From: Russ Combs Date: Tue, 28 Oct 2014 17:55:37 +0000 (-0400) Subject: moved normal_mask out of flow X-Git-Tag: 3.0.0-233~1315^2~2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2aeb58d085d97c6ba7eb998d853f2a7b2f56fd0a;p=thirdparty%2Fsnort3.git moved normal_mask out of flow --- diff --git a/ChangeLog b/ChangeLog index b6dd3b073..11ec50011 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,6 +34,7 @@ -- pulled in latest from Josh -- pulled in HI defaults patch from Bhagya -- refactored inspector groups +-- moved normal_mask out of flow into inspector policy 125 -- discovered can't catch exceptions thrown from Lua to C++; need to diff --git a/extra/src/inspectors/dpx.cc b/extra/src/inspectors/dpx.cc index cbe6fb8f1..4e8e4e949 100644 --- a/extra/src/inspectors/dpx.cc +++ b/extra/src/inspectors/dpx.cc @@ -147,7 +147,7 @@ static const InspectApi dpx_api nullptr, nullptr }, - IT_PROTOCOL, + IT_NETWORK, PROTO_BIT__UDP, nullptr, // service nullptr, // contents diff --git a/src/flow/flow.h b/src/flow/flow.h index 74cec0523..c7cc705bc 100644 --- a/src/flow/flow.h +++ b/src/flow/flow.h @@ -34,7 +34,6 @@ #include "flow/flow_key.h" #include "framework/inspector.h" #include "framework/plug_data.h" -#include "normalize/normalize.h" #include "framework/codec.h" #define SSNFLAG_SEEN_CLIENT 0x00000001 @@ -162,12 +161,6 @@ public: void markup_packet_flags(Packet*); void set_direction(Packet*); - void set_normalizations(uint32_t m) - { normal_mask = m; }; - - bool norm_is_enabled(uint32_t b) - { return Normalize_IsEnabled(normal_mask, (NormFlags)b); }; - void set_expire(Packet*, uint32_t timeout); int get_expire(Packet*); bool expired(Packet*); @@ -255,7 +248,6 @@ public: // FIXIT-M privatize if possible sfip_t server_ip; // or uint8_t to reduce sizeof from 24 to 20 uint64_t expire_time; - uint32_t normal_mask; int32_t iface_in; int32_t iface_out; diff --git a/src/main/policy.h b/src/main/policy.h index ab46116d3..dd31895a1 100644 --- a/src/main/policy.h +++ b/src/main/policy.h @@ -88,6 +88,7 @@ public: public: struct FrameworkPolicy* framework_policy; + uint32_t normal_mask; }; //------------------------------------------------------------------------- diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc index 1d248633d..dfda9e090 100644 --- a/src/network_inspectors/normalize/normalize.cc +++ b/src/network_inspectors/normalize/normalize.cc @@ -226,7 +226,8 @@ int Normalizer::exec(int, void* pv) { Flow* flow = (Flow*)pv; assert(flow); - flow->set_normalizations(config.normalizer_flags); + InspectionPolicy* pi = get_inspection_policy(); + pi->normal_mask = config.normalizer_flags; return 0; } diff --git a/src/network_inspectors/normalize/normalize.h b/src/network_inspectors/normalize/normalize.h index 9aed536ea..22007fc66 100644 --- a/src/network_inspectors/normalize/normalize.h +++ b/src/network_inspectors/normalize/normalize.h @@ -22,6 +22,7 @@ #define NORMALIZE_H #include +#include "main/policy.h" // these control protocol specific normalizations all are enables except // tcp_urp which is enabled with tcp core and disabled explicitly. @@ -48,9 +49,10 @@ typedef enum { NORM_ALL = 0x0003FFFF // all normalizations on } NormFlags; -static inline int Normalize_IsEnabled(uint32_t mask, NormFlags nf) +static inline int Normalize_IsEnabled(NormFlags nf) { - return ( (mask & nf) != 0 ); + InspectionPolicy* pi = get_inspection_policy(); + return ( (pi->normal_mask & nf) != 0 ); } #endif diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc index 7088dfd3e..b852837b2 100644 --- a/src/stream/tcp/tcp_session.cc +++ b/src/stream/tcp/tcp_session.cc @@ -456,12 +456,12 @@ static THREAD_LOCAL Packet *s5_pkt = nullptr; static THREAD_LOCAL Packet *cleanup_pkt = nullptr; /* F U N C T I O N S **********************************************/ -static inline void init_flush_policy(Flow* flow, StreamTracker* trk) +static inline void init_flush_policy(Flow*, StreamTracker* trk) { if ( !trk->splitter ) trk->flush_policy = STREAM_FLPOLICY_IGNORE; - else if ( !flow->norm_is_enabled(NORM_TCP_IPS) ) + else if ( !Normalize_IsEnabled(NORM_TCP_IPS) ) trk->flush_policy = STREAM_FLPOLICY_ON_ACK; else @@ -1021,14 +1021,9 @@ static inline void NormalDropPacket (Packet*) Active_DropPacket(); } -static inline bool Normalize_IsEnabled(Packet* p, NormFlags f) -{ - return p->flow->norm_is_enabled(f); -} - static inline int NormalDropPacketIf (Packet* p, NormFlags f) { - if ( Normalize_IsEnabled(p, f) ) + if ( Normalize_IsEnabled(f) ) { NormalDropPacket(p); normStats[PC_TCP_BLOCK]++; @@ -1067,7 +1062,7 @@ static inline int NormalTrimPayloadIf ( Packet* p, NormFlags f, uint16_t max, TcpDataBlock* tdb ) { if ( - Normalize_IsEnabled(p, f) && + Normalize_IsEnabled(f) && p->dsize > max ) { NormalTrimPayload(p, max, tdb); @@ -1302,7 +1297,7 @@ static inline int ValidTimestamp(StreamTracker *talker, #if 0 if ( p->ptrs.tcph->th_flags & TH_ACK && - Normalize_IsEnabled(p, NORM_TCP_OPT) ) + Normalize_IsEnabled(NORM_TCP_OPT) ) { // FIXIT-L validate tsecr here (check that it was previously sent) // checking for the most recent ts is easy enough must check if @@ -1585,7 +1580,7 @@ static inline void UpdateSsn( // forces seq-- on ACK of FIN. :( rcv->s_mgr.state == TCP_STATE_ESTABLISHED && rcv->s_mgr.state_queue == TCP_STATE_NONE && - Normalize_IsEnabled(p, NORM_TCP_IPS) ) + Normalize_IsEnabled(NORM_TCP_IPS) ) { // walk the seglist until a gap or tdb->ack whichever is first // if a gap exists prior to ack, move ack back to start of gap @@ -2312,7 +2307,7 @@ static inline int flush_ackd( static inline int flush_stream( TcpSession *tcpssn, StreamTracker *st, Packet *p, uint32_t dir) { - if ( Normalize_IsEnabled(p, NORM_TCP_IPS) ) + if ( Normalize_IsEnabled(NORM_TCP_IPS) ) { uint32_t bytes = get_q_sequenced(st); return flush_to_seq(tcpssn, st, bytes, p, dir); @@ -2824,7 +2819,7 @@ static uint32_t Stream5GetTcpTimestamp(Packet *p, uint32_t *ts, int strip) { if(opt.code == TcpOptCode::TIMESTAMP) { - if ( strip && Normalize_IsEnabled(p, NORM_TCP_OPT) ) + if ( strip && Normalize_IsEnabled(NORM_TCP_OPT) ) { NormalStripTimeStamp(p, &opt); } @@ -3279,7 +3274,7 @@ static int StreamQueue(StreamTracker *st, Packet *p, TcpDataBlock *tdb, int last = 0; ); - ips_data = Normalize_IsEnabled(p, NORM_TCP_IPS); + ips_data = Normalize_IsEnabled(NORM_TCP_IPS); if ( ips_data ) reassembly_policy = REASSEMBLY_POLICY_FIRST; else @@ -5058,7 +5053,7 @@ static int ProcessTcp( if (StreamGetPolicy(lwssn, config, FROM_CLIENT) != STREAM_POLICY_MACOS) { - if ( Normalize_IsEnabled(p, NORM_TCP_TRIM) ) + if ( Normalize_IsEnabled(NORM_TCP_TRIM) ) { NormalTrimPayload(p, 0, tdb); // remove data on SYN } @@ -5249,7 +5244,7 @@ static int ProcessTcp( talker->s_mgr.sub_state |= SUB_RST_SENT; Stream5UpdatePerfBaseState(&sfBase, lwssn, TCP_STATE_CLOSING); - if ( Normalize_IsEnabled(p, NORM_TCP_IPS) ) + if ( Normalize_IsEnabled(NORM_TCP_IPS) ) listener->s_mgr.state = TCP_STATE_CLOSED; /* else for ids: leave listener open, data may be in transit */ @@ -5581,7 +5576,7 @@ static int ProcessTcp( // window is zero in one direction until we've seen both sides. if ( !(lwssn->s5_state.session_flags & SSNFLAG_MIDSTREAM) ) { - if ( Normalize_IsEnabled(p, NORM_TCP_TRIM) ) + if ( Normalize_IsEnabled(NORM_TCP_TRIM) ) { // sender of syn w/mss limits payloads from peer // since we store mss on sender side, use listener mss @@ -5598,7 +5593,7 @@ static int ProcessTcp( NormalTrimPayload(p, max, tdb); } - if ( Normalize_IsEnabled(p, NORM_TCP_ECN_STR) ) + if ( Normalize_IsEnabled(NORM_TCP_ECN_STR) ) NormalCheckECN(tcpssn, p); } /* @@ -5648,7 +5643,7 @@ static int ProcessTcp( if ((listener->flush_policy != STREAM_FLPOLICY_ON_ACK) && (listener->flush_policy != STREAM_FLPOLICY_ON_DATA) && - Normalize_IsEnabled(p, NORM_TCP_IPS)) + Normalize_IsEnabled(NORM_TCP_IPS)) { p->packet_flags |= PKT_PDU_TAIL; }