From: Joel Cornett Date: Tue, 26 Apr 2016 17:32:15 +0000 (-0400) Subject: rebased from master X-Git-Tag: 3.0.0-233~418^2~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a256c19ddac1f7a7e0caaec3201e14924439928d;p=thirdparty%2Fsnort3.git rebased from master --- diff --git a/extra/CMakeLists.txt b/extra/CMakeLists.txt deleted file mode 100644 index d4b84e570..000000000 --- a/extra/CMakeLists.txt +++ /dev/null @@ -1,93 +0,0 @@ -if (BUILD_EXTRA_PLUGINS) - # This condition is only true if this directory is included as - # a subdirectory of the top level source directory. - - set(SNORT_EXECUTABLE $ CACHE INTERNAL "Snort binary" FORCE) - add_subdirectory(src) - -else (BUILD_EXTRA_PLUGINS) - - cmake_minimum_required(VERSION 2.8.8) - project(snort_extra CXX C) - - set (EXTRA_VERSION_MAJOR 1) - set (EXTRA_VERSION_MINOR 0) - set (EXTRA_VERSION_BUILD 0-a4) - set (VERSION "${EXTRA_VERSION_MAJOR}.${EXTRA_VERSION_MINOR}.${EXTRA_VERSION_BUILD}") - - set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++11") - set (CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_SOURCE_DIR}") - - # Look for Snort using pkg-config and our own find-snort module - - if (APPLE) - set(CMAKE_MACOSX_RPATH OFF) - endif(APPLE) - - find_package(DAQ REQUIRED) - find_package(Snort REQUIRED) - find_package(LuaJIT REQUIRED) - - - # add Snort++ properties to the current build - string (REPLACE "-DHAVE_CONFIG_H" " " tmp_cmp_flags "${SNORT_INTERFACE_COMPILE_OPTIONS}") - string (REPLACE ";" " " tmp_cmp_flags "${tmp_cmp_flags}") - string (STRIP "${CMAKE_CXX_FLAGS} ${tmp_cmp_flags}" tmp_cmp_flags) - set (CMAKE_CXX_FLAGS "${tmp_cmp_flags}" CACHE STRING - "Flags used by the compiler during all build types." FORCE) - - include_directories(${SNORT_INTERFACE_INCLUDE_DIRECTORIES}) - - string(REPLACE ";" " " tmp_link_flags "${SNORT_INTERFACE_LINK_FLAGS}") - string (STRIP "${CMAKE_EXE_LINKER_FLAGS} ${tmp_link_flags}" tmp_link_flags) - set (CMAKE_EXE_LINKER_FLAGS "${tmp_link_flags}" CACHE STRING - "Flags used by the linker. " FORCE) - - - include(CheckCXXCompilerFlag) - set (CMAKE_REQUIRED_FLAGS "-fvisibility=hidden") - check_cxx_compiler_flag (${CMAKE_REQUIRED_FLAGS} HAVE_VISIBILITY) - if (HAVE_VISIBILITY) - set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${CMAKE_REQUIRED_FLAGS} -DHAVE_VISIBILITY") - endif () - unset(CMAKE_REQUIRED_FLAGS) - - # Some shared library flags for the two platforms which I am using - set(CMAKE_REQUIRED_FLAGS "-Wl,-undefined,dynamic_lookup") - check_cxx_compiler_flag(${CMAKE_REQUIRED_FLAGS} HAVE_DYNAMIC_LOOKUP) - if(HAVE_DYNAMIC_LOOKUP) - set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${CMAKE_REQUIRED_FLAGS}") - endif() - unset (CMAKE_REQUIRED_FLAGS) - - - set (CMAKE_REQUIRED_FLAGS "-Wl,-export-dynamic") - check_cxx_compiler_flag (${CMAKE_REQUIRED_FLAGS} HAVE_EXPORT_DYNAMIC) - if (HAVE_EXPORT_DYNAMIC) - set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${CMAKE_REQUIRED_FLAGS}") - endif () - unset(CMAKE_REQUIRED_FLAGS) - - - set (CMAKE_REQUIRED_FLAGS "-Wl,-shared") - check_cxx_compiler_flag (${CMAKE_REQUIRED_FLAGS} HAVE_SHARED) - if (HAVE_SHARED) - set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} ${CMAKE_REQUIRED_FLAGS}") - endif () - unset(CMAKE_REQUIRED_FLAGS) - - add_subdirectory(src) - - - # adding make unisntall - configure_file( - "${CMAKE_CURRENT_SOURCE_DIR}/cmake_uninstall.cmake.in" - "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake" - IMMEDIATE @ONLY) - - add_custom_target(uninstall - COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake) - - include (packaging_data.cmake) - -endif (BUILD_EXTRA_PLUGINS) diff --git a/extra/COPYING b/extra/COPYING deleted file mode 100644 index 6891f1c3e..000000000 --- a/extra/COPYING +++ /dev/null @@ -1,395 +0,0 @@ -***************************************************************************** -The text that follows is the GNU General Public License, Version 2 (GPL V2) -and governs your use, modification and/or distribution of SNORT. - -Section 9 of the GPL V2 acknowledges that the Free Software Foundation may -publish revised and/or new versions of the GPL V2 from time to time. Section 9 -further states that a licensee of a program subject to the GPL V2 could be -free to use any such revised and/or new versions under two different scenarios: - -1. "Failure to Specify." Section 9 of the GPL V2 allows a licensee of a -program governed by an unspecified version of the General Public License to -choose any version of the General Public License ever published by the Free -Software Foundation to govern his or her use of such program. - -This provision is not applicable to your use of SNORT because we have -expressly stated in a number of instances that any third party's use, -modification or distribution of SNORT is governed by GPL V2. - -2. "Any Later Version." At the end of the terms and condition of the GPL V2 is -a section called "How to Apply these Terms to Your New Program," which -provides guidance to a developer on how to apply the GPL V2 to a third party's -use, modification and/or distribution of his/her program. Among other things, -this guidance suggests that the developer attach certain notices to the -program. Of particular importance is the following notice: - -"This program is free software; you can redistribute it and/or modify it under -the terms of the GNU General Public License as published by the Free Software -Foundation; either version 2 of the License, or (at your option) any later -version." - -Thus if a developer follows strictly the guidance provided by the Free -Software Foundation, Section 9 of the GPL V2 provides the licensee the option -to either use, modify or distribute the program under GPL V2 or under any -later version published by the Free Software Foundation. - -SNORT is an open source project that is governed exclusively by the GPL V2 -and any third party desiring to use, modify or distribute SNORT must do so by -strictly following the terms and conditions of GPL V2. Anyone using, modifying -or distributing SNORT does not have the option to chose to use, modify or -distribute SNORT under any revised or new version of the GPL, including -without limitation, the GNU General Public License Version 3. - -For ease of reference, the comparable notice that is used with SNORT -(contained in the 'README' file) is as follows: - -"This program is free software; you can redistribute it and/or modify it under -the terms of the GNU General Public License Version 2 as published by the Free -Software Foundation. You may not use, modify or distribute this program under -any other version of the GNU General Public License." - -If you have any questions about this statement, please feel free to email -snort-info@snort.org. -***************************************************************************** - - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc. - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Library General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) 19yy - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, - USA - - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) 19yy name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - , 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Library General -Public License instead of this License. diff --git a/extra/FindDAQ.cmake b/extra/FindDAQ.cmake deleted file mode 100644 index 6e0f19ff0..000000000 --- a/extra/FindDAQ.cmake +++ /dev/null @@ -1,86 +0,0 @@ -# -# -# Locate DAQ library -# This module defines -# DAQ_FOUND, if false, do not try to link to Lua -# -# DAQ_FOUND - system has the daq -# DAQ_INCLUDE_DIR - the daqs include directory -# DAQ_LIBRARIES - the libraries needed to use the daq -# -## Copied from default CMake FindLua51.cmake - - - -set (ERROR_MESSAGE - " - ERROR! cannot find the DAQ. Go get it from - http://snort.org/snort-downloads or use the --with-daq-* - options if you have it installed inn an unusual place. You can - also set the DAQ_DIR environment variablet to the daqs root installation directory\n\n" -) - - - -find_path(DAQ_INCLUDE_DIR - NAMES daq.h - HINTS ENV DAQ_DIR - PATH_SUFFIXES daq -) - - -# find any static libraries -if (ENABLE_STATIC_DAQ) - execute_process( - COMMAND daq-modules-config --static --libs - OUTPUT_VARIABLE DAQ_STATIC_LIBRARIES - RESULT_VARIABLE result - OUTPUT_STRIP_TRAILING_WHITESPACE - ) - - # This will be false if the exit status was 0 and true if the binary was not found - if (result) - message(FATAL_ERROR " - - ERROR! cannot find the DAQs static libraries! make sure the binary - file `daq-modules-config` is in your path, or specific the daqs path - with the --with-daq-root= - - ") - endif() - - set(DAQ_LIB daq_static) -else() - set(DAQ_LIB daq) - set(DAQ_STATIC_LIBRARIES) -endif() - - -find_library(DAQ_LIBRARY - NAMES ${DAQ_LIB} - HINTS ${DAQ_LIBRARIES_DIR} # user specified path in ./configure_cmake.sh - DOC "DAQ library directory" - NO_DEFAULT_PATH - NO_CMAKE_ENVIRONMENT_PATH -) - -find_library(DAQ_LIBRARY - NAMES ${DAQ_LIB} - HINTS ENV DAQ_DIR - PATH_SUFFIXES daq - DOC "DAQ library directory" -) - -set(DAQ_LIBRARIES ${DAQ_LIBRARY} ${DAQ_STATIC_LIBRARIES}) - -include(FindPackageHandleStandardArgs) -find_package_handle_standard_args(DAQ - REQUIRED_VARS DAQ_LIBRARY DAQ_LIBRARIES DAQ_INCLUDE_DIR - FAIL_MESSAGE "${ERROR_MESSAGE}" -) - -mark_as_advanced( - DAQ_INCLUDE_DIR - DAQ_LIBRARY - DAQ_LIBRARIES -) diff --git a/extra/FindLuaJIT.cmake b/extra/FindLuaJIT.cmake deleted file mode 100644 index 1ec761f14..000000000 --- a/extra/FindLuaJIT.cmake +++ /dev/null @@ -1,83 +0,0 @@ -# -# Locate LUAJIT library -# This module defines -# LUAJIT_FOUND, if false, do not try to link to Lua -# LUAJIT_LIBRARIES -# LUAJIT_INCLUDE_DIR, where to find lua.h -# LUAJIT_VERSION_STRING, the version of Lua found (since CMake 2.8.8) - -## Copied from default CMake FindLua51.cmake -set( LUA_PATHS - ~/Library/Frameworks - /Library/Frameworks - /sw - /opt/local - /opt/csw - /opt -) - -set(ERROR_MESSAGE - "\n\tCan't Find luajit! Get it from - http://luajit.org/download.html or use the --with-luajit-* - options if you have it installed inn an unusual place. You can - also set the LUA_DIR environment variablet to the daqs root installation directory\n" -) - - -find_path(LUAJIT_INCLUDE_DIR - NAMES luajit.h - HINTS ENV LUA_DIR - PATH_SUFFIXES include include/luajit-2.0 - PATHS ${LUA_PATHS} -) - -find_library(LUAJIT_LIBRARIES - NAMES luajit-5.1 - HINTS ${LUAJIT_LIBRARIES_DIR} - DOC "Lua Libraries" - NO_DEFAULT_PATH - NO_CMAKE_ENVIRONMENT_PATH -) -find_library(LUAJIT_LIBRARIES - NAMES luajit-5.1 - HINTS ENV LUA_DIR - PATH_SUFFIXES luajit-5.1 - PATHS ${LUA_PATHS} - DOC "Lua Libraries" -) - -if (APPLE) - set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${LUAJIT_LIBRARIES} -pagezero_size 10000 -image_base 100000000") -endif() - -if(LUAJIT_LIBRARIES) - # include the math library for Unix - if(UNIX AND NOT APPLE) - find_library(MATH_LIBRARY m) - list(APPEND LUAJIT_LIBRARIES "${MATH_LIBRARY}") - endif() -endif() - - -if(LUAJIT_INCLUDE_DIR AND EXISTS "${LUAJIT_INCLUDE_DIR}/luajit.h") - file(STRINGS "${LUAJIT_INCLUDE_DIR}/luajit.h" luajit_version_str REGEX "^#define[ \t]+LUAJIT_VERSION[ \t]+\"LuaJIT .+\"") - - string(REGEX REPLACE "^#define[ \t]+LUAJIT_VERSION[ \t]+\"LuaJIT ([^\"]+)\".*" "\\1" LUAJIT_VERSION_STRING "${luajit_version_str}") - unset(luajit_version_str) -endif() - -include(FindPackageHandleStandardArgs) -# handle the QUIETLY and REQUIRED arguments and set LUA_FOUND to TRUE if -# all listed variables are TRUE -find_package_handle_standard_args(LuaJIT - REQUIRED_VARS LUAJIT_LIBRARIES LUAJIT_INCLUDE_DIR - VERSION_VAR LUAJIT_VERSION_STRING - FAIL_MESSAGE "${ERROR_MESSAGE}" -) - -mark_as_advanced( - LUAJIT_INCLUDE_DIR - LUAJIT_LIBRARIES - MATH_LIBRARY -) - diff --git a/extra/FindSnort.cmake b/extra/FindSnort.cmake deleted file mode 100644 index 8a0cdffc3..000000000 --- a/extra/FindSnort.cmake +++ /dev/null @@ -1,128 +0,0 @@ -# -# SNORT_FOUND - Found Snort -# SNORT_EXECUTABLE - The Snort++ executable -# SNORT_INCLUDE_DIR - Snort include directory -# -# -# These varaibles are all lists whose variables are retrieved from either -# snort.cmake or pkg-config. snort.cmake will always take precendence over pkg-config. -# SNORT_INTERFACE_COMPILE_OPTIONS - a list of Snort++'s compile options. -# SNORT_INTERFACE_INCLUDE_DIRECTORIES - The directories that Snort++ includes -# when building. -# SNORT_INTERFACE_LINK_FLAGS - Snort++ link flags. only available with `pkg-config` -# - -set(ERROR_MESSAGE - " - Unable to find Snort. Either - - 1) Using ccmake, manually set the cmake variables - SNORT_INCLUDE_DIR and SNORT_EXECUTABLE. - - 2) run cmake with the following arguments - -DSNORT_INCLUDE_DIR:PATH=/full/path/to/snort/include/dir - -DSNORT_EXECUTABLE:PATH=/full/path/to/snort/binary - - 3) set the environment variable SNORT_DIR to the root - root installation directory. - - 4) Find the file snort.cmake. Manually set set the - variable SNORT_IMPORT_FILE using either ccmake or the - command line (-DSNORT_IMPORT_FILE=/full/install/path/lib/snort/snort.cmake) - - 5) install pkg-config and add the path to snort.pc to the PKG_CONFIG_PATH - environment variable. - - " -) - - -# First, lets try to import the Snort -find_file (SNORT_IMPORT_FILE - NAMES snort.cmake - HINTS ENV SNORT_DIR - PATH_SUFFIXES lib lib/snort snort -) - -if (SNORT_IMPORT_FILE) - include (${SNORT_IMPORT_FILE}) - - if (NOT SNORT_EXECUTABLE) - get_target_property(tmp_exe snort LOCATION) - set(SNORT_EXECUTABLE "${tmp_exe}" CACHE FILEPATH "Snort executable" FORCE) - endif() - - get_target_property(tmp_cflags snort INTERFACE_COMPILE_OPTIONS) - set (SNORT_INTERFACE_COMPILE_OPTIONS "${tmp_cflags}" CACHE STRING - "The compile options with which Snort was linked" FORCE) - - get_target_property(tmp_int_dir snort INTERFACE_INCLUDE_DIRECTORIES) - set(SNORT_INTERFACE_INCLUDE_DIRECTORIES "${tmp_int_dir}" CACHE FILEPATH - "The directories that Snort include's when building" FORCE) - - -endif(SNORT_IMPORT_FILE) - - - -find_package(PkgConfig QUIET) - -if (PKG_CONFIG_FOUND) - pkg_check_modules(SNORT_PKG snort) - - if (SNORT_PKG_FOUND) - - # CMake file takes precedence over pkg-config file - if (NOT SNORT_INTERFACE_COMPILE_OPTIONS) - set (SNORT_INTERFACE_COMPILE_OPTIONS "${SNORT_PKG_CFLAGS_OTHER}" CACHE STRING - "The compile options with which Snort was linked" FORCE) - endif() - - if (NOT SNORT_INTERFACE_INCLUDE_DIRECTORIES) - set (SNORT_INTERFACE_INCLUDE_DIRECTORIES "${SNORT_PKG_INCLUDE_DIRS}" CACHE STRING - "The compile options with which Snort was linked" FORCE) - endif() - - # add Snort link flags - set (SNORT_INTERFACE_LINK_FLAGS "${SNORT_PKG_LDFLAGS}" - CACHE STRING "The link flags with which the Snort++ binary was linked" FORCE) - - - if (CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT) - set (CMAKE_INSTALL_PREFIX "${SNORT_PKG_PREFIX}" CACHE PATH - "Install path prefix, prepended onto install directories." FORCE) - endif (CMAKE_INSTALL_PREFIX_INITIALIZED_TO_DEFAULT) - - endif (SNORT_PKG_FOUND) -endif (PKG_CONFIG_FOUND) - - -find_path (SNORT_INCLUDE_DIR - NAMES main/snort_types.h - HINTS ${SNORT_INTERFACE_INCLUDE_DIRECTORIES} ENV SNORT_DIR - PATH_SUFFIXES snort include/snort -) - -find_program (SNORT_EXECUTABLE - NAMES snort - HINTS ${SNORT_PKG_PREFIX} ENV SNORT_DIR - PATH_SUFFIXES bin # necessary when SNORT_DIR is set -) - -include(FindPackageHandleStandardArgs) -find_package_handle_standard_args( Snort - REQUIRED_VARS SNORT_INCLUDE_DIR SNORT_EXECUTABLE - FAIL_MESSAGE "${ERROR_MESSAGE}" -) - - -mark_as_advanced( - SNORT_INCLUDE_DIR - SNORT_EXECUTABLE - SNORT_IMPORT_FILE - SNORT_INTERFACE_COMPILE_OPTIONS - SNORT_INTERFACE_INCLUDE_DIRECTORIES - SNORT_INTERFACE_LINK_FLAGS -) - - diff --git a/extra/LICENSE b/extra/LICENSE deleted file mode 100644 index 8083cddbb..000000000 --- a/extra/LICENSE +++ /dev/null @@ -1,395 +0,0 @@ -***************************************************************************** -The text that follows is the GNU General Public License, Version 2 (GPL V2) -and governs your use, modification and/or distribution of SNORT. - -Section 9 of the GPL V2 acknowledges that the Free Software Foundation may -publish revised and/or new versions of the GPL V2 from time to time. Section 9 -further states that a licensee of a program subject to the GPL V2 could be -free to use any such revised and/or new versions under two different scenarios: - -1. "Failure to Specify." Section 9 of the GPL V2 allows a licensee of a -program governed by an unspecified version of the General Public License to -choose any version of the General Public License ever published by the Free -Software Foundation to govern his or her use of such program. - -This provision is not applicable to your use of SNORT because we have -expressly stated in a number of instances that any third party's use, -modification or distribution of SNORT is governed by GPL V2. - -2. "Any Later Version." At the end of the terms and condition of the GPL V2 is -a section called "How to Apply these Terms to Your New Program," which -provides guidance to a developer on how to apply the GPL V2 to a third party's -use, modification and/or distribution of his/her program. Among other things, -this guidance suggests that the developer attach certain notices to the -program. Of particular importance is the following notice: - -"This program is free software; you can redistribute it and/or modify it under -the terms of the GNU General Public License as published by the Free Software -Foundation; either version 2 of the License, or (at your option) any later -version." - -Thus if a developer follows strictly the guidance