionIterator(const IP4Hdr* const, const uint8_t valid_hdr_len);
IpOptionIteratorIter begin() const;
IpOptionIteratorIter end() const;
inline uint32_t flow() const
{ return (uint16_t)((ntohl(ip6_vtf) & 0x000FFFFF) >> 20); }
- // becaise Snort expects this in terms of 32 bit words.
+ // because Snort expects this in terms of 32 bit words.
inline uint8_t hlen() const
{ return IP6_HEADER_LEN; }
{ return ip6f_ident; }
};
-// Reflects the recomended IPv6 order in RFC 2460 4.1
+// Reflects the recommended IPv6 order in RFC 2460 4.1
constexpr int IPV6_ORDER_MAX = 7;
inline int IPV6IdExtensionOrder(const ProtocolId prot_id)
{
const uint8_t* get_root_layer(const Packet* const p)
{
- // since token ring is the grinder, its the begining of the packet.
+ // since token ring is the grinder, its the beginning of the packet.
if (p->num_layers > 0)
return p->layers[0].start;
return nullptr;
uint16_t length;
};
-// forward declaring relevent structs. Since we're only return a pointer,
+// forward declaring relevant structs. Since we're only return a pointer,
// there is no need for the actual header files
namespace vlan
* layer refer to packet get_next_ip_proto()
* for more information.
* int8_t curr_layer = the current, zero based layer from which to
- * start searching inward. After the function returs,
+ * start searching inward. After the function returns,
* This field will be set to the layer before
* the Ip Api. If no IP layer is found,
* it will be set to -1.
* false: if the api has NOT been set
*
* NOTE: curr_layer is zero based. That means to get all of the ip
- * layers (starting from teh innermost layer), during the first call
+ * layers (starting from the innermost layer), during the first call
* 'curr_layer == p->num_layers'.
*
* NOTE: This functions is extremely useful in a loop
#define PKT_PDU_TAIL 0x00000200 /* end of PDU */
#define PKT_HTTP_DECODE 0x00000400 /* this packet has normalized http */
-#define PKT_ALLOW_MULTIPLE_DETECT 0x00000800 /* packet has either pipelined mime attachements
+#define PKT_ALLOW_MULTIPLE_DETECT 0x00000800 /* packet has either pipelined mime attachments
or pipeline http requests */
#define PKT_PAYLOAD_OBFUSCATE 0x00001000
pkth->pktlen = len;
pkth->ts = p->pkth->ts;
- layer::set_packet_pointer(c); // set layer pointer to ensure lookin at the new packet
+ layer::set_packet_pointer(c); // set layer pointer to ensure looking at the new packet
total_rebuilt_pkts++; // update local counter
return 0;
}
class SO_PUBLIC PacketManager
{
public:
- // decode this packet and set all relevent packet fields.
+ // decode this packet and set all relevant packet fields.
static void decode(Packet*, const struct _daq_pkthdr*, const uint8_t*, bool cooked = false);
// when encoding, rather than copy the destination MAC address from the
/* Accessor functions -- any object in Snort++ can now convert a
* protocol to its mapped value.
*
- * The equivelant of Snort's PROTO_ID */
+ * The equivalent of Snort's PROTO_ID */
static constexpr std::size_t max_protocols() // compile time constant
{ return CodecManager::s_protocols.size(); }
/*
* Undefined Protocols!
*/
- FINISHED_DECODE = 0x0100, // Indicates Codecs have succesfully decoded packet
+ FINISHED_DECODE = 0x0100, // Indicates Codecs have successfully decoded packet
TEREDO = 0x0101,
GTP = 0x0102,
IP_EMBEDDED_IN_ICMP4 = 0x0103,
if (pkt[9] == 3)
{
/* Saw a TLS version, but this could also be an SSHv2 length.
- * If it is, check if a hypothetical TLS record-data length agress
+ * If it is, check if a hypothetical TLS record-data length agrees
* with its record length */
datalen = THREE_BYTE_LEN( (pkt+6) );
else if (size >= 8 && pkt[7] == 2)
{
/* A version of '2' at byte 7 overlaps with TLS record-data length.
- * Check if a hypothetical TLS record-data length agress with its
+ * Check if a hypothetical TLS record-data length agrees with its
* record length */
datalen = THREE_BYTE_LEN( (pkt+6) );
{
if (p->layers[i].start == (const uint8_t*)tcp_header)
{
- // Can't use the tph_header->hlen() becuase the entire may
+ // Can't use the tph_header->hlen() because the entire may
// be an EOF or invalid options. However, this layers length
// has been valid by the codecs.
end_ptr = (hdr + p->layers[i].length);
const uint8_t TCPOLEN_PARTIAL_PERM = 2; /* Partial Order Permitted/ Experimental [RFC1693] */
const uint8_t TCPOLEN_PARTIAL_SVC = 3; /* 3 bytes long -- Experimental - [RFC1693] */
-/* atleast decode T/TCP options... */
+/* at least decode T/TCP options... */
const uint8_t TCPOLEN_CC = 6; /* page 17 of rfc1644 */
const uint8_t TCPOLEN_CC_NEW = 6; /* page 17 of rfc1644 */
const uint8_t TCPOLEN_CC_ECHO = 6; /* page 17 of rfc1644 */
uint8_t addr4[6];
};
-/* Frame type/subype combinations with version = 0
+/* Frame type/subtype combinations with version = 0
** FRAME TYPE ***** HEX **** SUBTYPE TYPE DESCRIPT ********/
#define WLAN_TYPE_MGMT_ASREQ 0x0 /* 0000 00 Association Req */
#define WLAN_TYPE_MGMT_ASRES 0x10 /* 0001 00 Assocaition Res */
#define WLAN_TYPE_CONT_PS 0xa4 /* 1010 01 Power Save */
#define WLAN_TYPE_CONT_RTS 0xb4 /* 1011 01 Request to send */
-#define WLAN_TYPE_CONT_CTS 0xc4 /* 1100 01 Clear to sene */
+#define WLAN_TYPE_CONT_CTS 0xc4 /* 1100 01 Clear to send */
#define WLAN_TYPE_CONT_ACK 0xd4 /* 1101 01 Acknowledgement */
#define WLAN_TYPE_CONT_CFE 0xe4 /* 1110 01 Cont. Free end */
#define WLAN_TYPE_CONT_CFACK 0xf4 /* 1111 01 CF-End + CF-Ack */
**
** Reference - Efficient String matching: An Aid to Bibliographic Search
** Alfred V Aho and Margaret J Corasick
-** Bell Labratories
+** Bell Laboratories
** Copyright (C) 1975 Association for Computing Machinery,Inc
**
** Implemented from the 4 algorithms in the paper by Aho & Corasick
** 2) This algorithm finds all occurrences of all patterns within a
** body of text.
** 3) Support is included to handle upper and lower case matching.
-** 4) Some comopilers optimize the search routine well, others don't, this makes all the difference.
+** 4) Some compilers optimize the search routine well, others don't, this makes all the difference.
** 5) Aho inspects all bytes of the search text, but only once so it's very efficient,
** if the patterns are all large than the Modified Wu-Manbar method is often faster.
** 6) I don't subscribe to any one method is best for all searching needs,
acsm->acsmStateTable[s].FailState = next;
/*
- * Copy 'next'states MatchList to 's' states MatchList,
+ * Copy 'next' states MatchList to 's' states MatchList,
* we copy them so each list can be AC_FREE'd later,
* else we could just manipulate pointers to fake the copy.
*/
**
** Reference - Efficient String matching: An Aid to Bibliographic Search
** Alfred V Aho and Margaret J Corasick
-** Bell Labratories
+** Bell Laboratories
** Copyright (C) 1975 Association for Computing Machinery,Inc
**
** +++
** only use 1/4 of what we use to. The caching performance is better in
** pure benchmarking tests, but does not show overall improvement in Snort.
** Unfortunately, once a pattern match test has been performed Snort moves
-** on to doing many other things before we get back to a patteren match test,
+** on to doing many other things before we get back to a pattern match test,
** so the cache is voided.
**
** This versions has better caching performance characteristics, reduced
** You can use any of the 4 storage modes above -full, sparse, banded,
** sparse-bands, set the structure directly.
** For applications where you have lots of data and a pattern set to
-** search, this version was up to 3x faster than the previous verion, due
+** search, this version was up to 3x faster than the previous version, due
** to caching performance. This cannot be fully realized in Snort yet,
** but other applications may have better caching opportunities.
** Snort only needs to use the banded or full storage.
FailState[s] = next;
/*
- * Copy 'next'states MatchList to 's' states MatchList,
+ * Copy 'next' states MatchList to 's' states MatchList,
* we copy them so each list can be AC_FREE'd later,
* else we could just manipulate pointers to fake the copy.
