From: Russ Combs Date: Thu, 28 May 2015 13:12:29 +0000 (-0400) Subject: build 154 X-Git-Tag: 3.0.0-233~966 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3f97dc155cb0f40cf347917e0c16c40f6862bbbf;p=thirdparty%2Fsnort3.git build 154 --- diff --git a/extra/src/codecs/socket.cc b/extra/src/codecs/socket.cc index b487a558d..4f009a93a 100644 --- a/extra/src/codecs/socket.cc +++ b/extra/src/codecs/socket.cc @@ -76,7 +76,8 @@ static void set_key(CodecData& codec, DecodeData& snort) codec.proto_bits |= PROTO_BIT__TCP; } -static void set_flags(const DAQ_SktHdr_t* pci, CodecData& codec, DecodeData& snort) +static void set_flags( + const DAQ_SktHdr_t* pci, const RawData& raw, CodecData& codec, DecodeData& snort) { if ( pci->flags & DAQ_SKT_FLAG_TO_SERVER ) snort.decode_flags |= DECODE_C2S; @@ -85,9 +86,12 @@ static void set_flags(const DAQ_SktHdr_t* pci, CodecData& codec, DecodeData& sno snort.decode_flags |= DECODE_SOF; if ( pci->flags & DAQ_SKT_FLAG_END_FLOW ) + { snort.decode_flags |= DECODE_EOF; - - codec.lyr_len = 0; + codec.lyr_len = raw.len; + } + else + codec.lyr_len = 0; } bool SocketCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort) @@ -105,7 +109,7 @@ bool SocketCodec::decode(const RawData& raw, CodecData& codec, DecodeData& snort snort.set_pkt_type(PktType::FILE); } - set_flags(pci, codec, snort); + set_flags(pci, raw, codec, snort); return true; } diff --git a/extra/src/daqs/daq_socket.c b/extra/src/daqs/daq_socket.c index e98f84d6e..16e2080b2 100644 --- a/extra/src/daqs/daq_socket.c +++ b/extra/src/daqs/daq_socket.c @@ -120,7 +120,7 @@ static void sock_cleanup(SockImpl* impl) impl->sock_c = impl->sock_a = impl->sock_b = -1; } -static int sock_recv(SockImpl* impl, int* sock, struct sockaddr_in* psin) +static int sock_recv(SockImpl* impl, int* sock) { int n = recv(*sock, impl->buf, impl->snaplen, 0); @@ -130,10 +130,8 @@ static int sock_recv(SockImpl* impl, int* sock, struct sockaddr_in* psin) { DPE(impl->error, "%s: can't recv from socket (%s)\n", __FUNCTION__, strerror(errno)); - *sock = -1; - psin->sin_addr.s_addr = 0; - psin->sin_port = 0; impl->pci.flags = DAQ_SKT_FLAG_END_FLOW; + *sock = -1; } return 0; } @@ -210,7 +208,7 @@ static int sock_poll(SockImpl* impl, int* sock, struct sockaddr_in* psin) return 0; else if ( *sock >= 0 && FD_ISSET(*sock, &inputs) ) - return sock_recv(impl, sock, psin); + return sock_recv(impl, sock); else if ( *sock < 0 && FD_ISSET(impl->sock_c, &inputs) ) return sock_accept(impl, sock, psin); @@ -222,6 +220,20 @@ static int sock_poll(SockImpl* impl, int* sock, struct sockaddr_in* psin) // daq utilities //------------------------------------------------------------------------- +static void clear(SockImpl* impl) +{ + if ( impl->sock_a < 0 ) + { + impl->sin_a.sin_addr.s_addr = 0; + impl->sin_a.sin_port = 0; + } + if ( impl->sock_b < 0 ) + { + impl->sin_b.sin_addr.s_addr = 0; + impl->sin_b.sin_port = 0; + } +} + static void set_pkt_hdr(SockImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len) { struct timeval t; @@ -257,6 +269,9 @@ static void set_pkt_hdr(SockImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len) impl->pci.flags |= DAQ_SKT_FLAG_TO_SERVER; } + if ( impl->pci.flags & DAQ_SKT_FLAG_END_FLOW ) + clear(impl); + phdr->priv_ptr = &impl->pci; } diff --git a/extra/src/loggers/log_hext.cc b/extra/src/loggers/log_hext.cc index 61d2695cb..a9ad91824 100644 --- a/extra/src/loggers/log_hext.cc +++ b/extra/src/loggers/log_hext.cc @@ -224,7 +224,7 @@ void HextLogger::log(Packet* p, const char*, Event*) log_raw(p); log_data(p->pkt, p->pkth->caplen); } - else if ( p->is_tcp() and p->dsize ) + else if ( p->has_tcp_data() ) { log_header(p); log_data(p->data, p->dsize); diff --git a/src/file_api/file_service.cc b/src/file_api/file_service.cc index f812e0a6a..77067c5ce 100644 --- a/src/file_api/file_service.cc +++ b/src/file_api/file_service.cc @@ -953,7 +953,8 @@ static void enable_file_type(File_type_callback_func callback) file_type_id_enabled = true; // file_sevice_reconfig_set(true); start_file_processing(); - LogMessage("File service: file type enabled.\n"); + // FIXIT-L snort++ does not yet output startup configuration + //LogMessage("File service: file type enabled.\n"); } if ( callback == NULL ) @@ -979,7 +980,8 @@ static inline void _update_file_sig_callback(File_signature_callback_func cb) } else if (file_signature_cb != cb) { - WarningMessage("File service: signature callback redefined.\n"); + // FIXIT-L this should be a parse warning messgae + //WarningMessage("File service: signature callback redefined.\n"); } } @@ -994,7 +996,7 @@ static void enable_file_signature(File_signature_callback_func callback) file_sevice_reconfig_set(true); #endif start_file_processing(); - LogMessage("File service: file signature enabled.\n"); + //LogMessage("File service: file signature enabled.\n"); } } @@ -1007,7 +1009,7 @@ static void enable_file_capture(File_signature_callback_func callback) #ifdef SNORT_RELOAD file_sevice_reconfig_set(true); #endif - LogMessage("File service: file capture enabled.\n"); + //LogMessage("File service: file capture enabled.\n"); /* Enable file signature*/ enable_file_signature(callback); } diff --git a/src/main/build.h b/src/main/build.h index 45e08719a..9ced4405d 100644 --- a/src/main/build.h +++ b/src/main/build.h @@ -7,5 +7,5 @@ // // //-----------------------------------------------// -#define BUILD "153" +#define BUILD "154" diff --git a/src/service_inspectors/nhttp_inspect/nhttp_event_gen.h b/src/service_inspectors/nhttp_inspect/nhttp_event_gen.h index c4914be0e..09150bc49 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_event_gen.h +++ b/src/service_inspectors/nhttp_inspect/nhttp_event_gen.h @@ -21,6 +21,7 @@ #define NHTTP_EVENT_GEN_H #include +#include #include "events/event_queue.h" @@ -36,6 +37,8 @@ public: void reset() { events_generated = 0; } void create_event(NHttpEnums::EventSid sid) { + if ( sid == NHTTP_NOT_HTTP ) + printf("found one\n"); assert(((int)sid > 0) && ((int)sid <= 64)); if ((events_generated & (((uint64_t)1) << (sid-1))) == 0) {