provided by the Free -Software Foundation, Section 9 of the GPL V2 provides the licensee the option -to either use, modify or distribute the program under GPL V2 or under any -later version published by the Free Software Foundation. - -SNORT is an open source project that is governed exclusively by the GPL V2 -and any third party desiring to use, modify or distribute SNORT must do so by -strictly following the terms and conditions of GPL V2. Anyone using, modifying -or distributing SNORT does not have the option to chose to use, modify or -distribute SNORT under any revised or new version of the GPL, including -without limitation, the GNU General Public License Version 3. - -For ease of reference, the comparable notice that is used with SNORT -(contained in the 'README' file) is as follows: - -"This program is free software; you can redistribute it and/or modify it under -the terms of the GNU General Public License Version 2 as published by the Free -Software Foundation. You may not use, modify or distribute this program under -any other version of the GNU General Public License." - -If you have any questions about this statement, please feel free to email -snort-info@snort.org. -***************************************************************************** - - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc. - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Library General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) 19yy - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, - USA - - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) 19yy name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - , 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Library General -Public License instead of this License. diff --git a/extra/Makefile.am b/extra/Makefile.am deleted file mode 100644 index ff58a74f9..000000000 --- a/extra/Makefile.am +++ /dev/null @@ -1,20 +0,0 @@ - -EXTRA_DIST = \ -README \ -COPYING \ -LICENSE - -SUBDIRS = \ -src - -AM_CXXFLAGS = @AM_CXXFLAGS@ - -DISTCLEANFILES = \ -compile \ -config.guess \ -config.sub \ -depcomp \ -install-sh \ -ltmain.sh \ -missing - diff --git a/extra/README b/extra/README deleted file mode 100644 index 97ec5f0d0..000000000 --- a/extra/README +++ /dev/null @@ -1,108 +0,0 @@ -Snort++ Extras - -Snort++ is all about plugins. It has over 200 by default and makes it easy -to add more in C++ or LuaJIT. This file will walk you through building and -running a set of extra example plugins. If you haven't installed and -verified Snort++, you will need to do that first. We will cover the -following topics: - -* Overview -* Download -* Build Extras -* Run Extras -* Next Steps - -OVERVIEW - -The following things are pluggable in Snort++: - -* codec - decode and encode support for a given protocol -* data - additional configuration for inspectors -* inspector - replaces Snort preprocessors -* ips_option - IPS rule option like content and byte_test -* ips_action - IPS rule action like alert and block -* search_engine - fast pattern matcher -* logger - event handers -* SO rules - dynamic rules - -DOWNLOAD - -There are two extra tarballs, one for autotools and one for cmake: - - snort_extra-1.0.0-a1-130-auto.tar.gz - snort_extra-1.0.0-a1-130-cmake.tar.gz - -If you cloned from github, you have already have everything. - -BUILD EXTRAS - -Follow these steps: - -1. Set up source directory: - -* If you are using a github clone: - - cd extra/ - -* Otherwise do this: - - tar zxf extra-tarball - cd snort_extra-1.0.0* - -2. Setup install path (same as for snort): - - export my_path=/path/to/snorty - export PKG_CONFIG_PATH=$my_path/lib/pkgconfig - -3. Compile and install: - -* To build with autotools, simply do the usual from the top level directory: - - ./configure --prefix=$my_path - make -j 8 install - -* To build with cmake and make, run configure_cmake.sh. It will automatically create and populate a new subdirectory named 'build'. - - ./configure_cmake.sh --prefix=$my_path - cd build - make -j 8 install - -Note: - -* If you are using autotools with a github clone, first do autoreconf -isvf. -* If you are familiar with cmake, you can run cmake/ccmake instead of - configure_cmake.sh. -* cmake --help will list any available generators, such as Xcode. Feel - free to use one, however help with those will be provided separately. - -RUN EXTRAS - -In the following, replace a.pcap with your favorite. - -* The following demonstrates a C++ logger and a LuaJIT logger: - - $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \ - -r a.pcap --plugin-path $my_path/lib/snort_extra -A alert_ex - - $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \ - -r a.pcap --script-path $my_path/lib/snort_extra -A lualert - -You can edit $my_path/lib/snort_extra/loggers/alert.lua to tweak the output -format and rerun the above command to try it out. - -* The last example demonstrates a LuaJIT rule option called find. The rule, - supplied on stdin, uses the Lua [[ multiline string ]] delimiters to avoid - shell escape issues: - - echo 'alert tcp any any -> any 80 ( sid:1; msg:"test"; http_method; find:"pat = [[GET]]"; )' | \ - $my_path/bin/snort -c $my_path/etc/snort/snort.lua -r a.pcap \ - -A cmg --script-path $my_path/lib/snort_extra --stdin-rules - -NEXT STEPS o")~ - -There is no design guide yet but you can develop your own plugins in C++ by -using the examples as a starting point. In addition, IPS options and -loggers can also be written in LuaJIT. The API may change going forward, -but you are encouraged to roll your own now and let us know how it goes so -we can incorporate any suggestions in the final design. - diff --git a/extra/cmake_uninstall.cmake.in b/extra/cmake_uninstall.cmake.in deleted file mode 100644 index 2c34c8199..000000000 --- a/extra/cmake_uninstall.cmake.in +++ /dev/null @@ -1,21 +0,0 @@ -if(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") - message(FATAL_ERROR "Cannot find install manifest: @CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") -endif(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") - -file(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" files) -string(REGEX REPLACE "\n" ";" files "${files}") -foreach(file ${files}) - message(STATUS "Uninstalling $ENV{DESTDIR}${file}") - if(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}") - exec_program( - "@CMAKE_COMMAND@" ARGS "-E remove \"$ENV{DESTDIR}${file}\"" - OUTPUT_VARIABLE rm_out - RETURN_VALUE rm_retval - ) - if(NOT "${rm_retval}" STREQUAL 0) - message(FATAL_ERROR "Problem when removing $ENV{DESTDIR}${file}") - endif(NOT "${rm_retval}" STREQUAL 0) - else(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}") - message(STATUS "File $ENV{DESTDIR}${file} does not exist.") - endif(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}") -endforeach(file) \ No newline at end of file diff --git a/extra/configure.ac b/extra/configure.ac deleted file mode 100644 index b59adbcd4..000000000 --- a/extra/configure.ac +++ /dev/null @@ -1,105 +0,0 @@ -#-------------------------------------------------------------------------- -# initialization -#-------------------------------------------------------------------------- - -AC_INIT([snort_extra], [1.0.0-a4], [snort-team@sourcefire.com]) -AC_PREREQ(2.69) - -AC_CONFIG_SRCDIR([config.h.in]) -AC_CONFIG_MACRO_DIR([m4]) -AC_CONFIG_HEADERS([config.h]) - -AM_INIT_AUTOMAKE(foreign) -AM_SILENT_RULES([yes]) - -# Checks for programs. -AC_PROG_CC([clang gcc]) -AC_PROG_CXX([clang++ g++]) -AC_PROG_LIBTOOL - -LT_INIT - -# Use the same defines Snort used -# (absolutely critical to ensure struct definitions match) -CPPFLAGS="$CPPFLAGS `pkg-config --cflags snort`" - -CPPFLAGS="$CPPFLAGS -DBUILDING_SO" - -CFLAGS="$CFLAGS -std=gnu99" -CXXFLAGS="$CXXFLAGS -std=c++11" - -AX_CXX_COMPILE_STDCXX_11 - -#-------------------------------------------------------------------------- -# visibility foo -#-------------------------------------------------------------------------- - -# modified from gnulib/m4/visibility.m4 -AC_DEFUN([CC_VISIBILITY], -[ - AC_REQUIRE([AC_PROG_CC]) - AC_MSG_CHECKING([for visibility support]) - gl_save_CFLAGS="$CFLAGS" - - AC_CACHE_VAL(gl_cv_cc_visibility, [ - # Add -Werror flag since some compilers, e.g. icc 7.1, don't support it, - # but only warn about it instead of compilation failing - CFLAGS="$CFLAGS -Werror -fvisibility=hidden" - AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ - extern __attribute__((__visibility__("hidden"))) int hiddenvar; - extern __attribute__((__visibility__("default"))) int exportedvar; - extern __attribute__((__visibility__("hidden"))) int hiddenfunc (void); - extern __attribute__((__visibility__("default"))) int exportedfunc (void);]], - [[]])], - [gl_cv_cc_visibility="yes"], - [gl_cv_cc_visibility="no"]) - ]) - AC_MSG_RESULT([$gl_cv_cc_visibility]) - CFLAGS="$gl_save_CFLAGS" - if test "x$gl_cv_cc_visibility" = "xyes"; then - # flags pulled from snort but we need to define the have - #CFLAGS="$CFLAGS -fvisibility=hidden" - #CXXFLAGS="$CXXFLAGS -fvisibility=hidden" - AC_DEFINE([HAVE_VISIBILITY],[1], - [Define if the compiler supports visibility declarations.]) - fi -]) -CC_VISIBILITY() - -#-------------------------------------------------------------------------- -# outputs -#-------------------------------------------------------------------------- - -AC_SUBST(AM_CXXFLAGS) - -AC_CONFIG_FILES([ \ - Makefile \ - src/Makefile \ - src/codecs/Makefile \ - src/daqs/Makefile \ - src/inspectors/Makefile \ - src/ips_options/Makefile \ - src/loggers/Makefile \ - src/search_engines/Makefile \ - src/so_rules/Makefile \ -]) - -AC_OUTPUT - -AC_MSG_RESULT([ - $PACKAGE $VERSION - ======== - - prefix: ${prefix} - sysconfdir: ${sysconfdir} - libdir: ${libdir} - includedir: ${includedir} - - compiler: ${CC} - compiler++: ${CXX} - cflags: ${CFLAGS} - cxxflags: ${CXXFLAGS} - cppflags: ${CPPFLAGS} - ldflags: ${LDFLAGS} - libs: ${LIBS} -]) diff --git a/extra/configure_cmake.sh b/extra/configure_cmake.sh deleted file mode 100755 index cd0cbf500..000000000 --- a/extra/configure_cmake.sh +++ /dev/null @@ -1,132 +0,0 @@ -#!/bin/sh -# Convenience wrapper for easily viewing/setting options that -# the project's CMake scripts will recognize -set -e -command="$0 $*" - -# check for `cmake` command -type cmake > /dev/null 2>&1 || { - echo "\ -This package requires CMake, please install it first, then you may -use this configure script to access CMake equivalent functionality.\ -" >&2; - exit 1; -} - -usage="\ -Usage: $0 [OPTION]... [VAR=VALUE]... - - --builddir= The build directory - --generator= run cmake --help for a list of generators - --prefix= Snort++ installation prefix - - Optional Packages: - --with-daq-includes=DIR DAQ include directory - --with-daq-libraries=DIR DAQ library directory - --with-luajit-includes=DIR luajit include directory - --with-luajit-libraries=DIR luajit library directory -" - -sourcedir="$( cd "$( dirname "$0" )" && pwd )" - -# Function to append a CMake cache entry definition to the -# CMakeCacheEntries variable -# $1 is the cache entry variable name -# $2 is the cache entry variable type -# $3 is the cache entry variable value -append_cache_entry () { - CMakeCacheEntries="$CMakeCacheEntries -D $1:$2=$3" -} - -check_and_append_cache_entry() { - if [ -f $3 ]; then - append_cache_entry $1 $2 $3 - else - echo "" - echo "the $1 variable, which is specified using a --with-* options," - echo "requires an absolute path to the library. Could not stat the" - echo "the library:" - echo " $3" - echo "" - exit 1 - fi -} - -# set defaults -builddir=build -prefix=/usr/local/snort -CMakeCacheEntries="" -append_cache_entry CMAKE_INSTALL_PREFIX PATH $prefix - - -# parse arguments -while [ $# -ne 0 ]; do - case "$1" in - -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;; - *) optarg= ;; - esac - - case "$1" in - --help|-h) - echo "${usage}" 1>&2 - exit 1 - ;; - --builddir=*) - builddir=$optarg - ;; - --generator=*) - CMakeGenerator="$optarg" - ;; - --prefix=*) - prefix=$optarg - append_cache_entry CMAKE_INSTALL_PREFIX PATH $optarg - ;; - --with-luajit-includes=*) - append_cache_entry LUAJIT_INCLUDE_DIR PATH $optarg - ;; - --with-luajit-libraries=*) - append_cache_entry LUAJIT_LIBRARIES_DIR PATH $optarg - ;; - --with-daq-includes=*) - append_cache_entry DAQ_INCLUDE_DIR PATH $optarg - ;; - --with-daq-libraries=*) - append_cache_entry DAQ_LIBRARIES_DIR PATH $optarg - ;; - *) - echo "Invalid option '$1'. Try $0 --help to see available options." - exit 1 - ;; - esac - shift -done - -if [ -d $builddir ]; then - # If build directory exists, check if it has a CMake cache - if [ -f $builddir/CMakeCache.txt ]; then - # If the CMake cache exists, delete it so that this configuration - # is not tainted by a previous one - rm -f $builddir/CMakeCache.txt - fi -else - # Create build directory - mkdir -p $builddir -fi - -echo "Build Directory : $builddir" -echo "Source Directory: $sourcedir" -cd $builddir - -gen="" -[ "$CMakeGenerator" ] && gen+=" -G $CMakeGenerator" - -cmake $gen \ - -DCOMPILE_DEFINITIONS:STRING="$CPPFLAGS" \ - -DCMAKE_CXX_FLAGS:STRING="$CXXFLAGS $CPPFLAGS" \ - -DCMAKE_C_FLAGS:STRING="$CFLAGS $CPPFLAGS" \ - $CMakeCacheEntries $sourcedir - -echo "# This is the command used to configure this build" > config.status -echo $command >> config.status -chmod u+x config.status - diff --git a/extra/packaging_data.cmake b/extra/packaging_data.cmake deleted file mode 100644 index 80c4f6b29..000000000 --- a/extra/packaging_data.cmake +++ /dev/null @@ -1,23 +0,0 @@ - -add_custom_target(dist - COMMAND ${CMAKE_COMMAND} --build ${CMAKE_BINARY_DIR} --target package_source -) - -set (AUTOTOOL_FILES "autom4te.cache;m4;configure.ac;Makefile.am") - -set (CPACK_GENERATOR TGZ) -set (CPACK_PACKAGE_NAME "snort_extra") -set (CPACK_PACKAGE_VENDOR "Cisco") -set (CPACK_PACKAGE_VERSION_MAJOR "${EXTRA_VERSION_MAJOR}") -set (CPACK_PACKAGE_VERSION_MINOR "${EXTRA_VERSION_MINOR}") -set (CPACK_PACKAGE_VERSION_PATCH "${EXTRA_VERSION_BUILD}") -set (CPACK_PACKAGE_ICON "${CMAKE_SOURCE_DIR}/doc/images/snort.png") -set (CPACK_PACKAGE_INSTALL_DIRECTORY "snort") -set (CPACK_RESOURCE_FILE_LICENSE "${CMAKE_SOURCE_DIR}/LICENSE") -set (CPACK_RESOURCE_FILE_README "${CMAKE_SOURCE_DIR}/README") -set (CPACK_SOURCE_PACKAGE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}") -set (CPACK_SOURCE_IGNORE_FILES "${AUTOTOOL_FILES}") -set (CPACK_SOURCE_GENERATOR TGZ) - -include(CPack) - diff --git a/extra/src/CMakeLists.txt b/extra/src/CMakeLists.txt deleted file mode 100644 index 8552dcfaf..000000000 --- a/extra/src/CMakeLists.txt +++ /dev/null @@ -1,152 +0,0 @@ -################################################ -# MACRO FOR ADDING EXAMPLE LIBRARIES -# -# Look in subdirecties for examples. This macro -# will take care of all the logic, especially adding -# this to the test configuration -# -# PARAMS: -# library ==> library name to be installed -# install_path ==> install into folder lib/[snort/snort_ex]/install_path -# SOURCES ==> all arguments after install path are library sources -# -################################################ - -macro (add_example_library libname install_path) - set (sources ${ARGN}) - - # Did we get any sources? - list(LENGTH sources num_extra_args) - if (${num_extra_args} GREATER 0) - - add_library (${libname} SHARED ${sources} ) - set_target_properties ( ${libname} - PROPERTIES - COMPILE_FLAGS "-DBUILDING_SO" - ) - - # If we're testing plugins, set a variable for later use. - if (BUILD_EXTRA_PLUGINS) - set (TMP_PLUGINS "${BUILT_PLUGINS}") - list (APPEND TMP_PLUGINS ${libname}) - - # Force implied, but making this explicit - set (BUILT_PLUGINS "${TMP_PLUGINS}" CACHE INTERNAL "example plugin libraries" FORCE) - endif (BUILD_EXTRA_PLUGINS) - - - install (TARGETS ${libname} - LIBRARY DESTINATION "${EX_INSTALL_PATH}/${install_path}" - ) - - else (${num_extra_args} GREATER 0) - - message (STATUS "add_static_library requires at least one source file!") - message (FATAL "usage: add_static_library lib_name source_1 source_2 source_3 ...") - - endif (${num_extra_args} GREATER 0) -endmacro (add_example_library) - - - -################################################ -#### SETTING CORRECT VARIABLES FOR BULIDING #### -################################################ - -if (BUILD_EXTRA_PLUGINS) - set (TEST_INSTALL_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/test_install") - set (EX_INSTALL_PATH "lib/snort") - include_directories (BEFORE "${TEST_INSTALL_DIRECTORY}/include/snort") - include_directories (AFTER ${DAQ_INCLUDE_DIR}) - - # reset this variable in case Cmake is reconfigured. i.e., - # we will keep appending the same libraries multiple times otherwise - unset (BUILT_PLUGINS CACHE) - - -else (BUILD_EXTRA_PLUGINS) - include_directories (AFTER ${DAQ_INCLUDE_DIR}) - include_directories (BEFORE ${LUAJIT_INCLUDE_DIR}) - include_directories (BEFORE ${SNORT_INCLUDE_DIR}) - set (EX_INSTALL_PATH "lib/snort_extra") - -endif (BUILD_EXTRA_PLUGINS) - - -################################################ -####### FINALLY, ADDING SUBDIRECTORIES ####### -################################################ - - -add_subdirectory (codecs) -add_subdirectory (daqs) -add_subdirectory (inspectors) -add_subdirectory (ips_options) -add_subdirectory (loggers) -add_subdirectory (search_engines) -add_subdirectory (so_rules) - - -############################################################################## -# When Testing plugins, I want to build snort, install it, and then include -# the installed directory. This makes sure we install all correct files. -# The result is below. -############################################################################## - -if (BUILD_EXTRA_PLUGINS) - - ################################################ - # This variable, DBUILD_EXTRA_PLUGINS, is toggled because - # when Snort++ builds unit test, this directory will - # get recursively called from 'make install'. Infinite loops - # seem like a poor life choice. - ################################################ - - ################################################ - # Breaking this down by command - # 1) Remove the previously installed directory (if it exists) - # While this may strictly not necessary, this is a - # safegaurd to ensure only current files are included. - # 2) Clean this directory and all subdirectories. This command - # works in tandem with WORKING_DIRECTORY to ensure it - # only cleans extra plugins. Also, we check in the top - # level cmake file to ensure that Makefiles have been - # generated. So, the command is definitely valid. - # 3) Ensure we don't recursively build this directly. Also - # ensures we install into a temporary directory - # 4) build snort. Can technically be combined with 'make install' - # but lets keep them seperate for clarity. - # 5) install snort into the temp install directory. - # 6) reset cmake options - # 7) Another make is required to ensure the all the configured files - # revert to their original form. I chose u2spewfoo because - # it only has one source file - # 8) possible cmake bug? timestamp on installed binary not updating. - # Manually touch file to ensure we don't needlesly rebuild - ################################################ - - set (TMP_INSTALL_PREFIX ${CMAKE_INSTALL_PREFIX}) - - # install Snort into temporary directory - add_custom_command( - OUTPUT "${TEST_INSTALL_DIRECTORY}/bin/snort" - COMMAND ${CMAKE_COMMAND} -E remove_directory ${TEST_INSTALL_DIRECTORY} - COMMAND make clean - COMMAND ${CMAKE_COMMAND} ${CMAKE_BINARY_DIR} -DCMAKE_INSTALL_PREFIX=${TEST_INSTALL_DIRECTORY} -DBUILD_EXTRA_PLUGINS=OFF -# COMMAND ${CMAKE_COMMAND} --build ${CMAKE_BINARY_DIR} --target snort # performed during --target install - COMMAND ${CMAKE_COMMAND} --build ${CMAKE_BINARY_DIR} --target install - COMMAND ${CMAKE_COMMAND} ${CMAKE_BINARY_DIR} -DCMAKE_INSTALL_PREFIX=${TMP_INSTALL_PREFIX} -DBUILD_EXTRA_PLUGINS=ON - COMMAND ${CMAKE_COMMAND} --build ${CMAKE_BINARY_DIR} --target u2spewfoo - COMMAND ${CMAKE_COMMAND} -E touch_nocreate ${TEST_INSTALL_DIRECTORY}/bin/snort - DEPENDS snort - COMMENT "Building extra plugins using installed Snort" - WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} - ) - add_custom_target(install_snort DEPENDS "${TEST_INSTALL_DIRECTORY}/bin/snort") - - - # set in Macro above - foreach (lib ${BUILT_PLUGINS}) - add_dependencies(${lib} install_snort) - endforeach(lib) -endif (BUILD_EXTRA_PLUGINS) diff --git a/extra/src/Makefile.am b/extra/src/Makefile.am deleted file mode 100644 index 5fed5eafe..000000000 --- a/extra/src/Makefile.am +++ /dev/null @@ -1,12 +0,0 @@ - -SUBDIRS = \ -codecs \ -daqs \ -inspectors \ -ips_options \ -loggers \ -search_engines \ -so_rules - -AM_CXXFLAGS = @AM_CXXFLAGS@ - diff --git a/extra/src/codecs/CMakeLists.txt b/extra/src/codecs/CMakeLists.txt deleted file mode 100644 index 0ef7941d1..000000000 --- a/extra/src/codecs/CMakeLists.txt +++ /dev/null @@ -1,14 +0,0 @@ - -add_example_library(cd_eapol codecs cd_eapol.cc) -add_example_library(cd_i4l_rawip codecs cd_i4l_rawip.cc) -add_example_library(cd_linux_sll codecs cd_linux_sll.cc) -add_example_library(cd_null codecs cd_null.cc) -add_example_library(cd_pflog codecs cd_pflog.cc) -add_example_library(cd_pim codecs cd_pim.cc) -add_example_library(cd_ppp codecs cd_ppp.cc) -add_example_library(cd_raw4 codecs cd_raw4.cc) -add_example_library(cd_raw6 codecs cd_raw6.cc) -add_example_library(cd_slip codecs cd_slip.cc) -add_example_library(cd_token_ring codecs cd_token_ring.cc) -add_example_library(cd_wlan codecs cd_wlan.cc) - diff --git a/extra/src/codecs/Makefile.am b/extra/src/codecs/Makefile.am deleted file mode 100644 index 44c777ed6..000000000 --- a/extra/src/codecs/Makefile.am +++ /dev/null @@ -1,65 +0,0 @@ - -cdlibdir = $(pkglibdir)/codecs - -cdlib_LTLIBRARIES = libcd_eapol.la -libcd_eapol_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_eapol_la_LDFLAGS = -export-dynamic -shared -libcd_eapol_la_SOURCES = cd_eapol.cc - -cdlib_LTLIBRARIES += libcd_i4l_rawip.la -libcd_i4l_rawip_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_i4l_rawip_la_LDFLAGS = -export-dynamic -shared -libcd_i4l_rawip_la_SOURCES = cd_i4l_rawip.cc - -cdlib_LTLIBRARIES += libcd_linux_sll.la -libcd_linux_sll_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_linux_sll_la_LDFLAGS = -export-dynamic -shared -libcd_linux_sll_la_SOURCES = cd_linux_sll.cc - -cdlib_LTLIBRARIES += libcd_null.la -libcd_null_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_null_la_LDFLAGS = -export-dynamic -shared -libcd_null_la_SOURCES = cd_null.cc - -cdlib_LTLIBRARIES += libcd_pflog.la -libcd_pflog_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_pflog_la_LDFLAGS = -export-dynamic -shared -libcd_pflog_la_SOURCES = cd_pflog.cc - -cdlib_LTLIBRARIES += libcd_pim.la -libcd_pim_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_pim_la_LDFLAGS = -export-dynamic -shared -libcd_pim_la_SOURCES = cd_pim.cc - -cdlib_LTLIBRARIES += libcd_ppp.la -libcd_ppp_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_ppp_la_LDFLAGS = -export-dynamic -shared -libcd_ppp_la_SOURCES = cd_ppp.cc - -cdlib_LTLIBRARIES += libcd_raw4.la -libcd_raw4_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_raw4_la_LDFLAGS = -export-dynamic -shared -libcd_raw4_la_SOURCES = cd_raw4.cc - -cdlib_LTLIBRARIES += libcd_raw6.la -libcd_raw6_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_raw6_la_LDFLAGS = -export-dynamic -shared -libcd_raw6_la_SOURCES = cd_raw6.cc - -cdlib_LTLIBRARIES += libcd_slip.la -libcd_slip_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_slip_la_LDFLAGS = -export-dynamic -shared -libcd_slip_la_SOURCES = cd_slip.cc - -cdlib_LTLIBRARIES += libcd_token_ring.la -libcd_token_ring_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_token_ring_la_LDFLAGS = -export-dynamic -shared -libcd_token_ring_la_SOURCES = cd_token_ring.cc - -cdlib_LTLIBRARIES += libcd_wlan.la -libcd_wlan_la_CXXFLAGS = $(AM_CXXFLAGS) -libcd_wlan_la_LDFLAGS = -export-dynamic -shared -libcd_wlan_la_SOURCES = cd_wlan.cc - -AM_CXXFLAGS = @AM_CXXFLAGS@ - diff --git a/extra/src/codecs/cd_eapol.cc b/extra/src/codecs/cd_eapol.cc deleted file mode 100644 index a26e61fd0..000000000 --- a/extra/src/codecs/cd_eapol.cc +++ /dev/null @@ -1,152 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_eapol.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "framework/codec.h" -#include "codecs/codec_module.h" -#include "protocols/protocol_ids.h" -#include "protocols/eapol.h" - -#define CD_EAPOL_NAME "eapol" -#define CD_EAPOL_HELP "support for extensible authentication protocol over LAN" - -namespace -{ -static const RuleMap eapol_rules[] = -{ - { DECODE_EAPOL_TRUNCATED, "truncated EAP header" }, - { DECODE_EAPKEY_TRUNCATED, "EAP key truncated" }, - { DECODE_EAP_TRUNCATED, "EAP header truncated" }, - { 0, nullptr } -}; - -class EapolModule : public CodecModule -{ -public: - EapolModule() : CodecModule(CD_EAPOL_NAME, CD_EAPOL_HELP) { } - - const RuleMap* get_rules() const override - { return eapol_rules; } -}; - -class EapolCodec : public Codec -{ -public: - EapolCodec() : Codec(CD_EAPOL_NAME) { } - ~EapolCodec() { } - - bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_protocol_ids(std::vector&) override; - -private: - void DecodeEAP(const RawData&, const CodecData&); - void DecodeEapolKey(const RawData&, const CodecData&); -}; -} // namespace - -void EapolCodec::get_protocol_ids(std::vector& v) -{ v.push_back(ProtocolId::ETHERTYPE_EAPOL); } - -void EapolCodec::DecodeEAP(const RawData& raw, const CodecData& codec) -{ - if (raw.len < sizeof(eapol::EAPHdr)) - codec_event(codec, DECODE_EAP_TRUNCATED); -} - -void EapolCodec::DecodeEapolKey(const RawData& raw, const CodecData& codec) -{ - if (raw.len < sizeof(eapol::EapolKey)) - codec_event(codec, DECODE_EAPKEY_TRUNCATED); -} - -/************************************************* - ************** main codec functions ************ - *************************************************/ - -bool EapolCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) -{ - const eapol::EtherEapol* const eplh = - reinterpret_cast(raw.data); - - if (raw.len < sizeof(eapol::EtherEapol)) - { - codec_event(codec, DECODE_EAPOL_TRUNCATED); - return false; - } - - if (eplh->eaptype == EAPOL_TYPE_EAP) - DecodeEAP(raw, codec); - - else if (eplh->eaptype == EAPOL_TYPE_KEY) - DecodeEapolKey(raw, codec); - - return true; -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ return new EapolModule; } - -static void mod_dtor(Module* m) -{ delete m; } - -static Codec* ctor(Module*) -{ return new EapolCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi eapol_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - CD_EAPOL_NAME, - CD_EAPOL_HELP, - mod_ctor, - mod_dtor, - }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, // ctor - dtor, // dtor -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &eapol_api.base, - nullptr -}; -#else -const BaseApi* cd_eapol = &eapol_api.base; -#endif - diff --git a/extra/src/codecs/cd_i4l_rawip.cc b/extra/src/codecs/cd_i4l_rawip.cc deleted file mode 100644 index 1c862944c..000000000 --- a/extra/src/codecs/cd_i4l_rawip.cc +++ /dev/null @@ -1,109 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_i4l_rawip.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include "framework/codec.h" - -#define I4L_RAWIP_NAME "i4l_rawip" -#define I4L_RAWIP_HELP_STR "support for I4L IP" - -#ifdef DLT_I4L_RAWIP -#define I4L_RAWIP_HELP ADD_DLT(I4L_RAWIP_HELP_STR, DLT_I4L_RAWIP) -#else -#define I4L_RAWIP_HELP I4L_RAWIP_HELP_STR -#endif - -namespace -{ -class I4LRawIpCodec : public Codec -{ -public: - I4LRawIpCodec() : Codec(I4L_RAWIP_NAME) { } - ~I4LRawIpCodec() { } - - void get_data_link_type(std::vector&) override; - bool decode(const RawData&, CodecData&, DecodeData&) override; -}; -} // namespace - -void I4LRawIpCodec::get_data_link_type(std::vector& v) -{ -#ifdef DLT_I4L_RAWIP - v.push_back(DLT_I4L_RAWIP); -#else - UNUSED(v); -#endif -} - -bool I4LRawIpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) -{ - if (raw.len < 2) - return false; - - codec.lyr_len = 2; - codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4; - return true; -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new I4LRawIpCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi i4l_rawip_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - I4L_RAWIP_NAME, - I4L_RAWIP_HELP, - nullptr, // mod_ctor - nullptr // mod_dtor - }, - nullptr, // ginit - nullptr, // gterm - nullptr, // tinit - nullptr, // tterm - ctor, - dtor, -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &i4l_rawip_api.base, - nullptr -}; -#else -const BaseApi* cd_i4l_rawip = &i4l_rawip_api.base; -#endif - diff --git a/extra/src/codecs/cd_linux_sll.cc b/extra/src/codecs/cd_linux_sll.cc deleted file mode 100644 index af92cbdb1..000000000 --- a/extra/src/codecs/cd_linux_sll.cc +++ /dev/null @@ -1,108 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_linux_sll.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include "framework/codec.h" -#include "protocols/linux_sll.h" - -#define CD_LINUX_SLL_NAME "linux_sll" -#define CD_LINUX_SLL_HELP_STR "support for Linux SLL" -#define CD_LINUX_SLL_HELP ADD_DLT(CD_LINUX_SLL_HELP_STR, DLT_LINUX_SLL) - -namespace -{ -class LinuxSllCodec : public Codec -{ -public: - LinuxSllCodec() : Codec(CD_LINUX_SLL_NAME) { } - ~LinuxSllCodec() { } - - void get_data_link_type(std::vector&) override; - bool decode(const RawData&, CodecData&, DecodeData&) override; -}; -} // namespace - -void LinuxSllCodec::get_data_link_type(std::vector& v) -{ -#ifdef DLT_LINUX_SLL - v.push_back(DLT_LINUX_SLL); -#endif -} - -bool LinuxSllCodec::decode(const RawData& raw, CodecData& data, DecodeData&) -{ - /* do a little validation */ - if (raw.len < linux_sll::SLL_HDR_LEN) - return false; - - /* lay the ethernet structure over the packet data */ - const linux_sll::SLLHdr* const sllh = reinterpret_cast(raw.data); - - /* grab out the network type */ - data.next_prot_id = (ProtocolId)ntohs(sllh->sll_protocol); - data.lyr_len = linux_sll::SLL_HDR_LEN; - return true; -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new LinuxSllCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi linux_ssl_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - CD_LINUX_SLL_NAME, - CD_LINUX_SLL_HELP, - nullptr, - nullptr, - }, - nullptr, - nullptr, - nullptr, - nullptr, - ctor, - dtor, -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &linux_ssl_api.base, - nullptr -}; -#else -const BaseApi* cd_linux_sll = &linux_ssl_api.base; -#endif - diff --git a/extra/src/codecs/cd_null.cc b/extra/src/codecs/cd_null.cc deleted file mode 100644 index 6cc6e48e9..000000000 --- a/extra/src/codecs/cd_null.cc +++ /dev/null @@ -1,102 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_null.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include - -#include "framework/codec.h" -#include "protocols/protocol_ids.h" - -#define CD_NULL_NAME "null" -#define CD_NULL_HELP_STR "support for null encapsulation" -#define CD_NULL_HELP ADD_DLT(CD_NULL_HELP_STR, DLT_NULL) - -namespace -{ -class NullCodec : public Codec -{ -public: - NullCodec() : Codec(CD_NULL_NAME) { } - ~NullCodec() { } - - bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_data_link_type(std::vector&) override; -}; -} // namespace - -static const uint16_t NULL_HDRLEN = 4; - -bool NullCodec::decode(const RawData& raw, CodecData& data, DecodeData&) -{ - if (raw.len < NULL_HDRLEN) - return false; - - data.lyr_len = NULL_HDRLEN; - data.next_prot_id = ProtocolId::ETHERTYPE_IPV4; - return true; -} - -void NullCodec::get_data_link_type(std::vector& v) -{ v.push_back(DLT_NULL); } - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new NullCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi null_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - CD_NULL_NAME, - CD_NULL_HELP, - nullptr, - nullptr, - }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, // ctor - dtor, // dtor -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &null_api.base, - nullptr -}; -#else -const BaseApi* cd_null = &null_api.base; -#endif - diff --git a/extra/src/codecs/cd_pflog.cc b/extra/src/codecs/cd_pflog.cc deleted file mode 100644 index 8c8491422..000000000 --- a/extra/src/codecs/cd_pflog.cc +++ /dev/null @@ -1,273 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2002-2013 Sourcefire, Inc. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include "framework/codec.h" - -#ifndef DLT_PFLOG -#define DLT_PFLOG 117 -#endif - -#define PFLOG_NAME "pflog" -#define PFLOG_HELP_STR "support for OpenBSD PF log" - -#define PFLOG_HELP ADD_DLT(PFLOG_HELP_STR, DLT_PFLOG) - -namespace -{ -/* - * Snort supports 3 versions of the OpenBSD pflog header: - * - * Pflog1_Hdr: CVS = 1.3, DLT_OLD_PFLOG = 17, Length = 28 - * Pflog2_Hdr: CVS = 1.8, DLT_PFLOG = 117, Length = 48 - * Pflog3_Hdr: CVS = 1.12, DLT_PFLOG = 117, Length = 64 - * Pflog3_Hdr: CVS = 1.172, DLT_PFLOG = 117, Length = 100 - * - * Since they have the same DLT, Pflog{2,3}Hdr are distinguished - * by their actual length. The minimum required length excludes - * padding. - */ -/* Old OpenBSD pf firewall pflog0 header - * (information from pf source in kernel) - * the rule, reason, and action codes tell why the firewall dropped it -fleck - */ - -class PflogCodec : public Codec -{ -public: - PflogCodec() : Codec(PFLOG_NAME) { } - ~PflogCodec() { } - - bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_data_link_type(std::vector&) override; -}; - -struct Pflog1Hdr -{ - uint32_t af; - char intf[IFNAMSIZ]; - int16_t rule; - uint16_t reason; - uint16_t action; - uint16_t dir; -}; - -#define PFLOG1_HDRLEN (sizeof(struct _Pflog1_hdr)) - -/* - * Note that on OpenBSD, af type is sa_family_t. On Linux, that's an unsigned - * short, but on OpenBSD, that's a uint8_t, so we should explicitly use uint8_t - * here. - ronaldo - */ - -#define PFLOG_RULELEN 16 -#define PFLOG_PADLEN 3 - -struct Pflog2Hdr -{ - int8_t length; - uint8_t af; - uint8_t action; - uint8_t reason; - char ifname[IFNAMSIZ]; - char ruleset[PFLOG_RULELEN]; - uint32_t rulenr; - uint32_t subrulenr; - uint8_t dir; - uint8_t pad[PFLOG_PADLEN]; -}; - -#define PFLOG2_HDRLEN (sizeof(Pflog2Hdr)) -#define PFLOG2_HDRMIN (PFLOG2_HDRLEN - PFLOG_PADLEN) - -struct Pflog3Hdr -{ - int8_t length; - uint8_t af; - uint8_t action; - uint8_t reason; - char ifname[IFNAMSIZ]; - char ruleset[PFLOG_RULELEN]; - uint32_t rulenr; - uint32_t subrulenr; - uint32_t uid; - uint32_t pid; - uint32_t rule_uid; - uint32_t rule_pid; - uint8_t dir; - uint8_t pad[PFLOG_PADLEN]; -}; - -#define PFLOG3_HDRLEN (sizeof(Pflog3Hdr)) -#define PFLOG3_HDRMIN (PFLOG3_HDRLEN - PFLOG_PADLEN) - -struct Pflog4Hdr -{ - uint8_t length; - uint8_t af; - uint8_t action; - uint8_t reason; - char ifname[IFNAMSIZ]; - char ruleset[PFLOG_RULELEN]; - uint32_t rulenr; - uint32_t subrulenr; - uint32_t uid; - uint32_t pid; - uint32_t rule_uid; - uint32_t rule_pid; - uint8_t dir; - uint8_t rewritten; - uint8_t pad[2]; - uint8_t saddr[16]; - uint8_t daddr[16]; - uint16_t sport; - uint16_t dport; -}; - -#define PFLOG4_HDRLEN sizeof(struct Pflog4Hdr) -#define PFLOG4_HDRMIN sizeof(struct Pflog4Hdr) -} // namespace - -void PflogCodec::get_data_link_type(std::vector& v) -{ v.push_back(DLT_PFLOG); } - -bool PflogCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) -{ - const uint32_t cap_len = raw.len; - uint8_t af, pflen; - uint32_t hlen; - uint32_t padlen = PFLOG_PADLEN; - - if (cap_len < PFLOG2_HDRMIN) - return false; - - /* lay the pf header structure over the packet data */ - switch (*((uint8_t*)raw.data)) - { - case PFLOG2_HDRMIN: - { - const Pflog2Hdr* const pf2h = - reinterpret_cast(raw.data); - pflen = pf2h->length; - hlen = PFLOG2_HDRLEN; - af = pf2h->af; - break; - } - case PFLOG3_HDRMIN: - { - const Pflog3Hdr* const pf3h = - reinterpret_cast(raw.data); - pflen = pf3h->length; - hlen = PFLOG3_HDRLEN; - af = pf3h->af; - break; - } - case PFLOG4_HDRMIN: - { - const Pflog4Hdr* const pf4h = - reinterpret_cast(raw.data); - pflen = pf4h->length; - hlen = PFLOG4_HDRLEN; - af = pf4h->af; - padlen = sizeof(pf4h->pad); - break; - } - default: - return false; - } - - /* now that we know a little more, do a little more validation */ - if (cap_len < hlen) - return false; - - /* note that the pflen may exclude the padding which is always present */ - if (pflen < hlen - padlen || pflen > hlen) - return false; - - /* check the network type - should only be AF_INET or AF_INET6 */ - switch (af) - { - case AF_INET: /* IPv4 */ - codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4; - break; - -#if defined(AF_INET6) - case AF_INET6: /* IPv6 */ - codec.next_prot_id = ProtocolId::ETHERTYPE_IPV6; - break; -#endif - - default: - /* FIXIT-L add decoder drop event for unknown pflog network type - * To my knowledge, pflog devices can only - * pass IP and IP6 packets. -fleck - */ - break; - } - - codec.lyr_len = hlen; - return true; -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new PflogCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi pflog_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - PFLOG_NAME, - PFLOG_HELP, - nullptr, // mod_ctor - nullptr // mod_dtor - }, - nullptr, // ginit - nullptr, // gterm - nullptr, // tinit - nullptr, // tterm - ctor, - dtor, -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &pflog_api.base, - nullptr -}; -#else -const BaseApi* cd_pflog = &pflog_api.base; -#endif - diff --git a/extra/src/codecs/cd_pim.cc b/extra/src/codecs/cd_pim.cc deleted file mode 100644 index 8849f1ca2..000000000 --- a/extra/src/codecs/cd_pim.cc +++ /dev/null @@ -1,98 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2002-2013 Sourcefire, Inc. -// Copyright (C) 1998-2002 Martin Roesch -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -// cd_pim.