*/
* 1-1 fmt(0-full,1-sparse,2-banded,3-sparsebands)
* 2-2 bool match flag (indicates this state has pattern matches)
* 3-3 sparse state count ( # of input/next-state pairs )
-* 4-3+2*cnt 'input,next-state' pairs... each sizof(acstate_t)
+* 4-3+2*cnt 'input,next-state' pairs... each sizeof(acstate_t)
*
* above example case yields:
* Full Format: 0, 1 7 0 0 0 3 0 0 0 0 0 0 0 0 0 0 ...
ACSM2_MEMORY_TYPE__TRANSTABLE);
MEMASSERT(acsm->acsmTransTable, "_acsmCompile2");
- /* Alloc a MatchList table - this has a lis tof pattern matches for each state, if any */
+ /* Alloc a MatchList table - this has a list of pattern matches for each state, if any */
acsm->acsmMatchList =
(ACSM_PATTERN2**)AC_MALLOC(sizeof(ACSM_PATTERN2*) * acsm->acsmMaxStates,
ACSM2_MEMORY_TYPE__MATCHLIST);
}
/*
- * Global sumary of all info and all state machines built during this run
+ * Global summary of all info and all state machines built during this run
* This feeds off of the last pattern groupd built within snort,
* all groups use the same format, state size, etc..
* Combined with accrued stats, we get an average picture of things.
};
/*
-* Aho-Corasick State Machine Struct - one per group of pattterns
+* Aho-Corasick State Machine Struct - one per group of patterns
*/
struct ACSM_STRUCT2
{
** word 3+ : transition word = input<<24 | next-state-index
** input : 8 bit character, input to state machine from search text
** next-state-index: 24 bits for index of next state
-** (if we reallly need 16M states, we can add a state->index lookup array)
+** (if we really need 16M states, we can add a state->index lookup array)
** ...repeat for each state ...
**
** * if a state is empty it has words 1 and 2, but no transition words.
** a binary search if there are more than 5 elements in the state to test for
** a match. This allows us to use a simple sparse memory design with an
** acceptable worst case search scenario. The binary search over 256 elements
-** is limtied to a max of 8 tests. The zero'th state may use a full 256 state
+** is limited to a max of 8 tests. The zero'th state may use a full 256 state
** array, so a quick index lookup provides the next state transition. The
** zero'th state is generally visited much more than other states.
**
** instruction pipelining. Aren't we all. To this end, the number of
** patterns, length of search text, and cpu cache L1,L2,L3 all affect
** performance. The relative performance of the sparse and full format NFA and
-** DFA varies as you vary the pattern charactersitics,and search text length,
+** DFA varies as you vary the pattern characteristics, and search text length,
** but strong performance trends are present and stable.
**
**
**
** Reference - Efficient String matching: An Aid to Bibliographic Search
** Alfred V Aho and Margaret J Corasick
-** Bell Labratories
+** Bell Laboratories
** Copyright (C) 1975 Association for Computing Machinery,Inc
**
** 12/4/06 - man - modified summary
** 6/26/07 - man - Added last_match tracking, and accounted for nocase/case by
-** preseting the last match state, and reverting if we fail the
+** presetting the last match state, and reverting if we fail the
** case memcmp test for any rule in the states matching rule
-** list. The states in the defaul matcher represent either
+** list. The states in the default matcher represent either
** case or nocase states, so they are dual mode, that makes
** this a bit tricky. When we sue the pure exact match, or
** pure don't care matching routines, we just track the last
** 01/2008 - man - added 2 phase pattern matcher using a pattern match queue.
** Text is scanned and matching states are queued, duplicate
** matches are dropped, and after the complete buffer scan the
-** queued matches are processed. This improves cacheing
+** queued matches are processed. This improves caching
** performance, and reduces duplicate rule processing. The
** queue is limited in size and is flushed if it becomes full
** during the scan. This allows simple insertions. Tracking
bnfa_state_t full[BNFA_MAX_ALPHABET_SIZE];
if ( !_bnfa_conv_node_to_full(tk,full) )
- return 1; /* emtpy state */
+ return 1; /* empty state */
while ( tj )
{
FailState[s] = next;
/*
- * Copy 'next'states MatchList into 's' states MatchList,
+ * Copy 'next' states MatchList into 's' states MatchList,
* we just create a new list nodes, the patterns are not copied.
*/
for ( mlist = MatchList[next]; mlist; mlist = mlist->next)
#ifdef ALLOW_NFA_FULL
/*
-* Conver state machine to full format
+* Convert state machine to full format
*/
static int _bnfa_conv_list_to_full(bnfa_struct_t* bnfa)
{
* The transition and failure states are replaced with the start index of
* transition state, this eliminates the NextState[] lookup....
*
-* The compaction of multiple arays into a single array reduces the total
+* The compaction of multiple arrays into a single array reduces the total
* number of states that can be handled since the max index is 2^24-1,
* whereas without compaction we had 2^24-1 states.
*/
ps_index++; /* skip past state word */
- /* conver state 'k' to full format */
+ /* convert state 'k' to full format */
_bnfa_list_conv_row_to_full(bnfa, (bnfa_state_t)k, full);
/* count transitions */
* sindex - state tracker, set value to zero to reset the state machine,
* zero should be the value passed in on the 1st buffer or each buffer
* that is to be analyzed on its own, the state machine updates this
-* during searches. This allows for sequential buffer searchs without
-* reseting the state machine. Save this value as returned from the
+* during searches. This allows for sequential buffer searches without
+* resetting the state machine. Save this value as returned from the
* previous search for the next search.
*
* returns
void bnfaPrintInfo(bnfa_struct_t* pstruct); /* print info on this search engine */
/*
- * Summary - this tracks search engine information accross multiple instances of
+ * Summary - this tracks search engine information across multiple instances of
* search engines. It helps in snort where we have many search engines, each using
* rule grouping, to track total patterns, states, memory, etc...
*
void bnfaPrintInfoEx(bnfa_struct_t* p, const char* text);
void bnfaAccumInfo(bnfa_struct_t* pstruct); // add info to summary over multiple search engines
void bnfaPrintSummary(); /* print current summary */
-void bnfaInitSummary(); /* reset accumulator foir global summary over multiple engines */
+void bnfaInitSummary(); /* reset accumulator for global summary over multiple engines */
void bnfa_print_qinfo();
#endif
}
/* Dequeue context item in pending queue - this will get put in the permanent
- * context id list or free'd */
+ * context id list or freed */
ctx_node = (DCE2_CoCtxIdNode*)DCE2_QueueDequeue(cot->pending_ctx_ids);
if (ctx_node == nullptr)
{
/********************************************************************
* Function: DCE2_CoReassemble()
*
- * Gets a reassemly packet based on the transport and the type of
+ * Gets a reassembly packet based on the transport and the type of
* reassembly we want to do. Sets rule options and calls detect
* on the reassembled packet.
*
* the current data in fragmentation and segmentation buffers
* to the detection engine. Whether we do or not is based on
* whether or not we are configured to do so. The number of bytes
- * in the fragmentation and segmentation buffers are calulated
+ * in the fragmentation and segmentation buffers are calculated
* and if they exceed the amount we are configured for, we
* reassemble.
*
DCE2_Buffer* cli_stub_buf;
DCE2_Buffer* srv_stub_buf;
- int opnum; /* Opnum that is ultimatley used for request */
- int ctx_id; /* Context id that is ultimatley used for request */
+ int opnum; /* Opnum that is ultimately used for request */
+ int ctx_id; /* Context id that is ultimately used for request */
/* These are set on a first fragment received */
int expected_call_id; /* Expected call id for fragments */
* numbers, but in the order they were in the client packet */
DCE2_Queue* pending_ctx_ids;
- /* Keeps track of fragmentation buffer and frag specfic data */
+ /* Keeps track of fragmentation buffer and frag specific data */
DCE2_CoFragTracker frag_tracker;
int max_xmit_frag; /* The maximum negotiated size of a client request */
return DCE2_RET__ERROR;
// These are special cases. The write succeeds but the unlock fails
- // so an error reponse is returned but the data was actually written.
+ // so an error response is returned but the data was actually written.
if (DCE2_ComInfoIsResponse(com_info) && DCE2_ComInfoIsStatusError(com_info))
{
if (DCE2_SmbIsTidIPC(ssd, ssd->cur_rtracker->tid))
DCE2_SmbRequestTracker* rtracker, const uint16_t fid)
{
Profile profile(dce2_smb_pstat_smb_fid);
-
- DebugFormat(DEBUG_DCE_SMB, "Dequeueing file tracker "
- "and binding to fid: 0x%04X\n", fid);
-
+ DebugFormat(DEBUG_DCE_SMB, "Dequeuing file tracker and binding to fid: 0x%04X\n", fid);
DCE2_SmbFileTracker* ftracker = (DCE2_SmbFileTracker*)DCE2_QueueDequeue(rtracker->ft_queue);
if (ftracker == nullptr)
}
}
- // Other values were intialized when queueing.
