From: Russ Combs <rucombs@cisco.com>
Date: Wed, 9 Jul 2014 21:27:08 +0000 (-0400)
Subject: changed default atom splitter for service inspectors
X-Git-Tag: 3.0.0-233~1444^2~13
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9f9300bd03f2acd115fabd9c8f65b029c75aaa81;p=thirdparty%2Fsnort3.git

changed default atom splitter for service inspectors
---

diff --git a/src/framework/inspector.cc b/src/framework/inspector.cc
index c634f4100..668a3e156 100644
--- a/src/framework/inspector.cc
+++ b/src/framework/inspector.cc
@@ -23,6 +23,8 @@
 #include <assert.h>
 #include <string.h>
 
+#include "stream/stream_splitter.h"
+
 //-------------------------------------------------------------------------
 // packet handler stuff
 //-------------------------------------------------------------------------
@@ -84,3 +86,11 @@ bool Inspector::get_buf(const char* key, Packet* p, InspectionBuffer& b)
     return get_buf(id, p, b);
 }
 
+StreamSplitter* Inspector::get_splitter(bool to_server)
+{
+    if ( !api || api->type != IT_SERVICE )
+        return nullptr;
+
+    return new AtomSplitter(to_server);
+}
+
diff --git a/src/framework/inspector.h b/src/framework/inspector.h
index c8ce82d82..e7350f393 100644
--- a/src/framework/inspector.h
+++ b/src/framework/inspector.h
@@ -95,8 +95,7 @@ public:
     { return false; };
 
     // IT_SERVICE only
-    virtual class StreamSplitter* get_splitter(bool /*to_server*/)
-    { return nullptr; };
+    virtual class StreamSplitter* get_splitter(bool to_server);
 
     void set_api(const InspectApi* p)
     { api = p; };
diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index be4da8e51..a7ae2d286 100644
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -575,12 +575,12 @@ void InspectorManager::execute (Packet* p)
         if ( !flow )
             return;
 
-        if ( flow->clouseau )
+        if ( flow->clouseau && (p->proto_bits & flow->clouseau->get_api()->proto_bits) )
             bumble(p);
 
         // FIXIT BIND need more than one service inspector?
         //::execute(p, fp->service.vec, fp->service.num);
-        if ( flow->gadget )
+        if ( flow->gadget && (p->proto_bits & flow->gadget->get_api()->proto_bits) )
             flow->gadget->eval(p);
     }
     else
diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc
index ff05c542b..8320f1f82 100644
--- a/src/stream/tcp/stream_tcp.cc
+++ b/src/stream/tcp/stream_tcp.cc
@@ -44,10 +44,6 @@ public:
 
     void eval(Packet*);
 
-    void pinit();
-    void pterm();
-    void reset();
-
 public:
     StreamTcpConfig* config;
 };
@@ -67,16 +63,6 @@ int StreamTcp::verify_config(SnortConfig* sc)
     return Stream5VerifyTcpConfig(sc, config);
 }
 
-void StreamTcp::pinit()
-{
-    tcp_sinit();
-}
-
-void StreamTcp::pterm()
-{
-    tcp_sterm();
-}
-
 void StreamTcp::show(SnortConfig*)
 {
     if ( config )
@@ -89,10 +75,6 @@ void StreamTcp::eval(Packet*)
     assert(false);
 }
 
-void StreamTcp::reset()
-{
-}
-
 StreamTcpConfig* get_tcp_cfg(Inspector* ins)
 {
     assert(ins);
@@ -125,6 +107,16 @@ Session* tcp_ssn(Flow* lws)
     return new TcpSession(lws);
 }
 
+void tcp_pinit()
+{
+    tcp_sinit();
+}
+
+void tcp_pterm()
+{
+    tcp_sterm();
+}
+
 static const InspectApi tcp_api =
 {
     {
@@ -143,8 +135,8 @@ static const InspectApi tcp_api =
     nullptr, // term
     tcp_ctor,
     tcp_dtor,
-    nullptr, // pinit
-    nullptr, // pterm
+    tcp_pinit,
+    tcp_pterm,
     tcp_ssn,
     tcp_sum,
     tcp_stats,