From: Russ Combs <rucombs@cisco.com>
Date: Sun, 2 Nov 2014 11:55:46 +0000 (-0500)
Subject: norm flags and ps log file fixes
X-Git-Tag: 3.0.0-233~1283
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7303dcf50aebca144d651d591da43522d7a6624c;p=thirdparty%2Fsnort3.git

norm flags and ps log file fixes
---

diff --git a/ChangeLog b/ChangeLog
index 1bd4c0113..8369c57e2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,6 +11,9 @@
 -- new_http_inspect reactiveated (no longer REG_TEST only)
 -- ip defrag fixes from Josh
 -- added default bindings for stream only configs
+-- added --warn-all
+-- refactored normalizer flags
+-- fixed port_scan logfile to default to off
 
 126
 -- pulled latest from tom
diff --git a/src/main/policy.h b/src/main/policy.h
index dd31895a1..51a02af00 100644
--- a/src/main/policy.h
+++ b/src/main/policy.h
@@ -72,6 +72,7 @@ public:
 
     uint32_t checksum_eval;
     uint32_t checksum_drop;
+    uint32_t normal_mask;
 
     bool decoder_drop;
 };
@@ -88,7 +89,6 @@ public:
 
 public:
     struct FrameworkPolicy* framework_policy;
-    uint32_t normal_mask;
 };
 
 //-------------------------------------------------------------------------
diff --git a/src/main/snort_module.cc b/src/main/snort_module.cc
index fec73e807..16fab79ca 100644
--- a/src/main/snort_module.cc
+++ b/src/main/snort_module.cc
@@ -391,8 +391,11 @@ static const Parameter s_params[] =
     { "--version", Parameter::PT_IMPLIED, nullptr, nullptr,
       "show version number (same as -V)" },
 
+    { "--warn-all", Parameter::PT_IMPLIED, nullptr, nullptr,
+      "enable all warnings" },
+
     { "--warn-flowbits", Parameter::PT_IMPLIED, nullptr, nullptr,
-      "warn about flowbits that checked but not set and vice-versa" },
+      "warn about flowbits that are checked but not set and vice-versa" },
 
     { "--warn-unknown", Parameter::PT_IMPLIED, nullptr, nullptr,
       "warn about unknown symbols in your config" },
@@ -734,6 +737,11 @@ bool SnortModule::set(const char*, Value& v, SnortConfig* sc)
     else if ( v.is("--version") )
         help_version(sc, v.get_string());
 
+    else if ( v.is("--warn-all") )
+    {
+        sc->logging_flags |= LOGGING_FLAG__WARN_FLOWBITS;
+        sc->logging_flags |= LOGGING_FLAG__WARN_UNKNOWN;
+    }
     else if ( v.is("--warn-flowbits") )
         sc->logging_flags |= LOGGING_FLAG__WARN_FLOWBITS;
 
diff --git a/src/main/thread.cc b/src/main/thread.cc
index 434a8cbe3..a272d7674 100644
--- a/src/main/thread.cc
+++ b/src/main/thread.cc
@@ -71,9 +71,6 @@ unsigned get_instance_max()
     return instance_max;
 }
 
-
-
-
 bool set_cpu_affinity(SnortConfig* sc, const std::string& str, int cpu)
 {
     std::map<const std::string, int>& sa = *(sc->source_affinity);
diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index 7a7e70ee6..d6ee0c51b 100644
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -464,9 +464,13 @@ void InspectorManager::thread_init(SnortConfig* sc)
     Inspector::slot = get_instance_id();
 
     for ( auto* p : sc->framework_config->clist )
+    {
         if ( p->api.tinit )
             p->api.tinit();
+    }
 
+    // pin->tinit() only called for default policy
+    set_default_policy();
     InspectionPolicy* pi = get_inspection_policy();
 
     if ( pi && pi->framework_policy )
@@ -482,6 +486,8 @@ void InspectorManager::thread_init(SnortConfig* sc)
 
 void InspectorManager::thread_term(SnortConfig* sc)
 {
+    // pin->tterm() only called for default policy
+    set_default_policy();
     InspectionPolicy* pi = get_inspection_policy();
 
     if ( pi && pi->framework_policy )
@@ -495,8 +501,10 @@ void InspectorManager::thread_term(SnortConfig* sc)
     }
 
     for ( auto* p : sc->framework_config->clist )
+    {
         if ( p->api.tterm )
             p->api.tterm();
+    }
 }
 
