From: Russ Combs Date: Mon, 27 Apr 2015 19:13:56 +0000 (-0400) Subject: added publish-subscribe handling of data events and data_log example X-Git-Tag: 3.0.0-233~996 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2c91f7b6bbcafabca7201954c50ebd5113ff4a65;p=thirdparty%2Fsnort3.git added publish-subscribe handling of data events and data_log example --- diff --git a/ChangeLog b/ChangeLog index 8542d467e..8c139ffae 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,8 @@ +Pending - build 148 + +-- added publish-subscribe handling of data events +-- added data_log plugin example for pub-sub + 15/04/23 - build 147 -- change PT_DATA to IT_PASSIVE; supports named instances, reload, and consumers diff --git a/extra/src/inspectors/CMakeLists.txt b/extra/src/inspectors/CMakeLists.txt index 74803e759..5d8f6c631 100644 --- a/extra/src/inspectors/CMakeLists.txt +++ b/extra/src/inspectors/CMakeLists.txt @@ -1,2 +1,3 @@ -add_example_library(dpx inspectors dpx.cc) +add_example_library(insex inspectors dpx.cc) +add_example_library(insex inspectors data_log.cc) diff --git a/extra/src/inspectors/Makefile.am b/extra/src/inspectors/Makefile.am index 54a614340..ea1038cc0 100644 --- a/extra/src/inspectors/Makefile.am +++ b/extra/src/inspectors/Makefile.am @@ -1,10 +1,16 @@ AUTOMAKE_OPTIONS=foreign -dpxlibdir = $(pkglibdir)/inspectors -dpxlib_LTLIBRARIES = libdpx.la +insexlibdir = $(pkglibdir)/inspectors + +insexlib_LTLIBRARIES = libdpx.la libdpx_la_CXXFLAGS = $(AM_CXXFLAGS) libdpx_la_LDFLAGS = -export-dynamic -shared libdpx_la_SOURCES = dpx.cc +insexlib_LTLIBRARIES += libdata_log.la +libdata_log_la_CXXFLAGS = $(AM_CXXFLAGS) +libdata_log_la_LDFLAGS = -export-dynamic -shared +libdata_log_la_SOURCES = data_log.cc + AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/extra/src/inspectors/data_log.cc b/extra/src/inspectors/data_log.cc new file mode 100644 index 000000000..761de955d --- /dev/null +++ b/extra/src/inspectors/data_log.cc @@ -0,0 +1,222 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2015-2015 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// data_log.cc author Russ Combs + +#ifdef HAVE_CONFIG_H +#include "config.h" +#endif + +#include +#include + +#include +#include + +#include "main/snort_debug.h" +#include "main/snort_types.h" +#include "framework/data_bus.h" +#include "framework/inspector.h" +#include "framework/module.h" +#include "log/messages.h" +#include "log/text_log.h" +#include "protocols/packet.h" +#include "time/profiler.h" +#include "utils/stats.h" +#include "flow/flow.h" +#include "sfip/sfip_t.h" + +static const char* s_name = "data_log"; +static const char* f_name = "data.log"; +static const char* s_help = "log selected published data to data.log"; + +static THREAD_LOCAL SimpleStats dl_stats; + +//------------------------------------------------------------------------- +// log stuff +//------------------------------------------------------------------------- + +static THREAD_LOCAL TextLog* tlog = nullptr; + +static void dl_tinit() +{ + std::string fname; + get_instance_file(fname, f_name); + tlog = TextLog_Init(fname.c_str(), 64*K_BYTES, 1*M_BYTES); +} + +static void dl_tterm() +{ + TextLog_Term(tlog); +} + +//------------------------------------------------------------------------- +// data stuff +//------------------------------------------------------------------------- + +class LogHandler : public DataHandler +{ +public: + LogHandler(std::string s) + { key = s; } + + void handle(DataEvent& e, Flow*); + +private: + std::string key; +}; + +void LogHandler::handle(DataEvent& e, Flow* f) +{ + unsigned n; + const char* b = (char*)e.get_data(n); + + // FIXIT-L hexify binary data + std::string val(b, n); + + TextLog_Print(tlog, "%u, ", time(nullptr)); + TextLog_Print(tlog, "%s, %d, ", sfip_to_str(&f->client_ip), f->client_port); + TextLog_Print(tlog, "%s, %d, ", sfip_to_str(&f->server_ip), f->server_port); + TextLog_Print(tlog, "%s, %*s\n", key.c_str(), n, val.c_str()); + + dl_stats.total_packets++; +} + +//------------------------------------------------------------------------- +// inspector stuff +//------------------------------------------------------------------------- + +class DataLog : public Inspector +{ +public: + DataLog(std::string s) { key = s; } + + void show(SnortConfig*) override; + void eval(Packet*) override { }; + + bool configure(SnortConfig*) override + { + get_data_bus().subscribe(key.c_str(), new LogHandler(key)); + return true; + } + +private: + std::string key; +}; + +void DataLog::show(SnortConfig*) +{ + LogMessage("%s config:\n", s_name); + LogMessage(" key = %s\n", key.c_str()); +} + +//------------------------------------------------------------------------- +// module stuff +//------------------------------------------------------------------------- + +static const Parameter dl_params[] = +{ + { "key", Parameter::PT_STRING, nullptr, nullptr, + "name of data buffer to log" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + +class DataLogModule : public Module +{ +public: + DataLogModule() : Module(s_name, s_help, dl_params) + { } + + const PegInfo* get_pegs() const override + { return simple_pegs; } + + PegCount* get_counts() const override + { return (PegCount*)&dl_stats; } + + bool set(const char*, Value& v, SnortConfig*) override; + +public: + std::string key; +}; + +bool DataLogModule::set(const char*, Value& v, SnortConfig*) +{ + if ( v.is("key") ) + key = v.get_string(); + + else + return false; + + return true; +} + +//------------------------------------------------------------------------- +// api stuff +//------------------------------------------------------------------------- + +static Module* mod_ctor() +{ return new DataLogModule; } + +static void mod_dtor(Module* m) +{ delete m; } + +static Inspector* dl_ctor(Module* m) +{ + DataLogModule* mod = (DataLogModule*)m; + return new DataLog(mod->key); +} + +static void dl_dtor(Inspector* p) +{ + delete p; +} + +static const InspectApi dl_api +{ + { + PT_INSPECTOR, + sizeof(InspectApi), + INSAPI_VERSION, + 0, + API_RESERVED, + API_OPTIONS, + s_name, + s_help, + mod_ctor, + mod_dtor + }, + IT_PASSIVE, + (uint16_t)PktType::NONE, + nullptr, // buffers + nullptr, // service + nullptr, // pinit + nullptr, // pterm + dl_tinit, + dl_tterm, + dl_ctor, + dl_dtor, + nullptr, // ssn + nullptr // reset +}; + +SO_PUBLIC const BaseApi* snort_plugins[] = +{ + &dl_api.base, + nullptr +}; + diff --git a/extra/src/inspectors/dpx.cc b/extra/src/inspectors/dpx.cc index 6aee0a91a..e4788fcf0 100644 --- a/extra/src/inspectors/dpx.cc +++ b/extra/src/inspectors/dpx.cc @@ -1,6 +1,5 @@ //-------------------------------------------------------------------------- // Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2013-2013 Sourcefire, Inc. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published @@ -16,7 +15,6 @@ // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- - // dpx.cc author Russ Combs #ifdef HAVE_CONFIG_H @@ -41,17 +39,6 @@ #define DPX_GID 256 #define DPX_SID 1 -#define DPX_REV 1 -#define DPX_PRI 1 -#define DPX_MSG "too much data sent to port" - -#if 0 -#define PP_DPX 10000 - -#ifdef DEBUG -#define DEBUG_DPX DEBUG_PP_EXP -#endif -#endif static const char* s_name = "dpx"; static const char* s_help = "dynamic inspector example"; @@ -64,10 +51,10 @@ static THREAD_LOCAL SimpleStats dpxstats; // class stuff //------------------------------------------------------------------------- -class DpxPH : public Inspector +class Dpx : public Inspector { public: - DpxPH(); + Dpx(uint16_t port, uint16_t max); void show(SnortConfig*) override; void eval(Packet*) override; @@ -77,20 +64,20 @@ private: uint16_t max; }; -DpxPH::DpxPH() +Dpx::Dpx(uint16_t p, uint16_t m) { - port = 68; - max = 300; + port = p; + max = m; } -void DpxPH::show(SnortConfig*) +void Dpx::show(SnortConfig*) { LogMessage("%s config:\n", s_name); LogMessage(" port = %d\n", port); LogMessage(" max = %d\n", max); } -void DpxPH::eval(Packet* p) +void Dpx::eval(Packet* p) { // precondition - what we registered for assert(p->is_udp()); @@ -105,13 +92,36 @@ void DpxPH::eval(Packet* p) // module stuff //------------------------------------------------------------------------- +static const Parameter dpx_params[] = +{ + { "port", Parameter::PT_PORT, nullptr, nullptr, + "port to check" }, + + { "max", Parameter::PT_INT, "0:65535", "0", + "maximum payload before alert" }, + + { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } +}; + +static const RuleMap dpx_rules[] = +{ + { DPX_SID, "too much data sent to port" }, + { 0, nullptr } +}; + class DpxModule : public Module { public: - DpxModule() : Module(s_name, s_help) + DpxModule() : Module(s_name, s_help, dpx_params) { } - const PegInfo* get_pegs() const + unsigned get_gid() const override + { return DPX_GID; } + + const RuleMap* get_rules() const override + { return dpx_rules; } + + const PegInfo* get_pegs() const override { return simple_pegs; } PegCount* get_counts() const override @@ -119,15 +129,42 @@ public: ProfileStats* get_profile() const override { return &dpxPerfStats; } + + bool set(const char*, Value& v, SnortConfig*) override; + +public: + uint16_t port; + uint16_t max; }; +bool DpxModule::set(const char*, Value& v, SnortConfig*) +{ + if ( v.is("port") ) + port = v.get_long(); + + else if ( v.is("max") ) + max = v.get_long(); + + else + return false; + + return true; +} + //------------------------------------------------------------------------- // api stuff //------------------------------------------------------------------------- -static Inspector* dpx_ctor(Module*) +static Module* mod_ctor() +{ return new DpxModule; } + +static void mod_dtor(Module* m) +{ delete m; } + +static Inspector* dpx_ctor(Module* m) { - return new DpxPH; + DpxModule* mod = (DpxModule*)m; + return new Dpx(mod->port, mod->max); } static void dpx_dtor(Inspector* p) @@ -146,13 +183,13 @@ static const InspectApi dpx_api API_OPTIONS, s_name, s_help, - nullptr, - nullptr + mod_ctor, + mod_dtor }, IT_NETWORK, - PROTO_BIT__UDP, + (uint16_t)PktType::UDP, + nullptr, // buffers nullptr, // service - nullptr, // contents nullptr, // pinit nullptr, // pterm nullptr, // tinit diff --git a/extra/src/search_engines/sfksearch.cc b/extra/src/search_engines/sfksearch.cc