+ // Other values were initialized when queuing.
ftracker->fid_v1 = (int)fid;
return ftracker;
{
Profile profile(dce2_smb_pstat_smb_fid);
- DebugFormat(DEBUG_DCE_SMB, "Queueing file tracker "
+ DebugFormat(DEBUG_DCE_SMB, "Queuing file tracker "
"with Uid: %hu, Tid: %hu\n", uid, tid);
DCE2_SmbFileTracker* ftracker = (DCE2_SmbFileTracker*)
*
* Returns:
* DCE2_Ret
- * DCE2_RET__ERROR if an error occured. Nothing can
+ * DCE2_RET__ERROR if an error occurred. Nothing can
* be trusted.
* DCE2_RET__SUCCESS if data was successfully added.
*
* DCE2_Ret
* DCE2_RET__SUCCESS if we were able to successfully parse the
* integer to the type specified.
- * DCE2_RET__ERROR if an error occured in parsing.
+ * DCE2_RET__ERROR if an error occurred in parsing.
*
********************************************************************/
DCE2_Ret DCE2_GetValue(char* start, char* end, void* int_value, int negate,
uint16_t smb_mid; /* multiplex id */
};
-/* For server empty respones indicating client error or interim response */
+/* For server empty responses indicating client error or interim response */
struct SmbEmptyCom
{
uint8_t smb_wct; /* value = 0 */
*
* Checks some relevant fields in the header to make sure they're
* sane.
- * Side effects are potential alerts for anomolous behavior.
+ * Side effects are potential alerts for anomalous behavior.
*
* Arguments:
* DCE2_SmbSsnData *
* Pointer to the session data structure.
* SmbNtHdr *
- * Pointer to the header struct layed over the packet data.
+ * Pointer to the header struct laid over the packet data.
*
* Returns:
* DCE2_Ret
* initial Session Request / Session Positive/Negative response
* followed by the normal SMB conversation, i.e. Negotiate,
* SessionSetupAndX, etc.
- * Side effects are potential alerts for anomolous behavior.
+ * Side effects are potential alerts for anomalous behavior.
*
* Arguments:
* DCE2_SmbSsnData * - the session data structure.
if (data_len < data_need)
{
DebugFormat(DEBUG_DCE_SMB, "Data len(%hu) < NetBIOS SS header(%u). "
- "Queueing data.\n", data_len, data_need);
+ "Queuing data.\n", data_len, data_need);
if (DCE2_SmbHandleSegmentation(seg_buf, data_ptr,
data_len, sizeof(NbssHdr)) != DCE2_RET__SUCCESS)
if (data_len < data_need)
{
DebugFormat(DEBUG_DCE_SMB, "Data len (%hu) < "
- "NetBIOS SS header + SMB header (%u). Queueing data.\n",
+ "NetBIOS SS header + SMB header (%u). Queuing data.\n",
data_len, data_need);
if (DCE2_SmbHandleSegmentation(seg_buf, data_ptr, data_len,
continue;
}
- // Check the SMB header for anomolies
+ // Check the SMB header for anomalies
if (DCE2_SmbHdrChecks(ssd, smb_hdr) != DCE2_RET__SUCCESS)
{
DebugMessage(DEBUG_DCE_SMB, "Bad SMB header.\n");
{
DebugFormat(DEBUG_DCE_SMB, "Data len(%hu) < "
"NetBIOS SS header + NetBIOS len(%zu). "
- "Queueing data.\n", data_len, sizeof(NbssHdr) + nb_len);
+ "Queuing data.\n", data_len, sizeof(NbssHdr) + nb_len);
if (DCE2_SmbHandleSegmentation(seg_buf, data_ptr, data_len,
sizeof(NbssHdr) + nb_len) != DCE2_RET__SUCCESS)
// Sets up the function to call for the command and valid word and byte
// counts for the command. Ensuring valid word and byte counts is very
// important to processing the command as it will assume the command is
- // legitimate and can access data that is acutally there. Note that
+ // legitimate and can access data that is actually there. Note that
// commands with multiple word counts indicate a different command
// structure, however most, if not all just have an extended version
// of the structure for which the extended part isn't used. If the
{
case DNS_RESP_STATE_RR_RDATA_START:
DebugFormat(DEBUG_DNS,
- "DNS ADDITONAL RR %d: type %hu, class %hu, "
+ "DNS ADDITIONAL RR %d: type %hu, class %hu, "
"ttl %u rdlength %hu\n", i,
dnsSessionData->curr_rr.type,
dnsSessionData->curr_rr.dns_class,
if (!PROTO_IS_FTP(ftp_ssn))
{
DebugMessage(DEBUG_FTPTELNET,
- "FTP-DATA Invalid FTP_SESSION retrieved durring lookup\n");
+ "FTP-DATA Invalid FTP_SESSION retrieved during lookup\n");
if (data_ssn->data_chan)
p->flow->set_ignore_direction(SSN_DIR_BOTH);
#define F_DATE "date"
#define F_LITERAL "'"
#define F_STRING "string"
-#define F_STRING_FMT "formated_string"
+#define F_STRING_FMT "formatted_string"
#define F_HOST_PORT "host_port"
#define F_LONG_HOST_PORT "long_host_port"
#define F_EXTD_HOST_PORT "extd_host_port"
SfIp serverIP;
uint16_t serverPort;
- /* A file is being transfered on ftp-data channel */
+ /* A file is being transferred on ftp-data channel */
char* filename;
int file_xfer_info; /* -1: ignore, 0: unknown, >0: filename length */
unsigned char flags;
*
* Arguments: None
*
- * Effect: The telnet nogiation data is removed from the data
+ * Effect: The telnet negotiation data is removed from the data
*
* Comments:
*
read_ptr = p->data;
end = p->data + p->dsize;
- /* look to see if we have any telnet negotiaion codes in the data */
+ /* look to see if we have any telnet negotiation codes in the data */
while (!normalization_required && (read_ptr < end))
{
/* look for the start of a negotiation string */
/* rewind the data stream to p->data */
read_ptr = p->data;
- /* setup for overwriting the negotaiation strings with
+ /* setup for overwriting the negotiation strings with
* the follow-on data
*/
write_ptr = (unsigned char*)DecodeBuffer.data;
/* RFC 885 defines an End of Record telnet option */
#define RFC885
-/* RFC 1184 defines Abort, Suspend, and End of File telnet optinos */
+/* RFC 1184 defines Abort, Suspend, and End of File telnet options */
#define RFC1184
#include "ftpp_si.h"
* GTP_Ret
* true if we were able to successfully parse the
* port list.
- * false if an error occured in parsing the port list.
+ * false if an error occurred in parsing the port list.
*
********************************************************************/
static int gtp_processInfoElements(GTPMsg* msg, const uint8_t* buff, uint16_t len)
if (!validated)
{
// The purpose of validate() is to quickly and efficiently dispose of obviously wrong
- // bindings. Passing is no guarentee that the connection is really HTTP, but failing
+ // bindings. Passing is no guarantee that the connection is really HTTP, but failing
// makes it clear that it isn't.