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "framework/codec.h" -#include "framework/decode_data.h" -#include "codecs/codec_module.h" - -namespace -{ -// yes, macros are necessary. The API and class constructor require different strings. -#define CD_PIM_NAME "pim" -#define CD_PIM_HELP "support for protocol independent multicast" - -class PimCodec : public Codec -{ -public: - PimCodec() : Codec(CD_PIM_NAME) { } - ~PimCodec() { } - - void get_protocol_ids(std::vector&) override; - bool decode(const RawData&, CodecData&, DecodeData&) override; -}; - -const uint16_t IPPROTO_ID_PIM = 103; -} // namespace - -void PimCodec::get_protocol_ids(std::vector& v) -{ - v.push_back(static_cast(IPPROTO_ID_PIM)); -} - -bool PimCodec::decode(const RawData&, CodecData& codec, DecodeData&) -{ - codec_event(codec, DECODE_IP_BAD_PROTO); - return true; -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new PimCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi pim_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - CD_PIM_NAME, - CD_PIM_HELP, - nullptr, - nullptr - }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, - dtor, -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &pim_api.base, - nullptr -}; - diff --git a/extra/src/codecs/cd_ppp.cc b/extra/src/codecs/cd_ppp.cc deleted file mode 100644 index df44b4632..000000000 --- a/extra/src/codecs/cd_ppp.cc +++ /dev/null @@ -1,112 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_ppp.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include "framework/codec.h" - -#define PPP_NAME "ppp" -#define PPP_HELP_STR "support for point-to-point encapsulation" -#define PPP_HELP ADD_DLT(PPP_HELP_STR, DLT_PPP) - -namespace -{ -class PPPCodec : public Codec -{ -public: - PPPCodec() : Codec(PPP_NAME) { } - ~PPPCodec() { } - - bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_data_link_type(std::vector&) override; -}; -} // namespace - -#ifndef DLT_PPP -static constexpr int DLT_PPP = 9; -#endif - -static constexpr uint8_t CHDLC_ADDR_BROADCAST = 0xff; -static constexpr uint8_t CHDLC_CTRL_UNNUMBERED = 0x03; - -void PPPCodec::get_data_link_type(std::vector& v) -{ v.push_back(DLT_PPP); } - -bool PPPCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) -{ - if (raw.len < 2) - return false; - - if (raw.data[0] == CHDLC_ADDR_BROADCAST && raw.data[1] == CHDLC_CTRL_UNNUMBERED) - { - /* - * Check for full HDLC header (rfc1662 section 3.2) - */ - codec.lyr_len = 2; - } - - codec.next_prot_id = ProtocolId::ETHERTYPE_PPP; - return true; -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new PPPCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi ppp_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - PPP_NAME, - PPP_HELP, - nullptr, // mod_ctor - nullptr, // mod_dtor - }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, - dtor, -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &ppp_api.base, - nullptr -}; -#else -const BaseApi* cd_ppp = &ppp_api.base; -#endif - diff --git a/extra/src/codecs/cd_raw4.cc b/extra/src/codecs/cd_raw4.cc deleted file mode 100644 index 362272124..000000000 --- a/extra/src/codecs/cd_raw4.cc +++ /dev/null @@ -1,99 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_raw4.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include - -#include "framework/codec.h" -#include "protocols/protocol_ids.h" - -#define CD_RAW4_NAME "raw4" -#define CD_RAW4_HELP_STR "support for unencapsulated IPv4" -#define CD_RAW4_HELP ADD_DLT(ADD_DLT(CD_RAW4_HELP_STR, DLT_RAW), DLT_IPV4) - -namespace -{ -class Raw4Codec : public Codec -{ -public: - Raw4Codec() : Codec(CD_RAW4_NAME) { } - ~Raw4Codec() { } - - bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_data_link_type(std::vector&) override; -}; -} // namespace - -bool Raw4Codec::decode(const RawData&, CodecData& data, DecodeData&) -{ - data.next_prot_id = ProtocolId::ETHERTYPE_IPV4; - return true; -} - -void Raw4Codec::get_data_link_type(std::vector& v) -{ - v.push_back(DLT_RAW); - v.push_back(DLT_IPV4); -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new Raw4Codec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi raw4_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - CD_RAW4_NAME, - CD_RAW4_HELP, - nullptr, - nullptr, - }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, // ctor - dtor, // dtor -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &raw4_api.base, - nullptr -}; -#else -const BaseApi* cd_raw4 = &raw4_api.base; -#endif - diff --git a/extra/src/codecs/cd_raw6.cc b/extra/src/codecs/cd_raw6.cc deleted file mode 100644 index f6357ab60..000000000 --- a/extra/src/codecs/cd_raw6.cc +++ /dev/null @@ -1,96 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_raw6.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include - -#include "framework/codec.h" -#include "protocols/protocol_ids.h" - -#define CD_RAW6_NAME "raw6" -#define CD_RAW6_HELP_STR "support for unencapsulated IPv6" -#define CD_RAW6_HELP ADD_DLT(CD_RAW6_HELP_STR, DLT_IPV6) - -namespace -{ -class Raw6Codec : public Codec -{ -public: - Raw6Codec() : Codec(CD_RAW6_NAME) { } - ~Raw6Codec() { } - - bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_data_link_type(std::vector&) override; -}; -} // namespace - -bool Raw6Codec::decode(const RawData&, CodecData& data, DecodeData&) -{ - data.next_prot_id = ProtocolId::ETHERTYPE_IPV6; - return true; -} - -void Raw6Codec::get_data_link_type(std::vector& v) -{ v.push_back(DLT_IPV6); } - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new Raw6Codec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi raw6_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - CD_RAW6_NAME, - CD_RAW6_HELP, - nullptr, - nullptr, - }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, // ctor - dtor, // dtor -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &raw6_api.base, - nullptr -}; -#else -const BaseApi* cd_raw6 = &raw6_api.base; -#endif - diff --git a/extra/src/codecs/cd_slip.cc b/extra/src/codecs/cd_slip.cc deleted file mode 100644 index e92bcbc60..000000000 --- a/extra/src/codecs/cd_slip.cc +++ /dev/null @@ -1,103 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_sip.cc author Josh Rosenbaum - -#include -#include -#include "framework/codec.h" -#include "protocols/protocol_ids.h" - -#define CD_SLIP_NAME "slip" -#define CD_SLIP_HELP_STR "support for slip protocol" -#define CD_SLIP_HELP ADD_DLT(CD_SLIP_HELP_STR, DLT_SLIP) - -const uint16_t SLIP_HEADER_LEN = 16; - -namespace -{ -class SlipCodec : public Codec -{ -public: - SlipCodec() : Codec(CD_SLIP_NAME) { } - ~SlipCodec() { } - - bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_data_link_type(std::vector&) override; -}; -} // namespace - -void SlipCodec::get_data_link_type(std::vector& v) -{ -#if DLT_SLIP - v.push_back(DLT_SLIP); -#endif -} - -bool SlipCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) -{ - if (raw.len < SLIP_HEADER_LEN) - return false; - - // set the fields which will be sent back to the packet manager - codec.lyr_len = SLIP_HEADER_LEN; - codec.next_prot_id = ProtocolId::ETHERTYPE_IPV4; - return true; -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Codec* ctor(Module*) -{ return new SlipCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi slip_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - CD_SLIP_NAME, - CD_SLIP_HELP, - nullptr, - nullptr - }, - nullptr, - nullptr, - nullptr, - nullptr, - ctor, - dtor -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &slip_api.base, - nullptr -}; -#else -const BaseApi* cd_slip = &slip_api.base; -#endif - diff --git a/extra/src/codecs/cd_token_ring.cc b/extra/src/codecs/cd_token_ring.cc deleted file mode 100644 index f18cd02f9..000000000 --- a/extra/src/codecs/cd_token_ring.cc +++ /dev/null @@ -1,230 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2002-2013 Sourcefire, Inc. -// Copyright (C) 1998-2002 Martin Roesch -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// token_ring.h author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include "protocols/token_ring.h" -#include "framework/codec.h" -#include "codecs/codec_module.h" - -#ifdef DLT_IEEE802 - -namespace -{ -#define TR_NAME "token_ring" -#define TR_HELP "support for token ring decoding" - -static const RuleMap tkr_rules[] = -{ - { DECODE_BAD_TRH, "(" TR_NAME ") Bad Token Ring Header" }, - { DECODE_BAD_TR_ETHLLC, "(" TR_NAME ") Bad Token Ring ETHLLC Header" }, - { DECODE_BAD_TR_MR_LEN, "(" TR_NAME ") Bad Token Ring MRLENHeader" }, - { DECODE_BAD_TRHMR, "(" TR_NAME ") Bad Token Ring MR Header" }, - { 0, nullptr } -}; - -class TrCodecModule : public CodecModule -{ -public: - TrCodecModule() : CodecModule(TR_NAME, TR_HELP) { } - - const RuleMap* get_rules() const override - { return tkr_rules; } -}; - -class TrCodec : public Codec -{ -public: - TrCodec() : Codec(TR_NAME) { } - ~TrCodec() { } - - void get_data_link_type(std::vector&) override; - bool decode(const RawData&, CodecData&, DecodeData&) override; -}; - -// THESE ARE NEVER USED!! -#define MINIMAL_TOKENRING_HEADER_LEN 22 -#define TR_HLEN MINIMAL_TOKENRING_HEADER_LEN -#define TOKENRING_LLC_LEN 8 -// DELETE FIN - -#define TR_ALEN 6 /* octets in an Ethernet header */ - -#define AC 0x10 -#define LLC_FRAME 0x40 - -#define TRMTU 2000 /* 2000 bytes */ -#define TR_RII 0x80 -#define TR_RCF_DIR_BIT 0x80 -#define TR_RCF_LEN_MASK 0x1f00 -#define TR_RCF_BROADCAST 0x8000 /* all-routes broadcast */ -#define TR_RCF_LIMITED_BROADCAST 0xC000 /* single-route broadcast */ -#define TR_RCF_FRAME2K 0x20 -#define TR_RCF_BROADCAST_MASK 0xC000 -} // namespace - -void TrCodec::get_data_link_type(std::vector& v) -{ - v.push_back(DLT_IEEE802); -} - -//void DecodeTRPkt(Packet * p, const DAQ_PktHdr_t * pkthdr, const uint8_t * pkt) -bool TrCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) -{ - const uint32_t cap_len = raw.len; - uint32_t dataoff; /* data offset is variable here */ - - if (cap_len < sizeof(token_ring::Trh_hdr)) - { - codec_event(codec, DECODE_BAD_TRH); - return false; - } - - /* lay the tokenring header structure over the packet data */ - //const token_ring::Trh_hdr *trh = reinterpret_cast(raw_pkt); - - /* - * according to rfc 1042: - * - * The presence of a Routing Information Field is indicated by the Most - * Significant Bit (MSB) of the source address, called the Routing - * Information Indicator (RII). If the RII equals zero, a RIF is - * not present. If the RII equals 1, the RIF is present. - * .. - * However the MSB is already zeroed by this moment, so there's no - * real way to figure out whether RIF is presented in packet, so we are - * doing some tricks to find IPARP signature.. - */ - - /* - * first I assume that we have single-ring network with no RIF - * information presented in frame - */ - if (cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc))) - { - codec_event(codec, DECODE_BAD_TR_ETHLLC); - return false; - } - - const token_ring::Trh_llc* trhllc = - reinterpret_cast(raw.data + sizeof(token_ring::Trh_hdr)); - - if (trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP) - { - /* - * DSAP != SSAP != 0xAA .. either we are having frame which doesn't - * carry IP datagrams or has RIF information present. We assume - * lattest ... - */ - - if (cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + - sizeof(token_ring::Trh_mr))) - { - codec_event(codec, DECODE_BAD_TRHMR); - return false; - } - - const token_ring::Trh_mr* const trhmr = - reinterpret_cast(raw.data + sizeof(token_ring::Trh_hdr)); - - if (cap_len < (sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc) + - sizeof(token_ring::Trh_mr) + TRH_MR_LEN(trhmr))) - { - codec_event(codec, DECODE_BAD_TR_MR_LEN); - return false; - } - - dataoff = sizeof(token_ring::Trh_hdr) + TRH_MR_LEN(trhmr) + sizeof(token_ring::Trh_llc); - } - else - { - dataoff = sizeof(token_ring::Trh_hdr) + sizeof(token_ring::Trh_llc); - } - - /* - * ideally we would need to check both SSAP, DSAP, and protoid fields: IP - * datagrams and ARP requests and replies are transmitted in standard - * 802.2 LLC Type 1 Unnumbered Information format, control code 3, with - * the DSAP and the SSAP fields of the 802.2 header set to 170, the - * assigned global SAP value for SNAP [6]. The 24-bit Organization Code - * in the SNAP is zero, and the remaining 16 bits are the EtherType from - * Assigned Numbers [7] (IP = 2048, ARP = 2054). .. but we would check - * SSAP and DSAP and assume this would be enough to trust. - */ - if (trhllc->dsap != IPARP_SAP && trhllc->ssap != IPARP_SAP) - { - return false; - } - - codec.lyr_len = dataoff; - codec.next_prot_id = trhllc->ethertype(); - return true; -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ return new TrCodecModule; } - -static void mod_dtor(Module* m) -{ delete m; } - -static Codec* ctor(Module*) -{ return new TrCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi tr_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - TR_NAME, - TR_HELP, - mod_ctor, - mod_dtor - }, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, - dtor, -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &tr_api.base, - nullptr -}; - -#endif - diff --git a/extra/src/codecs/cd_wlan.cc b/extra/src/codecs/cd_wlan.cc deleted file mode 100644 index b15d4498f..000000000 --- a/extra/src/codecs/cd_wlan.cc +++ /dev/null @@ -1,206 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2002-2013 Sourcefire, Inc. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// cd_wlan.cc author Josh Rosenbaum - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include "protocols/wlan.h" -#include "framework/codec.h" -#include "codecs/codec_module.h" -#include "protocols/protocol_ids.h" -#include "log/text_log.h" - -#ifndef DLT_IEEE802_11 -#define DLT_IEEE802_11 105 -#endif - -#define CD_WLAN_NAME "wlan" -#define CD_WLAN_HELP_STR "support for wireless local area network protocol" -#define CD_WLAN_HELP ADD_DLT(CD_WLAN_HELP_STR, DLT_IEEE802_11) - -namespace -{ -static const RuleMap wlan_rules[] = -{ - { DECODE_BAD_80211_ETHLLC, "bad 802.11 LLC header" }, - { DECODE_BAD_80211_OTHER, "bad 802.11 extra LLC info" }, - { 0, nullptr } -}; - -class WlanCodecModule : public CodecModule -{ -public: - WlanCodecModule() : CodecModule(CD_WLAN_NAME, CD_WLAN_HELP) { } - - const RuleMap* get_rules() const - { return wlan_rules; } -}; - -class WlanCodec : public Codec -{ -public: - WlanCodec() : Codec(CD_WLAN_NAME) { } - ~WlanCodec() { } - - bool decode(const RawData&, CodecData&, DecodeData&) override; - void get_data_link_type(std::vector&) override; - void get_protocol_ids(std::vector& v) override; - void log(TextLog* const, const uint8_t* pkt, const uint16_t len) override; -}; - -#define MINIMAL_IEEE80211_HEADER_LEN 10 /* Ack frames and others */ -#define IEEE802_11_DATA_HDR_LEN 24 /* Header for data packets */ -} // namespace - -void WlanCodec::get_data_link_type(std::vector& v) -{ v.push_back(DLT_IEEE802_11); } - -void WlanCodec::get_protocol_ids(std::vector& v) -{ v.push_back(ProtocolId::ETHERNET_802_11); } - -bool WlanCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) -{ - if (raw.len < MINIMAL_IEEE80211_HEADER_LEN) - return false; - - /* lay the wireless structure over the packet data */ - const wlan::WifiHdr* wifih = reinterpret_cast(raw.data); - - /* determine frame type */ - switch (wifih->frame_control & 0x00ff) - { - /* management frames */ - case WLAN_TYPE_MGMT_ASREQ: - case WLAN_TYPE_MGMT_ASRES: - case WLAN_TYPE_MGMT_REREQ: - case WLAN_TYPE_MGMT_RERES: - case WLAN_TYPE_MGMT_PRREQ: - case WLAN_TYPE_MGMT_PRRES: - case WLAN_TYPE_MGMT_BEACON: - case WLAN_TYPE_MGMT_ATIM: - case WLAN_TYPE_MGMT_DIS: - case WLAN_TYPE_MGMT_AUTH: - case WLAN_TYPE_MGMT_DEAUTH: - break; - - /* Control frames */ - case WLAN_TYPE_CONT_PS: - case WLAN_TYPE_CONT_RTS: - case WLAN_TYPE_CONT_CTS: - case WLAN_TYPE_CONT_ACK: - case WLAN_TYPE_CONT_CFE: - case WLAN_TYPE_CONT_CFACK: - break; - /* Data packets without data */ - case WLAN_TYPE_DATA_NULL: - case WLAN_TYPE_DATA_CFACK: - case WLAN_TYPE_DATA_CFPL: - case WLAN_TYPE_DATA_ACKPL: - - break; - case WLAN_TYPE_DATA_DTCFACK: - case WLAN_TYPE_DATA_DTCFPL: - case WLAN_TYPE_DATA_DTACKPL: - case WLAN_TYPE_DATA_DATA: - { - codec.lyr_len = IEEE802_11_DATA_HDR_LEN; - codec.next_prot_id = ProtocolId::ETHERNET_LLC; - - break; - } - default: - break; - } - - return true; -} - -void WlanCodec::log(TextLog* const text_log, const uint8_t* raw_pkt, - const uint16_t /*lyr_len*/) -{ - const wlan::WifiHdr* wifih = reinterpret_cast(raw_pkt); - - /* src addr */ - TextLog_Print(text_log, "addr1(%02X:%02X:%02X:%02X:%02X:%02X) -> ", - wifih->addr1[0], wifih->addr1[1], wifih->addr1[2], - wifih->addr1[3], wifih->addr1[4], wifih->addr1[5]); - - /* dest addr */ - TextLog_Print(text_log, "%02X:%02X:%02X:%02X:%02X:%02X)", - wifih->addr2[0], wifih->addr2[1], wifih->addr2[2], - wifih->addr2[3], wifih->addr2[4], wifih->addr2[5]); - - TextLog_NewLine(text_log); - TextLog_Putc(text_log, '\t'); - TextLog_Print(text_log, "frame_control:%02x duration_id:%02x " - "seq_control:%02x", ntohs(wifih->frame_control), - ntohs(wifih->duration_id), ntohs(wifih->seq_control)); -} - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ return new WlanCodecModule; } - -static void mod_dtor(Module* m) -{ delete m; } - -static Codec* ctor(Module*) -{ return new WlanCodec(); } - -static void dtor(Codec* cd) -{ delete cd; } - -static const CodecApi wlan_api = -{ - { - PT_CODEC, - sizeof(CodecApi), - CDAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - CD_WLAN_NAME, - CD_WLAN_HELP, - mod_ctor, - mod_dtor - }, - nullptr, - nullptr, - nullptr, - nullptr, - ctor, - dtor, -}; - -#ifdef BUILDING_SO -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &wlan_api.base, - nullptr -}; -#else -const BaseApi* cd_wlan = &wlan_api.base; -#endif - diff --git a/extra/src/daqs/CMakeLists.txt b/extra/src/daqs/CMakeLists.txt deleted file mode 100644 index f9b11e1a1..000000000 --- a/extra/src/daqs/CMakeLists.txt +++ /dev/null @@ -1,3 +0,0 @@ - -add_example_library(daq_socket daqs daq_socket.c) - diff --git a/extra/src/daqs/Makefile.am b/extra/src/daqs/Makefile.am deleted file mode 100644 index 262b995cd..000000000 --- a/extra/src/daqs/Makefile.am +++ /dev/null @@ -1,8 +0,0 @@ - -daqlibdir = $(pkglibdir)/daqs - -daqlib_LTLIBRARIES = daq_socket.la -daq_socket_la_CFLAGS = -DBUILDING_SO -daq_socket_la_LDFLAGS = -module -export-dynamic -avoid-version -shared -daq_socket_la_SOURCES = daq_socket.c - diff --git a/extra/src/daqs/daq_socket.c b/extra/src/daqs/daq_socket.c deleted file mode 100644 index 89f4840d0..000000000 --- a/extra/src/daqs/daq_socket.c +++ /dev/null @@ -1,601 +0,0 @@ -/*-------------------------------------------------------------------------- -// Copyright (C) 2015-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -*/ -/* daq_socket.c author Russ Combs */ - -#include "daqs/daq_user.h" - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include -#include - -#include -#include -#include - -#include -#include -#include -#include - -#include -#include - -#define DAQ_MOD_VERSION 0 -#define DAQ_NAME "socket" -#define DAQ_TYPE (DAQ_TYPE_INTF_CAPABLE | DAQ_TYPE_INLINE_CAPABLE | DAQ_TYPE_MULTI_INSTANCE) -#define DEFAULT_PORT 8000 - -typedef struct { - int sock_a; // recv from b - int sock_b; // recv from a - int sock_c; // connect - - int use_a; - int port; - int passive; - int stop; - - unsigned timeout; - unsigned snaplen; - - struct sockaddr_in sin_a; - struct sockaddr_in sin_b; - - DAQ_UsrHdr_t pci; - - uint8_t* buf; - char error[DAQ_ERRBUF_SIZE]; - - DAQ_State state; - DAQ_Stats_t stats; -} SockImpl; - -//------------------------------------------------------------------------- -// socket functions -//------------------------------------------------------------------------- - -static int sock_setup(SockImpl* impl) -{ - struct sockaddr_in sin; - - if ( (impl->sock_c = socket(PF_INET, SOCK_STREAM, 0)) == -1 ) - { - DPE(impl->error, "%s: can't create listener socket (%s)\n", __func__, strerror(errno)); - return -1; - } - - sin.sin_family = PF_INET; - sin.sin_addr.s_addr = INADDR_ANY; - sin.sin_port = htons(impl->port); - - if ( bind(impl->sock_c, (struct sockaddr*)&sin, sizeof(sin)) == -1 ) - { - DPE(impl->error, "%s: can't bind listener socket (%s)\n", __func__, strerror(errno)); - return -1; - } - - if ( listen(impl->sock_c, 2) == -1 ) - { - DPE(impl->error, "%s: can't listen on socket (%s)\n", __func__, strerror(errno)); - return -1; - } - return 0; -} - -static void sock_cleanup(SockImpl* impl) -{ - if ( impl->sock_c >= 0 ) - close(impl->sock_c); - - if ( impl->sock_a >= 0 ) - close(impl->sock_a); - - if ( impl->sock_b >= 0 ) - close(impl->sock_b); - - impl->sock_c = impl->sock_a = impl->sock_b = -1; -} - -static int sock_recv(SockImpl* impl, int* sock) -{ - int n = recv(*sock, impl->buf, impl->snaplen, 0); - - if ( n <= 0 ) - { - if (errno != EINTR) - { - DPE(impl->error, "%s: can't recv from socket (%s)\n", __func__, strerror(errno)); - impl->pci.flags = DAQ_USR_FLAG_END_FLOW; - *sock = -1; - } - return 0; - } - return n; -} - -static int sock_send( - SockImpl* impl, int sock, const uint8_t* buf, uint32_t len) -{ - if ( sock < 0 ) - return 0; - - int n = send(sock, buf, len, 0); - - while ( 0 <= n && (uint32_t)n < len ) - { - buf += n; - len -= n; - n = send(sock, buf, len, 0); - } - if ( n == -1 ) - { - DPE(impl->error, "%s: can't send on socket (%s)\n", __func__, strerror(errno)); - return -1; - } - return 0; -} - -static int sock_accept(SockImpl* impl, int* sock, struct sockaddr_in* psin) -{ - const char* banner; - socklen_t len = sizeof(*psin); - *sock = accept(impl->sock_c, (struct sockaddr*)psin, &len); - - if ( *sock == -1 ) - { - DPE(impl->error, "%s: can't accept incoming connection (%s)\n", __func__, strerror(errno)); - return -1; - } - banner = impl->use_a ? "client\n" : "server\n"; - sock_send(impl, *sock, (const uint8_t*)banner, 7); - - impl->pci.flags = DAQ_USR_FLAG_START_FLOW; - return 0; -} - -static int sock_poll(SockImpl* impl, int* sock, struct sockaddr_in* psin) -{ - int max_fd; - fd_set inputs; - - if ( impl->sock_c < 0 ) - return 0; - - FD_ZERO(&inputs); - FD_SET(impl->sock_c, &inputs); - max_fd = impl->sock_c; - - if ( *sock > 0 ) - { - FD_SET(*sock, &inputs); - - if ( *sock > max_fd ) - max_fd = *sock; - } - - struct timeval timeout; - timeout.tv_sec = 1; - timeout.tv_usec = 0; - - if ( !select(max_fd+1, &inputs, NULL, NULL, &timeout) ) - return 0; - - else if ( *sock >= 0 && FD_ISSET(*sock, &inputs) ) - return sock_recv(impl, sock); - - else if ( *sock < 0 && FD_ISSET(impl->sock_c, &inputs) ) - return sock_accept(impl, sock, psin); - - return 0; -} - -//------------------------------------------------------------------------- -// daq utilities -//------------------------------------------------------------------------- - -static void clear(SockImpl* impl) -{ - if ( impl->sock_a < 0 ) - { - impl->sin_a.sin_addr.s_addr = 0; - impl->sin_a.sin_port = 0; - } - if ( impl->sock_b < 0 ) - { - impl->sin_b.sin_addr.s_addr = 0; - impl->sin_b.sin_port = 0; - } -} - -static void set_pkt_hdr(SockImpl* impl, DAQ_PktHdr_t* phdr, ssize_t len) -{ - struct timeval t; - gettimeofday(&t, NULL); - - phdr->ts.tv_sec = t.tv_sec; - phdr->ts.tv_usec = t.tv_usec; - phdr->caplen = len; - phdr->pktlen = len; - phdr->ingress_index = -1; - phdr->egress_index = -1; - phdr->ingress_group = -1; - phdr->egress_group = -1; - phdr->flags = 0; - phdr->address_space_id = 0; - phdr->opaque = 0; - - // use_a already toggled - if ( impl->use_a ) - { - impl->pci.src_addr = impl->sin_b.sin_addr.s_addr; - impl->pci.dst_addr = impl->sin_a.sin_addr.s_addr; - impl->pci.src_port = impl->sin_b.sin_port; - impl->pci.dst_port = impl->sin_a.sin_port; - impl->pci.flags &= ~DAQ_USR_FLAG_TO_SERVER; - } - else - { - impl->pci.src_addr = impl->sin_a.sin_addr.s_addr; - impl->pci.dst_addr = impl->sin_b.sin_addr.s_addr; - impl->pci.src_port = impl->sin_a.sin_port; - impl->pci.dst_port = impl->sin_b.sin_port; - impl->pci.flags |= DAQ_USR_FLAG_TO_SERVER; - } - - if ( impl->pci.flags & DAQ_USR_FLAG_END_FLOW ) - clear(impl); - - phdr->priv_ptr = &impl->pci; -} - -// forward all but drops, retries and blacklists: -static const int s_fwd[MAX_DAQ_VERDICT] = { 1, 0, 1, 1, 0, 1, 0 }; - -static int socket_daq_process( - SockImpl* impl, DAQ_Analysis_Func_t cb, void* user) -{ - DAQ_PktHdr_t hdr; - int* sock = impl->use_a ? &impl->sock_a : &impl->sock_b; - struct sockaddr_in* psin = impl->use_a ? &impl->sin_a : &impl->sin_b; - impl->pci.flags = 0; - - int n = sock_poll(impl, sock, psin); - - // don't toggle w/o at least one connection so client is always 1st - if ( impl->sock_a > -1 || impl->sock_b > -1 ) - impl->use_a = !impl->use_a; - - if ( n <= 0 && !impl->pci.flags ) - return n; - - set_pkt_hdr(impl, &hdr, n); - DAQ_Verdict verdict = cb(user, &hdr, impl->buf); - - if ( verdict >= MAX_DAQ_VERDICT ) - verdict = DAQ_VERDICT_BLOCK; - - impl->stats.verdicts[verdict]++; - - if ( impl->passive || s_fwd[verdict] ) - { - // already toggled use_a, so we get a->b or b->a - sock = impl->use_a ? &impl->sock_a : &impl->sock_b; - sock_send(impl, *sock, impl->buf, n); - } - return n; -} - -static int socket_daq_config ( - SockImpl* impl, const DAQ_Config_t* cfg, char* errBuf, size_t errMax) -{ - DAQ_Dict* entry; - - if ( cfg->name ) - { - char* end = NULL; - impl->port = (int)strtol(cfg->name, &end, 0); - } - for ( entry = cfg->values; entry; entry = entry->next) - { - if ( !entry->value || !*entry->value ) - { - snprintf(errBuf, errMax, "%s: variable needs value (%s)\n", __func__, entry->key); - return DAQ_ERROR; - } - else if ( !strcmp(entry->key, "port") ) - { - char* end = entry->value; - impl->port = (int)strtol(entry->value, &end, 0); - - if ( *end || impl->port <= 0 || impl->port > 65535 ) - { - snprintf(errBuf, errMax, "%s: bad port (%s)\n", __func__, entry->value); - return DAQ_ERROR; - } - } - else if ( !strcmp(entry->key, "proto") ) - { - if ( !strcmp(entry->value, "tcp") ) - impl->pci.ip_proto = IPPROTO_TCP; - - else if ( !strcmp(entry->value, "udp") ) - impl->pci.ip_proto = IPPROTO_UDP; - else - { - snprintf(errBuf, errMax, "%s: bad proto (%s)\n", __func__, entry->value); - return DAQ_ERROR; - } - } - else - { - snprintf(errBuf, errMax, - "%s: unsupported variable (%s=%s)\n", __func__, entry->key, entry->value); - return DAQ_ERROR; - } - } - if ( !impl->pci.ip_proto ) - impl->pci.ip_proto = IPPROTO_TCP; - - if ( !impl->port ) - impl->port = DEFAULT_PORT; - - impl->snaplen = cfg->snaplen ? cfg->snaplen : IP_MAXPACKET; - impl->timeout = cfg->timeout; - impl->passive = ( cfg->mode == DAQ_MODE_PASSIVE ); - - return DAQ_SUCCESS; -} - -//------------------------------------------------------------------------- -// daq -//------------------------------------------------------------------------- - -static void socket_daq_shutdown (void* handle) -{ - SockImpl* impl = (SockImpl*)handle; - - if ( impl->buf ) - free(impl->buf); - - free(impl); -} - -//------------------------------------------------------------------------- - -static int socket_daq_initialize ( - const DAQ_Config_t* cfg, void** handle, char* errBuf, size_t errMax) -{ - SockImpl* impl = calloc(1, sizeof(*impl)); - - if ( !impl ) - { - snprintf(errBuf, errMax, "%s: failed to allocate the ipfw context!", __func__); - return DAQ_ERROR_NOMEM; - } - - if ( socket_daq_config(impl, cfg, errBuf, errMax) != DAQ_SUCCESS ) - { - socket_daq_shutdown(impl); - return DAQ_ERROR; - } - impl->buf = malloc(impl->snaplen); - - if ( !impl->buf ) - { - snprintf(errBuf, errMax, "%s: failed to allocate the ipfw buffer!", __func__); - socket_daq_shutdown(impl); - return DAQ_ERROR_NOMEM; - } - - impl->sock_c = impl->sock_a = impl->sock_b = -1; - impl->use_a = 1; - impl->state = DAQ_STATE_INITIALIZED; - - *handle = impl; - return DAQ_SUCCESS; -} - -//------------------------------------------------------------------------- - -static int socket_daq_start (void* handle) -{ - SockImpl* impl = (SockImpl*)handle; - - if ( sock_setup(impl) ) - return DAQ_ERROR; - - impl->state = DAQ_STATE_STARTED; - return DAQ_SUCCESS; -} - -static int socket_daq_stop (void* handle) -{ - SockImpl* impl = (SockImpl*)handle; - sock_cleanup(impl); - impl->state = DAQ_STATE_STOPPED; - return DAQ_SUCCESS; -} - -//------------------------------------------------------------------------- - -static int socket_daq_inject ( - void* handle, const DAQ_PktHdr_t* hdr, const uint8_t* buf, uint32_t len, - int reverse) -{ - (void)hdr; - - SockImpl* impl = (SockImpl*)handle; - int sock; - - if ( reverse ) - sock = impl->use_a ? impl->sock_b : impl->sock_a; - else - sock = impl->use_a ? impl->sock_a : impl->sock_b; - - int status = sock_send(impl, sock, buf, len); - - if ( status ) - return DAQ_ERROR; - - impl->stats.packets_injected++; - return DAQ_SUCCESS; -} - -//------------------------------------------------------------------------- - -static int socket_daq_acquire ( - void* handle, int cnt, DAQ_Analysis_Func_t callback, DAQ_Meta_Func_t meta, void* user) -{ - (void)meta; - - SockImpl* impl = (SockImpl*)handle; - int hit = 0, miss = 0; - impl->stop = 0; - - while ( hit < cnt || cnt <= 0 ) - { - int status = socket_daq_process(impl, callback, user); - - if ( status > 0 ) - { - hit++; - miss = 0; - } - else if ( status < 0 ) - return DAQ_ERROR; - - else if ( ++miss == 2 || impl->stop ) - break; - } - return DAQ_SUCCESS; -} - -//------------------------------------------------------------------------- - -static int socket_daq_breakloop (void* handle) -{ - SockImpl* impl = (SockImpl*)handle; - impl->stop = 1; - return DAQ_SUCCESS; -} - -static DAQ_State socket_daq_check_status (void* handle) -{ - SockImpl* impl = (SockImpl*)handle; - return impl->state; -} - -static int socket_daq_get_stats (void* handle, DAQ_Stats_t* stats) -{ - SockImpl* impl = (SockImpl*)handle; - *stats = impl->stats; - return DAQ_SUCCESS; -} - -static void socket_daq_reset_stats (void* handle) -{ - SockImpl* impl = (SockImpl*)handle; - memset(&impl->stats, 0, sizeof(impl->stats)); -} - -static int socket_daq_get_snaplen (void* handle) -{ - SockImpl* impl = (SockImpl*)handle; - return impl->snaplen; -} - -static uint32_t socket_daq_get_capabilities (void* handle) -{ - (void)handle; - return DAQ_CAPA_BLOCK | DAQ_CAPA_REPLACE | DAQ_CAPA_INJECT | DAQ_CAPA_INJECT_RAW - | DAQ_CAPA_BREAKLOOP | DAQ_CAPA_UNPRIV_START; -} - -static int socket_daq_get_datalink_type(void *handle) -{ - (void)handle; - return DLT_USER; -} - -static const char* socket_daq_get_errbuf (void* handle) -{ - SockImpl* impl = (SockImpl*)handle; - return impl->error; -} - -static void socket_daq_set_errbuf (void* handle, const char* s) -{ - SockImpl* impl = (SockImpl*)handle; - DPE(impl->error, "%s", s ? s : ""); -} - -static int socket_daq_get_device_index(void* handle, const char* device) -{ - (void)handle; - (void)device; - return DAQ_ERROR_NOTSUP; -} - -static int socket_daq_set_filter (void* handle, const char* filter) -{ - (void)handle; - (void)filter; - return DAQ_ERROR_NOTSUP; -} - -//------------------------------------------------------------------------- - -#ifdef BUILDING_SO -DAQ_SO_PUBLIC DAQ_Module_t DAQ_MODULE_DATA = -#else -DAQ_Module_t socket_daq_module_data = -#endif -{ - .api_version = DAQ_API_VERSION, - .module_version = DAQ_MOD_VERSION, - .name = DAQ_NAME, - .type = DAQ_TYPE, - .initialize = socket_daq_initialize, - .set_filter = socket_daq_set_filter, - .start = socket_daq_start, - .acquire = socket_daq_acquire, - .inject = socket_daq_inject, - .breakloop = socket_daq_breakloop, - .stop = socket_daq_stop, - .shutdown = socket_daq_shutdown, - .check_status = socket_daq_check_status, - .get_stats = socket_daq_get_stats, - .reset_stats = socket_daq_reset_stats, - .get_snaplen = socket_daq_get_snaplen, - .get_capabilities = socket_daq_get_capabilities, - .get_datalink_type = socket_daq_get_datalink_type, - .get_errbuf = socket_daq_get_errbuf, - .set_errbuf = socket_daq_set_errbuf, - .get_device_index = socket_daq_get_device_index, - .modify_flow = NULL, - .hup_prep = NULL, - .hup_apply = NULL, - .hup_post = NULL, -}; - diff --git a/extra/src/inspectors/CMakeLists.txt b/extra/src/inspectors/CMakeLists.txt deleted file mode 100644 index cd32dd650..000000000 --- a/extra/src/inspectors/CMakeLists.txt +++ /dev/null @@ -1,3 +0,0 @@ - -add_example_library(dpx inspectors dpx.cc) -add_example_library(data_log inspectors data_log.cc) diff --git a/extra/src/inspectors/Makefile.am b/extra/src/inspectors/Makefile.am deleted file mode 100644 index 54c98c833..000000000 --- a/extra/src/inspectors/Makefile.am +++ /dev/null @@ -1,15 +0,0 @@ - -insexlibdir = $(pkglibdir)/inspectors - -insexlib_LTLIBRARIES = libdpx.la -libdpx_la_CXXFLAGS = $(AM_CXXFLAGS) -libdpx_la_LDFLAGS = -export-dynamic -shared -libdpx_la_SOURCES = dpx.cc - -insexlib_LTLIBRARIES += libdata_log.la -libdata_log_la_CXXFLAGS = $(AM_CXXFLAGS) -libdata_log_la_LDFLAGS = -export-dynamic -shared -libdata_log_la_SOURCES = data_log.cc - -AM_CXXFLAGS = @AM_CXXFLAGS@ - diff --git a/extra/src/inspectors/data_log.cc b/extra/src/inspectors/data_log.cc deleted file mode 100644 index 019c9c885..000000000 --- a/extra/src/inspectors/data_log.cc +++ /dev/null @@ -1,220 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2015-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// data_log.cc author Russ Combs - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include - -#include -#include - -#include "main/snort_debug.h" -#include "main/snort_types.h" -#include "framework/data_bus.h" -#include "framework/inspector.h" -#include "framework/module.h" -#include "log/messages.h" -#include "log/text_log.h" -#include "protocols/packet.h" -#include "profiler/profiler.h" -#include "utils/stats.h" -#include "flow/flow.h" -#include "sfip/sfip_t.h" - -static const char* s_name = "data_log"; -static const char* f_name = "data.log"; -static const char* s_help = "log selected published data to data.log"; - -static THREAD_LOCAL SimpleStats dl_stats; - -//------------------------------------------------------------------------- -// log stuff -//------------------------------------------------------------------------- - -static THREAD_LOCAL TextLog* tlog = nullptr; - -static void dl_tinit() -{ - tlog = TextLog_Init(f_name, 64*K_BYTES, 1*M_BYTES); -} - -static void dl_tterm() -{ - TextLog_Term(tlog); -} - -//------------------------------------------------------------------------- -// data stuff -//------------------------------------------------------------------------- - -class LogHandler : public DataHandler -{ -public: - LogHandler(std::string s) - { key = s; } - - void handle(DataEvent& e, Flow*); - -private: - std::string key; -}; - -void LogHandler::handle(DataEvent& e, Flow* f) -{ - unsigned n; - const char* b = (char*)e.get_data(n); - - // FIXIT-L hexify binary data - std::string val(b, n); - - TextLog_Print(tlog, "%u, ", time(nullptr)); - TextLog_Print(tlog, "%s, %d, ", sfip_to_str(&f->client_ip), f->client_port); - TextLog_Print(tlog, "%s, %d, ", sfip_to_str(&f->server_ip), f->server_port); - TextLog_Print(tlog, "%s, %*s\n", key.c_str(), n, val.c_str()); - - dl_stats.total_packets++; -} - -//------------------------------------------------------------------------- -// inspector stuff -//------------------------------------------------------------------------- - -class DataLog : public Inspector -{ -public: - DataLog(std::string s) { key = s; } - - void show(SnortConfig*) override; - void eval(Packet*) override { }; - - bool configure(SnortConfig*) override - { - get_data_bus().subscribe(key.c_str(), new LogHandler(key)); - return true; - } - -private: - std::string key; -}; - -void DataLog::show(SnortConfig*) -{ - LogMessage("%s config:\n", s_name); - LogMessage(" key = %s\n", key.c_str()); -} - -//------------------------------------------------------------------------- -// module stuff -//------------------------------------------------------------------------- - -static const Parameter dl_params[] = -{ - { "key", Parameter::PT_STRING, nullptr, "http_uri", - "name of data buffer to log" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -class DataLogModule : public Module -{ -public: - DataLogModule() : Module(s_name, s_help, dl_params) - { } - - const PegInfo* get_pegs() const override - { return simple_pegs; } - - PegCount* get_counts() const override - { return (PegCount*)&dl_stats; } - - bool set(const char*, Value& v, SnortConfig*) override; - -public: - std::string key; -}; - -bool DataLogModule::set(const char*, Value& v, SnortConfig*) -{ - if ( v.is("key") ) - key = v.get_string(); - - else - return false; - - return true; -} - -//------------------------------------------------------------------------- -// api stuff -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ return new DataLogModule; } - -static void mod_dtor(Module* m) -{ delete m; } - -static Inspector* dl_ctor(Module* m) -{ - DataLogModule* mod = (DataLogModule*)m; - return new DataLog(mod->key); -} - -static void dl_dtor(Inspector* p) -{ - delete p; -} - -static const InspectApi dl_api -{ - { - PT_INSPECTOR, - sizeof(InspectApi), - INSAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - s_name, - s_help, - mod_ctor, - mod_dtor - }, - IT_PASSIVE, - (uint16_t)PktType::NONE, - nullptr, // buffers - nullptr, // service - nullptr, // pinit - nullptr, // pterm - dl_tinit, - dl_tterm, - dl_ctor, - dl_dtor, - nullptr, // ssn - nullptr // reset -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &dl_api.base, - nullptr -}; - diff --git a/extra/src/inspectors/dpx.cc b/extra/src/inspectors/dpx.cc deleted file mode 100644 index ab0f4342e..000000000 --- a/extra/src/inspectors/dpx.cc +++ /dev/null @@ -1,208 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// dpx.cc author Russ Combs - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include -#include -#include - -#include "main/snort_debug.h" -#include "main/snort_types.h" -#include "events/event_queue.h" -#include "framework/inspector.h" -#include "framework/module.h" -#include "log/messages.h" -#include "protocols/packet.h" -#include "profiler/profiler.h" -#include "utils/stats.h" - -#define DPX_GID 256 -#define DPX_SID 1 - -static const char* s_name = "dpx"; -static const char* s_help = "dynamic inspector example"; - -static THREAD_LOCAL ProfileStats dpxPerfStats; - -static THREAD_LOCAL SimpleStats dpxstats; - -//------------------------------------------------------------------------- -// class stuff -//------------------------------------------------------------------------- - -class Dpx : public Inspector -{ -public: - Dpx(uint16_t port, uint16_t max); - - void show(SnortConfig*) override; - void eval(Packet*) override; - -private: - uint16_t port; - uint16_t max; -}; - -Dpx::Dpx(uint16_t p, uint16_t m) -{ - port = p; - max = m; -} - -void Dpx::show(SnortConfig*) -{ - LogMessage("%s config:\n", s_name); - LogMessage(" port = %d\n", port); - LogMessage(" max = %d\n", max); -} - -void Dpx::eval(Packet* p) -{ - // precondition - what we registered for - assert(p->is_udp()); - - if ( p->ptrs.dp == port && p->dsize > max ) - SnortEventqAdd(DPX_GID, DPX_SID); - - ++dpxstats.total_packets; -} - -//------------------------------------------------------------------------- -// module stuff -//------------------------------------------------------------------------- - -static const Parameter dpx_params[] = -{ - { "port", Parameter::PT_PORT, nullptr, nullptr, - "port to check" }, - - { "max", Parameter::PT_INT, "0:65535", "0", - "maximum payload before alert" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -static const RuleMap dpx_rules[] = -{ - { DPX_SID, "too much data sent to port" }, - { 0, nullptr } -}; - -class DpxModule : public Module -{ -public: - DpxModule() : Module(s_name, s_help, dpx_params) - { } - - unsigned get_gid() const override - { return DPX_GID; } - - const RuleMap* get_rules() const override - { return dpx_rules; } - - const PegInfo* get_pegs() const override - { return simple_pegs; } - - PegCount* get_counts() const override - { return (PegCount*)&dpxstats; } - - ProfileStats* get_profile() const override - { return &dpxPerfStats; } - - bool set(const char*, Value& v, SnortConfig*) override; - -public: - uint16_t port; - uint16_t max; -}; - -bool DpxModule::set(const char*, Value& v, SnortConfig*) -{ - if ( v.is("port") ) - port = v.get_long(); - - else if ( v.is("max") ) - max = v.get_long(); - - else - return false; - - return true; -} - -//------------------------------------------------------------------------- -// api stuff -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ return new DpxModule; } - -static void mod_dtor(Module* m) -{ delete m; } - -static Inspector* dpx_ctor(Module* m) -{ - DpxModule* mod = (DpxModule*)m; - return new Dpx(mod->port, mod->max); -} - -static void dpx_dtor(Inspector* p) -{ - delete p; -} - -static const InspectApi dpx_api -{ - { - PT_INSPECTOR, - sizeof(InspectApi), - INSAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - s_name, - s_help, - mod_ctor, - mod_dtor - }, - IT_NETWORK, - (uint16_t)PktType::UDP, - nullptr, // buffers - nullptr, // service - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - dpx_ctor, - dpx_dtor, - nullptr, // ssn - nullptr // reset -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &dpx_api.base, - nullptr -}; - diff --git a/extra/src/ips_options/CMakeLists.txt b/extra/src/ips_options/CMakeLists.txt deleted file mode 100644 index 1fd7a2bf2..000000000 --- a/extra/src/ips_options/CMakeLists.txt +++ /dev/null @@ -1,8 +0,0 @@ - -add_example_library(ips_urg ips_options ips_urg.cc) -add_example_library(ips_pkt_num ips_options ips_pkt_num.cc) - -install ( - FILES find.lua - DESTINATION "${EX_INSTALL_PATH}/ips_options" -) diff --git a/extra/src/ips_options/Makefile.am b/extra/src/ips_options/Makefile.am deleted file mode 100644 index 081b6a1a5..000000000 --- a/extra/src/ips_options/Makefile.am +++ /dev/null @@ -1,17 +0,0 @@ - -optlibdir = $(pkglibdir)/ips_options - -optlib_LTLIBRARIES = libips_pkt_num.la -libips_pkt_num_la_CXXFLAGS = $(AM_CXXFLAGS) -libips_pkt_num_la_LDFLAGS = -export-dynamic -shared -libips_pkt_num_la_SOURCES = ips_pkt_num.cc - -optlib_LTLIBRARIES += libips_urg.la -libips_urg_la_CXXFLAGS = $(AM_CXXFLAGS) -libips_urg_la_LDFLAGS = -export-dynamic -shared -libips_urg_la_SOURCES = ips_urg.cc - -dist_optlib_SCRIPTS = find.lua - -AM_CXXFLAGS = @AM_CXXFLAGS@ - diff --git a/extra/src/ips_options/find.lua b/extra/src/ips_options/find.lua deleted file mode 100755 index 56cd1844c..000000000 --- a/extra/src/ips_options/find.lua +++ /dev/null @@ -1,70 +0,0 @@ --- ---------------------------------------------------------- --- ips_option example: --- --- define keyword find --- --- configure snort with --- --- ./configure --prefix my/prefix --- --- then set up the path as follows: --- --- export LUA_PATH=my/prefix/include/snort/lua/?.lua\;\; --- --- write a rule as follows: --- --- alert tcp any any -> any 80 ( \ --- msg:"luajit example"; sid:1; \ --- content:"GET"; \ --- find:"pat='HTTP/1%.%d'"; ) --- --- the arg string is (in general) optional --- if present, it will be put in a table named args, eg: --- --- args { pat='GET .+ HTTP/1.1' } --- --- this table is defined before init is called --- the args string, if present, must be valid lua code like --- name1 = value1, name2 = 'value2'. --- ---------------------------------------------------------- - --- this pulls in snort bindings with ffi -require("snort_plugin") - --- init() is optional --- if present, called once when script is loaded --- here we return bool indicating args ok -function init () - if ( args.pat == nil ) then - return 'missing pat' - end - - if ( type(args.pat) ~= 'string' ) then - return 'pat must be string' - end - - return true -end - --- eval() is required --- eval must return a bool (match == true) -function eval () - -- buf is a luajit cdata - local buf = ffi.C.get_buffer() - - -- str is a lua string - local str = ffi.string(buf.data, buf.len) - - local i,j = string.find(str, args.pat) - - return (i and (i > 0)) -end - --- plugin table is required -plugin = -{ - type = "ips_option", -- only available type currently - name = "find", -- rule option keyword - version = 0 -- optional, defaults to zero -} - diff --git a/extra/src/ips_options/ips_pkt_num.cc b/extra/src/ips_options/ips_pkt_num.cc deleted file mode 100644 index f3a1f83d3..000000000 --- a/extra/src/ips_options/ips_pkt_num.cc +++ /dev/null @@ -1,195 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -// ips_pkt_num.cc author Russ Combs - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include - -#include "main/snort_types.h" -#include "main/thread.h" -#include "detection/detection_defines.h" -#include "detection/treenodes.h" -#include "framework/ips_option.h" -#include "framework/module.h" -#include "framework/parameter.h" -#include "framework/range.h" -#include "hash/sfhashfcn.h" -#include "protocols/packet.h" -#include "protocols/tcp.h" -#include "profiler/profiler.h" -#include "utils/stats.h" - -static const char* s_name = "pkt_num"; -static const char* s_help = "alert on raw packet number"; - -static THREAD_LOCAL ProfileStats pkt_num_perf_stats; - -//------------------------------------------------------------------------- -// option -//------------------------------------------------------------------------- - -class PktNumOption : public IpsOption -{ -public: - PktNumOption(const RangeCheck& c) : IpsOption(s_name) - { config = c; } - - uint32_t hash() const override; - bool operator==(const IpsOption&) const override; - - int eval(Cursor&, Packet*) override; - -private: - RangeCheck config; -}; - -uint32_t PktNumOption::hash() const -{ - uint32_t a, b, c; - - a = config.op; - b = config.min; - c = config.max; - - mix_str(a,b,c,get_name()); - finalize(a,b,c); - - return c; -} - -bool PktNumOption::operator==(const IpsOption& ips) const -{ - if ( strcmp(s_name, ips.get_name()) ) - return false; - - PktNumOption& rhs = (PktNumOption&)ips; - return ( config == rhs.config ); -} - -int PktNumOption::eval(Cursor&, Packet*) -{ - ProfileContext profile(pkt_num_perf_stats); - - if ( config.eval(get_packet_number()) ) - return DETECTION_OPTION_MATCH; - - return DETECTION_OPTION_NO_MATCH; -} - -//------------------------------------------------------------------------- -// module -//------------------------------------------------------------------------- - -static const Parameter s_params[] = -{ - { "~range", Parameter::PT_STRING, nullptr, nullptr, - "check if packet number is in given range" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -class PktNumModule : public Module -{ -public: - PktNumModule() : Module(s_name, s_help, s_params) { } - - bool begin(const char*, int, SnortConfig*) override; - bool set(const char*, Value&, SnortConfig*) override; - - ProfileStats* get_profile() const override - { return &pkt_num_perf_stats; } - - RangeCheck data; -}; - -bool PktNumModule::begin(const char*, int, SnortConfig*) -{ - data.init(); - return true; -} - -bool PktNumModule::set(const char*, Value& v, SnortConfig*) -{ - if ( !v.is("~range") ) - return false; - - return data.parse(v.get_string()); -} - -//------------------------------------------------------------------------- -// api methods -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ - return new PktNumModule; -} - -static void mod_dtor(Module* m) -{ - delete m; -} - -static IpsOption* pkt_num_ctor(Module* p, OptTreeNode*) -{ - PktNumModule* m = (PktNumModule*)p; - return new PktNumOption(m->data); -} - -static void pkt_num_dtor(IpsOption* p) -{ - delete p; -} - -static const IpsApi pkt_num_api = -{ - { - PT_IPS_OPTION, - sizeof(IpsApi), - IPSAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - s_name, - s_help, - mod_ctor, - mod_dtor - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - pkt_num_ctor, - pkt_num_dtor, - nullptr -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &pkt_num_api.base, - nullptr -}; - diff --git a/extra/src/ips_options/ips_urg.cc b/extra/src/ips_options/ips_urg.cc deleted file mode 100644 index 2d0d66d58..000000000 --- a/extra/src/ips_options/ips_urg.cc +++ /dev/null @@ -1,199 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -// ips_urg.cc author Russ Combs - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include - -#include "main/snort_types.h" -#include "main/thread.h" -#include "detection/detection_defines.h" -#include "detection/treenodes.h" -#include "framework/ips_option.h" -#include "framework/module.h" -#include "framework/parameter.h" -#include "framework/range.h" -#include "hash/sfhashfcn.h" -#include "protocols/packet.h" -#include "protocols/tcp.h" -#include "profiler/profiler.h" - -static const char* s_name = "urg"; -static const char* s_help = "detection for TCP urgent pointer"; - -static THREAD_LOCAL ProfileStats tcpUrgPerfStats; - -//------------------------------------------------------------------------- -// option -//------------------------------------------------------------------------- - -class TcpUrgOption : public IpsOption -{ -public: - TcpUrgOption(const RangeCheck& c) : IpsOption(s_name) - { config = c; } - - uint32_t hash() const override; - bool operator==(const IpsOption&) const override; - - int eval(Cursor&, Packet*) override; - -private: - RangeCheck config; -}; - -uint32_t TcpUrgOption::hash() const -{ - uint32_t a, b, c; - - a = config.op; - b = config.min; - c = config.max; - - mix_str(a,b,c,get_name()); - finalize(a,b,c); - - return c; -} - -bool TcpUrgOption::operator==(const IpsOption& ips) const -{ - if ( strcmp(s_name, ips.get_name()) ) - return false; - - TcpUrgOption& rhs = (TcpUrgOption&)ips; - return ( config == rhs.config ); -} - -int TcpUrgOption::eval(Cursor&, Packet* p) -{ - Profile profile(tcpUrgPerfStats); - - int rval = DETECTION_OPTION_NO_MATCH; - - if ( p->ptrs.tcph and p->ptrs.tcph->are_flags_set(TH_URG) and - config.eval(p->ptrs.tcph->urp()) ) - { - rval = DETECTION_OPTION_MATCH; - } - - return rval; -} - -//------------------------------------------------------------------------- -// module -//------------------------------------------------------------------------- - -static const Parameter s_params[] = -{ - { "~range", Parameter::PT_STRING, nullptr, nullptr, - "check if urgent offset is min<>max | min" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -class UrgModule : public Module -{ -public: - UrgModule() : Module(s_name, s_help, s_params) { } - - bool begin(const char*, int, SnortConfig*) override; - bool set(const char*, Value&, SnortConfig*) override; - - ProfileStats* get_profile() const override - { return &tcpUrgPerfStats; } - - RangeCheck