index 6e7ab885e..15aac6479 100644 --- a/extra/src/search_engines/sfksearch.cc +++ b/extra/src/search_engines/sfksearch.cc @@ -46,11 +46,6 @@ #define SFKSEARCH_TRACK_Q -#ifdef SFKSEARCH_TRACK_Q -//# include "snort.h" -//# include "util.h" -#endif - static void KTrieFree(KTRIENODE* n); static unsigned int mtot = 0; diff --git a/src/detection/detect.h b/src/detection/detect.h index ef686d43b..f369a42f7 100644 --- a/src/detection/detect.h +++ b/src/detection/detect.h @@ -49,7 +49,7 @@ extern THREAD_LOCAL ProfileStats detectPerfStats; /* detection/manipulation funcs */ void snort_ignore(Packet*); void snort_inspect(Packet*); -SO_PUBLIC bool Detect(Packet*); +bool Detect(Packet*); void CallOutputPlugins(Packet*); int EvalPacket(ListHead*, int, Packet*); int EvalHeader(RuleTreeNode*, Packet*, int); diff --git a/src/file_api/file_mime_process.cc b/src/file_api/file_mime_process.cc index 773f4c56f..88b2de386 100644 --- a/src/file_api/file_mime_process.cc +++ b/src/file_api/file_mime_process.cc @@ -36,6 +36,7 @@ #include "search_engines/search_tool.h" #include "protocols/packet.h" #include "detection_util.h" +#include "framework/data_bus.h" MimePcre mime_boundary_pcre; @@ -978,7 +979,7 @@ const uint8_t* process_mime_data(void* packet, const uint8_t* start, const uint8 file_api->set_file_name_from_log(&(mime_ssn->log_state->file_log), p->flow); } updateFilePosition(&position, file_api->get_file_processed_size(p->flow)); - Detect(p); + get_data_bus().publish(PACKET_EVENT, p); mime_ssn->state_flags &= ~MIME_FLAG_MULTIPLE_EMAIL_ATTACH; ResetEmailDecodeState((Email_DecodeState*)(mime_ssn->decode_state)); p->packet_flags |= PKT_ALLOW_MULTIPLE_DETECT; diff --git a/src/framework/CMakeLists.txt b/src/framework/CMakeLists.txt index 7a01ecf78..9fe2ddf8d 100644 --- a/src/framework/CMakeLists.txt +++ b/src/framework/CMakeLists.txt @@ -5,6 +5,7 @@ set (FRAMEWORK_INCLUDES codec.h counts.h cursor.h + data_bus.h decode_data.h logger.h inspector.h @@ -22,6 +23,7 @@ add_library ( framework STATIC ${FRAMEWORK_INCLUDES} codec.cc cursor.cc + data_bus.cc inspector.cc ips_option.cc parameter.cc diff --git a/src/framework/Makefile.am b/src/framework/Makefile.am index 95b4c40ce..eb116de46 100644 --- a/src/framework/Makefile.am +++ b/src/framework/Makefile.am @@ -11,6 +11,7 @@ bits.h \ codec.h \ counts.h \ cursor.h \ +data_bus.h \ decode_data.h \ logger.h \ inspector.h \ @@ -26,6 +27,7 @@ value.h libframework_a_SOURCES = \ codec.cc \ cursor.cc \ +data_bus.cc \ inspector.cc \ ips_option.cc \ parameter.cc \ diff --git a/src/framework/data_bus.cc b/src/framework/data_bus.cc new file mode 100644 index 000000000..d8be01c14 --- /dev/null +++ b/src/framework/data_bus.cc @@ -0,0 +1,93 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// data_bus.cc author Russ Combs + +#include "framework/data_bus.h" +#include "main/policy.h" +#include "protocols/packet.h" + +DataBus& get_data_bus() +{ return get_inspection_policy()->dbus; } + +class BufferEvent : public DataEvent +{ +public: + BufferEvent(const uint8_t* b, unsigned n) + { buf = b; len = n; } + + const uint8_t* get_data(unsigned& n) override + { n = len; return buf; } + +private: + const uint8_t* buf; + unsigned len; +}; + +class PacketEvent : public DataEvent +{ +public: + PacketEvent(Packet* p) + { packet = p; } + + const Packet* get_packet() override + { return packet; } + +private: + const Packet* packet; +}; + +DataBus::DataBus() { } + +DataBus::~DataBus() +{ + for ( auto& p : map ) + for ( auto* h : p.second ) + delete h; +} + +// add handler to list of handlers to be notified upon +// publication of given event +void DataBus::subscribe(const char* key, DataHandler* h) +{ + DataList& v = map[key]; + v.push_back(h); +} + +// notify subscribers of event +void DataBus::publish(const char* key, DataEvent& e, Flow* f) +{ + DataList& v = map[key]; + + for ( auto* h : v ) + h->handle(e, f); +} + +void DataBus::publish(const char* key, const uint8_t* buf, unsigned len, Flow* f) +{ + BufferEvent e(buf, len); + publish(key, e, f); +} + +void DataBus::publish(const char* key, Packet* p, Flow* f) +{ + PacketEvent e(p); + if ( !f ) + f = p->flow; + publish(key, e, f); +} + diff --git a/src/framework/data_bus.h b/src/framework/data_bus.h new file mode 100644 index 000000000..551b699f5 --- /dev/null +++ b/src/framework/data_bus.h @@ -0,0 +1,90 @@ +//-------------------------------------------------------------------------- +// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved. +// +// This program is free software; you can redistribute it and/or modify it +// under the terms of the GNU General Public License Version 2 as published +// by the Free Software Foundation. You may not use, modify or distribute +// this program under any other version of the GNU General Public License. +// +// This program is distributed in the hope that it will be useful, but +// WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. +//-------------------------------------------------------------------------- +// data_bus.h author Russ Combs + +#ifndef DATA_BUS_H +#define DATA_BUS_H + +#include +#include +#include + +// FIXIT-P evaluate perf; focus is on correctness +typedef std::vector DataList; +typedef std::map DataMap; + +#include "main/snort_types.h" + +class Flow; +struct Packet; + +class DataEvent +{ +public: + virtual ~DataEvent() { } + + virtual const Packet* get_packet() + { return nullptr; } + + virtual const uint8_t* get_data(unsigned& len) + { len = 0; return nullptr; } + + virtual const uint8_t* get_normalized_data(unsigned& len) + { return get_data(len); } + +protected: + DataEvent() { } +}; + +class DataHandler +{ +public: + virtual ~DataHandler() { } + + virtual void handle(DataEvent&, Flow*) { } + +protected: + DataHandler() { } +}; + +class SO_PUBLIC DataBus +{ +public: + DataBus(); + ~DataBus(); + + void subscribe(const char* key, DataHandler*); + void publish(const char* key, DataEvent&, Flow* = nullptr); + + // convenience methods + void publish(const char* key, const uint8_t*, unsigned, Flow* = nullptr); + void publish(const char* key, Packet*, Flow* = nullptr); + +private: + DataMap map; +}; + +// FIXIT-L this should be in snort_confg.h or similar but that +// requires refactoring to work as installed header +SO_PUBLIC DataBus& get_data_bus(); + +// common data events +#define PACKET_EVENT "detection.packet" + +#endif + diff --git a/src/log/text_log.cc b/src/log/text_log.cc index f5ef794c7..6503b397c 100644 --- a/src/log/text_log.cc +++ b/src/log/text_log.cc @@ -42,6 +42,22 @@ #define MIN_BUF (1* K_BYTES) #define MIN_FILE (MIN_BUF) +struct TextLog +{ +/* private: + file attributes: */ + FILE* file; + char* name; + size_t size; + size_t maxFile; + time_t last; + +/* buffer attributes: */ + unsigned int pos; + unsigned int maxBuf; + char buf[1]; +}; + /*------------------------------------------------------------------- * TextLog_Open/Close: open/close associated log file *------------------------------------------------------------------- @@ -70,6 +86,22 @@ static size_t TextLog_Size(FILE* file) return err ? 