switch (validate(buffer[k]))
{
enum UriType { URI__NOT_COMPUTE=-14, URI__PROBLEMATIC=-12, URI_ASTERISK = 2, URI_AUTHORITY,
URI_ABSPATH, URI_ABSOLUTE };
-// Body compression tpyes
+// Body compression types
enum CompressId { CMP_NONE=2, CMP_GZIP, CMP_DEFLATE };
// Message section in which an IPS option provides the buffer
~HttpMsgHeadShared();
// Get the next item in a comma-separated header value and convert it to an enum value
static int32_t get_next_code(const Field& field, int32_t& offset, const StrCode table[]);
- // Do a case insensitve search for "boundary=" in a Field
+ // Do a case insensitive search for "boundary=" in a Field
static bool boundary_present(const Field& field);
#ifdef REG_TEST
// Default unicode map is just a single string of tokens of the form
// HHHH:HH (HHHH = unicode, HH = ascii char)
+// __STRDUMP_DISABLE__
std::stringstream ss(
"0100:41 0101:61 0102:41 0103:61 0104:41 0105:61 0106:43 0107:63 0108:43 0109:63 010a:43 010b:63 "
"010c:43 010d:63 010e:44 010f:64 0111:64 0112:45 0113:65 0114:45 0115:65 0116:45 0117:65 0118:45 "
"ff41:61 ff42:62 ff43:63 ff44:64 ff45:65 ff46:66 ff47:67 ff48:68 ff49:69 ff4a:6a ff4b:6b ff4c:6c "
"ff4d:6d ff4e:6e ff4f:6f ff50:70 ff51:71 ff52:72 ff53:73 ff54:74 ff55:75 ff56:76 ff57:77 ff58:78 "
"ff59:79 ff5a:7a ff5b:7b ff5c:7c ff5d:7d ff5e:7e");
+// __STRDUMP_ENABLE__
std::string token;
}
}
else if (ch != '}')
- *len = 0; // ALERT!! charachter should be a digit or ''}''
+ *len = 0; // ALERT!! character should be a digit or ''}''
return true;
}
const char* next_letter; // The current command in fetch
bool found_len;
uint32_t length;
- bool esc_nxt_char; // true if the next charachter has been escaped
+ bool esc_nxt_char; // true if the next character has been escaped
};
// States for IMAP PAF
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
//--------------------------------------------------------------------------
-// modubs.h author Russ Combs <rucombs@cisco.com>
+// modbus.h author Russ Combs <rucombs@cisco.com>
#ifndef MODBUS_H
#define MODBUS_H
/*
* Client PAF calls this command to set the server's state. This is the
- * function which ensure's the server know the correct expected
+ * function which ensures the server know the correct expected
* DATA
*/
static inline void set_server_state(Flow* ssn, PopExpectedResp state)
* PARAMS:
*
* RETURNS:
- * 0 - if terminatino sequence not found
+ * 0 - if termination sequence not found
* 1 - if termination sequence found
*/
static inline bool find_data_end_single_line(PopPafData* pfdata, const uint8_t ch, bool client)
* Purpose:
*
* This preprocessor normalizes the RPC requests from remote machines by
- * converting all fragments into one continous stream.
+ * converting all fragments into one continuous stream.
* This is very useful for doing things like defeating hostile attackers
* trying to stealth themselves from IDSs by fragmenting the request so the
* string 0186A0 is broken up.
uint8_t* data_end; /* points to the end of the payload for loop control */
uint32_t length; /* length of current fragment */
int last_fragment = 0; /* have we seen the last fragment sign? */
- uint32_t decoded_len; /* our decoded length is always atleast a 0 byte header */
+ uint32_t decoded_len; /* our decoded length is always at least a 0 byte header */
uint32_t fraghdr; /* Used to store the RPC fragment header data */
int fragcount = 0; /* How many fragment counters have we seen? */
size_t decode_buf_rem = sizeof(DecodeBuffer.data);
decoded_len = 4;
decode_buf_rem -= 4;
- /* always make sure that we have enough data to process atleast
+ /* always make sure that we have enough data to process at least
* the header and that we only process at most, one fragment
*/
else if ((data_index + length) > data_end)
{
DebugMessage(DEBUG_RPC,
- "returning LARGE_FRAGSIZE"
- "since we'd read past our end\n");
+ "returning LARGE_FRAGSIZE since we'd read past our end\n");
return RPC_LARGE_FRAGSIZE;
}
else
//-------------------------------------------------------------------------
// splitter stuff:
//
-// see above commments on MIN_CALL_BODY_SZ
+// see above comments on MIN_CALL_BODY_SZ
// why flush_point == 28 instead of 32 IDK
//
// we don't set a flush point to flush_point (= 28 above) because that will
/*
* Purpose: Inspects the packet's payload for fragment records and
- * converts them into one infragmented record.
+ * converts them into one unfragmented record.
*/
void RpcDecode::eval(Packet* p)
{
// In this case we don't look at server packets.
// There is the case were stream configuration requires a 3 way handshake.
// If no 3 way, then the packet flags won't be set, so don't look at it
- // since we won't be able to determeine who's the client and who's the
+ // since we won't be able to determine who's the client and who's the
// server.
if ( !p->is_from_client() )
return;
uint32_t maxNumDialogsInSession;
uint32_t methodsConfig;
SIPMethodlist methods; // Which methods to check
- uint16_t maxUriLen; // Maximum requst_URI size
+ uint16_t maxUriLen; // Maximum request_URI size
uint16_t maxCallIdLen; // Maximum call_ID size.
uint16_t maxRequestNameLen; // Maximum length of request name in the CSeqID.
uint16_t maxFromLen; // Maximum From field size
{ "250", 3, RESP_250, SMTP_CMD_TYPE_NORMAL }, /* Requested mail action okay, completed */
{ "334", 3, RESP_334, SMTP_CMD_TYPE_NORMAL }, /* Auth intermediate response */
{ "354", 3, RESP_354, SMTP_CMD_TYPE_NORMAL }, /* Start mail input - data response */
- { "421", 3, RESP_421, SMTP_CMD_TYPE_NORMAL }, /* Service not availiable - closes connection
+ { "421", 3, RESP_421, SMTP_CMD_TYPE_NORMAL }, /* Service not available - closes connection
*/
{ "450", 3, RESP_450, SMTP_CMD_TYPE_NORMAL }, /* Mailbox unavailable */
{ "451", 3, RESP_451, SMTP_CMD_TYPE_NORMAL }, /* Local error in processing */
config->num_cmds++;
- /* allocate enough memory for new commmand - alloc one extra for NULL entry */
+ /* allocate enough memory for new command - alloc one extra for NULL entry */
// FIXIT-L this constant reallocation is not necessary; use vector
cmds = (SMTPToken*)snort_calloc((config->num_cmds + 1) * sizeof(*cmds));
cmd_config = (SMTPCmdConfig*)snort_calloc((config->num_cmds + 1) * sizeof(*cmd_config));
return 1;
}
-/* Calback to return the email headers */
+/* Callback to return the email headers */
static int SMTP_GetEmailHdrs(Flow* flow, uint8_t** buf, uint32_t* len, uint32_t* type)
{
SMTPData* ssn = get_session_data(flow);
* @param eol end of end of line marker
*
* @return response
- * @retval 0 function succeded without error
+ * @retval 0 function succeeded without error
* @retval -1 there were errors
*/
int SMTP_NormalizeCmd(Packet* p, const uint8_t* ptr, const uint8_t* eolm, const uint8_t* eol)
* key exchange. Both server and client should
* send one, but as per Alex Kirk's note on this,
* in some implementations the server does not
- * actually send this message. So receving a new
+ * actually send this message. So receiving a new
* keys msg from the client is sufficient.
*/
if ( direction == SSH_DIR_FROM_CLIENT )
const uint32_t* pn, * pi;
/* SFIP_CONTAINS is returned here due to how sfvar_ip_in
- * handles zero'ed IPs" */
+ * handles zeroed IPs" */
if (!ip)
return SFIP_CONTAINS;
if (!ip_raw || !buf ||
(family != AF_INET && family != AF_INET6) ||
/* Make sure if it's IPv6 that the buf is large enough. */
- /* Need atleast a max of 8 fields of 4 bytes plus 7 for colons in
+ /* Need at least a max of 8 fields of 4 bytes plus 7 for colons in
* between. Need 1 more byte for null. */
(family == AF_INET6 && bufsize < INET6_ADDRSTRLEN) ||
/* Make sure if it's IPv4 that the buf is large enough.
snort_free(var);
}
-/* Allocaties and returns an IP node described by 'str' */
+/* Allocates and returns an IP node described by 'str' */
static sfip_node_t* sfipnode_alloc(const char* str, SfIpRet* status)
{
// FIXIT-L rename variables from ret to something with more descriptive
}
}
- /* Check if this is a negated, zero'ed IP (equivalent of a "!any") */
+ /* Check if this is a negated, zeroed IP (equivalent of a "!any") */
if (!ret->ip->is_set() && (ret->flags & SFIP_NEGATED))
{
if (status)
}
/* If we're here, the head node was lesser than the new node */
- /* Before searching the list, verify there is atleast two nodes.
+ /* Before searching the list, verify there is at least two nodes.
* (This saves an extra check during the loop below) */
if (!(*head)->next)
{
return SFIP_NOT_ANY;
}
- /* Check if this is a negated, zero'ed IP (equivalent of a "!any") */
+ /* Check if this is a negated, zeroed IP (equivalent of a "!any") */
if (copy_var->head && !copy_var->head->ip->is_set())
{
snort_free(tok);
_negate_node(node);
}
- /* Check if this is a negated, zero'ed IP (equivalent of a "!any") */
+ /* Check if this is a negated, zeroed IP (equivalent of a "!any") */
if (!node->ip->is_set() && (node->flags & SFIP_NEGATED))
{
sfip_node_free(node);
struct _ip_node* next;
int flags;
// XXX
- int addr_flags; /* Flags used exlusively by Snort */
- /* Keeping these variables seperate keeps
+ int addr_flags; /* Flags used exclusively by Snort */
+ /* Keeping these variables separate keeps
* this from stepping on Snort's toes. */
/* Should merge them later */
} sfip_node_t;
};
//---------------------------------------------------------------
+// __STRDUMP_DISABLE__
static FuncTest ftests[] =
{
#define NUM_TESTS (sizeof(ftests)/sizeof(ftests[0]))
+// __STRDUMP_ENABLE__
//---------------------------------------------------------------
static int RunFunc(const char* func, const char* arg1, const char* arg2)
* then more specific information will be written into the routing tables
* from RNA. Ideally, information will only move from less specific to more
* specific. If a more general information is to overwrite existing entries,
- * the table should be free'ed and rebuilt.
