From: snorty Date: Sat, 6 Aug 2016 14:23:40 +0000 (-0400) Subject: move ohi to extra/ X-Git-Tag: 3.0.0-233~306 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2b8bdf6ddfa1c3ebc34bcb838b78bc44f8edf9b6;p=thirdparty%2Fsnort3.git move ohi to extra/ --- diff --git a/configure.ac b/configure.ac index c2ce18f84..cc2e420db 100644 --- a/configure.ac +++ b/configure.ac @@ -1176,7 +1176,6 @@ src/service_inspectors/dnp3/Makefile \ src/service_inspectors/dns/Makefile \ src/service_inspectors/ftp_telnet/Makefile \ src/service_inspectors/gtp/Makefile \ -src/service_inspectors/http_inspect/Makefile \ src/service_inspectors/imap/Makefile \ src/service_inspectors/modbus/Makefile \ src/service_inspectors/nhttp_inspect/Makefile \ diff --git a/extra/configure.ac b/extra/configure.ac index d9340c7f9..531be20da 100644 --- a/extra/configure.ac +++ b/extra/configure.ac @@ -41,6 +41,7 @@ src/daqs/daq_socket/Makefile \ src/inspectors/Makefile \ src/inspectors/data_log/Makefile \ src/inspectors/dpx/Makefile \ +src/inspectors/http_server/Makefile \ src/ips_options/Makefile \ src/ips_options/find/Makefile \ src/ips_options/ips_pkt_num/Makefile \ diff --git a/extra/src/inspectors/CMakeLists.txt b/extra/src/inspectors/CMakeLists.txt index 147773538..d86341840 100644 --- a/extra/src/inspectors/CMakeLists.txt +++ b/extra/src/inspectors/CMakeLists.txt @@ -1,2 +1,3 @@ add_subdirectory ( dpx ) add_subdirectory ( data_log ) +add_subdirectory ( http_server ) diff --git a/extra/src/inspectors/Makefile.am b/extra/src/inspectors/Makefile.am index d2ce3eb63..f3f019aaf 100644 --- a/extra/src/inspectors/Makefile.am +++ b/extra/src/inspectors/Makefile.am @@ -1,6 +1,7 @@ SUBDIRS = \ data_log \ -dpx +dpx \ +http_server AM_CPPFLAGS = @AM_CPPFLAGS@ AM_CFLAGS= @AM_CFLAGS@ diff --git a/src/service_inspectors/http_inspect/CMakeLists.txt b/extra/src/inspectors/http_server/CMakeLists.txt similarity index 50% rename from src/service_inspectors/http_inspect/CMakeLists.txt rename to extra/src/inspectors/http_server/CMakeLists.txt index 985807289..e66e2b26e 100644 --- a/src/service_inspectors/http_inspect/CMakeLists.txt +++ b/extra/src/inspectors/http_server/CMakeLists.txt @@ -35,13 +35,38 @@ set (FILE_LIST hi_ui_iis_unicode_map.cc hi_ui_iis_unicode_map.h hi_util.h + ips_http.cc + ips_http_header.cc ) -# can't be be linked dynamically yet -#if (STATIC_INSPECTORS) - add_library(http_inspect STATIC ${FILE_LIST}) +cmake_minimum_required ( VERSION 2.8.11 ) +project ( http_server CXX ) -#else (STATIC_INSPECTORS) -# add_shared_library(http_inspect inspectors ${FILE_LIST}) +if ( APPLE ) + set ( CMAKE_MACOSX_RPATH OFF ) + set ( + CMAKE_SHARED_LINKER_FLAGS + "${CMAKE_SHARED_LINKER_FLAGS} -undefined dynamic_lookup" + ) +endif ( APPLE ) + +include ( FindPkgConfig ) +pkg_search_module ( SNORT3 REQUIRED snort>=3 ) + +add_library ( + http_server SHARED + ${FILE_LIST} +) + +set ( CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11" ) + +target_include_directories ( + http_server PUBLIC + ${SNORT3_INCLUDE_DIRS} +) + +install ( + TARGETS http_server + LIBRARY DESTINATION "lib/${CMAKE_PROJECT_NAME}/inspectors" +) -#endif (STATIC_INSPECTORS) diff --git a/src/service_inspectors/http_inspect/Makefile.am b/extra/src/inspectors/http_server/Makefile.am similarity index 59% rename from src/service_inspectors/http_inspect/Makefile.am rename to extra/src/inspectors/http_server/Makefile.am index e64ea9800..c4fbb75b9 100644 --- a/src/service_inspectors/http_inspect/Makefile.am +++ b/extra/src/inspectors/http_server/Makefile.am @@ -19,16 +19,16 @@ hi_si.cc hi_si.h \ hi_stream_splitter.cc hi_stream_splitter.h \ hi_ui_config.cc hi_ui_config.h \ hi_ui_iis_unicode_map.cc hi_ui_iis_unicode_map.h \ -hi_util.h +hi_util.h \ +ips_http.cc \ +ips_http_header.cc -if STATIC_INSPECTORS -noinst_LIBRARIES = libhttp_inspect.a -libhttp_inspect_a_SOURCES = $(file_list) -else -shlibdir = $(pkglibdir)/inspectors -shlib_LTLIBRARIES = libhttp_inspect.la -libhttp_inspect_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libhttp_inspect_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared -libhttp_inspect_la_SOURCES = $(file_list) -endif +http_serverlibdir = $(pkglibdir)/inspectors + +AM_CXXFLAGS = @SNORT3_CFLAGS@ -std=c++11 + +http_serverlib_LTLIBRARIES = libhttp_server.la +libhttp_server_la_CXXFLAGS = $(AM_CXXFLAGS) +libhttp_server_la_LDFLAGS = -export-dynamic -shared -avoid-version +libhttp_server_la_SOURCES = $(file_list) diff --git a/src/service_inspectors/http_inspect/dev_notes.txt b/extra/src/inspectors/http_server/dev_notes.txt similarity index 100% rename from src/service_inspectors/http_inspect/dev_notes.txt rename to extra/src/inspectors/http_server/dev_notes.txt diff --git a/src/service_inspectors/http_inspect/hi_ad.cc b/extra/src/inspectors/http_server/hi_ad.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_ad.cc rename to extra/src/inspectors/http_server/hi_ad.cc diff --git a/src/service_inspectors/http_inspect/hi_ad.h b/extra/src/inspectors/http_server/hi_ad.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_ad.h rename to extra/src/inspectors/http_server/hi_ad.h diff --git a/src/service_inspectors/http_inspect/hi_client.cc b/extra/src/inspectors/http_server/hi_client.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_client.cc rename to extra/src/inspectors/http_server/hi_client.cc diff --git a/src/service_inspectors/http_inspect/hi_client.h b/extra/src/inspectors/http_server/hi_client.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_client.h rename to extra/src/inspectors/http_server/hi_client.h diff --git a/src/service_inspectors/http_inspect/hi_client_norm.cc b/extra/src/inspectors/http_server/hi_client_norm.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_client_norm.cc rename to extra/src/inspectors/http_server/hi_client_norm.cc diff --git a/src/service_inspectors/http_inspect/hi_client_norm.h b/extra/src/inspectors/http_server/hi_client_norm.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_client_norm.h rename to extra/src/inspectors/http_server/hi_client_norm.h diff --git a/src/service_inspectors/http_inspect/hi_cmd_lookup.cc b/extra/src/inspectors/http_server/hi_cmd_lookup.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_cmd_lookup.cc rename to extra/src/inspectors/http_server/hi_cmd_lookup.cc diff --git a/src/service_inspectors/http_inspect/hi_cmd_lookup.h b/extra/src/inspectors/http_server/hi_cmd_lookup.