 //-------------------------------------------------------------------------
diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index 57dc1055e..9fee991ac 100644
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -513,12 +513,6 @@ void Binder::apply(Flow* flow, Stuff& stuff)
     // setup action
     stuff.apply_action(flow);
 
-    // FIXIT-H move normalizer flags to policy
-    Inspector* ins = InspectorManager::get_inspector(INS_NORM);
-
-    if ( ins )
-        ins->exec(0, flow);
-
     // setup session
     stuff.apply_session(flow);
 
diff --git a/src/network_inspectors/normalize/norm.cc b/src/network_inspectors/normalize/norm.cc
index 5b9b9ba04..f84ce9509 100644
--- a/src/network_inspectors/normalize/norm.cc
+++ b/src/network_inspectors/normalize/norm.cc
@@ -30,7 +30,6 @@
 
 #include "utils/stats.h"
 #include "perf_monitor/perf.h"
-#include "packet_io/sfdaq.h"
 #include "protocols/ipv4.h"
 #include "protocols/ipv4_options.h"
 #include "protocols/tcp.h"
@@ -550,14 +549,6 @@ void Norm_ResetStats (void)
 
 int Norm_SetConfig (NormalizerConfig* nc)
 {
-    if ( !DAQ_CanReplace() )
-    {
-        // FIXIT-L output only once
-        //LogMessage("WARNING: normalizations disabled because DAQ"
-        //    " can't replace packets.\n");
-        nc->normalizer_flags = 0x0;
-        return -1;
-    }
     if ( !nc->normalizer_flags )
     {
         return 0;
@@ -566,15 +557,6 @@ int Norm_SetConfig (NormalizerConfig* nc)
     {
         nc->normalizers[PacketManager::proto_id(ETHERTYPE_IPV4)] = Norm_IP4;
     }
-    if ( Norm_IsEnabled(nc, NORM_IP4_TRIM) )
-    {
-        if ( !DAQ_CanInject() )
-        {
-            ParseWarning("normalize_ip4: trim disabled since DAQ "
-                "can't inject packets.\n");
-            Norm_Disable(nc, NORM_IP4_TRIM);
-        }
-    }
     if ( Norm_IsEnabled(nc, NORM_ICMP4) )
     {
         nc->normalizers[PacketManager::proto_id(IPPROTO_ID_ICMPV4)] = Norm_ICMP4;
diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc
index dfda9e090..058d62ceb 100644
--- a/src/network_inspectors/normalize/normalize.cc
+++ b/src/network_inspectors/normalize/normalize.cc
@@ -23,7 +23,7 @@
 #include "norm.h"
 #include "norm_module.h"
 #include "packet_io/active.h"
-#include "mstring.h"
+#include "packet_io/sfdaq.h"
 #include "parser.h"
 #include "profiler.h"
 #include "snort_types.h"
@@ -32,6 +32,7 @@
 #include "flow/flow.h"
 
 THREAD_LOCAL ProfileStats norm_perf_stats;
+static THREAD_LOCAL uint32_t t_flags = 0;
 
 //-------------------------------------------------------------------------
 // printing stuff
@@ -160,10 +161,9 @@ class Normalizer : public Inspector
 public:
     Normalizer(const NormalizerConfig&);
 
-    void tinit() override;
+    bool configure(SnortConfig*) override;
     void show(SnortConfig*) override;
     void eval(Packet*) override;
-    int exec(int, void*) override;
 
 private:
     NormalizerConfig config;
@@ -174,22 +174,21 @@ Normalizer::Normalizer(const NormalizerConfig& nc)
     config = nc;
 }
 