0 : sbuf.st_size; } +int TextLog_Tell(TextLog* const txt) +{ + return txt->pos; +} + +int TextLog_Avail(TextLog* const txt) +{ + return txt->maxBuf - txt->pos - 1; +} + +void TextLog_Reset(TextLog* const txt) +{ + txt->pos = 0; + txt->buf[txt->pos] = '\0'; +} + /*------------------------------------------------------------------- * TextLog_Init: constructor *------------------------------------------------------------------- diff --git a/src/log/text_log.h b/src/log/text_log.h index a9b085670..0946fdae0 100644 --- a/src/log/text_log.h +++ b/src/log/text_log.h @@ -48,30 +48,10 @@ // FIXIT-L need a LogMessage based subclass of TextLog // or some such to get stdout or syslog - -/* - * DO NOT ACCESS STRUCT MEMBERS DIRECTLY - * EXCEPT FROM WITHIN THE IMPLEMENTATION! - */ -struct TextLog -{ -/* private: - file attributes: */ - FILE* file; - char* name; - size_t size; - size_t maxFile; - time_t last; - -/* buffer attributes: */ - unsigned int pos; - unsigned int maxBuf; - char buf[1]; -}; +struct TextLog; TextLog* TextLog_Init( - const char* name, unsigned int maxBuf = 0, size_t maxFile = 0 - ); + const char* name, unsigned int maxBuf = 0, size_t maxFile = 0); void TextLog_Term(TextLog*); bool TextLog_Putc(TextLog* const, char); @@ -79,27 +59,14 @@ bool TextLog_Quote(TextLog* const, const char*); bool TextLog_Write(TextLog* const, const char*, int len); bool TextLog_Print(TextLog* const, const char* format, ...); bool TextLog_Flush(TextLog* const); +int TextLog_Tell(TextLog* const); +int TextLog_Avail(TextLog* const); +void TextLog_Reset(TextLog* const); /*------------------------------------------------------------------- * helper functions *------------------------------------------------------------------- */ -static inline int TextLog_Tell(TextLog* const txt) -{ - return txt->pos; -} - -static inline int TextLog_Avail(TextLog* const txt) -{ - return txt->maxBuf - txt->pos - 1; -} - -static inline void TextLog_Reset(TextLog* const txt) -{ - txt->pos = 0; - txt->buf[txt->pos] = '\0'; -} - static inline bool TextLog_NewLine(TextLog* const txt) { return TextLog_Putc(txt, '\n'); diff --git a/src/main/CMakeLists.txt b/src/main/CMakeLists.txt index 55c5f9fbf..454c09cab 100644 --- a/src/main/CMakeLists.txt +++ b/src/main/CMakeLists.txt @@ -3,8 +3,6 @@ set (INCLUDES thread.h snort_debug.h snort_types.h - snort.h - snort_config.h ) add_library (main STATIC @@ -19,8 +17,9 @@ add_library (main STATIC policy.h shell.h shell.cc - snort.h snort.cc + snort.h + snort_config.h snort_debug.cc snort_config.cc snort_module.h diff --git a/src/main/Makefile.am b/src/main/Makefile.am index 2304f3c14..1e53e510c 100644 --- a/src/main/Makefile.am +++ b/src/main/Makefile.am @@ -7,8 +7,6 @@ noinst_LIBRARIES = libmain.a x_include_HEADERS = \ snort_debug.h \ snort_types.h \ -snort.h \ -snort_config.h \ thread.h libmain_a_SOURCES = \ @@ -27,6 +25,7 @@ snort.cc \ snort.h \ snort_config.cc \ snort_config.h \ +snort_config.h \ snort_debug.cc \ snort_module.cc \ snort_module.h \ diff --git a/src/main/policy.cc b/src/main/policy.cc index f0151a583..0be0a9ff3 100644 --- a/src/main/policy.cc +++ b/src/main/policy.cc @@ -26,7 +26,8 @@ #include "managers/inspector_manager.h" #include "parser/vars.h" #include "main/shell.h" -#include "snort.h" +#include "main/snort.h" +#include "detection/detect.h" //------------------------------------------------------------------------- // traffic policy @@ -53,6 +54,15 @@ NetworkPolicy::~NetworkPolicy() // inspection policy //------------------------------------------------------------------------- +class AltPktHandler : public DataHandler +{ +public: + AltPktHandler() { }; + + void handle(DataEvent& e, Flow*) + { Detect((Packet*)e.get_packet()); } // FIXIT-L not const! +}; + InspectionPolicy::InspectionPolicy() { framework_policy = nullptr; @@ -65,6 +75,11 @@ InspectionPolicy::~InspectionPolicy() InspectorManager::delete_policy(this); } +void InspectionPolicy::configure() +{ + dbus.subscribe(PACKET_EVENT, new AltPktHandler); +} + //------------------------------------------------------------------------- // detection policy //------------------------------------------------------------------------- diff --git a/src/main/policy.h b/src/main/policy.h index 6c0de81c5..d6c509856 100644 --- a/src/main/policy.h +++ b/src/main/policy.h @@ -24,6 +24,7 @@ #include #include "main/snort_types.h" +#include "framework/data_bus.h" struct PortTable; struct vartable_t; @@ -86,8 +87,11 @@ public: InspectionPolicy(); ~InspectionPolicy(); + void configure(); + public: struct FrameworkPolicy* framework_policy; + DataBus dbus; }; //------------------------------------------------------------------------- diff --git a/src/main/snort.cc b/src/main/snort.cc index 3dfbce48d..5ea36a726 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -685,7 +685,7 @@ void LogRebuiltPacket(Packet* p) SnortEventqPop(); } -DAQ_Verdict ProcessPacket( +static DAQ_Verdict ProcessPacket( Packet* p, const DAQ_PktHdr_t* pkthdr, const uint8_t* pkt, bool is_frag) { DAQ_Verdict verdict = DAQ_VERDICT_PASS; @@ -735,6 +735,14 @@ DAQ_Verdict ProcessPacket( return verdict; } +void ProcessDefragPacket(Packet* p, Packet* dpkt) +{ + SnortEventqPush(); + PacketManager::encode_set_pkt(p); + ProcessPacket(dpkt, dpkt->pkth, dpkt->pkt, true); + SnortEventqPop(); +} + DAQ_Verdict fail_open( void*, const DAQ_PktHdr_t*, const uint8_t*) { @@ -774,7 +782,7 @@ DAQ_Verdict packet_callback( ActionManager::reset_queue(); - verdict = ProcessPacket(s_packet, pkthdr, pkt); + verdict = ProcessPacket(s_packet, pkthdr, pkt, false); ActionManager::execute(s_packet); diff --git a/src/main/snort.h b/src/main/snort.h index 6adb43dde..566cb2ffe 100644 --- a/src/main/snort.h +++ b/src/main/snort.h @@ -58,12 +58,11 @@ void snort_thread_idle(); void snort_thread_rotate(); void CapturePacket(); +void ProcessDefragPacket(Packet* raw, Packet* defrag); void DecodeRebuiltPacket(Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt, Flow*); void DetectRebuiltPacket(Packet*); void LogRebuiltPacket(Packet*); -DAQ_Verdict ProcessPacket(Packet*, const DAQ_PktHdr_t*, const uint8_t* pkt, bool is_frag=false); - DAQ_Verdict fail_open(void*, const DAQ_PktHdr_t*, const uint8_t*); DAQ_Verdict packet_callback(void*, const DAQ_PktHdr_t*, const uint8_t*); diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc index 07c2e4ffd..57372d2b0 100644 --- a/src/managers/inspector_manager.cc +++ b/src/managers/inspector_manager.cc @@ -665,6 +665,7 @@ bool InspectorManager::configure(SnortConfig* sc) { set_policies(sc, idx); InspectionPolicy* p = sc->policy_map->inspection_policy[idx]; + p->configure(); ok = ::configure(sc, p->framework_policy) && ok; } diff --git a/src/service_inspectors/ftp_telnet/ft_main.cc b/src/service_inspectors/ftp_telnet/ft_main.cc index 058cb1c2a..b76982147 100644 --- a/src/service_inspectors/ftp_telnet/ft_main.cc +++ b/src/service_inspectors/ftp_telnet/ft_main.cc @@ -65,6 +65,7 @@ #include "detection_util.h" #include "parser.h" #include "sfsnprintfappend.h" +#include "framework/data_bus.h" #ifdef PERF_PROFILING // FIXIT-M ftp, http, etc. should not be calling Detect() @@ -260,7 +261,7 @@ void do_detection(Packet* p) * main detection engine for each protocol field. */ MODULE_PROFILE_START(ftppDetectPerfStats); - Detect(p); + get_data_bus().publish(PACKET_EVENT, p); DisableInspection(p); MODULE_PROFILE_END(ftppDetectPerfStats); diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc index ab741319f..985e850ac 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/src/service_inspectors/http_inspect/hi_main.cc @@ -79,6 +79,7 @@ #include "file_api/file_api.h" #include "sf_email_attach_decode.h" #include "protocols/tcp.h" +#include "framework/data_bus.h" const HiSearchToken hi_patterns[] = { @@ -604,7 +605,7 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) } // see comments on call to Detect() below MODULE_PROFILE_START(hiDetectPerfStats); - Detect(p); + get_data_bus().publish(PACKET_EVENT, p); #ifdef PERF_PROFILING hiDetectCalled = 1; #endif @@ -693,6 +694,10 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) session->client.request.uri_size); p->packet_flags |= PKT_HTTP_DECODE; + + get_data_bus().publish( + "http_uri", session->client.request.uri_norm, + session->client.request.uri_norm_size, p->flow); } else if ( session->client.request.uri ) { @@ -708,6 +713,10 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) session->client.request.uri_size); p->packet_flags |= PKT_HTTP_DECODE; + + get_data_bus().publish( + "http_raw_uri", session->client.request.uri, + session->client.request.uri_size, p->flow); } if ( session->client.request.header_norm || diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc index 8487ae455..70fa9b8db 100644 --- a/src/service_inspectors/rpc_decode/rpc_decode.cc +++ b/src/service_inspectors/rpc_decode/rpc_decode.cc @@ -61,6 +61,7 @@ #include "stream/stream_splitter.h" #include "target_based/sftarget_protocol_reference.h" #include "protocols/tcp.h" +#include "framework/data_bus.h" #define RPC_MAX_BUF_SIZE 256 #define RPC_FRAG_HDR_SIZE sizeof(uint32_t) @@ -315,7 +316,7 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, if (RpcPrepRaw(data, rsdata->frag_len, p) != RPC_STATUS__SUCCESS) return RPC_STATUS__ERROR; - Detect(p); + get_data_bus().publish(PACKET_EVENT, p); } if ( (dsize > 0) ) @@ -400,7 +401,7 @@ static RpcStatus RpcStatefulInspection(RpcDecodeConfig* rconfig, if ( (dsize > 0) ) RpcPreprocEvent(rconfig, rsdata, RPC_MULTIPLE_RECORD); - Detect(p); + get_data_bus().publish(PACKET_EVENT, p); RpcBufClean(&rsdata->frag); } diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index 3443778c8..83ef4277b 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -952,10 +952,7 @@ static void FragRebuild(FragTracker* ft, Packet* p) #endif encap_frag_cnt++; - SnortEventqPush(); - PacketManager::encode_set_pkt(p); - ProcessPacket(dpkt, dpkt->pkth, dpkt->pkt, true); - SnortEventqPop(); + ProcessDefragPacket(p, dpkt); encap_frag_cnt--; DEBUG_WRAP(DebugMessage(DEBUG_FRAG,