From: Russ Combs <rucombs@cisco.com>
Date: Fri, 24 Oct 2014 18:06:10 +0000 (-0400)
Subject: another take on flow normalizations
X-Git-Tag: 3.0.0-233~1331
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a1bf3821cee669bd67bb10ded3dfe3db03e06037;p=thirdparty%2Fsnort3.git

another take on flow normalizations
---

diff --git a/doc/start.txt b/doc/start.txt
index 4d90613e0..2e33ac39e 100644
--- a/doc/start.txt
+++ b/doc/start.txt
@@ -155,3 +155,7 @@ include::errors.txt[]
 * Snort can't tell you the exact filename or line number of a semantic
   error but it will tell you the fully qualified name.
 
+* The dump DAQ will not work with multiple threads unless you use --daq-var
+  file=/dev/null.  This will be fixed in at some point to use the Snort log
+  directory, etc.
+
diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc
index c1207c334..6ed14f010 100644
--- a/src/network_inspectors/binder/binder.cc
+++ b/src/network_inspectors/binder/binder.cc
@@ -311,7 +311,16 @@ Binding* Binder::get_binding(Flow* flow)
     // so we act as if binder wasn't configured at all
     return nullptr;
 }
-    
+
+// FIXIT-P these lookups should be optimized when the dust settles
+#define INS_WIZ  "wizard"
+#define INS_STR  "stream_"
+#define INS_IP   "stream_ip"
+#define INS_ICMP "stream_icmp"
+#define INS_TCP  "stream_tcp"
+#define INS_UDP  "stream_udp"
+#define INS_NORM "normalizer"
+
 BindAction Binder::apply(Flow* flow, Binding* pb)
 {
     if ( !pb )
@@ -327,7 +336,7 @@ BindAction Binder::apply(Flow* flow, Binding* pb)
         return pb->use.action;
     }
 
-    if ( !strncmp(pb->use.name.c_str(), "stream_", 7) )
+    if ( !strncmp(pb->use.name.c_str(), INS_STR, 7) )
     {
         set_session(flow, pb->use.name.c_str());
         return BA_INSPECT;
@@ -336,7 +345,7 @@ BindAction Binder::apply(Flow* flow, Binding* pb)
     init_flow(flow);
     Inspector* ins;
 
-    if ( pb->use.name == "wizard" )
+    if ( pb->use.name == INS_WIZ )
     {
         ins = InspectorManager::get_wizard();
         if ( ins )
@@ -365,22 +374,27 @@ BindAction Binder::apply(Flow* flow, Binding* pb)
 
 void Binder::init_flow(Flow* flow)
 {
+    Inspector* ins = InspectorManager::get_inspector(INS_NORM);
+
+    if ( ins )
+        ins->exec(0, flow);
+
     switch ( flow->protocol )
     {
     case PktType::IP:
-        set_session(flow, "stream_ip");
+        set_session(flow, INS_IP);
         break;
 
     case PktType::ICMP:
-        set_session(flow, "stream_icmp");
+        set_session(flow, INS_ICMP);
         break;
 
     case PktType::TCP:
-        set_session(flow, "stream_tcp");
+        set_session(flow, INS_TCP);
         break;
 
     case PktType::UDP:
-        set_session(flow, "stream_udp");
+        set_session(flow, INS_UDP);
         break;
 
     default:
diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc
index 45ca58cef..9c7f19ce4 100644
--- a/src/network_inspectors/normalize/normalize.cc
+++ b/src/network_inspectors/normalize/normalize.cc
@@ -163,6 +163,7 @@ public:
     void tinit() override;
     void show(SnortConfig*) override;
     void eval(Packet*) override;
+    int exec(int, void*) override;
 
 private:
     NormalizerConfig config;
@@ -217,15 +218,20 @@ void Normalizer::eval(Packet *p)
     MODULE_PROFILE_START(norm_perf_stats);
 
     if ( !PacketIsRebuilt(p) && !Active_PacketWasDropped() )
-    {
         Norm_Packet(&config, p);
-        p->flow->set_normalizations(config.normalizer_flags);
-    }
 
     MODULE_PROFILE_END(norm_perf_stats);
     return;
 }
 
+int Normalizer::exec(int, void* pv)
+{
+    Flow* flow = (Flow*)pv;
+    assert(flow);
+    flow->set_normalizations(config.normalizer_flags);
+    return 0;
+}
+
 //-------------------------------------------------------------------------
 // api stuff
 //-------------------------------------------------------------------------