+ * the table should be freed and rebuilt.
*
*
* Implementation:
* Inserts are performed by specifying a CIDR and a pointer to its associated
* data. Since a new routing table entry may overwrite previous entries,
* a flag selects whether the insert favors the most recent or favors the most
- * specific. Favoring most specific should be the default behvior. If
+ * specific. Favoring most specific should be the default behavior. If
* the user wishes to overwrite routing entries with more general data, the
* table should be flushed, rather than using favor-most-recent.
*
* Before modifying the routing or data tables, the insert function performs a
- * lookup on the CIDR-to-be-insertted. If no entry or an entry *of differing
- * bit length* is found, the data is insertted into the data table, and its
+ * lookup on the CIDR-to-be-inserted. If no entry or an entry *of differing
+ * bit length* is found, the data is inserted into the data table, and its
* index is used for the new routing table entry. If an entry is found that
* is as specific as the new CIDR, the index stored points to where the new
* data is written into the data table.
table_t* table = (table_t*)snort_alloc(sizeof(table_t));
/* If this limit is exceeded, there will be no way to distinguish
- * between pointers and indeces into the data table. Only
+ * between pointers and indices into the data table. Only
* applies to DIR-n-m. */
#if SIZEOF_LONG_INT == 8
if (data_size >= 0x800000000000000)
* a specific subnet. table->data[] entry for more specific subnet is not cleared.
*
* @note RT_FAVOR_TIME can cause orphaned table->data[] entries if the entire subnet
- * is replaced by more specific sudnets.
+ * is replaced by more specific subnets.
*/
static inline uint32_t _dir_remove_all(uint32_t* allocated, uint32_t index, uint32_t fill,
word length, dir_sub_table_t* table)
fill += index;
- /* Remove and overwrite without consedering CIDR specificity*/
+ /* Remove and overwrite without considering CIDR specificity*/
if (behavior == RT_FAVOR_TIME)
{
valueIndex = _dir_remove_all(&root_table->allocated, index, fill, length, sub_table);
* are used. */
int cur_num; /* Present number of used nodes */
- /** number of entries filled including chidren sub_tables. This is used
- * for freeing sub_tables when all entried are freed by delete operation.
+ /** number of entries filled including children sub_tables. This is used
+ * for freeing sub_tables when all entries are freed by delete operation.
*/
int filledEntries;
} dir_sub_table_t;
table = (table_flat_t*)(&base[table_ptr]);
/* If this limit is exceeded, there will be no way to distinguish
- * between pointers and indeces into the data table. Only
+ * between pointers and indices into the data table. Only
* applies to DIR-n-m. */
#if SIZEOF_LONG_INT == 8
* The mechanism for processing frags is based on the Linux IP stack
* implementation of IP defragmentation with proper amounts of paranoia
* and an IDS perspective applied. Some of this code was derived from
- * frag2 originally, but it's basically unrecognizeable if you compare
+ * frag2 originally, but it's basically unrecognizable if you compare
* it to frag2 IMO.
*
* I switched from using the UBI libs to using sfxhash and linked lists for
* Frag3 is also capable of performing "engine-based" IP defragmentation.
* What this means practically is that frag3 can model the IP stack of a
* engine on the network to avoid Ptacek-Newsham evasions of the IDS through
- * sensor/engine desynchronization. In terms of implentation, this is
+ * sensor/engine desynchronization. In terms of implementation, this is
* reflected by passing a "engine" into the defragmentation engine that has
* a specific configuration for a specific engine type. Windows can put
* fragments back together differently than Linux/BSD/etc, so we model that
}
/**
- * Generate an event due to a fragment being too short, typcially based
+ * Generate an event due to a fragment being too short, typically based
* on a non-last fragment that doesn't properly end on an 8-byte boundary
*
* @param engine Current run engine
/* Use the actual length here because packet may have been
* truncated. Don't want to try to copy more than we actually
* captured. Use dsize as the frag length since it is distance
- * between the last sucesfully decoded layer (which is ip6_frag
+ * between the last succesfully decoded layer (which is ip6_frag
* or ipv4) and the end of packet, */
fragLength = p->dsize;
endOfThisFrag = frag_offset + fragLength;
/*
* if we've accumulated enough data to match the calculated size
- * of the defragg'd packet, return 1
+ * of the defragged packet, return 1
*/
if (ft->frag_bytes == ft->calculated_size)
{
* Plug a Fragment into the fraglist of a FragTracker
*
* @param ft FragTracker to put the new node into
- * @param prev ptr to preceeding Fragment in fraglist
+ * @param prev ptr to preceding Fragment in fraglist
* @param next ptr to following Fragment in fraglist
* @param node ptr to node to put in list
*
ft->frag_time.tv_sec = p->pkth->ts.tv_sec;
ft->frag_time.tv_usec = p->pkth->ts.tv_usec;
- //dont forward fragments to engine if some previous fragment was dropped
+ //don't forward fragments to engine if some previous fragment was dropped
if ( ft->frag_flags & FRAG_DROP_FRAGMENTS )
{
DisableDetect();
/* Use the actual length here because packet may have been
* truncated. Don't want to try to copy more than we actually
* captured. Use dsize as the frag length since it is distance
- * between the last sucesfully decoded layer (which is ip6_frag
+ * between the last succesfully decoded layer (which is ip6_frag
* or ipv4) and the end of packet, */
len = fragLength = p->dsize;
fragStart = p->data;
{
uint16_t oldfrag_end;
/*
- * all non-last frags are supposed to end on 8-byte boundries
+ * all non-last frags are supposed to end on 8-byte boundaries
*/
if (frag_end & 7)
{
* existing frag -- existing frag needs to be split
* and the new frag inserted in the middle.
*
- * Need to duplciate left. Adjust that guys
+ * Need to duplicate left. Adjust that guys
* offset by + (frag_offset + len) and
* size by - (frag_offset + len - left->offset).
*/
/* Use the actual length here because packet may have been
* truncated. Don't want to try to copy more than we actually
* captured. Use dsize as the frag length since it is distance
- * between the last sucesfully decoded layer (which is ip6_frag
+ * between the last succesfully decoded layer (which is ip6_frag
* or ipv4) and the end of packet, */
fragLength = p->dsize;
fragStart = p->data;
else
{
/*
- * all non-last frags are supposed to end on 8-byte boundries
+ * all non-last frags are supposed to end on 8-byte boundaries
*/
if (frag_end & 7)
{
/* insert the fragment into the frag list */
ft->fraglist = f;
ft->fraglist_tail = f;
- ft->fraglist_count = 1; /* XXX: Are these duplciates? */
+ ft->fraglist_count = 1; /* XXX: Are these duplicates? */
ft->frag_pkts = 1;
/*
* @param fragLength Length of packet data
* @param len Length of this fragment
* @param slide Adjustment to make to left side of data (for left overlaps)
- * @param trunc Adjustment to maek to right side of data (for right overlaps)
+ * @param trunc Adjustment to make to right side of data (for right overlaps)
* @param frag_offset Offset for this fragment
- * @prarm left FragNode prior to this one
+ * @param left FragNode prior to this one
* @param retFrag this one after its inserted (returned)
*
* @return status
* Duplicate a frag node and insert it into the list.
*
* @param ft FragTracker to hold the packet
- * @prarm left FragNode prior to this one (to be dup'd)
+ * @param left FragNode prior to this one (to be dup'd)
* @param retFrag this one after its inserted (returned)
*
* @return status
* last frag offset
*/
- uint32_t frag_pkts; /* nummber of frag pkts stored under this tracker */
+ uint32_t frag_pkts; /* number of frag pkts stored under this tracker */
struct timeval frag_time; /* time we started tracking this frag */
return true;
}
-/* This will falsely return SSN_MISSING_BEFORE on the first reassembed
+/* This will falsely return SSN_MISSING_BEFORE on the first reassembled
* packet if reassembly for this direction was set mid-session */
uint8_t TcpStreamSession::missing_in_reassembled(uint8_t dir)
{
p->type(), p->get_ip_proto_next(),
p->ptrs.ip_api.get_src(), p->ptrs.sp,
p->ptrs.ip_api.get_dst(), p->ptrs.dp,
- // if the vlan protocol bit is defined, vlan layer gauranteed to exist
+ // if the vlan protocol bit is defined, vlan layer guaranteed to exist
(p->proto_bits & PROTO_BIT__VLAN) ? layer::get_vlan_layer(p)->vid() : 0,
(p->proto_bits & PROTO_BIT__MPLS) ? p->ptrs.mplsHdr.label : 0,
p->pkth->address_space_id);
static Flow* new_flow(FlowKey*);
// Looks in the flow cache for flow session with specified key and returns
- // pointer to flow session oject if found, otherwise null.
