From: Russ Combs (rucombs) Date: Thu, 21 Jan 2016 16:13:51 +0000 (-0500) Subject: Merge pull request #209 in SNORT/snort3 from lru_cache2 to master X-Git-Tag: 3.0.0-233~660 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0480a7caaacff72d99aa50f976445c7de031aea0;p=thirdparty%2Fsnort3.git Merge pull request #209 in SNORT/snort3 from lru_cache2 to master Squashed commit of the following: commit 75c8e8f3b2fbf35018f396ed5388303d7c2bd14c Author: Steve Chew Date: Wed Jan 20 15:09:58 2016 -0500 Moved host_tracker code to new location. --- diff --git a/configure.ac b/configure.ac index d4e6c2099..a260e6be9 100644 --- a/configure.ac +++ b/configure.ac @@ -1078,7 +1078,8 @@ src/search_engines/test/Makefile \ src/sfip/Makefile \ src/sfrt/Makefile \ src/target_based/Makefile \ -src/target_based/test/Makefile \ +src/host_tracker/Makefile \ +src/host_tracker/test/Makefile \ src/catch/Makefile \ src/time/Makefile \ src/ppm/Makefile \ diff --git a/src/Makefile.am b/src/Makefile.am index 1a8fcc79c..38fcefdd3 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -83,6 +83,7 @@ ips_options/libips_options.a \ search_engines/libsearch_engines.a \ target_based/libtarget_based.a \ main/libmain.a \ +host_tracker/libhost_tracker.a \ parser/libparser.a \ flow/libflow.a \ control/libcontrol.a \ @@ -119,6 +120,7 @@ flow \ framework \ hash \ helpers \ +host_tracker \ lua \ ips_options \ log \ diff --git a/src/host_tracker/CMakeLists.txt b/src/host_tracker/CMakeLists.txt new file mode 100644 index 000000000..3f588244c --- /dev/null +++ b/src/host_tracker/CMakeLists.txt @@ -0,0 +1,6 @@ + +add_library( host_tracker STATIC + host_module.cc + host_module.h + host_tracker.h +) diff --git a/src/host_tracker/Makefile.am b/src/host_tracker/Makefile.am new file mode 100644 index 000000000..24ba00c1c --- /dev/null +++ b/src/host_tracker/Makefile.am @@ -0,0 +1,13 @@ + +noinst_LIBRARIES = libhost_tracker.a + +libhost_tracker_a_SOURCES = \ +host_module.cc \ +host_module.h \ +host_tracker.h + +if BUILD_UNIT_TESTS +SUBDIRS = test +endif + + diff --git a/src/host_tracker/host_module.cc b/src/host_tracker/host_module.cc new file mode 100644 index 000000000..595c5e20a --- /dev/null +++ b/src/host_tracker/host_module.cc @@ -0,0 +1,112 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2015 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- + +// host_module.cc author Steve Chew + +#include "host_tracker/host_module.h" + +#include "stream/stream_api.h" +#include "target_based/snort_protocols.h" + +const Parameter HostTrackerModule::service_params[] = +{ + { "name", Parameter::PT_STRING, nullptr, nullptr, + "service identifier" }, + + { "proto", Parameter::PT_ENUM, "tcp | udp", "tcp", + "ip protocol" }, + + { "port", Parameter::PT_PORT, nullptr, nullptr, + "port number" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + +const Parameter HostTrackerModule::host_tracker_params[] = +{ + { "ip", Parameter::PT_ADDR, nullptr, "0.0.0.0/32", + "hosts address / cidr" }, + + { "frag_policy", Parameter::PT_ENUM, IP_POLICIES, nullptr, + "defragmentation policy" }, + + { "tcp_policy", Parameter::PT_ENUM, TCP_POLICIES, nullptr, + "tcp reassembly policy" }, + + { "services", Parameter::PT_LIST, HostTrackerModule::service_params, nullptr, + "list of service parameters" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + + +bool HostTrackerModule::set(const char*, Value& v, SnortConfig*) +{ + if ( host and v.is("ip") ) + { + sfip_t addr; + v.get_addr(addr); + host->set_ip_addr(addr); + } + else if ( host and v.is("frag_policy") ) + host->set_frag_policy(v.get_long() + 1); + + else if ( host and v.is("tcp_policy") ) + host->set_stream_policy(v.get_long() + 1); + + else if ( v.is("name") ) + app.protocol = AddProtocolReference(v.get_string()); + + else if ( v.is("proto") ) + app.ipproto = AddProtocolReference(v.get_string()); + + else if ( v.is("port") ) + app.port = v.get_long(); + + else + return false; + + return true; +} + +bool HostTrackerModule::begin(const char* fqn, int idx, SnortConfig*) +{ + if ( idx && !strcmp(fqn, "host_tracker") ) + host = new HostTracker; + + return true; +} + +bool HostTrackerModule::end(const char* fqn, int idx, SnortConfig*) +{ + if ( idx && !strcmp(fqn, "host_tracker.services") ) + { + host->add_service(app); + memset(&app, 0, sizeof(app)); + } + else if ( idx && !strcmp(fqn, "host_tracker") ) + { + // FIXIT-H: Next step will be to add the HostTracker object to + // a cache. For now just delete in the destructor. + //SFAT_AddHost(host); + //host = nullptr; + } + + return true; +} + diff --git a/src/host_tracker/host_module.h b/src/host_tracker/host_module.h new file mode 100644 index 000000000..a9184f8be --- /dev/null +++ b/src/host_tracker/host_module.h @@ -0,0 +1,65 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2015 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- + +// host_module.h author Steve Chew + +#ifndef HOST_MODULE_H +#define HOST_MODULE_H + +// Loads host configuration