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_cmd_lookup.h rename to extra/src/inspectors/http_server/hi_cmd_lookup.h diff --git a/src/service_inspectors/http_inspect/hi_events.cc b/extra/src/inspectors/http_server/hi_events.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_events.cc rename to extra/src/inspectors/http_server/hi_events.cc diff --git a/src/service_inspectors/http_inspect/hi_events.h b/extra/src/inspectors/http_server/hi_events.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_events.h rename to extra/src/inspectors/http_server/hi_events.h diff --git a/src/service_inspectors/http_inspect/hi_include.h b/extra/src/inspectors/http_server/hi_include.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_include.h rename to extra/src/inspectors/http_server/hi_include.h diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/extra/src/inspectors/http_server/hi_main.cc similarity index 99% rename from src/service_inspectors/http_inspect/hi_main.cc rename to extra/src/inspectors/http_server/hi_main.cc index bb82becab..0283734bb 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/extra/src/inspectors/http_server/hi_main.cc @@ -61,19 +61,20 @@ #include "detection/detect.h" #include "detection/detection_util.h" #include "events/event.h" -#include "main/snort_debug.h" -#include "utils/util.h" -#include "utils/util_utf.h" -#include "utils/sfsnprintfappend.h" -#include -#include "stream/stream_api.h" -#include "profiler/profiler.h" -#include "loggers/unified2_common.h" #include "file_api/file_api.h" #include "file_api/file_flows.h" +#include "framework/data_bus.h" +#include "log/unified2.h" +#include "main/snort_debug.h" +#include "mime/decode_base.h" +#include "profiler/profiler.h" #include "protocols/packet.h" #include "protocols/tcp.h" -#include "framework/data_bus.h" +#include "search_engines/search_tool.h" +#include "stream/stream_api.h" +#include "utils/util.h" +#include "utils/util_utf.h" +#include "utils/sfsnprintfappend.h" #include "hi_return_codes.h" #include "hi_ui_config.h" diff --git a/src/service_inspectors/http_inspect/hi_main.h b/extra/src/inspectors/http_server/hi_main.h similarity index 99% rename from src/service_inspectors/http_inspect/hi_main.h rename to extra/src/inspectors/http_server/hi_main.h index df5f9494c..65fe609d5 100644 --- a/src/service_inspectors/http_inspect/hi_main.h +++ b/extra/src/inspectors/http_server/hi_main.h @@ -26,13 +26,12 @@ #include -#include "hi_ui_config.h" +#include "detection/detection_util.h" #include "protocols/packet.h" #include "stream/stream_api.h" -#include "detection/detection_util.h" -#include "search_engines/search_tool.h" #include "utils/util_jsnorm.h" #include "utils/util_utf.h" +#include "hi_ui_config.h" #define MAX_METHOD_LEN 256 diff --git a/src/service_inspectors/http_inspect/hi_mi.cc b/extra/src/inspectors/http_server/hi_mi.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_mi.cc rename to extra/src/inspectors/http_server/hi_mi.cc diff --git a/src/service_inspectors/http_inspect/hi_mi.h b/extra/src/inspectors/http_server/hi_mi.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_mi.h rename to extra/src/inspectors/http_server/hi_mi.h diff --git a/src/service_inspectors/http_inspect/hi_module.cc b/extra/src/inspectors/http_server/hi_module.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_module.cc rename to extra/src/inspectors/http_server/hi_module.cc diff --git a/src/service_inspectors/http_inspect/hi_module.h b/extra/src/inspectors/http_server/hi_module.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_module.h rename to extra/src/inspectors/http_server/hi_module.h diff --git a/src/service_inspectors/http_inspect/hi_norm.cc b/extra/src/inspectors/http_server/hi_norm.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_norm.cc rename to extra/src/inspectors/http_server/hi_norm.cc diff --git a/src/service_inspectors/http_inspect/hi_norm.h b/extra/src/inspectors/http_server/hi_norm.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_norm.h rename to extra/src/inspectors/http_server/hi_norm.h diff --git a/src/service_inspectors/http_inspect/hi_reqmethod_check.h b/extra/src/inspectors/http_server/hi_reqmethod_check.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_reqmethod_check.h rename to extra/src/inspectors/http_server/hi_reqmethod_check.h diff --git a/src/service_inspectors/http_inspect/hi_return_codes.h b/extra/src/inspectors/http_server/hi_return_codes.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_return_codes.h rename to extra/src/inspectors/http_server/hi_return_codes.h diff --git a/src/service_inspectors/http_inspect/hi_server.cc b/extra/src/inspectors/http_server/hi_server.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_server.cc rename to extra/src/inspectors/http_server/hi_server.cc diff --git a/src/service_inspectors/http_inspect/hi_server.h b/extra/src/inspectors/http_server/hi_server.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_server.h rename to extra/src/inspectors/http_server/hi_server.h diff --git a/src/service_inspectors/http_inspect/hi_server_norm.cc b/extra/src/inspectors/http_server/hi_server_norm.cc similarity index 99% rename from src/service_inspectors/http_inspect/hi_server_norm.cc rename to extra/src/inspectors/http_server/hi_server_norm.cc index 2d38bc05a..3111519df 100644 --- a/src/service_inspectors/http_inspect/hi_server_norm.cc +++ b/extra/src/inspectors/http_server/hi_server_norm.cc @@ -57,6 +57,7 @@ #include "hi_return_codes.h" #include "detection/detection_util.h" +#include "search_engines/search_tool.h" #include "utils/safec.h" #include "utils/util_utf.h" diff --git a/src/service_inspectors/http_inspect/hi_server_norm.h b/extra/src/inspectors/http_server/hi_server_norm.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_server_norm.h rename to extra/src/inspectors/http_server/hi_server_norm.h diff --git a/src/service_inspectors/http_inspect/hi_si.cc b/extra/src/inspectors/http_server/hi_si.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_si.cc rename to extra/src/inspectors/http_server/hi_si.cc diff --git a/src/service_inspectors/http_inspect/hi_si.h b/extra/src/inspectors/http_server/hi_si.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_si.h rename to extra/src/inspectors/http_server/hi_si.h diff --git a/src/service_inspectors/http_inspect/hi_stream_splitter.cc b/extra/src/inspectors/http_server/hi_stream_splitter.