+ // pointer to flow session object if found, otherwise null.
static Flow* get_flow(const FlowKey*);
// Allocates a flow session object from the flow cache table for the protocol
int SegmentOverlapEditor::full_right_overlap_os3()
{
// If this packet is wholly overlapping and the same size as a previous one and we have not
- // received the one immediately preceeding, we take the FIRST.
+ // received the one immediately preceding, we take the FIRST.
if ( SEQ_EQ(right->seq, seq) && ( right->payload_size == len )
&& ( left && !SEQ_EQ(left->seq + left->payload_size, seq) ) )
{
{
{ "tcp_trim_syn", "tcp segments trimmed on SYN" },
{ "tcp_trim_rst", "RST packets with data trimmed" },
- { "tcp_trim_win", "data trimed to window" },
+ { "tcp_trim_win", "data trimmed to window" },
{ "tcp_trim_mss", "data trimmed to MSS" },
{ "tcp_ecn_session", "ECN bits cleared" },
{ "tcp_ts_nop", "timestamp options cleared" },
static inline int handle_repeated_syn_mswin(TcpStreamTracker* talker, TcpStreamTracker* listener,
TcpSegmentDescriptor& tsd, TcpSession* session)
{
- /* Windows has some strange behaviour here. If the sequence of the reset is the
- * next expected sequence, it Resets. Otherwise it ignores the 2nd SYN.
+ /* Windows has some strange behavior here. If the sequence of the reset is the
+ * next expected sequence, it Resets. Otherwise it ignores the 2nd SYN.
*/
if (SEQ_EQ(tsd.get_seg_seq(), listener->r_nxt_ack))
{
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
//--------------------------------------------------------------------------
-// tcp_reassember.cc author davis mcpherson <davmcphe@@cisco.com>
+// tcp_reassembler.cc author davis mcpherson <davmcphe@@cisco.com>
// Created on: Jul 31, 2015
#ifdef HAVE_CONFIG_H
* Without doing it this way, the timestamp would be 20. With
* the next packet to arrive (P4, seq 40), the ts_last value
* wouldn't be updated for the talker in ProcessTcp() since that
- * code specificially looks for the NEXT sequence number.
+ * code specifically looks for the NEXT sequence number.
*/
if ( !last_ts )
return purged_bytes;
return STREAM_UNALIGNED;
}
- /* move the ack boundry up, this is the only way we'll accept data */
+ /* move the ack boundary up, this is the only way we'll accept data */
// FIXIT-L for ips, must move all the way to first hole or right end
listener->r_nxt_ack = tsd.get_end_seq();
if ( tsd.get_pkt()->is_eth() )
{
- // if flag is set, gauranteed to have an eth layer
+ // if flag is set, guaranteed to have an eth layer
Packet* p = tsd.get_pkt();
const eth::EtherHdr* eh = layer::get_eth_layer(p);
bool t_hijack = !talker->compare_mac_addresses(eh->ether_src);
// FIXIT-M move this to normalizer base class, handle OS_PROXY in derived class
if (config->policy != StreamPolicy::OS_PROXY)
{
- /* check for valid seqeuence/retrans */
+ /* check for valid sequence/retrans */
if (!listener->is_segment_seq_valid(tsd) )
return;
{
if (!application)
{
- /* match of ipproto, proto. application not speicifed */
+ /* match of ipproto, proto. application not specified */
return true;
}
}
else if (!protocol)
{
- /* match of ipproto. protocol not speicifed */
+ /* match of ipproto. protocol not specified */
return true;
}
}
{
if (!application)
{
- /* match of ipproto, proto. application not speicifed */
+ /* match of ipproto, proto. application not specified */
return true;
}
}
else if (!protocol)
{
- /* match of ipproto. protocol not speicifed */
+ /* match of ipproto. protocol not specified */
return true;
}
}
#ifndef TIMERSUB_H
#define TIMERSUB_H
-// never worry about timersub type activies again -- from GLIBC and upcased.
+// never worry about timersub type activities again -- from GLIBC and upcased.
#define TIMERSUB(a, b, result) \
do { \
(result)->tv_sec = (a)->tv_sec - (b)->tv_sec; \
root = km->root[ *P ];
}
- /* Walk exisitng Patterns */
+ /* Walk existing Patterns */
while ( n )
{
if ( root->nodechar == *P )
else
{
/*
- * Start a new sibling bracnch to finish this Keyword
+ * Start a new sibling branch to finish this Keyword
*/
//printf("added sibling branch nodechar = %c \n",*P);
root->sibling= KMapCreateNode(km);
// Keyword Trie based Map Table
// The tree uses linked lists to build the finite automata
//
-// MapKeyFind(): Performs a setwise strcmp() equivalant.
+// MapKeyFind(): Performs a setwise strcmp() equivalent.
//
// Keys may be ascii or binary, both may be of random sizes. Each key may
// be a different size, or all one size. Fast dictionary lookup,
void pc_sum()
{
- // must sum explicitly; can't zero; daq stats are cuumulative ...
+ // must sum explicitly; can't zero; daq stats are cumulative ...
const DAQ_Stats_t* daq_stats = SFDAQ::get_stats();
g_daq_stats.hw_packets_received += daq_stats->hw_packets_received;
if (buf[buf_size - 1] != '\0' || (size_t)ret >= buf_size)
{
- /* truncation occured */
+ /* truncation occurred */
buf[buf_size - 1] = '\0';
return SNORT_SNPRINTF_TRUNCATION;
}
appendLen = vsnprintf(dest+currLen, dsize-currLen, format, ap);
va_end(ap);
- dest[dsize-1]=0; /* guarantee a null tremination */
+ dest[dsize-1]=0; /* guarantee a null termination */
return appendLen;
}
// This program is a simple utility for reading the flatbuffers files
// Snort generates. The files consist of a schema with a stream of
-// timetamped records that this program converts into a YAML array for
+// timestamped records that this program converts into a YAML array for
// further data processing.
#include <csignal>
table_api.open_table("alerts");
if (data_stream >> val &&
- util::case_compare(val, "disableD"))
+ util::case_compare(val, "disabled"))
{
table_api.add_option("default_rule_state", false);
}
if (!port.compare("any"))
{
- // Possible Snort bug, but only port zero is ignrored
+ // Possible Snort bug, but only port zero is ignored
bind.add_when_port("0");
}
else if (colon_pos == std::string::npos)
{
data_api.failed_conversion(data_stream, "can't convert " + port);
retval = false;
- bind.print_binding(false); // don't print the binding if an error occured
+ bind.print_binding(false); // don't print the binding if an error occurred
}
catch (std::out_of_range)
{
data_api.failed_conversion(data_stream, "Port" + port + " must be <= 65535");
retval = false;
- bind.print_binding(false); // don't print the binding if an error occured
+ bind.print_binding(false); // don't print the binding if an error occurred
}
}
#include <string>
/*
- * This file was specifically created to avoid cyclic depencies
- * and should therefore avoid ANY local depencies.
+ * This file was specifically created to avoid cyclic dependencies
+ * and should therefore avoid ANY local dependencies.
*/
class ConversionState;
RuleApi& rule_api;
#if 0
- Forward declaration fo parsing methods.Since these are all inline,
+ Forward declaration of parsing methods.Since these are all inline,
unable to forward declare in regular code.
inline bool eat_option(std::istringstream& stream);
}
else
{
- table_api.add_comment("Unable to convert " + elem +
- "!! The element must be a single charachter or number between 0 - 255 inclusive");
+ table_api.add_comment(
+ "Unable to convert " + elem + "!! "
+ "The element must be a single character or number between 0 - 255 inclusive");
retval = false;
}
}
while (stream >> elem && elem != "}")
tmp += " " + elem;
- // remove the extra space at the beginig of the string
+ // remove the extra space at the beginning of the string
if (tmp.size() > 0)
tmp.erase(tmp.begin());
std::string curr_pre_str = pre_str;
std::size_t max_line_length = c.max_line_length - pre_str_length - 1;
- // print a newline betweens strings, but not before the first line.
+ // print a newline between strings, but not before the first line.
if (first_str)
first_str = false;
else
out << "\n";
- // if the line is emptry, we need a newline. the loop won't print it.