data. + +// FIXIT-M - Temporarily create new HostTracker module to test new +// HostTracker object. May eventually replace old Hosts +// module with this one. + +#include "framework/module.h" +#include "host_tracker/host_tracker.h" + +#define host_tracker_help \ + "configure hosts" + +class HostTrackerModule : public Module +{ +public: + HostTrackerModule() : Module("host_tracker", host_tracker_help, host_tracker_params, true) + { + host = nullptr; + } + + ~HostTrackerModule() + { + // FIXIT-H: Change this back to an assert once we hand off the + // host to a cache. + if (host) + delete host; + } + + bool set(const char*, Value&, SnortConfig*) override; + bool begin(const char*, int, SnortConfig*) override; + bool end(const char*, int, SnortConfig*) override; + +private: + static const Parameter host_tracker_params[]; + static const Parameter service_params[]; + + HostApplicationEntry app; + HostTracker* host; +}; + +#endif + diff --git a/src/target_based/host_tracker.h b/src/host_tracker/host_tracker.h similarity index 100% rename from src/target_based/host_tracker.h rename to src/host_tracker/host_tracker.h diff --git a/src/target_based/test/Makefile.am b/src/host_tracker/test/Makefile.am similarity index 100% rename from src/target_based/test/Makefile.am rename to src/host_tracker/test/Makefile.am diff --git a/src/target_based/test/host_tracker_test.cc b/src/host_tracker/test/host_tracker_test.cc similarity index 99% rename from src/target_based/test/host_tracker_test.cc rename to src/host_tracker/test/host_tracker_test.cc index 03de79374..c00d1dae2 100644 --- a/src/target_based/test/host_tracker_test.cc +++ b/src/host_tracker/test/host_tracker_test.cc @@ -19,7 +19,7 @@ // host_tracker_test.cc author Steve Chew // unit tests for HostTracker class -#include "target_based/host_tracker.h" +#include "host_tracker/host_tracker.h" #include #include diff --git a/src/main/modules.cc b/src/main/modules.cc index adffb9135..ab2375c4b 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -61,7 +61,7 @@ using namespace std; #include "stream/stream_api.h" #include "utils/stats.h" #include "target_based/snort_protocols.h" -#include "target_based/host_tracker.h" +#include "host_tracker/host_module.h" //------------------------------------------------------------------------- // detection module @@ -2053,93 +2053,6 @@ bool HostsModule::end(const char* fqn, int idx, SnortConfig*) return true; } -//------------------------------------------------------------------------- -// HostTracker module -//------------------------------------------------------------------------- - -// FIXIT-M - Temporarily create new HostTracker module to test new -// HostTracker object. May eventually replace old Hosts -// module with this one. - -class HostTrackerModule : public Module -{ -public: - HostTrackerModule() : Module("host_tracker", hosts_help, hosts_params, true) - { - host = nullptr; - } - - ~HostTrackerModule() - { - // FIXIT-H: Change this back to an assert once we hand off the - // host to a cache. - if (host) - delete host; - } - - bool set(const char*, Value&, SnortConfig*) override; - bool begin(const char*, int, SnortConfig*) override; - bool end(const char*, int, SnortConfig*) override; - -private: - HostApplicationEntry app; - HostTracker* host; -}; - -bool HostTrackerModule::set(const char*, Value& v, SnortConfig*) -{ - if ( host and v.is("ip") ) - { - sfip_t addr; - v.get_addr(addr); - host->set_ip_addr(addr); - } - else if ( host and v.is("frag_policy") ) - host->set_frag_policy(v.get_long() + 1); - - else if ( host and v.is("tcp_policy") ) - host->set_stream_policy(v.get_long() + 1); - - else if ( v.is("name") ) - app.protocol = AddProtocolReference(v.get_string()); - - else if ( v.is("proto") ) - app.ipproto = AddProtocolReference(v.get_string()); - - else if ( v.is("port") ) - app.port = v.get_long(); - - else - return false; - - return true; -} - -bool HostTrackerModule::begin(const char* fqn, int idx, SnortConfig*) -{ - if ( idx && !strcmp(fqn, "host_tracker") ) - host = new HostTracker; - - return true; -} - -bool HostTrackerModule::end(const char* fqn, int idx, SnortConfig*) -{ - if ( idx && !strcmp(fqn, "host_tracker.services") ) - { - host->add_service(app); - memset(&app, 0, sizeof(app)); - } - else if ( idx && !strcmp(fqn, "host_tracker") ) - { - // FIXIT-H: Next step will be to add the HostTracker object to - // a cache. For now just delete in the destructor. - //SFAT_AddHost(host); - //host = nullptr; - } - - return true; -} #if 0 //------------------------------------------------------------------------- diff --git a/src/target_based/Makefile.am b/src/target_based/Makefile.am index 3b78e77da..0334d7799 100644 --- a/src/target_based/Makefile.am +++ b/src/target_based/Makefile.am @@ -7,12 +7,7 @@ sftarget_reader.h \ sftarget_hostentry.cc \ sftarget_hostentry.h \ sftarget_data.h \ -host_tracker.h \ snort_protocols.cc \ snort_protocols.h -if BUILD_UNIT_TESTS -SUBDIRS = test -endif -