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_stream_splitter.cc rename to extra/src/inspectors/http_server/hi_stream_splitter.cc diff --git a/src/service_inspectors/http_inspect/hi_stream_splitter.h b/extra/src/inspectors/http_server/hi_stream_splitter.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_stream_splitter.h rename to extra/src/inspectors/http_server/hi_stream_splitter.h diff --git a/src/service_inspectors/http_inspect/hi_ui_config.cc b/extra/src/inspectors/http_server/hi_ui_config.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_ui_config.cc rename to extra/src/inspectors/http_server/hi_ui_config.cc diff --git a/src/service_inspectors/http_inspect/hi_ui_config.h b/extra/src/inspectors/http_server/hi_ui_config.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_ui_config.h rename to extra/src/inspectors/http_server/hi_ui_config.h diff --git a/src/service_inspectors/http_inspect/hi_ui_iis_unicode_map.cc b/extra/src/inspectors/http_server/hi_ui_iis_unicode_map.cc similarity index 100% rename from src/service_inspectors/http_inspect/hi_ui_iis_unicode_map.cc rename to extra/src/inspectors/http_server/hi_ui_iis_unicode_map.cc diff --git a/src/service_inspectors/http_inspect/hi_ui_iis_unicode_map.h b/extra/src/inspectors/http_server/hi_ui_iis_unicode_map.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_ui_iis_unicode_map.h rename to extra/src/inspectors/http_server/hi_ui_iis_unicode_map.h diff --git a/src/service_inspectors/http_inspect/hi_util.h b/extra/src/inspectors/http_server/hi_util.h similarity index 100% rename from src/service_inspectors/http_inspect/hi_util.h rename to extra/src/inspectors/http_server/hi_util.h diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/extra/src/inspectors/http_server/http_inspect.cc similarity index 94% rename from src/service_inspectors/http_inspect/http_inspect.cc rename to extra/src/inspectors/http_server/http_inspect.cc index 40ccab1bf..11766ebea 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/extra/src/inspectors/http_server/http_inspect.cc @@ -40,18 +40,15 @@ #include #include +// FIXIT-L all snort includes should use
instead of "form" #include "protocols/packet.h" #include "main/snort_debug.h" -#include "parser/parser.h" #include "decompress/file_decomp.h" #include "profiler/profiler.h" -#include "detection/detection_util.h" #include "stream/stream_api.h" -#include "target_based/snort_protocols.h" #include "file_api/file_api.h" #include "file_api/file_service.h" -#include "utils/kmap.h" -#include +#include "mime/decode_base.h" #include "utils/util.h" #include "framework/inspector.h" #include "managers/inspector_manager.h" @@ -455,15 +452,31 @@ static const InspectApi hi_api = nullptr // reset }; -#ifdef BUILDING_SO +extern const BaseApi* ips_http_uri; +extern const BaseApi* ips_http_header; +extern const BaseApi* ips_http_client_body; +extern const BaseApi* ips_http_method; +extern const BaseApi* ips_http_cookie; +extern const BaseApi* ips_http_stat_code; +extern const BaseApi* ips_http_stat_msg; +extern const BaseApi* ips_http_raw_uri; +extern const BaseApi* ips_http_raw_header; +extern const BaseApi* ips_http_raw_cookie; + SO_PUBLIC const BaseApi* snort_plugins[] = { &hg_api.base, &hi_api.base, + ips_http_uri, + ips_http_header, + ips_http_client_body, + ips_http_method, + ips_http_cookie, + ips_http_stat_code, + ips_http_stat_msg, + ips_http_raw_uri, + ips_http_raw_header, + ips_http_raw_cookie, nullptr }; -#else -const BaseApi* sin_http_global = &hg_api.base; -const BaseApi* sin_http_inspect = &hi_api.base; -#endif diff --git a/src/ips_options/ips_http.cc b/extra/src/inspectors/http_server/ips_http.cc similarity index 99% rename from src/ips_options/ips_http.cc rename to extra/src/inspectors/http_server/ips_http.cc index 8c95aeb8d..fec0f7f53 100644 --- a/src/ips_options/ips_http.cc +++ b/extra/src/inspectors/http_server/ips_http.cc @@ -134,7 +134,7 @@ static const IpsApi uri_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, @@ -179,7 +179,7 @@ static const IpsApi client_body_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, @@ -224,7 +224,7 @@ static const IpsApi method_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, @@ -269,7 +269,7 @@ static const IpsApi cookie_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, @@ -314,7 +314,7 @@ static const IpsApi stat_code_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, @@ -359,7 +359,7 @@ static const IpsApi stat_msg_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, @@ -404,7 +404,7 @@ static const IpsApi raw_uri_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, @@ -449,7 +449,7 @@ static const IpsApi raw_header_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, @@ -494,7 +494,7 @@ static const IpsApi raw_cookie_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, IPS_OPT, diff --git a/src/ips_options/ips_http_header.cc b/extra/src/inspectors/http_server/ips_http_header.cc similarity index 99% rename from src/ips_options/ips_http_header.cc rename to extra/src/inspectors/http_server/ips_http_header.cc index 1d2ccbfd5..a2eb4149c 100644 --- a/src/ips_options/ips_http_header.cc +++ b/extra/src/inspectors/http_server/ips_http_header.cc @@ -26,7 +26,6 @@ using namespace std; #include "main/snort_types.h" #include "main/snort_debug.h" -#include "parser/parser.h" #include "profiler/profiler.h" #include "flow/flow.h" #include "detection/detection_defines.h" @@ -241,7 +240,7 @@ static const IpsApi header_api = PT_IPS_OPTION, sizeof(IpsApi), IPSAPI_VERSION, - 0, + 2, API_RESERVED, API_OPTIONS, s_name, diff --git a/src/Makefile.am b/src/Makefile.am index cd5707774..5d65cbb8d 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -16,7 +16,6 @@ service_inspectors/dnp3/libdnp3.a \ service_inspectors/dns/libdns.a \ service_inspectors/ftp_telnet/libftp_telnet.a \ service_inspectors/gtp/libgtp_inspect.a \ -service_inspectors/http_inspect/libhttp_inspect.a \ service_inspectors/modbus/libmodbus.a \ service_inspectors/nhttp_inspect/libnhttp_inspect.a \ service_inspectors/rpc_decode/librpc_decode.a \ diff --git a/src/actions/actions.cc b/src/actions/actions.cc index 74381bcd1..a5cb8d2d8 100644 --- a/src/actions/actions.cc +++ b/src/actions/actions.cc @@ -25,6 +25,7 @@ #include "detection/detect.h" #include "detection/tag.h" #include "packet_io/active.h" +#include "parser/parser.h" #include "utils/stats.h" static void pass() diff --git a/src/decompress/Makefile.am b/src/decompress/Makefile.am index 002c084b7..9a5bd82ed 100644 --- a/src/decompress/Makefile.am +++ b/src/decompress/Makefile.am @@ -1,11 +1,15 @@ noinst_LIBRARIES = libdecompress.a -libdecompress_a_SOURCES = \ -file_decomp.cc \ +x_includedir = $(pkgincludedir)/decompress + +x_include_HEADERS = \ file_decomp.h \ -file_decomp_pdf.cc \ file_decomp_pdf.h \ -file_decomp_swf.cc \ file_decomp_swf.h +libdecompress_a_SOURCES = \ +file_decomp.cc \ +file_decomp_pdf.cc \ +file_decomp_swf.cc + diff --git a/src/decompress/file_decomp.h b/src/decompress/file_decomp.h index 84bbfdb65..667246553 100644 --- a/src/decompress/file_decomp.h +++ b/src/decompress/file_decomp.h @@ -56,8 +56,9 @@ typedef enum file_compression_type typedef struct fd_session_s* fd_session_p_t, fd_session_t; -#include "file_decomp_pdf.h" -#include "file_decomp_swf.h" +// FIXIT-L this should be unravelled so that these internal includes are not necessary +#include "decompress/file_decomp_pdf.h" +#include "decompress/file_decomp_swf.h" #include #ifdef HAVE_LZMA diff --git a/src/detection/Makefile.am b/src/detection/Makefile.am index e4c3d45a9..ea68ba291 100644 --- a/src/detection/Makefile.am +++ b/src/detection/Makefile.am @@ -4,8 +4,10 @@ noinst_LIBRARIES = libdetection.a x_includedir = $(pkgincludedir)/detection x_include_HEADERS = \ +detect.h \ detection_defines.h \ detection_options.h \ +detection_util.h \ pattern_match_data.h \ rule_option_types.h \ rules.h \ @@ -14,10 +16,8 @@ treenodes.h libdetection_a_SOURCES = \ detect.cc \ -detect.h \ detection_options.cc \ detection_util.cc \ -detection_util.h \ fp_config.cc \ fp_config.h \ fp_create.cc \ diff --git a/src/detection/detect.h b/src/detection/detect.h index 9f47f6c77..c8bc2af7b 100644 --- a/src/detection/detect.h +++ b/src/detection/detect.h @@ -30,7 +30,6 @@ #include "protocols/packet.h" #include "detection/rules.h" #include "detection/treenodes.h" -#include "parser/parser.h" #include "log/log.h" #include "events/event.h" diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc index 9ae1a9ced..8f66153a9 100644 --- a/src/detection/fp_detect.cc +++ b/src/detection/fp_detect.cc @@ -66,6 +66,7 @@ #include "filters/rate_filter.h" #include "events/event_wrapper.h" #include "packet_io/active.h" +#include "parser/parser.h" #include "stream/stream_api.h" #include "utils/sflsq.h" #include "utils/util.h" diff --git a/src/file_api/Makefile.am b/src/file_api/Makefile.am index d1cea5ebb..9abfed86e 100644 --- a/src/file_api/Makefile.am +++ b/src/file_api/Makefile.am @@ -1,19 +1,29 @@ noinst_LIBRARIES = libfile_api.a +x_includedir = $(pkgincludedir)/file_api + +x_include_HEADERS = \ +file_api.h \ +file_config.h \ +file_flows.h \ +file_identifier.h \ +file_lib.h \ +file_policy.h \ +file_service.h + libfile_api_a_SOURCES = \ circular_buffer.cc circular_buffer.h \ -file_api.h \ file_capture.cc file_capture.h \ -file_config.cc file_config.h \ -file_flows.cc file_flows.h \ +file_config.cc \ +file_flows.cc \ file_enforcer.cc file_enforcer.h \ -file_identifier.h file_identifier.cc \ +file_identifier.cc \ file_log.cc \ -file_lib.cc file_lib.h \ +file_lib.cc \ file_mempool.cc file_mempool.h \ file_module.cc file_module.h \ -file_policy.cc file_policy.h \ -file_service.cc file_service.h \ +file_policy.cc \ +file_service.cc \ file_stats.cc file_stats.h diff --git a/src/file_api/file_config.h b/src/file_api/file_config.h index dd9bec41f..dda9590e4 100644 --- a/src/file_api/file_config.h +++ b/src/file_api/file_config.h @@ -24,9 +24,9 @@ // This provides the basic configuration for file processing -#include "file_lib.h" -#include "file_identifier.h" -#include "file_policy.h" +#include "file_api/file_lib.h" +#include "file_api/file_identifier.h" +#include "file_api/file_policy.h" #define DEFAULT_FILE_TYPE_DEPTH 1460 #define DEFAULT_FILE_SIGNATURE_DEPTH 10485760 /*10 Mbytes*/ diff --git a/src/file_api/file_service.h b/src/file_api/file_service.h index 48ca3d1ef..3b3c7db97 100644 --- a/src/file_api/file_service.h +++ b/src/file_api/file_service.h @@ -26,7 +26,7 @@ #include #include "main/snort_types.h" -#include "file_policy.h" +#include "file_api/file_policy.h" class FileEnforcer; diff --git a/src/ips_options/CMakeLists.txt b/src/ips_options/CMakeLists.txt index d690a2259..d4e661fcd 100644 --- a/src/ips_options/CMakeLists.txt +++ b/src/ips_options/CMakeLists.txt @@ -16,8 +16,6 @@ SET( PLUGIN_LIST ips_fragbits.cc ips_fragoffset.cc ips_gid.cc - ips_http.cc - ips_http_header.cc ips_icmp_id.cc ips_icmp_seq.cc ips_icode.cc @@ -103,8 +101,6 @@ else (STATIC_IPS_OPTIONS) add_shared_library(ips_fragbits ips_options ips_fragbits.cc) add_shared_library(ips_fragoffset ips_options ips_fragoffset.cc) add_shared_library(ips_gid ips_options ips_gid.cc) - add_shared_library(ips_http ips_options ips_http.cc) - add_shared_library(ips_http_header ips_options ips_http_header.cc) add_shared_library(ips_icode ips_options ips_icode.cc) add_shared_library(ips_icmp_id ips_options ips_icmp_id.cc) add_shared_library(ips_icmp_seq ips_options ips_icmp_seq.cc) diff --git a/src/ips_options/Makefile.am b/src/ips_options/Makefile.am index e2c67c1b8..a35393937 100644 --- a/src/ips_options/Makefile.am +++ b/src/ips_options/Makefile.am @@ -15,8 +15,6 @@ ips_flags.cc \ ips_fragbits.cc \ ips_fragoffset.cc \ ips_gid.cc \ -ips_http.cc \ -ips_http_header.cc \ ips_icmp_id.cc \ ips_icmp_seq.cc \ ips_icode.cc \ @@ -147,16 +145,6 @@ libips_gid_la_SOURCES = ips_gid.cc #libips_hash_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared #libips_hash_la_SOURCES = ips_hash.cc -optlib_LTLIBRARIES += libips_http.la -libips_http_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libips_http_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared -libips_http_la_SOURCES = ips_http.cc - -optlib_LTLIBRARIES += libips_http_header.la -libips_http_header_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO -libips_http_header_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared -libips_http_header_la_SOURCES = ips_http_header.cc - optlib_LTLIBRARIES += libips_icmp_id.la libips_icmp_id_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libips_icmp_id_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared diff --git a/src/ips_options/ips_options.cc b/src/ips_options/ips_options.cc index 90c01218b..a823b558d 100644 --- a/src/ips_options/ips_options.cc +++ b/src/ips_options/ips_options.cc @@ -59,16 +59,6 @@ extern const BaseApi* ips_flags; extern const BaseApi* ips_fragbits; extern const BaseApi* ips_fragoffset; extern const BaseApi* ips_gid; -extern const BaseApi* ips_http_uri; -extern const BaseApi* ips_http_header; -extern const BaseApi* ips_http_client_body; -extern const BaseApi* ips_http_method; -extern const BaseApi* ips_http_cookie; -extern const BaseApi* ips_http_stat_code; -extern const BaseApi* ips_http_stat_msg; -extern const BaseApi* ips_http_raw_uri; -extern const BaseApi* ips_http_raw_header; -extern const BaseApi* ips_http_raw_cookie; extern const BaseApi* ips_icmp_id; extern const BaseApi* ips_icmp_seq; extern const BaseApi* ips_icode; @@ -131,16 +121,6 @@ const BaseApi* ips_options[] = ips_fragbits, ips_fragoffset, ips_gid, - ips_http_uri, - ips_http_header, - ips_http_client_body, - ips_http_method, - ips_http_cookie, - ips_http_stat_code, - ips_http_stat_msg, - ips_http_raw_uri, - ips_http_raw_header, - ips_http_raw_cookie, ips_icmp_id, ips_icmp_seq, ips_icode, diff --git a/src/log/Makefile.am b/src/log/Makefile.am index 326beed58..d2289aa61 100644 --- a/src/log/Makefile.am +++ b/src/log/Makefile.am @@ -4,13 +4,14 @@ noinst_LIBRARIES = liblog.a x_includedir = $(pkgincludedir)/log x_include_HEADERS = \ +log.h \ messages.h \ obfuscator.h \ -text_log.h +text_log.h \ +unified2.h liblog_a_SOURCES = \ log.cc \ -log.h \ log_text.cc \ log_text.h \ messages.cc \ diff --git a/src/log/log_text.cc b/src/log/log_text.cc index 3cbdf067b..ff0172261 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -44,9 +44,6 @@ #include "main/snort_config.h" #include "packet_io/sfdaq.h" -// should be able to delete this when we cutover to NHI -#include "service_inspectors/http_inspect/hi_main.h" // FIXIT-H bad dependency for Is*Data() - #include "sfip/sf_ip.h" #include "utils/util.h" #include "utils/util_net.h" diff --git a/src/loggers/unified2_common.h b/src/log/unified2.h similarity index 98% rename from src/loggers/unified2_common.h rename to src/log/unified2.h index e580993a2..aa944e48f 100644 --- a/src/loggers/unified2_common.h +++ b/src/log/unified2.h @@ -18,8 +18,8 @@ // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -#ifndef UNIFIED2_COMMON_H -#define UNIFIED2_COMMON_H +#ifndef UNIFIED2_H +#define UNIFIED2_H #ifdef HAVE_CONFIG_H #include "config.h" @@ -31,7 +31,7 @@ #endif #include -#include +#include "protocols/protocol_ids.h" // SNORT DEFINES // Long time ago... diff --git a/src/loggers/Makefile.am b/src/loggers/Makefile.am index d8677d9e2..c5d51c1e0 100644 --- a/src/loggers/Makefile.am +++ b/src/loggers/Makefile.am @@ -13,8 +13,7 @@ alert_full.cc \ alert_syslog.cc \ log_hext.cc \ log_pcap.cc \ -unified2.cc \ -unified2_common.h +unified2.cc if LINUX libloggers_a_SOURCES += alert_sf_socket.cc @@ -59,6 +58,6 @@ liblog_pcap_la_SOURCES = log_pcap.cc ehlib_LTLIBRARIES += libunified2.la libunified2_la_CXXFLAGS = $(AM_CXXFLAGS) -DBUILDING_SO libunified2_la_LDFLAGS = $(AM_LDFLAGS) -export-dynamic -shared -libunified2_la_SOURCES = unified2.cc unified2_common.h +libunified2_la_SOURCES = unified2.cc endif diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index 805eacfcb..add0980ea 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -25,7 +25,7 @@ * */ -#include "loggers/unified2_common.h" +#include "log/unified2.h" #ifdef HAVE_CONFIG_H #include "config.h" diff --git a/src/managers/Makefile.am b/src/managers/Makefile.am index e4f3498d7..745c687fb 100644 --- a/src/managers/Makefile.am +++ b/src/managers/Makefile.am @@ -1,18 +1,23 @@ x_luadir = $(pkgincludedir)/lua -noinst_LIBRARIES = libmanagers.a - x_lua_HEADERS = \ snort_config.lua \ snort_plugin.lua +x_mgrdir = $(pkgincludedir)/managers + +x_mgr_HEADERS = \ +inspector_manager.h + +noinst_LIBRARIES = libmanagers.a + libmanagers_a_SOURCES = \ action_manager.cc action_manager.h \ codec_manager.cc codec_manager.h \ connector_manager.cc connector_manager.h \ event_manager.cc event_manager.h \ -inspector_manager.cc inspector_manager.h \ +inspector_manager.cc \ ips_manager.cc ips_manager.h \ lua_plugin_defs.h \ module_manager.cc module_manager.h \ diff --git a/src/mime/Makefile.am b/src/mime/Makefile.am index 3c4f19e8a..49ab51464 100644 --- a/src/mime/Makefile.am +++ b/src/mime/Makefile.am @@ -1,16 +1,31 @@ noinst_LIBRARIES = libmime.a +x_includedir = $(pkgincludedir)/mime + +x_include_HEADERS = \ +decode_b64.h \ +decode_base.h \ +decode_bit.h \ +decode_buffer.h \ +decode_qp.h \ +decode_uu.h \ +file_mime_config.h \ +file_mime_decode.h \ +file_mime_log.h \ +file_mime_paf.h \ +file_mime_process.h + libmime_a_SOURCES = \ -file_mime_decode.h file_mime_decode.cc \ -file_mime_log.h file_mime_log.cc \ -file_mime_paf.h file_mime_paf.cc \ -file_mime_process.h file_mime_process.cc \ -file_mime_config.cc file_mime_config.h \ -decode_base.cc decode_base.h \ -decode_b64.cc decode_b64.h \ -decode_bit.cc decode_bit.h \ -decode_qp.cc decode_qp.h \ -decode_uu.cc decode_uu.h \ -decode_buffer.cc decode_buffer.h +decode_b64.cc \ +decode_base.cc \ +decode_bit.cc \ +decode_buffer.cc \ +decode_qp.cc \ +decode_uu.cc \ +file_mime_config.cc \ +file_mime_decode.cc \ +file_mime_log.cc \ +file_mime_paf.cc \ +file_mime_process.cc diff --git a/src/mime/decode_b64.cc b/src/mime/decode_b64.cc index 82abaa703..131e9fb12 100644 --- a/src/mime/decode_b64.cc +++ b/src/mime/decode_b64.cc @@ -16,15 +16,16 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -// Author: Bhagyashree Bantwal - -#include +// decode_b64.cc author Bhagyashree Bantwal #include "decode_b64.h" #include "utils/util.h" #include "utils/util_unfold.h" +#include "decode_base.h" +#include "decode_buffer.h" + void B64Decode::reset_decode_state() { reset_decoded_bytes(); diff --git a/src/mime/decode_b64.h b/src/mime/decode_b64.h index 5c32c0021..a7bd436fb 100644 --- a/src/mime/decode_b64.h +++ b/src/mime/decode_b64.h @@ -25,10 +25,9 @@ #include #include "main/snort_types.h" -#include "decode_buffer.h" -#include "decode_base.h" +#include "mime/decode_base.h" -class B64Decode: public DataDecode +class B64Decode : public DataDecode { public: B64Decode(int max_depth); @@ -40,7 +39,7 @@ public: void reset_decode_state() override; private: - DecodeBuffer* buffer = nullptr; + class DecodeBuffer* buffer = nullptr; }; // FIXIT-L inbuf should probably be const uint8_t* diff --git a/src/mime/decode_base.cc b/src/mime/decode_base.cc