+ // if the line is empty, we need a newline. the loop won't print it.
if (str.size() == 0)
out << "\n";
static const std::string start_errors =
"\nERRORS:\n"
- " all of these occured during the attempted conversion:\n\n";
+ " all of these occurred during the attempted conversion:\n\n";
static const std::string start_bad_rules =
"\nFAILED RULES CONVERSIONS:\n"
VarData* vd = new VarData();
vd->type = VarType::STRING;
- // if the previous variable was a symbol, we need a space seperator.
+ // if the previous variable was a symbol, we need a space separator.
if (!vars.empty())
s.insert(0, " ");
* I copied the Snort version of ExpandVars and made some
* minor adjustments.
*
- * Given a Snort style string to expand, this funcion will return
+ * Given a Snort style string to expand, this function will return
* the expanded string
*/
std::string DataApi::expand_vars(const std::string& string)
#include "data/dt_rule_api.h"
// FIXIT-L change name to data_api
-// FIXIT-L remove all unecessary includes
+// FIXIT-L remove all unnecessary includes
// FIXIT-L set_default_print name should be change to print_all
// As a heads up to whoever reads this file. This one API is really three
// distinct API's rolled into one. One API for rules, one api for misc
// data (variables, includes, etcs), one api for creating tables. Hoever,
-// the reason they are together is becasue this class is not static, and I
+// the reason they are together is because this class is not static, and I
// did not want to be pass three pointers to the three API's when creating
-// new convesion states. There are comments in in all caps which show the
-// seperate the sections.
+// new conversion states. There are comments in in all caps which show the
+// separate the sections.
// The first section of this file is really DataApi creation and
-// initialization, and adding miscelaneous objects to the DataApi data.
+// initialization, and adding miscellaneous objects to the DataApi data.
// The second section is for creating tables and their options. The third
// section is for creating rules.
bool empty() const
{ return vars.empty() && includes.empty(); }
- // functions specifically usefull when parsing includes.
+ // functions specifically useful when parsing includes.
// allows for easy swapping of data. These two functions
// swap data which will be printed in 'print_rules()' and
// 'print_conf_options()'
bool add_variable(std::string name, std::string value);
// add a Snort style include file
bool add_include_file(std::string name);
- // add a 'comment' to the Lua file. shoudl ONLY be used when
+ // add a 'comment' to the Lua file. should ONLY be used when
// adding a comment from the original Snort file.
void add_comment(std::string);
// Call when failed to convert a line.
{
if (curr_rule)
{
- DataApi::developer_error("Attempting to include a file while buliding a rule!");
+ DataApi::developer_error("Attempting to include a file while building a rule!");
}
else
{
void print_rules(std::ostream&, bool in_rule_file);
void print_rejects(std::ostream&);
- // functions specifically usefull when parsing includes.
+ // functions specifically useful when parsing includes.
// allows for easy swapping of data. These two functions
// swap data which will be printed in 'print_rules()' and
// 'print_conf_options()'
// I need to iterate over the stack of open tables. However,
// stack's don't allow iteration without popping. So, rather
// than change the underlying stack data structure, I am going
- // to just copy the entire data structure. Innedficciant, but
+ // to just copy the entire data structure. Inefficient, but
// not pressed for speed here.
std::stack<Table*> copy(open_tables);
* really three distinct API's rolled into one. One API for rules,
* one api for misc data (variables, includes, etcs), one api
* for creating tables. Hoever, the reason they are
-* together is becasue this class is not static, and I did not
+* together is because this class is not static, and I did not
* want to be pass three pointers to the three API's when
-* creating new convesion states. There are comments in
-* in all caps which show the seperate the sections.
+* creating new conversion states. There are comments in
+* in all caps which show the separate the sections.
*
* The first section of this file is really DataApi creation
-* and initialization, and adding miscelaneous objects
+* and initialization, and adding miscellaneous objects
* to the DataApi data. The second section is for creating
* tables and their options. The third section is for
* creating rules.
// add an option with a list of variables --> table = { name = 'elem1 elem2 ...' }
// corresponds to Parameter::PT_MULTI
bool add_list(std::string list_name, std::string next_elem);
-// add a commment to be printed in the table --> table = { -- comment \n ... }
+// add a comment to be printed in the table --> table = { -- comment \n ... }
bool add_comment(std::string comment);
// add a comment about an option change to the table
bool add_diff_option_comment(std::string orig_var, std::string new_var);
if (!tmp.empty())
{
- // first charachter is either a '#' or a ';'
+ // first character is either a '#' or a ';'
tmp.erase(tmp.begin());
util::ltrim(tmp);
}
std::string rules, // defaults to output_file
std::string errors); // defaults to output_file
- // parse a file without creating an entirely new Lua configuation
+ // parse a file without creating an entirely new Lua configuration
int parse_include_file(std::string input_file);
// set the next parsing state.
std::size_t path_sep = conf_file.find_last_of("\\");
#endif
- /* is there a directory seperator in the filename */
+ /* is there a directory separator in the filename */
if (path_sep != std::string::npos)
{
path_sep++; /* include path separator */
"output the new Snort++ lua configuration to <out_file>" },
{ "q", print_quiet, "",
- "quiet mode. Only output valid confiration information to the <out_file>" },
+ "quiet mode. Only output valid configuration information to the <out_file>" },
{ "r", parse_rule_file, "<rule_file>",
"output any converted rule to <rule_file>" },
{ "s", sing_rule_files, "",
"when parsing <include_file>, write <include_file>'s rules to "
- "<rule_file>. Meaningles if '-i' provided" },
+ "<rule_file>. Meaningless if '-i' provided" },
{ "t", sing_conf_files, "",
"when parsing <include_file>, write <include_file>'s information, "
- "excluding rules, to <out_file>. Meaningles if '-i' provided" },
+ "excluding rules, to <out_file>. Meaningless if '-i' provided" },
{ "V", print_version, "",
"Print the current Snort2Lua version" },
"between the Snort and Snort++ configurations to the <out_file>" },
{ "quiet", print_quiet, "",
- "Same as '-q'. quiet mode. Only output valid confiration information to the <out_file>" },
+ "Same as '-q'. quiet mode. Only output valid configuration information to the <out_file>" },
{ "remark", add_remark, "",
"same as '-m'. add a remark to the end of every converted rule" },
{
/*
* This file is directly copied (and then edited)
- * from Snrot++'s cmd_line.h
+ * from Snort++'s cmd_line.h
*/
bool parse_cmd_line(int argc, char* argv[]);
bool get_string(std::istringstream& stream,
std::string& option,
- const std::string delimeters)
+ const std::string delimiters)
{
- if (delimeters.empty() || !stream.good())
+ if (delimiters.empty() || !stream.good())
{
option = std::string();
return false;
}
- else if (delimeters.size() == 1)
+ else if (delimiters.size() == 1)
{
- std::getline(stream, option, delimeters[0]);
+ std::getline(stream, option, delimiters[0]);
trim(option);
return !option.empty();
}
while (stream.good() && option.empty())
{
pos = stream.tellg();
- std::getline(stream, option, delimeters[0]);
+ std::getline(stream, option, delimiters[0]);
}
- // find the first non-delimeter charachter
- const std::size_t first_char = option.find_first_not_of(delimeters);
+ // find the first non-delimiter character
+ const std::size_t first_char = option.find_first_not_of(delimiters);
- // if there are no characters between a delimeter, empty string. return false
+ // if there are no characters between a delimiter, empty string. return false
if (first_char == std::string::npos)
return false;
- // find the first delimeter after the first non-delimeter
- std::size_t first_delim = option.find_first_of(delimeters, first_char);
+ // find the first delimiter after the first non-delimiter
+ std::size_t first_delim = option.find_first_of(delimiters, first_char);
if (first_delim == std::string::npos)
first_delim = option.size(); // set value to take proper substr
const std::unique_ptr<const ConvertMap>& find_map(
const std::vector<std::unique_ptr<const ConvertMap> >&, const std::string& keyword, bool strict_case = true);
-// trim from begining
+// trim from beginning
std::string& ltrim(std::string& s);
// trim from end
bool file_exists(const std::string& name);
/*
- * Takes in a stream and a string of delimeters. The function will extract the characters
- * from the stream until it hits one of the delimeters. The substring will be set to the
- * third parameter. The stream itself will point to the chrachter after the first delim.
+ * Takes in a stream and a string of delimiters. The function will extract the characters
+ * from the stream until it hits one of the delimiters. The substring will be set to the
+ * third parameter. The stream itself will point to the character after the first delim.
*
* PARAMS:
* data_stream - the data stream from which to find a substring.
- * delimeters - The string of delimeters.
+ * delimiters - The string of delimiters.
* options - The found substring will be place in this parameter. If the
* stream is empty or no characters have been extracted, then
- * this parameter wil be set to an empty string.
+ * this parameter will be set to an empty string.
* RETURNS:
* True - when the string is found.
- * False - whenma substing was unable to be extracted.
+ * False - when the substring was unable to be extracted.