-void Normalizer::tinit()
+// FIXIT-L this works with one normalizer per policy
+// but would be better if binder could select
+// in which case normal_mask must be moved to flow
+bool Normalizer::configure(SnortConfig*)
 {
-    // FIXIT-H this isn't good with -z > 1
-    // this ensures we init just once but there is a race cond
-    // with other threads that won't normalize until this is done
-    if ( get_instance_id() ) 
-        return;
-
+    // FIXIT-L norm needs a nap policy mode
     if ( get_ips_policy()->policy_mode != POLICY_MODE__INLINE )
     {
-        ParseWarning("normalizations disabled because not inline.\n");
+        ParseWarning("normalizations disabled because not inline.");
         config.normalizer_flags = 0;
-        return;
+        return true;
     }
 
     NetworkPolicy* nap = get_network_policy();
+    nap->normal_mask = config.normalizer_flags;
 
     if ( nap->new_ttl && nap->new_ttl < nap->min_ttl )
     {
@@ -197,7 +196,18 @@ void Normalizer::tinit()
     }
 
     Norm_SetConfig(&config);
-    return;
+    return true;
+}
+
+// FIXIT-L norm flags check should be moved to flow
+// set flow flags once at start of flow
+bool Normalize_IsEnabled(NormFlags nf)
+{
+    if ( !(t_flags & nf) )
+        return false;
+
+    NetworkPolicy* nap = get_network_policy();
+    return ( (nap->normal_mask & nf) != 0 );
 }
 
 void Normalizer::show(SnortConfig* sc)
@@ -222,15 +232,6 @@ void Normalizer::eval(Packet *p)
     return;
 }
 
-int Normalizer::exec(int, void* pv)
-{
-    Flow* flow = (Flow*)pv;
-    assert(flow);
-    InspectionPolicy* pi = get_inspection_policy();
-    pi->normal_mask = config.normalizer_flags;
-    return 0;
-}
-
 //-------------------------------------------------------------------------
 // api stuff
 //-------------------------------------------------------------------------
@@ -252,6 +253,15 @@ static void no_dtor(Inspector* p)
     delete p;
 }
 
+static void no_tinit()
+{
+    if ( DAQ_CanReplace() )
+        t_flags = NORM_ALL;
+
+    if ( !DAQ_CanInject() )
+        t_flags &= ~NORM_IP4_TRIM;
+}
+
 static const InspectApi no_api =
 {
     {
@@ -269,7 +279,7 @@ static const InspectApi no_api =
     nullptr, // service
     nullptr, // pinit
     nullptr, // pterm
-    nullptr, // tinit
+    no_tinit,
     nullptr, // tterm
     no_ctor,
     no_dtor,
diff --git a/src/network_inspectors/normalize/normalize.h b/src/network_inspectors/normalize/normalize.h
index 22007fc66..ab1b53c4b 100644
--- a/src/network_inspectors/normalize/normalize.h
+++ b/src/network_inspectors/normalize/normalize.h
@@ -49,11 +49,7 @@ typedef enum {
     NORM_ALL             = 0x0003FFFF  // all normalizations on
 } NormFlags;
 
-static inline int Normalize_IsEnabled(NormFlags nf)
-{
-    InspectionPolicy* pi = get_inspection_policy();
-    return ( (pi->normal_mask & nf) != 0 );
-}
+bool Normalize_IsEnabled(NormFlags);
 
 #endif
 
diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc
index e33400600..dc88be224 100644
--- a/src/network_inspectors/perf_monitor/perf_monitor.cc
+++ b/src/network_inspectors/perf_monitor/perf_monitor.cc
@@ -286,11 +286,7 @@ bool PerfMonitor::configure(SnortConfig*)
 
 void PerfMonitor::tinit()
 {
-    // FIXIT-H this isn't good with -z > 1
-    // need thread local per config instance or restructure
-    // (file names are ok but not hash table)
-    if ( !get_instance_id() )
-        InitPerfStats(&config);
+    InitPerfStats(&config);
 }
 
 void PerfMonitor::tterm()
diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc
index ae5f002e9..5d719a4e0 100644
--- a/src/network_inspectors/port_scan/port_scan.cc
+++ b/src/network_inspectors/port_scan/port_scan.cc
@@ -770,8 +770,8 @@ static void PrintPortscanConf(PortscanConfig* config)
         LogMessage("    Number of Nodes:   %ld\n",
             config->common->memcap / (sizeof(PS_PROTO)*proto_cnt-1));
 