index 558f976da..00fb459d7 100644 --- a/src/mime/decode_base.cc +++ b/src/mime/decode_base.cc @@ -16,9 +16,9 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -// Author: Bhagyashree Bantwal +// decode_base.cc author Bhagyashree Bantwal -#include +#include "decode_base.h" #include "utils/util.h" void DataDecode::reset_decoded_bytes() diff --git a/src/mime/decode_base.h b/src/mime/decode_base.h index e8121c948..f796b6bc9 100644 --- a/src/mime/decode_base.h +++ b/src/mime/decode_base.h @@ -23,7 +23,6 @@ // Email attachment decoder #include - #include "main/snort_types.h" enum DecodeResult diff --git a/src/mime/decode_bit.cc b/src/mime/decode_bit.cc index 744cd5681..09416360d 100644 --- a/src/mime/decode_bit.cc +++ b/src/mime/decode_bit.cc @@ -16,11 +16,9 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -// Author: Bhagyashree Bantwal +// decode_bit.cc author Bhagyashree Bantwal -#include #include "decode_bit.h" - #include "utils/util.h" void BitDecode::reset_decode_state() diff --git a/src/mime/decode_bit.h b/src/mime/decode_bit.h index d73c42ad5..4fd76401b 100644 --- a/src/mime/decode_bit.h +++ b/src/mime/decode_bit.h @@ -23,10 +23,9 @@ // Email attachment decoder #include +#include "mime/decode_base.h" -#include "main/snort_types.h" - -class BitDecode:public DataDecode +class BitDecode : public DataDecode { public: BitDecode(int max_depth); diff --git a/src/mime/decode_buffer.cc b/src/mime/decode_buffer.cc index af75bd26b..0424c0f7d 100644 --- a/src/mime/decode_buffer.cc +++ b/src/mime/decode_buffer.cc @@ -16,13 +16,11 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -// Author: Bhagyashree Bantwal +// decode_buffer.cc author Bhagyashree Bantwal #include "decode_buffer.h" - #include "utils/util.h" - void DecodeBuffer::reset() { prev_encoded_bytes = 0; diff --git a/src/mime/decode_buffer.h b/src/mime/decode_buffer.h index 98dcf9b10..ed4e92c9e 100644 --- a/src/mime/decode_buffer.h +++ b/src/mime/decode_buffer.h @@ -23,7 +23,6 @@ // Manage decode/encode buffers #include - #include "main/snort_types.h" class DecodeBuffer diff --git a/src/mime/decode_qp.cc b/src/mime/decode_qp.cc index 9e7017795..7a7891a62 100644 --- a/src/mime/decode_qp.cc +++ b/src/mime/decode_qp.cc @@ -16,14 +16,14 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -// Author: Bhagyashree Bantwal +// decode_qp.cc author Bhagyashree Bantwal -#include #include "decode_qp.h" #include "utils/util.h" #include "utils/util_unfold.h" +#include "decode_buffer.h" void QPDecode::reset_decode_state() { diff --git a/src/mime/decode_qp.h b/src/mime/decode_qp.h index 79eda2515..993334661 100644 --- a/src/mime/decode_qp.h +++ b/src/mime/decode_qp.h @@ -23,11 +23,9 @@ // Email attachment decoder #include +#include "mime/decode_base.h" -#include "main/snort_types.h" -#include "decode_buffer.h" - -class QPDecode:public DataDecode +class QPDecode : public DataDecode { public: QPDecode(int max_depth); @@ -39,7 +37,7 @@ public: void reset_decode_state() override; private: - DecodeBuffer* buffer = nullptr; + class DecodeBuffer* buffer = nullptr; }; diff --git a/src/mime/decode_uu.cc b/src/mime/decode_uu.cc index 9fcf3a1ab..1de0b886a 100644 --- a/src/mime/decode_uu.cc +++ b/src/mime/decode_uu.cc @@ -16,14 +16,16 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -// Author: Bhagyashree Bantwal +// decode_uu.cc author Bhagyashree Bantwal -#include #include "decode_uu.h" + #include "utils/safec.h" #include "utils/util.h" #include "utils/util_unfold.h" +#include "decode_buffer.h" + #define UU_DECODE_CHAR(c) (((c) - 0x20) & 0x3f) void UUDecode::reset_decode_state() diff --git a/src/mime/decode_uu.h b/src/mime/decode_uu.h index b80f174a7..73a6ab7c0 100644 --- a/src/mime/decode_uu.h +++ b/src/mime/decode_uu.h @@ -1,6 +1,5 @@ //-------------------------------------------------------------------------- // Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 1998-2013 Sourcefire, Inc. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published @@ -23,10 +22,9 @@ // UU decoder -#include "decode_base.h" -#include "decode_buffer.h" +#include "mime/decode_base.h" -class UUDecode:public DataDecode +class UUDecode : public DataDecode { public: UUDecode(int max_depth); @@ -40,7 +38,7 @@ public: private: bool begin_found = false; bool end_found = false; - DecodeBuffer* buffer = nullptr; + class DecodeBuffer* buffer = nullptr; }; int sf_uudecode(uint8_t* src, uint32_t slen, uint8_t* dst, uint32_t dlen, uint32_t* bytes_read, diff --git a/src/mime/file_mime_config.cc b/src/mime/file_mime_config.cc index 9faecce8b..57588e8dd 100644 --- a/src/mime/file_mime_config.cc +++ b/src/mime/file_mime_config.cc @@ -16,18 +16,16 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -/* -** Author(s): Hui Cao -** -** NOTES -** 9.25.2012 - Initial Source Code. Hui Cao -*/ + +// file_mime_config.cc author Hui Cao +// 9.25.2012 - Initial Source Code. Hui Cao #include "file_mime_config.h" #include "log/messages.h" #include "main/snort_types.h" #include "file_api/file_service.h" + #include "file_mime_process.h" void DecodeConfig::update_max_depth(int64_t depth) diff --git a/src/mime/file_mime_config.h b/src/mime/file_mime_config.h index e094ba376..6a4f01c77 100644 --- a/src/mime/file_mime_config.h +++ b/src/mime/file_mime_config.h @@ -1,6 +1,5 @@ //-------------------------------------------------------------------------- // Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2012-2013 Sourcefire, Inc. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published diff --git a/src/mime/file_mime_decode.cc b/src/mime/file_mime_decode.cc index 09b1511c3..5a63557e5 100644 --- a/src/mime/file_mime_decode.cc +++ b/src/mime/file_mime_decode.cc @@ -16,16 +16,17 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -// Author: Bhagyashree Bantwal +// file_mime_decode.cc author Bhagyashree Bantwal -#include #include "file_mime_decode.h" + +#include "utils/util_unfold.h" +#include "utils/util.h" + #include "decode_b64.h" #include "decode_bit.h" #include "decode_qp.h" #include "decode_uu.h" -#include "utils/util_unfold.h" -#include "utils/util.h" void MimeDecode::reset_decoded_bytes() { diff --git a/src/mime/file_mime_decode.h b/src/mime/file_mime_decode.h index 9652a6a55..82cdcb9a7 100644 --- a/src/mime/file_mime_decode.h +++ b/src/mime/file_mime_decode.h @@ -1,6 +1,5 @@ //-------------------------------------------------------------------------- // Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 1998-2013 Sourcefire, Inc. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published @@ -25,11 +24,10 @@ #include -#include "decode_base.h" -#include "file_mime_config.h" - -#include "main/snort_types.h" #include "framework/counts.h" +#include "main/snort_types.h" +#include "mime/decode_base.h" +#include "mime/file_mime_config.h" enum DecodeType { @@ -79,7 +77,7 @@ public: private: DecodeType decode_type = DECODE_NONE; DecodeConfig* config; - DataDecode* decoder = NULL; + DataDecode* decoder = nullptr; }; #endif diff --git a/src/mime/file_mime_log.cc b/src/mime/file_mime_log.cc index e91c77e65..29daa9c0c 100644 --- a/src/mime/file_mime_log.cc +++ b/src/mime/file_mime_log.cc @@ -16,12 +16,9 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -/* -** Author(s): Hui Cao -** -** NOTES -** 9.25.2012 - Initial Source Code. Hui Cao -*/ + +// file_mime_log.cc author Hui Cao +// 9.25.2012 - Initial Source Code. Hui Cao #include "file_mime_log.h" diff --git a/src/mime/file_mime_log.h b/src/mime/file_mime_log.h index b2abe8903..0afd0e5b7 100644 --- a/src/mime/file_mime_log.h +++ b/src/mime/file_mime_log.h @@ -1,6 +1,5 @@ //-------------------------------------------------------------------------- // Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2012-2013 Sourcefire, Inc. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published @@ -25,8 +24,7 @@ // File name will be extracted from MIME header // Email headers and emails are also stored in the log buffer -#include "file_mime_config.h" -#include "file_mime_log.h" +#include "mime/file_mime_config.h" #include "file_api/file_api.h" enum EmailUserType @@ -51,14 +49,18 @@ class MailLogState public: MailLogState(MailLogConfig* conf); ~MailLogState(); + /* accumulate MIME attachment filenames. The filenames are appended by commas */ int log_file_name (const uint8_t* start, int length, bool* disp_cont); - void set_file_name_from_log (Flow* flow); - int log_email_hdrs (const uint8_t* start, int length); - int log_email_id (const uint8_t* start, int length, EmailUserType type); + void set_file_name_from_log(Flow*); + + int log_email_hdrs(const uint8_t* start, int length); + int log_email_id (const uint8_t* start, int length, EmailUserType); + void get_file_name (uint8_t** buf, uint32_t* len); void get_email_hdrs (uint8_t** buf, uint32_t* len); - void get_email_id (uint8_t** buf, uint32_t* len, EmailUserType type); + void get_email_id (uint8_t** buf, uint32_t* len, EmailUserType); + bool is_file_name_present(); bool is_email_hdrs_present(); bool is_email_from_present(); @@ -67,15 +69,15 @@ public: private: int extract_file_name(const char** start, int length, bool* disp_cont); int log_flags = 0; - uint8_t* buf = NULL; + uint8_t* buf = nullptr; unsigned char* emailHdrs; uint32_t log_depth; uint32_t hdrs_logged; - uint8_t* recipients = NULL; + uint8_t* recipients = nullptr; uint16_t rcpts_logged; - uint8_t* senders = NULL; + uint8_t* senders = nullptr; uint16_t snds_logged; - uint8_t* filenames = NULL; + uint8_t* filenames = nullptr; uint16_t file_logged; uint16_t file_current; }; diff --git a/src/mime/file_mime_paf.cc b/src/mime/file_mime_paf.cc index 59d746194..671946ceb 100644 --- a/src/mime/file_mime_paf.cc +++ b/src/mime/file_mime_paf.cc @@ -16,12 +16,9 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -/* -** Author(s): Hui Cao -** -** NOTES -** 9.25.2012 - Initial Source Code. Hui Cao -*/ + +// file_mime_paf.cc author Hui Cao +// 9.25.2012 - Initial Source Code. Hui Cao #include "file_mime_paf.h" @@ -32,6 +29,7 @@ #include "main/snort_types.h" #include "main/snort_debug.h" #include "file_api/file_api.h" + #include "file_mime_config.h" static const char* boundary_str = "boundary="; diff --git a/src/mime/file_mime_paf.h b/src/mime/file_mime_paf.h index 3878daa91..2b898d593 100644 --- a/src/mime/file_mime_paf.h +++ b/src/mime/file_mime_paf.h @@ -1,6 +1,5 @@ //-------------------------------------------------------------------------- // Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2012-2013 Sourcefire, Inc. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published @@ -25,10 +24,8 @@ // Provides list of MIME processing functions. Encoded file data will be decoded // and file name will be extracted from MIME header -#include - -#include "decode_base.h" -#include "file_mime_config.h" +#include "mime/decode_base.h" +#include "mime/file_mime_config.h" #include "file_api/file_api.h" /* State tracker for data */ @@ -63,7 +60,7 @@ enum DataEndState struct MimeDataPafInfo { MimeDataState data_state; - char boundary[ MAX_MIME_BOUNDARY_LEN + 1]; /* MIME boundary string + '\0' */ + char boundary[ MAX_MIME_BOUNDARY_LEN + 1]; /* MIME boundary string + '\0' */ int boundary_len; char* boundary_search; MimeBoundaryState boundary_state; @@ -82,10 +79,11 @@ inline bool scanning_boundary(MimeDataPafInfo* mime_info, uint32_t boundary_star return false; } -SO_PUBLIC void reset_mime_paf_state(MimeDataPafInfo *data_info); +SO_PUBLIC void reset_mime_paf_state(MimeDataPafInfo*); + /* Process data boundary and flush each file based on boundary*/ -SO_PUBLIC bool process_mime_paf_data(MimeDataPafInfo *data_info, uint8_t val); -SO_PUBLIC bool check_data_end(void *end_state, uint8_t val); +SO_PUBLIC bool process_mime_paf_data(MimeDataPafInfo*, uint8_t val); +SO_PUBLIC bool check_data_end(void* end_state, uint8_t val); #endif diff --git a/src/mime/file_mime_process.cc b/src/mime/file_mime_process.cc index 4741c4573..5a3961766 100644 --- a/src/mime/file_mime_process.cc +++ b/src/mime/file_mime_process.cc @@ -16,12 +16,9 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -/* -** Author(s): Hui Cao -** -** NOTES -** 9.25.2012 - Initial Source Code. Hui Cao -*/ + +// file_mime_process.cc author Hui Cao +// 9.25.2012 - Initial Source Code. Hui Cao #include "file_mime_process.h" @@ -29,18 +26,18 @@ #include "config.h" #endif -#include "file_mime_config.h" -#include "file_mime_decode.h" -#include "file_api/file_api.h" -#include "file_api/file_flows.h" - #include "main/snort_types.h" -#include "search_engines/search_tool.h" -#include "protocols/packet.h" #include "detection/detection_util.h" +#include "file_api/file_api.h" +#include "file_api/file_flows.h" #include "framework/data_bus.h" +#include "protocols/packet.h" +#include "search_engines/search_tool.h" #include "utils/util.h" +#include "file_mime_config.h" +#include "file_mime_decode.h" + struct MimeToken { const char* name; diff --git a/src/mime/file_mime_process.h b/src/mime/file_mime_process.h index d98de9b7e..c0f53d417 100644 --- a/src/mime/file_mime_process.h +++ b/src/mime/file_mime_process.h @@ -1,6 +1,5 @@ //-------------------------------------------------------------------------- // Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2012-2013 Sourcefire, Inc. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published @@ -27,10 +26,10 @@ #include "main/snort_types.h" #include "file_api/file_api.h" -#include "file_mime_config.h" -#include "file_mime_paf.h" -#include "file_mime_log.h" -#include "file_mime_decode.h" +#include "mime/file_mime_config.h" +#include "mime/file_mime_paf.h" +#include "mime/file_mime_log.h" +#include "mime/file_mime_decode.h" /* state flags */ #define MIME_FLAG_FOLDING 0x00000001 @@ -57,40 +56,43 @@ class SO_PUBLIC MimeSession public: MimeSession(DecodeConfig*, MailLogConfig*); virtual ~MimeSession(); + static void init(); static void exit(); - const uint8_t* process_mime_data(Flow *flow, const uint8_t *data, int data_size, - bool upload, FilePosition position); + + const uint8_t* process_mime_data(Flow*, const uint8_t *data, int data_size, + bool upload, FilePosition); + int get_data_state(); void set_data_state(int); MailLogState* get_log_state(); void set_mime_stats(MimeStats*); protected: - MimeDecode* decode_state = NULL; + MimeDecode* decode_state = nullptr; private: int data_state = STATE_DATA_INIT; int state_flags = 0; MimeDataPafInfo mime_boundary; - DecodeConfig* decode_conf = NULL; - MailLogConfig* log_config = NULL; - MailLogState* log_state = NULL; - MimeStats* mime_stats = NULL; + DecodeConfig* decode_conf = nullptr; + MailLogConfig* log_config = nullptr; + MailLogState* log_state = nullptr; + MimeStats* mime_stats = nullptr; // SMTP, IMAP, POP might have different implementation for this virtual int handle_header_line(const uint8_t*, const uint8_t*, int) { return 0; } virtual int normalize_data(const uint8_t* , const uint8_t* ) { return 0; } - virtual void decode_alert() {} - virtual void reset_state(Flow* ) {} + virtual void decode_alert() { } + virtual void reset_state(Flow* ) { } virtual bool is_end_of_data(Flow* ) { return false; } void reset_mime_state(); void setup_decode(const char* data, int size, bool cnt_xf); const uint8_t* process_mime_header(const uint8_t* ptr, const uint8_t* data_end_marker); const uint8_t* process_mime_body(const uint8_t* ptr, const uint8_t* data_end,bool is_data_end); - const uint8_t* process_mime_data_paf(Flow* flow, const uint8_t* start, const uint8_t* end, - bool upload, FilePosition position); + const uint8_t* process_mime_data_paf(Flow*, const uint8_t* start, const uint8_t* end, + bool upload, FilePosition); }; #endif diff --git a/src/network_inspectors/appid/appid_stats.cc b/src/network_inspectors/appid/appid_stats.cc index 18342259b..7b4b9db65 100644 --- a/src/network_inspectors/appid/appid_stats.cc +++ b/src/network_inspectors/appid/appid_stats.cc @@ -27,7 +27,7 @@ #include #include "log/messages.h" -#include "loggers/unified2_common.h" +#include "log/unified2.h" #include "utils/sflsq.h" #include "utils/util.h" diff --git a/src/search_engines/Makefile.am b/src/search_engines/Makefile.am index 37b2b9629..99a1131de 100644 --- a/src/search_engines/Makefile.am +++ b/src/search_engines/Makefile.am @@ -5,7 +5,8 @@ x_includedir = $(pkgincludedir)/search_engines x_include_HEADERS = \ pat_stats.h \ -search_common.h +search_common.h \ +search_tool.h acsmx_sources = \ ac_std.cc \ @@ -47,7 +48,6 @@ libsearch_engines_a_SOURCES = \ search_engines.cc \ search_engines.h \ search_tool.cc \ -search_tool.h \ $(bnfa_sources) \ $(hyper_sources) diff --git a/src/service_inspectors/Makefile.am b/src/service_inspectors/Makefile.am index 624ca9f95..eb1fa2ecc 100644 --- a/src/service_inspectors/Makefile.am +++ b/src/service_inspectors/Makefile.am @@ -21,7 +21,6 @@ dnp3 \ dns \ ftp_telnet \ gtp \ -http_inspect \ imap \ modbus \ nhttp_inspect \ diff --git a/src/service_inspectors/service_inspectors.cc b/src/service_inspectors/service_inspectors.cc index 90ffe3ee9..31d3f3239 100644 --- a/src/service_inspectors/service_inspectors.cc +++ b/src/service_inspectors/service_inspectors.cc @@ -60,8 +60,6 @@ extern const BaseApi* sin_ftp_client; extern const BaseApi* sin_ftp_server; extern const BaseApi* sin_ftp_data; extern const BaseApi* sin_gtp; -extern const BaseApi* sin_http_global; -extern const BaseApi* sin_http_inspect; extern const BaseApi* sin_modbus; extern const BaseApi* sin_nhttp; extern const BaseApi* sin_rpc_decode; @@ -109,8 +107,6 @@ const BaseApi* service_inspectors[] = sin_ftp_server, sin_ftp_data, sin_gtp, - sin_http_global, - sin_http_inspect, sin_modbus, sin_nhttp, sin_rpc_decode, diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc index b34398494..3cee5f980 100644 --- a/src/service_inspectors/smtp/smtp.cc +++ b/src/service_inspectors/smtp/smtp.cc @@ -37,7 +37,7 @@ #include "utils/sfsnprintfappend.h" #include "target_based/snort_protocols.h" #include "protocols/ssl.h" -#include "loggers/unified2_common.h" +#include "log/unified2.h" #include "detection/detection_util.h" #include "utils/safec.h" diff --git a/src/utils/Makefile.am b/src/utils/Makefile.am index b7219fae6..49e4b0645 100644 --- a/src/utils/Makefile.am +++ b/src/utils/Makefile.am @@ -6,27 +6,32 @@ x_includedir = $(pkgincludedir)/utils x_include_HEADERS = \ bitop.h \ dnet_header.h \ +kmap.h \ safec.h \ segment_mem.h \ sflsq.h \ sfmemcap.h \ +sfsnprintfappend.h \ snort_bounds.h \ stats.h \ -util.h +util.h \ +util_jsnorm.h \ +util_unfold.h \ +util_utf.h libutils_a_SOURCES = \ boyer_moore.cc boyer_moore.h \ dyn_array.cc dyn_array.h \ -kmap.cc kmap.h \ +kmap.cc \ segment_mem.cc \ sflsq.cc \ sfmemcap.cc \ -sfsnprintfappend.cc sfsnprintfappend.h \ +sfsnprintfappend.cc \ snort_bounds.h \ stats.cc \ util.cc \ -util_jsnorm.cc util_jsnorm.h \ +util_jsnorm.cc \ util_net.cc util_net.h \ -util_unfold.cc util_unfold.h \ -util_utf.cc util_utf.h +util_unfold.cc \ +util_utf.cc diff --git a/tools/u2spewfoo/u2_common.h b/tools/u2spewfoo/u2_common.h index 90c85eb92..dc6f828d3 100644 --- a/tools/u2spewfoo/u2_common.h +++ b/tools/u2spewfoo/u2_common.h @@ -23,7 +23,7 @@ #include #include -#include "loggers/unified2_common.h" +#include "log/unified2.h" struct u2record {