*/
bool get_string(std::istringstream& data_stream,
std::string& option,
- const std::string delimeters);
+ const std::string delimiters);
/*
* Returns the rest of the data_streams data as one argument.
- * Usefule when parsing filenames with spaces or other
+ * Useful when parsing filenames with spaces or other
* characters which can get removed by c++ libraries
*
* NO SIDE EFFECTS
*
* PARAMS:
* data_stream - the rule's data stream
- * opt_name - the option name for which to seach.
+ * opt_name - the option name for which to search.
* RETURN:
* the opt_names value or an empty string if the opt_name
* is not found.
// remove any ']]' and double spaces from this string.
std::string& sanitize_lua_string(std::string& s);
-// find the location of the first space before max_str_lenght.
+// find the location of the first space before max_str_length.
// if no space exists before max_str_length, return the first space
// after max_length. Otherwise, return std::string::npos
std::size_t get_substr_length(std::string s, std::size_t max_length);
class TableApi;
-// The Binders destrutor will add the Objects configuration to the
+// The Binders destructor will add the Objects configuration to the
// table_api.
class Binder
{
if (!elem.empty() && elem.front() != '<')
{
- // add the '<' charachter back for next call
+ // add the '<' character back for next call
attr_file.unget();
return true;
}
}
/*
- * Parse the 'SERVICE' element and add elemnts to Lua configuration
+ * Parse the 'SERVICE' element and add elements to Lua configuration
*/
void AttributeTable::parse_service()
{
parse_attr_table();
/*
- * While there probaby should be another else,
+ * While there probably should be another else,
* I have absolutely NO idea what correct
* 'grammar' entails. So, in this case and all others
* just ignore any extra data.
}
else
{
- data_api.failed_conversion(data_stream, "include requires a"
- "'filename' argument");
+ data_api.failed_conversion(data_stream, "include requires a 'filename' argument");
}
return false;
std::string rule_string = data_stream.str();
std::size_t end_pos = rule_string.rfind(')');
rule_string = rule_string.substr(0, end_pos);
- util::rtrim(rule_string); // gaurantee last char is a rule opt/subopt
+ util::rtrim(rule_string); // guarantee last char is a rule opt/subopt
data_stream.str(rule_string);
data_stream.seekg(curr_pos); // position was reset. so find curr position
if (map)
{
- // using smart pointer to gaurantee new Map is deleted
+ // using smart pointer to guarantee new Map is deleted
const std::vector<std::unique_ptr<const ConvertMap> >& ruletype_map =
ruletype_api;
std::unique_ptr<ConvertMap> new_map(new ConvertMap());
std::string units = "B";
std::istringstream tmp_stream(keyword);
- tmp_stream >> limit; // gauranteed success since keyword is non-empty
+ tmp_stream >> limit; // guaranteed success since keyword is non-empty
if (tmp_stream >> c)
{
if (c == 'K' || c == 'k')
}
// Read from data_stream either a single value x or list : [x,y,z ... ]
-// Put in str either a single value 'x', or space sperated list 'x y z'
+// Put in str either a single value 'x', or space separated list 'x y z'
bool DcerpcServer::convert_val_or_list(std::istringstream& data_stream, std::string& str)
{
if (!(data_stream >> str))
// remove ""
str.erase(std::remove(str.begin(), str.end(), '"'), str.end());
- // convert ',' seperators to spaces
+ // convert ',' separators to spaces
replace(str.begin(), str.end(), ',', ' ');
return true;
((ports.find('[') == std::string::npos) && (ports.find(']') !=
std::string::npos)))
{
- // found outer list seperator
+ // found outer list separator
if (one_type)
{
return false;
{
return true;
}
- else // wait for list terminator or item seperator
+ else // wait for list terminator or item separator
{
if (!data_stream.get(c))
return false;
table_api.open_table("stream_ip");
- // full options are comma seperated
+ // full options are comma separated
while (util::get_string(data_stream, keyword, ","))
{
bool tmpval = true;
- // suboptions are space seperated
+ // suboptions are space separated
std::istringstream args_stream(keyword);
args_stream >> keyword;
retval = false;
}
- table_api.close_table(); // anonymouse
+ table_api.close_table(); // anonymous
}
table_api.close_table(); // "bounce_to"
}
}
}
- // adding the defualt port.
+ // adding the default port.
if (!ports_set)
bind.add_when_port("23");
bool tmpval = true;
std::istringstream arg_stream(keyword);
- // should be gauranteed to happen. Checking for error just cause
+ // should be guaranteed to happen. Checking for error just cause
if (!(arg_stream >> keyword))
tmpval = false;
retval = tmpval;
}
- table_api.close_table(); // unecessary since the state will be reset
+ table_api.close_table(); // unnecessary since the state will be reset
return retval;
}
bool tmpval = true;
std::istringstream arg_stream(keyword);
- // should be gauranteed to happen. Checking for error just cause
+ // should be guaranteed to happen. Checking for error just cause
if (!(arg_stream >> keyword))
tmpval = false;
bool tmpval = true;
std::istringstream arg_stream(keyword);
- // should be gauranteed to happen. Checking for error just cause
+ // should be guaranteed to happen. Checking for error just cause
if (!(arg_stream >> keyword))
tmpval = false;
bool tmpval = true;
std::istringstream arg_stream(keyword);
- // should be gauranteed to happen. Checking for error just cause
+ // should be guaranteed to happen. Checking for error just cause
if (!(arg_stream >> keyword))
tmpval = false;
server.set_when_role("server");
any.set_when_role("any");
- // create pointers so other member functinos can access binders
+ // create pointers so other member functions can access binders
bind_client = &client;
bind_server = &server;
bind_any = &any;
bool tmpval = true;
std::istringstream arg_stream(keyword);
- // should be gauranteed to happen. Checking for error just cause
+ // should be guaranteed to happen. Checking for error just cause
if (!(arg_stream >> keyword))
tmpval = false;
std::string tmp_str;
val = "";
- opts >> keyword; // gauranteed to work since get_string is true
+ opts >> keyword; // guaranteed to work since get_string is true
std::getline(opts, val);
util::trim(keyword);
add_sticky_buffer(data_stream, "pkt_data");
// since this option is not an content modifier,
- // lets coninue parsing the rest of the rule.
+ // lets continue parsing the rest of the rule.
data_stream.clear();
data_stream.seekg(pos);
return set_next_rule_state(data_stream);
namespace rules
{
/*
- * Convert rule option from comma list to a space sperated list in qoutes:
+ * Convert rule option from comma list to a space separated list in qoutes:
* x,y,z to "x y z"
*/
val.insert(0, group);
size_t start_pos = val.find(',');
if (start_pos == std::string::npos)
- rule_api.bad_rule(data, "dnp3_obj:expecting 2 args seperated by comma");
+ rule_api.bad_rule(data, "dnp3_obj:expecting 2 args separated by comma");
else
val.insert(start_pos+1, var);
{
// react may not have arguments. So, set this information now.
- // create this table to ensure react is instatiated
+ // create this table to ensure react is instantiated
c.get_table_api().open_table("react");
c.get_table_api().close_table();
!tmp.compare("reset_source") ||
!tmp.compare("icmp_port"))
{
- // Now that we have confirmed this is a vlid option, parse it!!
+ // Now that we have confirmed this is a valid option, parse it!!
table_api.open_table("reject");
do
{
// reject may not have arguments. So, set this information now.
- // create this table to ensure reject is instatiated
+ // create this table to ensure reject is instantiated
c.get_table_api().open_table("reject");
c.get_table_api().close_table();
/* network to host ordering
In the event structure, only the last 40 bits are not 32 bit fields
- The first 11 fields need to be convertted */
+ The first 11 fields need to be converted */
field = (uint8_t*)&event;
for (i=0; i<11; i++, field+=4)
{
/* network to host ordering
In the event structure, only the last 40 bits are not 32 bit fields
- The first fields need to be convertted */
+ The first fields need to be converted */
field = (uint8_t*)&event;
for (i=0; i<9; i++, field+=4)
{
/* network to host ordering
In the event structure, only the last 40 bits are not 32 bit fields
- The first 11 fields need to be convertted */
+ The first 11 fields need to be converted */
field = (uint8_t*)&event;
for (i=0; i<11; i++, field+=4)
{
/* network to host ordering
In the event structure, only the last 40 bits are not 32 bit fields
- The first fields need to be convertted */
+ The first fields need to be converted */
field = (uint8_t*)&event;
for (i=0; i<9; i++, field+=4)
{
memcpy(&packet, record->data, offset);
/* network to host ordering
- The first 7 fields need to be convertted */
+ The first 7 fields need to be converted */
field = (uint8_t*)&packet;
for (counter=0; counter<7; counter++, field+=4)
{
projects / thirdparty / snort3.git / commitdiff