-        if (config->logfile != NULL)
-            LogMessage("    Logfile:           %s\n", config->logfile);
+        if ( config->logfile )
+            LogMessage("    Logfile:           %s\n", "yes");
 
         if(config->ignore_scanners)
         {
@@ -864,9 +864,6 @@ PortScan::~PortScan()
 
 bool PortScan::configure(SnortConfig* sc)
 {
-    // FIXIT-L use fixed base file name
-    config->logfile = SnortStrdup("portscan.log");
-
     global = (PsData*)DataManager::acquire(PSG_NAME, sc);
     config->common = global->data;
     return true;
@@ -875,22 +872,29 @@ bool PortScan::configure(SnortConfig* sc)
 void PortScan::tinit()
 {
     g_tmp_pkt = PacketManager::encode_new();
+    ps_init_hash(config->common->memcap);
+
+    if ( !config->logfile )
+        return;
 
     std::string name;
-    get_instance_file(name, config->logfile);
+    get_instance_file(name, "portscan.log");
     g_logfile = fopen(name.c_str(), "a+");
 
-    if (g_logfile == NULL)
+    if ( !g_logfile )
     {
         FatalError("Portscan log file '%s' could not be opened: %s.\n",
-            config->logfile, get_error(errno));
+            name.c_str(), get_error(errno));
     }
-    ps_init_hash(config->common->memcap);
 }
 
 void PortScan::tterm()
 {
-    fclose(g_logfile);
+    if ( g_logfile )
+    {
+        fclose(g_logfile);
+        g_logfile = nullptr;
+    }
     ps_cleanup();
     PacketManager::encode_delete(g_tmp_pkt);
     g_tmp_pkt = NULL;
diff --git a/src/network_inspectors/port_scan/ps_detect.cc b/src/network_inspectors/port_scan/ps_detect.cc
index 052ecca66..aacb2effa 100644
--- a/src/network_inspectors/port_scan/ps_detect.cc
+++ b/src/network_inspectors/port_scan/ps_detect.cc
@@ -213,9 +213,6 @@ PortscanConfig::PortscanConfig()
 
 PortscanConfig::~PortscanConfig()
 {
-    if ( logfile )
-        free(logfile);
-
     if ( ignore_scanners )
         ipset_free(ignore_scanners);
 
diff --git a/src/network_inspectors/port_scan/ps_detect.h b/src/network_inspectors/port_scan/ps_detect.h
index 85c42e41c..9419ad097 100644
--- a/src/network_inspectors/port_scan/ps_detect.h
+++ b/src/network_inspectors/port_scan/ps_detect.h
@@ -47,7 +47,7 @@ struct PortscanConfig
     int proto_cnt;
     int include_midstream;
     int print_tracker;
-    char *logfile;
+    bool logfile;
 
     IPSET *ignore_scanners;
     IPSET *ignore_scanned;
diff --git a/src/network_inspectors/port_scan/ps_module.cc b/src/network_inspectors/port_scan/ps_module.cc
index 81ccaa513..0be868ff0 100644
--- a/src/network_inspectors/port_scan/ps_module.cc
+++ b/src/network_inspectors/port_scan/ps_module.cc
@@ -57,6 +57,9 @@ static const Parameter ps_params[] =
     { "include_midstream", Parameter::PT_BOOL, nullptr, "false",
       "list of CIDRs with optional ports" },
 
+    { "logfile", Parameter::PT_BOOL, nullptr, "false",
+      "write scan events to file" },
+
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
 
@@ -175,6 +178,9 @@ bool PortScanModule::set(const char*, Value& v, SnortConfig*)
         if ( !ips || ipset_parse(ips, v.get_string()) )
             return false;
     }
+    else if ( v.is("logfile") )
+        config->logfile = v.get_bool();
+
     else
         return false;
 
diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index f87e38573..2e3069ca1 100644
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -1301,6 +1301,8 @@ Defrag::Defrag(FragEngine& e) : engine(e), layers(DEFAULT_LAYERMAX) { }
 
 bool Defrag::configure(SnortConfig* sc)
 {
+    // FIXIT-L kinda squiffy ... set for each instance
+    // (but to same value) ... move to tinit() ?
     layers = sc->get_num_layers();
     return true;
 }