From: Russ Combs (rucombs) Date: Wed, 15 Feb 2017 14:10:22 +0000 (-0500) Subject: Merge pull request #818 in SNORT/snort3 from doc_conn to master X-Git-Tag: 3.0.0-233~69 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7495bcf73cf42ddae1d3f1daefe5ee02be86a7c8;p=thirdparty%2Fsnort3.git Merge pull request #818 in SNORT/snort3 from doc_conn to master Squashed commit of the following: commit 98a35eebc3b3fee688a6abbed98a478493fb3e6e Author: Russ Combs Date: Wed Feb 15 07:46:55 2017 -0500 add plugin path to cmake doc build commit 38fd4f4e696f4d3696fa9e6a344b3548ac2d67ed Author: Russ Combs Date: Wed Feb 15 06:18:28 2017 -0500 add connectors to generated reference parts of manual --- diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt index 354816a84..0b9835ed6 100644 --- a/doc/CMakeLists.txt +++ b/doc/CMakeLists.txt @@ -23,6 +23,7 @@ set ( MODULE_SOURCES basic.txt codec.txt + connector.txt data.txt inspector.txt ips_action.txt @@ -37,7 +38,7 @@ set ( bugs.txt building.txt concepts.txt - connector.txt + connectors.txt daq.txt dcerpc.txt differences.txt diff --git a/doc/Makefile.am b/doc/Makefile.am index 358ee1062..451f2df01 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -13,6 +13,7 @@ signals.txt \ version.txt \ basic.txt \ codec.txt \ +connector.txt \ inspector.txt \ ips_action.txt \ ips_option.txt \ @@ -30,7 +31,7 @@ bugs.txt \ building.txt \ concepts.txt \ config_changes.txt \ -connector.txt \ +connectors.txt \ daq.txt \ dcerpc.txt \ differences.txt \ @@ -115,6 +116,11 @@ codec.txt: $(snort) $(snort) $(plugin_path) --markup --help-module $$m ; \ done > $@ +connector.txt: $(snort) + for m in `$(snort) $(plugin_path) --list-modules connector` ; do \ + $(snort) $(plugin_path) --markup --help-module $$m ; \ + done > $@ + inspector.txt: $(snort) for m in `$(snort) $(plugin_path) --list-modules inspector` ; do \ $(snort) $(plugin_path) --markup --help-module $$m ; \ diff --git a/doc/connector.txt b/doc/connectors.txt similarity index 93% rename from doc/connector.txt rename to doc/connectors.txt index 61756a59a..6be0306e4 100644 --- a/doc/connector.txt +++ b/doc/connectors.txt @@ -1,12 +1,12 @@ Connectors are a set of modules that are used to exchange message-oriented -data among snort threads and the external world. A typical use-case is +data among Snort threads and the external world. A typical use-case is HA (High Availability) message exchange. Connectors serve to decouple the message transport from the message creation/consumption. Connectors expose a common API for several forms of message transport. Connectors are a Snort plugin type. -===== Connector (parent plugin class): +===== Connector (parent plugin class) Connectors may either be a simplex channel and perform unidirectional communications. Or may be duplex and perform bidirectional communications. @@ -25,7 +25,7 @@ There are currently two implementations of Connectors: * FileConnector - Write messages to files and read messages from files. -===== TcpConnector: +===== TcpConnector TcpConnector is a subclass of Connector and implements a DUPLEX type Connector, able to send and receive messages over a tcp session. @@ -54,7 +54,7 @@ An example segment of TcpConnector configuration: } -===== FileConnector: +===== FileConnector FileConnector implements a Connector that can either read from files or write to files. FileConnector's are simplex and must be configured to be @@ -70,7 +70,7 @@ The configured 'name' string is used to construct the actual names as in: * file_connector_NAME_transmit and file_connector_NAME_receive -All messages for one snort invocation are read and written to one file. +All messages for one Snort invocation are read and written to one file. In the case of a receive FileConnector, all messages are read from the file prior to the start of packet processing. This allows the messages to diff --git a/doc/features.txt b/doc/features.txt index c997e5916..f4a11a874 100644 --- a/doc/features.txt +++ b/doc/features.txt @@ -25,7 +25,7 @@ include::high_availability.txt[] ==== Connector -include::connector.txt[] +include::connectors.txt[] ==== Side Channel diff --git a/doc/help.cmake b/doc/help.cmake index cbc534d64..e3d1d694e 100644 --- a/doc/help.cmake +++ b/doc/help.cmake @@ -2,9 +2,9 @@ function ( add_help_command generator_script output_file ) add_custom_command ( OUTPUT ${output_file} - COMMAND ${generator_script} $ ${output_file} + COMMAND ${generator_script} $ ${output_file} $ENV{SNORT_PLUGIN_PATH} DEPENDS snort - COMMENT "Documents: building ${output_file}" + COMMENT "Documents: building ${output_file} with $ENV{SNORT_PLUGIN_PATH}" ) endfunction ( add_help_command ) diff --git a/doc/high_availability.txt b/doc/high_availability.txt index 15b0b025f..e57d842c8 100644 --- a/doc/high_availability.txt +++ b/doc/high_availability.txt @@ -1,7 +1,7 @@ -HighAvailability (or HA) is a snort module that provides state coherancy +HighAvailability (or HA) is a Snort module that provides state coherancy between two partner snort instances. It uses SideChannel for messaging. -There can be multiple types of HA within snort and snort plugins. HA +There can be multiple types of HA within Snort and Snort plugins. HA implements an extensible architecture to enable plugins to subscribe to the base flow HA messaging. These plugins can then include their own messages along with the flow cache HA messages. diff --git a/doc/side_channel.txt b/doc/side_channel.txt index fcb336a1c..3a3d3320b 100644 --- a/doc/side_channel.txt +++ b/doc/side_channel.txt @@ -1,5 +1,5 @@ -SideChannel is a snort module that uses Connectors to implement a messaging -infrastructure that is used to communicate between snort threads and the +SideChannel is a Snort module that uses Connectors to implement a messaging +infrastructure that is used to communicate between Snort threads and the outside world. SideChannel adds functionality onto the Connector as: diff --git a/doc/snort_manual.txt b/doc/snort_manual.txt index e336e0249..3ca89957b 100644 --- a/doc/snort_manual.txt +++ b/doc/snort_manual.txt @@ -46,6 +46,12 @@ protocol decoding, anomaly detection, and construction of active responses. include::codec.txt[] +== Connector Modules + +Connectors support High Availability communication links. + +include::connector.txt[] + == Inspector Modules These modules perform a variety of functions, including analysis of