data; -}; - -bool UrgModule::begin(const char*, int, SnortConfig*) -{ - data.init(); - return true; -} - -bool UrgModule::set(const char*, Value& v, SnortConfig*) -{ - if ( !v.is("~range") ) - return false; - - return data.parse(v.get_string()); -} - -//------------------------------------------------------------------------- -// api methods -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ - return new UrgModule; -} - -static void mod_dtor(Module* m) -{ - delete m; -} - -static IpsOption* urg_ctor(Module* p, OptTreeNode*) -{ - UrgModule* m = (UrgModule*)p; - return new TcpUrgOption(m->data); -} - -static void urg_dtor(IpsOption* p) -{ - delete p; -} - -static const IpsApi urg_api = -{ - { - PT_IPS_OPTION, - sizeof(IpsApi), - IPSAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - s_name, - s_help, - mod_ctor, - mod_dtor - }, - OPT_TYPE_DETECTION, - 1, PROTO_BIT__TCP, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - urg_ctor, - urg_dtor, - nullptr -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &urg_api.base, - nullptr -}; - diff --git a/extra/src/loggers/CMakeLists.txt b/extra/src/loggers/CMakeLists.txt deleted file mode 100644 index b05e6a2a6..000000000 --- a/extra/src/loggers/CMakeLists.txt +++ /dev/null @@ -1,9 +0,0 @@ - -add_example_library(alert_ex loggers alert_ex.cc) -add_example_library(alert_unixsock loggers alert_unixsock.cc) -add_example_library(log_null loggers log_null.cc) - -install ( - FILES alert.lua - DESTINATION "${EX_INSTALL_PATH}/loggers" -) diff --git a/extra/src/loggers/Makefile.am b/extra/src/loggers/Makefile.am deleted file mode 100644 index 43ddafc46..000000000 --- a/extra/src/loggers/Makefile.am +++ /dev/null @@ -1,22 +0,0 @@ - -loglibdir = $(pkglibdir)/loggers - -loglib_LTLIBRARIES = libalert_ex.la -libalert_ex_la_CXXFLAGS = $(AM_CXXFLAGS) -libalert_ex_la_LDFLAGS = -export-dynamic -shared -libalert_ex_la_SOURCES = alert_ex.cc - -loglib_LTLIBRARIES += libalert_unixsock.la -libalert_unixsock_la_CXXFLAGS = $(AM_CXXFLAGS) -libalert_unixsock_la_LDFLAGS = -export-dynamic -shared -libalert_unixsock_la_SOURCES = alert_unixsock.cc - -loglib_LTLIBRARIES += liblog_null.la -liblog_null_la_CXXFLAGS = $(AM_CXXFLAGS) -liblog_null_la_LDFLAGS = -export-dynamic -shared -liblog_null_la_SOURCES = log_null.cc - -dist_loglib_SCRIPTS = alert.lua - -AM_CXXFLAGS = @AM_CXXFLAGS@ - diff --git a/extra/src/loggers/alert.lua b/extra/src/loggers/alert.lua deleted file mode 100755 index 03476b9d5..000000000 --- a/extra/src/loggers/alert.lua +++ /dev/null @@ -1,67 +0,0 @@ --- ---------------------------------------------------------- --- logger example: --- --- define keyword lualert --- --- configure snort with --- --- ./configure --prefix my/prefix --- --- then set up the path as follows: --- --- export LUA_PATH=my/prefix/include/snort/lua/?.lua\;\; --- --- You can use with -A lualert by adding lualert to your --- snort.lua: --- --- lualert = --- { --- args = "num = 1, str = 'bar', cond = true" --- } --- --- the arg string is (in general) optional --- if present, it will be put in a table named args, eg: --- --- args = { num = 1, str = 'bar', cond = true } --- --- this table is defined before init is called --- the args string, if present, must be valid lua code like --- above. --- ---------------------------------------------------------- - --- this pulls in snort bindings with ffi -require("snort_plugin") - --- init() is optional --- if present, called once when script is loaded --- here we return bool indicating args ok -function init () - return true -end - --- alert() is required -function alert () - -- get luajit structs - local evt = ffi.C.get_event() - local pkt = ffi.C.get_packet() - - -- str is a luajit string - local str = ffi.string(evt.msg) - - -- FIXIT - this gets: - -- bad argument #2 to 'format' (number expected, got cdata) - --print(string.format('%ld %d:%d:%d %s', - -- pkt.num, evt.gid, evt.sid, evt.rev, str)) - - print(string.format('%d:%d:%d %s', - evt.gid, evt.sid, evt.rev, str)) -end - --- plugin table is required -plugin = -{ - type = "logger", - name = "lualert", -- eg -A lualert - version = 0 -- optional version of this file -} - diff --git a/extra/src/loggers/alert_ex.cc b/extra/src/loggers/alert_ex.cc deleted file mode 100644 index b5eaafcaf..000000000 --- a/extra/src/loggers/alert_ex.cc +++ /dev/null @@ -1,156 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2013-2013 Sourcefire, Inc. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -// alert_ex.cc author Russ Combs - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include - -#include -#include -using namespace std; - -#include "main/snort_types.h" -#include "framework/logger.h" -#include "framework/module.h" -#include "protocols/packet.h" -#include "detection/signature.h" - -static const char* s_name = "alert_ex"; -static const char* s_help = "output gid:sid:rev for alerts"; - -//------------------------------------------------------------------------- -// module stuff -//------------------------------------------------------------------------- - -static const Parameter s_params[] = -{ - { "upper", Parameter::PT_BOOL, nullptr, "false", - "true/false -> convert to upper/lower case" }, - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -class ExModule : public Module -{ -public: - ExModule() : Module(s_name, s_help, s_params) { } - - bool set(const char*, Value&, SnortConfig*) override; - bool begin(const char*, int, SnortConfig*) override; - -public: - bool upper; -}; - -bool ExModule::set(const char*, Value& v, SnortConfig*) -{ - if ( v.is("packet") ) - upper = v.get_bool(); - - else - return false; - - return true; -} - -bool ExModule::begin(const char*, int, SnortConfig*) -{ - upper = true; - return true; -} - -//------------------------------------------------------------------------- -// logger stuff -//------------------------------------------------------------------------- - -class ExLogger : public Logger -{ -public: - ExLogger(ExModule* m) - { upper = m->upper; } - - void alert(Packet*, const char* msg, Event*) override; - -private: - bool upper; -}; - -void ExLogger::alert(Packet*, const char* msg, Event* e) -{ - string s = msg; - - if ( upper ) - transform(s.begin(), s.end(), s.begin(), ::toupper); - else - transform(s.begin(), s.end(), s.begin(), ::tolower); - - cout << e->sig_info->generator << ":"; - cout << e->sig_info->id << ":"; - cout << e->sig_info->rev << " "; - cout << s << endl; -} - -//------------------------------------------------------------------------- -// api stuff -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ return new ExModule; } - -static void mod_dtor(Module* m) -{ delete m; } - -static Logger* ex_ctor(SnortConfig*, Module* mod) -{ - return new ExLogger((ExModule*)mod); -} - -static void ex_dtor(Logger* p) -{ delete p; } - -static const LogApi ex_api = -{ - { - PT_LOGGER, - sizeof(LogApi), - LOGAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - s_name, - s_help, - mod_ctor, - mod_dtor - }, - OUTPUT_TYPE_FLAG__ALERT, - ex_ctor, - ex_dtor -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &ex_api.base, - nullptr -}; - diff --git a/extra/src/loggers/alert_unixsock.cc b/extra/src/loggers/alert_unixsock.cc deleted file mode 100644 index 0374147ca..000000000 --- a/extra/src/loggers/alert_unixsock.cc +++ /dev/null @@ -1,302 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2002-2013 Sourcefire, Inc. -// Copyright (C) 1998-2002 Martin Roesch -// Copyright (C) 2000,2001 Andrew R. Baker -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include -#include -#include - -#include - -#include "main/snort_types.h" -#include "main/snort_debug.h" -#include "framework/logger.h" -#include "framework/module.h" -#include "detection/signature.h" -#include "events/event.h" -#include "protocols/packet.h" -#include "utils/util.h" - -#define UNSOCK_FILE "snort_alert" - -/* this is equivalent to the 32-bit pcap pkthdr struct - */ -struct pcap_pkthdr32 -{ - struct sf_timeval32 ts; /* packet timestamp */ - uint32_t caplen; /* packet capture length */ - uint32_t len; /* packet "real" length */ -}; - -/* this struct is for the alert socket code.... */ -// FIXIT-L alert unix sock supports l2-l3-l4 encapsulations - -const unsigned int ALERTMSG_LENGTH = 256; -struct Alertpkt -{ - uint8_t alertmsg[ALERTMSG_LENGTH]; /* variable.. */ - struct pcap_pkthdr32 pkth; - uint32_t dlthdr; /* datalink header offset. (ethernet, etc.. ) */ - uint32_t nethdr; /* network header offset. (ip etc...) */ - uint32_t transhdr; /* transport header offset (tcp/udp/icmp ..) */ - uint32_t data; - uint32_t val; /* which fields are valid. (NULL could be - * valids also) */ - /* Packet struct --> was null */ -#define NOPACKET_STRUCT 0x1 - /* no transport headers in packet */ -#define NO_TRANSHDR 0x2 - uint8_t pkt[65535]; // FIXIT-L move to end and send actual size - - uint32_t gid; - uint32_t sid; - uint32_t rev; - uint32_t class_id; - uint32_t priority; - - uint32_t event_id; - uint32_t event_ref; - struct sf_timeval32 ref_time; -}; - -struct UnixSock -{ - int socket; - struct sockaddr_un addr; - Alertpkt alert; -}; - -static THREAD_LOCAL UnixSock us; - -#define s_name "alert_unixsock" - -//------------------------------------------------------------------------- -// alert_unixsock module -//------------------------------------------------------------------------- - -static const Parameter s_params[] = -{ - // FIXIT-L add name param? - - { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr } -}; - -#define s_help \ - "output event over unix socket" - -class UnixSockModule : public Module -{ -public: - UnixSockModule() : Module(s_name, s_help, s_params) { } - - bool set(const char*, Value&, SnortConfig*) override - { return false; } -}; - -//------------------------------------------------------------------------- - -static void get_alert_pkt( - Packet* p, const char* msg, Event* event) -{ - DebugMessage(DEBUG_LOG, "Logging Alert data!\n"); - - // FIXIT-L ugh ... - memset((char*)&us.alert,0,sizeof(us.alert)); - - us.alert.gid = event->sig_info->generator; - us.alert.sid = event->sig_info->id; - us.alert.rev = event->sig_info->rev; - us.alert.class_id = event->sig_info->class_id; - us.alert.priority = event->sig_info->priority; - - us.alert.event_id = event->event_id; - us.alert.event_ref = event->event_reference; - us.alert.ref_time = event->ref_time; - - if (p && p->pkt) - { - memmove( (void*)&us.alert.pkth, (const void*)p->pkth, sizeof(us.alert.pkth)); - memmove(us.alert.pkt, (const void*)p->pkt, us.alert.pkth.caplen); - } - else - us.alert.val |= NOPACKET_STRUCT; - - if (msg) - { - // FIXIT-L ugh ... - memmove( (void*)us.alert.alertmsg, (const void*)msg, - strlen(msg)>ALERTMSG_LENGTH-1 ? ALERTMSG_LENGTH - 1 : strlen(msg)); - } - - /* some data which will help monitoring utility to dissect packet */ - if (!(us.alert.val & NOPACKET_STRUCT)) - { - if (p) - { - if (p->proto_bits & PROTO_BIT__ETH) - { - const eth::EtherHdr* eh = layer::get_eth_layer(p); - us.alert.dlthdr=(char*)eh-(char*)p->pkt; - } - - /* we don't log any headers besides eth yet */ - if (p->ptrs.ip_api.is_ip4() && p->pkt) - { - us.alert.nethdr=(char*)p->ptrs.ip_api.get_ip4h()-(char*)p->pkt; - - switch (p->type()) - { - case PktType::TCP: - if (p->ptrs.tcph) - us.alert.transhdr=(char*)p->ptrs.tcph-(char*)p->pkt; - break; - - case PktType::UDP: - if (p->ptrs.udph) - us.alert.transhdr=(char*)p->ptrs.udph-(char*)p->pkt; - break; - - case PktType::ICMP: - if (p->ptrs.icmph) - us.alert.transhdr=(char*)p->ptrs.icmph-(char*)p->pkt; - break; - - default: - /* us.alert.transhdr is null due to initial memset */ - us.alert.val|=NO_TRANSHDR; - break; - } /* switch */ - } - - if (p->data && p->pkt) - us.alert.data=p->data - p->pkt; - } - } -} - -//------------------------------------------------------------------------- - -static void OpenAlertSock(void) -{ - std::string name; - get_instance_file(name, UNSOCK_FILE); - - if ( access(name.c_str(), W_OK) ) - ErrorMessage("%s file doesn't exist or isn't writable\n", name.c_str()); - - memset((char*)&us.addr, 0, sizeof(us.addr)); - us.addr.sun_family = AF_UNIX; - - /* copy path over and preserve a null byte at the end */ - strncpy(us.addr.sun_path, name.c_str(), sizeof(us.addr.sun_path)-1); - - if ( (us.socket = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0 ) - FatalError("socket() call failed: %s", get_error(errno)); - -#ifdef FREEBSD - int buflen=sizeof(us.alert); - - if ( setsockopt(us.socket, SOL_SOCKET, SO_SNDBUF, (char*)&buflen, sizeof(int)) < 0 ) - FatalError("setsockopt() call failed: %s", get_error(errno)); -#endif -} - -//------------------------------------------------------------------------- - -class UnixSockLogger : public Logger -{ -public: - UnixSockLogger() { } - - void open() override; - void close() override; - - void alert(Packet*, const char* msg, Event*) override; -}; - -void UnixSockLogger::open() -{ - OpenAlertSock(); -} - -void UnixSockLogger::close() -{ - if ( us.socket >= 0 ) - ::close(us.socket); - - us.socket = -1; -} - -void UnixSockLogger::alert(Packet* p, const char* msg, Event* event) -{ - get_alert_pkt(p, msg, event); - - if (sendto(us.socket,(const void*)&us.alert,sizeof(us.alert), - 0,(struct sockaddr*)&us.addr,sizeof(us.addr))==-1) - { - /* whatever we do to sign that some alerts could be missed */ - } -} - -//------------------------------------------------------------------------- - -static Module* mod_ctor() -{ return new UnixSockModule; } - -static void mod_dtor(Module* m) -{ delete m; } - -static Logger* unix_sock_ctor(SnortConfig*, Module*) -{ return new UnixSockLogger; } - -static void unix_sock_dtor(Logger* p) -{ delete p; } - -static LogApi unix_sock_api -{ - { - PT_LOGGER, - sizeof(LogApi), - LOGAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - s_name, - s_help, - mod_ctor, - mod_dtor - }, - OUTPUT_TYPE_FLAG__ALERT, - unix_sock_ctor, - unix_sock_dtor -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &unix_sock_api.base, - nullptr -}; - diff --git a/extra/src/loggers/log_null.cc b/extra/src/loggers/log_null.cc deleted file mode 100644 index 8d18e5406..000000000 --- a/extra/src/loggers/log_null.cc +++ /dev/null @@ -1,78 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2002-2013 Sourcefire, Inc. -// Copyright (C) 1998-2002 Martin Roesch -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -/* This module is a NULL placeholder for people that want to turn off - * logging for whatever reason. Please note that logging is separate from - * alerting, they are completely separate output facilities within Snort. - */ - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include - -#include "framework/logger.h" -#include "framework/module.h" - -#define s_name "log_null" -#define s_help "disable logging of packets" - -//------------------------------------------------------------------------- -// log_null module -//------------------------------------------------------------------------- - -class NullLogger : public Logger -{ -public: - NullLogger() { } -}; - -static Logger* null_ctor(SnortConfig*, Module*) -{ return new NullLogger; } - -static void null_dtor(Logger* p) -{ delete p; } - -static LogApi null_api -{ - { - PT_LOGGER, - sizeof(LogApi), - LOGAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - s_name, - s_help, - nullptr, // mod_ctor, - nullptr //mod_dtor - }, - OUTPUT_TYPE_FLAG__LOG, - null_ctor, - null_dtor -}; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &null_api.base, - nullptr -}; - diff --git a/extra/src/search_engines/CMakeLists.txt b/extra/src/search_engines/CMakeLists.txt deleted file mode 100644 index bc425a7e0..000000000 --- a/extra/src/search_engines/CMakeLists.txt +++ /dev/null @@ -1,7 +0,0 @@ - -add_example_library(lowmem search_engines - lowmem.cc - sfksearch.cc - sfksearch.h - trie_api.cc -) diff --git a/extra/src/search_engines/Makefile.am b/extra/src/search_engines/Makefile.am deleted file mode 100644 index a39b800dd..000000000 --- a/extra/src/search_engines/Makefile.am +++ /dev/null @@ -1,14 +0,0 @@ - -selibdir = $(pkglibdir)/search_engines -selib_LTLIBRARIES = liblowmem.la -liblowmem_la_CXXFLAGS = $(AM_CXXFLAGS) -liblowmem_la_LDFLAGS = -export-dynamic -shared - -liblowmem_la_SOURCES = \ -lowmem.cc \ -sfksearch.cc \ -sfksearch.h \ -trie_api.cc - -AM_CXXFLAGS = @AM_CXXFLAGS@ - diff --git a/extra/src/search_engines/lowmem.cc b/extra/src/search_engines/lowmem.cc deleted file mode 100644 index 74527af00..000000000 --- a/extra/src/search_engines/lowmem.cc +++ /dev/null @@ -1,141 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2002-2013 Sourcefire, Inc. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -/* -* An abstracted interface to the Multi-Pattern Matching routines, -* thats why we're passing 'void *' objects around. -* -* Marc A Norton -* -* Updates: -* 3/06 - Added AC_BNFA search -*/ -// lowmem.cc author Russ Combs - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include "sfksearch.h" -#include "main/snort_debug.h" -#include "main/snort_types.h" -#include "log/messages.h" -#include "framework/mpse.h" -#include "profiler/profiler.h" - -//------------------------------------------------------------------------- -// "lowmem" -//------------------------------------------------------------------------- - -class LowmemMpse : public Mpse -{ -private: - KTRIE_STRUCT* obj; - -public: - LowmemMpse(SnortConfig*, bool use_gc, const MpseAgent* agent) - : Mpse("lowmem", use_gc) - { obj = KTrieNew(0, agent); } - - ~LowmemMpse() - { KTrieDelete(obj); } - - int add_pattern( - SnortConfig*, const uint8_t* P, unsigned m, - const PatternDescriptor& desc, void* user) override - { - return KTrieAddPattern(obj, P, m, desc.no_case, desc.negated, user); - } - - int prep_patterns(SnortConfig* sc) override - { - return KTrieCompile(sc, obj); - } - - int _search( - const uint8_t* T, int n, MpseMatch match, - void* context, int* current_state) override - { - *current_state = 0; - return KTrieSearch(obj, T, n, match, context); - } - - int get_pattern_count() override - { return KTriePatternCount(obj); } -}; - -//------------------------------------------------------------------------- -// api -//------------------------------------------------------------------------- - -static Mpse* lm_ctor(SnortConfig* sc, class Module*, bool use_gc, const MpseAgent* agent) -{ - return new LowmemMpse(sc, use_gc, agent); -} - -static void lm_dtor(Mpse* p) -{ - delete p; -} - -static void lm_init() -{ - KTrie_init_xlatcase(); - KTrieInitMemUsed(); -} - -static void lm_print() -{ - if ( !KTrieMemUsed() ) - return; - - double x = (double)KTrieMemUsed(); - - LogMessage("[ LowMem Search-Method Memory Used : %g %s ]\n", - (x > 1.e+6) ? x/1.e+6 : x/1.e+3, - (x > 1.e+6) ? "MBytes" : "KBytes"); -} - -static const MpseApi lm_api = -{ - { - PT_SEARCH_ENGINE, - sizeof(MpseApi), - SEAPI_VERSION, - 0, - API_RESERVED, - API_OPTIONS, - "lowmem", - "Keyword Trie (low memory, moderate performance) MPSE", - nullptr, - nullptr - }, - false, - nullptr, - nullptr, - nullptr, - nullptr, - lm_ctor, - lm_dtor, - lm_init, - lm_print, -}; - -const BaseApi* se_lowmem = &lm_api.base; - diff --git a/extra/src/search_engines/sfksearch.cc b/extra/src/search_engines/sfksearch.cc deleted file mode 100644 index e6a03fbc9..000000000 --- a/extra/src/search_engines/sfksearch.cc +++ /dev/null @@ -1,819 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2001 Marc Norton -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2003-2013 Sourcefire, Inc. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -/* -* ksearch.c -* -* Basic Keyword Search Trie - uses linked lists to build the finite automata -* -* Keyword-Match: Performs the equivalent of a multi-string strcmp() -* - use for token testing after parsing the language tokens using lex or the like. -* -* Keyword-Search: searches the input text for one of multiple keywords, -* and supports case sensitivite and case insensitive patterns. -*/ -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include -#include -#include -#include - -#include "main/snort_types.h" -#include "main/snort_debug.h" -#include "main/thread.h" -#include "sfksearch.h" -#include "utils/snort_bounds.h" - -static void KTrieFree(KTRIENODE* n); - -static unsigned int mtot = 0; - -unsigned int KTrieMemUsed(void) -{ - return mtot; -} - -void KTrieInitMemUsed(void) -{ - mtot = 0; -} - -/* -* Allocate Memory -*/ -static void* KTRIE_MALLOC(int n) -{ - void* p; - - if (n < 1) - return NULL; - - p = calloc(1, n); - - if (p) - mtot += n; - - return p; -} - -/* -* Free Memory -*/ -static void KTRIE_FREE(void* p) -{ - if (p == NULL) - return; - - free(p); -} - -/* -* Local/Tmp nocase array -*/ -static THREAD_LOCAL uint8_t Tnocase[65*1024]; - -/* -** Case Translation Table -*/ -static uint8_t xlatcase[256]; - -/* -* -*/ -void KTrie_init_xlatcase(void) -{ - for (int i=0; i<256; i++) - { - xlatcase[ i ] = (uint8_t)tolower(i); - } -} - -/* -* -*/ -static inline void ConvertCaseEx(uint8_t* d, const uint8_t* s, int m) -{ - int i; - for ( i=0; i < m; i++ ) - { - d[i] = xlatcase[ s[i] ]; - } -} - -/* -* -*/ -KTRIE_STRUCT* KTrieNew(int method, const MpseAgent* agent) -{ - KTRIE_STRUCT* ts = (KTRIE_STRUCT*)KTRIE_MALLOC(sizeof(KTRIE_STRUCT) ); - - if ( !ts ) - return 0; - - memset(ts, 0, sizeof(KTRIE_STRUCT)); - - ts->memory = sizeof(KTRIE_STRUCT); - ts->nchars = 0; - ts->npats = 0; - ts->end_states = 0; - ts->method = method; /* - old method, 1 = queue */ - ts->agent = agent; - - return ts; -} - -int KTriePatternCount(KTRIE_STRUCT* k) -{ - return k->npats; -} - -/* - * Deletes memory that was used in creating trie - * and nodes - */ -void KTrieDelete(KTRIE_STRUCT* k) -{ - KTRIEPATTERN* p = NULL; - KTRIEPATTERN* pnext = NULL; - int i; - - if (k == NULL) - return; - - p = k->patrn; - - while (p != NULL) - { - pnext = p->next; - - if (k->agent && p->user) - k->agent->user_free(p->user); - - if (k->agent) - { - if (p && p->rule_option_tree) - k->agent->tree_free(&p->rule_option_tree); - } - - if (k->agent) - { - if (p && p->neg_list) - k->agent->list_free(&p->neg_list); - } - - KTRIE_FREE(p->P); - KTRIE_FREE(p->Pcase); - KTRIE_FREE(p); - - p = pnext; - } - - for (i = 0; i < KTRIE_ROOT_NODES; i++) - KTrieFree(k->root[i]); - - KTRIE_FREE(k); -} - -/* - * Recursively delete all nodes in trie - */ -static void KTrieFree(KTRIENODE* n) -{ - if (n == NULL) - return; - - KTrieFree(n->child); - KTrieFree(n->sibling); - - KTRIE_FREE(n); -} - -/* -* -*/ -static KTRIEPATTERN* KTrieNewPattern(const uint8_t* P, unsigned n) -{ - KTRIEPATTERN* p; - int ret; - - if (n < 1) - return NULL; - - p = (KTRIEPATTERN*)KTRIE_MALLOC(sizeof(KTRIEPATTERN) ); - - if (p == NULL) - return NULL; - - /* Save as a nocase string */ - p->P = (uint8_t*)KTRIE_MALLOC(n); - if ( !p->P ) - { - KTRIE_FREE(p); - return NULL; - } - - ConvertCaseEx(p->P, P, n); - - /* Save Case specific version */ - p->Pcase = (uint8_t*)KTRIE_MALLOC(n); - if ( !p->Pcase ) - { - KTRIE_FREE(p->P); - KTRIE_FREE(p); - return NULL; - } - - ret = SafeMemcpy(p->Pcase, P, n, p->Pcase, p->Pcase + n); - if (ret != SAFEMEM_SUCCESS) - { - KTRIE_FREE(p->Pcase); - KTRIE_FREE(p->P); - KTRIE_FREE(p); - return NULL; - } - - p->n = n; - p->next = NULL; - - return p; -} - -/* -* Add Pattern info to the list of patterns -*/ -int KTrieAddPattern( - KTRIE_STRUCT* ts, const uint8_t* P, unsigned n, - bool nocase, bool negative, void* user) -{ - KTRIEPATTERN* pnew; - - if ( !ts->patrn ) - { - pnew = ts->patrn = KTrieNewPattern(P, n); - - if ( !pnew ) - return -1; - } - else - { - pnew = KTrieNewPattern(P, n); - - if ( !pnew ) - return -1; - - pnew->next = ts->patrn; /* insert at head of list */ - - ts->patrn = pnew; - } - - pnew->nocase = nocase; - pnew->negative = negative; - pnew->user = user; - pnew->mnext = NULL; - - ts->npats++; - ts->memory += sizeof(KTRIEPATTERN) + 2 * n; /* Case and nocase */ - - return 0; -} - -/* -* -*/ -static KTRIENODE* KTrieCreateNode(KTRIE_STRUCT* ts) -{ - KTRIENODE* t=(KTRIENODE*)KTRIE_MALLOC(sizeof(KTRIENODE) ); - - if (!t) - return 0; - - memset(t,0,sizeof(KTRIENODE)); - - ts->memory += sizeof(KTRIENODE); - - return t; -} - -/* -* Insert a Pattern in the Trie -*/ -static int KTrieInsert(KTRIE_STRUCT* ts, KTRIEPATTERN* px) -{ - int type = 0; - int n = px->n; - uint8_t* P = px->P; - KTRIENODE* root; - - /* Make sure we at least have a root character for the tree */ - if ( !ts->root[*P] ) - { - ts->root[*P] = root = KTrieCreateNode(ts); - if ( !root ) - return -1; - root->edge = *P; - } - else - { - root = ts->root[*P]; - } - - /* Walk existing Patterns */ - while ( n ) - { - if ( root->edge == *P ) - { - P++; - n--; - - if ( n && root->child ) - { - root=root->child; - } - else /* cannot continue */ - { - type = 0; /* Expand the tree via the child */ - break; - } - } - else - { - if ( root->sibling ) - { - root=root->sibling; - } - else /* cannot continue */ - { - type = 1; /* Expand the tree via the sibling */ - break; - } - } - } - - /* - * Add the next char of the Keyword, if any - */ - if ( n ) - { - if ( type == 0 ) - { - /* - * Start with a new child to finish this Keyword - */ - root->child= KTrieCreateNode(ts); - if ( !root->child ) - return -1; - root=root->child; - root->edge = *P; - P++; - n--; - ts->nchars++; - } - else - { - /* - * Start a new sibling bracnch to finish this Keyword - */ - root->sibling= KTrieCreateNode(ts); - if ( !root->sibling ) - return -1; - root=root->sibling; - root->edge = *P; - P++; - n--; - ts->nchars++; - } - } - - /* - * Finish the keyword as child nodes - */ - while ( n ) - { - root->child = KTrieCreateNode(ts); - if ( !root->child ) - return -1; - root=root->child; - root->edge = *P; - P++; - n--; - ts->nchars++; - } - - if ( root->pkeyword ) - { - px->mnext = root->pkeyword; /* insert duplicates at front of list */ - root->pkeyword = px; - ts->duplicates++; - } - else - { - root->pkeyword = px; - ts->end_states++; - } - - return 0; -} - -/* -* -*/ -static void Build_Bad_Character_Shifts(KTRIE_STRUCT* kt) -{ - int i,k; - KTRIEPATTERN* plist; - - /* Calc the min pattern size */ - kt->bcSize = 32000; - - for ( plist=kt->patrn; plist!=NULL; plist=plist->next ) - { - if ( plist->n < kt->bcSize ) - { - kt->bcSize = plist->n; /* smallest pattern size */ - } - } - - /* - * Initialze the Bad Character shift table. - */ - for (i = 0; i < KTRIE_ROOT_NODES; i++) - { - kt->bcShift[i] = (unsigned short)kt->bcSize; - } - - /* - * Finish the Bad character shift table - */ - for ( plist=kt->patrn; plist!=NULL; plist=plist->next ) - { - int shift, cindex; - - for ( k=0; kbcSize; k++ ) - { - shift = kt->bcSize - 1 - k; - - cindex = plist->P[ k ]; - - if ( shift < kt->bcShift[ cindex ] ) - { - kt->bcShift[ cindex ] = (unsigned short)shift; - } - } - } -} - -static int KTrieBuildMatchStateNode( - SnortConfig* sc, KTRIENODE* root, KTRIE_STRUCT* ts) -{ - int cnt = 0; - KTRIEPATTERN* p; - - if (!root) - return 0; - - /* each and every prefix match at this root*/ - if (root->pkeyword) - { - for (p = root->pkeyword; p; p = p->mnext) - { - if (p->user) - { - if (p->negative) - { - ts->agent->negate_list(p->user, &root->pkeyword->neg_list); - } - else - { - ts->agent->build_tree(sc, p->user, &root->pkeyword->rule_option_tree); - } - } - - cnt++; - } - - /* Last call to finalize the tree for this root */ - ts->agent->build_tree(sc, NULL, &root->pkeyword->rule_option_tree); - } - - /* for child of this root */ - if (root->child) - { - cnt += KTrieBuildMatchStateNode(sc, root->child, ts); - } - - /* 1st sibling of this root -- other siblings will be processed from - * within the processing for root->sibling. */ - if (root->sibling) - { - cnt += KTrieBuildMatchStateNode(sc, root->sibling, ts); - } - - return cnt; -} - -static int KTrieBuildMatchStateTrees(SnortConfig* sc, KTRIE_STRUCT* ts) -{ - int i, cnt = 0; - KTRIENODE* root; - - /* Find the states that have a MatchList */ - for (i = 0; i < KTRIE_ROOT_NODES; i++) - { - root = ts->root[i]; - /* each and every prefix match at this root*/ - if ( root and ts->agent ) - { - cnt += KTrieBuildMatchStateNode(sc, root, ts); - } - } - - return cnt; -} - -/* -* Build the Keyword TRIE -* -*/ -static inline int _KTrieCompile(KTRIE_STRUCT* ts) -{ - KTRIEPATTERN* p; - /* - static int tmem=0; // unused - */ - - /* - * Build the Keyword TRIE - */ - for ( p=ts->patrn; p; p=p->next ) - { - if ( KTrieInsert(ts, p) ) - return -1; - } - - /* - * Build A Setwise Bad Character Shift Table - */ - Build_Bad_Character_Shifts(ts); - - /* - tmem += ts->memory; - printf(" Compile stats: %d patterns, %d chars, %d duplicate patterns, %d bytes, %d total-bytes\n",ts->npats,ts->nchars,ts->duplicates,ts->memory,tmem); - */ - - return 0; -} - -int KTrieCompile(SnortConfig* sc, KTRIE_STRUCT* ts) -{ - int rval; - - if ((rval = _KTrieCompile(ts))) - return rval; - - if ( ts->agent ) - KTrieBuildMatchStateTrees(sc, ts); - - return 0; -} - -void sfksearch_print_qinfo(void) -{ -} - -/* -* Search - Algorithm -* -* This routine will log any substring of T that matches a keyword, -* and processes all prefix matches. This is used for generic -* pattern searching with a set of keywords and a body of text. -* -* -* -* kt- Trie Structure -* T - nocase text -* Tc- case specific text -* n - text length -* -* returns: -* # pattern matches -*/ -static inline int KTriePrefixMatch( - KTRIE_STRUCT* kt, const uint8_t* T, const uint8_t*, const uint8_t* bT, int n, - MpseMatch match, void* context) -{ - KTRIENODE* root = kt->root[ *T ]; - int nfound = 0; - KTRIEPATTERN* pk; - int index; - - /* Check if any keywords start with this character */ - if ( !root ) - return 0; - - while ( n ) - { - if ( root->edge == *T ) - { - T++; - n--; - - pk = root->pkeyword; - if (pk) - { - index = (int)(T - bT); - nfound++; - if (match (pk->user, pk->rule_option_tree, index, context, pk->neg_list) > 0) - { - return nfound; - } - } - - if ( n && root->child ) - { - root = root->child; - } - else /* cannot continue -- match is over */ - { - break; - } - } - else - { - if ( root->sibling ) - { - root = root->sibling; - } - else /* cannot continue */ - { - break; - } - } - } - - return nfound; -} - -/* -* -*/ -static inline int KTrieSearchNoBC( - KTRIE_STRUCT* ks, const uint8_t* Tx, int n, MpseMatch match, void* context) -{ - int nfound = 0; - const uint8_t* T, * bT; - - ConvertCaseEx(Tnocase, Tx, n); - - T = Tnocase; - bT = T; - - for (; n>0; n--, T++, Tx++ ) - { - nfound += KTriePrefixMatch(ks, T, Tx, bT, n, match, context); - } - - return nfound; -} - -/* -* -*/ -static inline int KTrieSearchBC( - KTRIE_STRUCT* ks, const uint8_t* Tx, int n, MpseMatch match, void* context) -{ - int tshift; - const uint8_t* Tend; - const uint8_t* T, * bT; - int nfound = 0; - short* bcShift = (short*)ks->bcShift; - int bcSize = ks->bcSize; - - ConvertCaseEx(Tnocase, Tx, n); - - T = Tnocase; - bT = T; - - Tend = T + n - bcSize; - - bcSize--; - - for (; T <= Tend; n--, T++, Tx++ ) - { - while ( (tshift = bcShift[ *( T + bcSize ) ]) > 0 ) - { - T += tshift; - Tx += tshift; - if ( T > Tend ) - return nfound; - } - - nfound += KTriePrefixMatch(ks, T, Tx, bT, n, match, context); - } - - return nfound; -} - -int KTrieSearch( - KTRIE_STRUCT* ks, const uint8_t* T, int n, MpseMatch match, void* context) -{ - if ( ks->bcSize < 3 ) - return KTrieSearchNoBC(ks, T, n, match, context); - else - return KTrieSearchBC(ks, T, n, match, context); -} - -/* -* -* TEST DRIVER FOR KEYWORD TRIE -* -*/ -#ifdef KTRIE_MAIN - -char** gargv; - -int trie_nmatches = 0; - -int match(unsigned id, int index, void* context) -{ - trie_nmatches++; - data = context; - printf("id=%d found at index=%d, %s\n",id,index,gargv[id]); - return 0; -} - -/* -* -*/ -int main(int argc, char** argv) -{ - int i; - KTRIE_STRUCT* ts; - int nocase=1; // don't care about case - - gargv = argv; - - ts = KTrieNew(); - - if ( argc < 3 ) - { - printf("%s text pat1 pat2 ... patn [-c(ase-sensitive)\n",argv[0]); - printf("search for keywords-default, or match keywords\n"); - exit(0); - } - - for (i=1; i %d characters, %d patterns, %d bytes allocated\n",ts->nchars,ts->npats,ts->memory); - - printf("Searching...\n"); - - KTrieSearch(ts, (uint8_t*)argv[1], strlen(argv[1]), match, 0); - - printf("%d matches found\n",trie_nmatches); - - printf("normal pgm finish.\n"); - - return 0; -} - -#endif - diff --git a/extra/src/search_engines/sfksearch.h b/extra/src/search_engines/sfksearch.h deleted file mode 100644 index 49496d28c..000000000 --- a/extra/src/search_engines/sfksearch.h +++ /dev/null @@ -1,97 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2003-2013 Sourcefire, Inc. -// Copyright (C) 2001 Marc Norton -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- - -#ifndef SFKSEARCH_H -#define SFKSEARCH_H - -// ksearch.h - Trie based multi-pattern matcher - -#include -#include "search_engines/search_common.h" - -struct KTRIEPATTERN -{ - KTRIEPATTERN* next; /* global list of all patterns*/ - KTRIEPATTERN* mnext; /* matching list of duplicate keywords*/ - - uint8_t* P; /* no case*/ - uint8_t* Pcase; /* case sensitive*/ - - void* user; - void* rule_option_tree; - void* neg_list; - - int n; - int nocase; - int negative; -}; - -struct KTRIENODE -{ - int edge; /* character*/ - - KTRIENODE* sibling; - KTRIENODE* child; - - KTRIEPATTERN* pkeyword; -}; - -#define KTRIE_ROOT_NODES 256 - -struct KTRIE_STRUCT -{ - KTRIEPATTERN* patrn; /* List of patterns, built as they are added*/ - KTRIENODE* root[KTRIE_ROOT_NODES]; /* KTrie nodes*/ - - const struct MpseAgent* agent; - - int memory; - int nchars; - int npats; - int duplicates; - int method; - int end_states; /* should equal npats - duplicates*/ - - int bcSize; - unsigned short bcShift[KTRIE_ROOT_NODES]; -}; - -void KTrie_init_xlatcase(); - -KTRIE_STRUCT* KTrieNew(int method, const MpseAgent*); - -int KTrieAddPattern( - KTRIE_STRUCT*, const uint8_t* P, unsigned n, - bool nocase, bool negative, void* id); - -int KTrieCompile(struct SnortConfig*, KTRIE_STRUCT*); - -int KTrieSearch(KTRIE_STRUCT*, const uint8_t* T, int n, MpseMatch, void* context); - -unsigned int KTrieMemUsed(); -void KTrieInitMemUsed(); - -void KTrieDelete(KTRIE_STRUCT*); -int KTriePatternCount(KTRIE_STRUCT*); - -void sfksearch_print_qinfo(); - -#endif - diff --git a/extra/src/search_engines/trie_api.cc b/extra/src/search_engines/trie_api.cc deleted file mode 100644 index 0e2438d07..000000000 --- a/extra/src/search_engines/trie_api.cc +++ /dev/null @@ -1,30 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// Copyright (C) 2013-2013 Sourcefire, Inc. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// trie_api.cc author Russ Combs - -#include "framework/mpse.h" - -extern const BaseApi* se_lowmem; - -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - se_lowmem, - nullptr -}; - diff --git a/extra/src/so_rules/CMakeLists.txt b/extra/src/so_rules/CMakeLists.txt deleted file mode 100644 index 1293e7990..000000000 --- a/extra/src/so_rules/CMakeLists.txt +++ /dev/null @@ -1,36 +0,0 @@ - -# Use this macro to create text files -macro (create_txt_header txt_file hdr_file) - - add_custom_command( OUTPUT ${hdr_file} - COMMAND - "${SNORT_EXECUTABLE}" --rule-to-text < "${CMAKE_CURRENT_LIST_DIR}/${txt_file}" > "${CMAKE_CURRENT_BINARY_DIR}/${hdr_file}" - DEPENDS "${txt_file}" - WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} - COMMENT "so_rules: Building ${hdr_file}" - ) - include_directories(${CMAKE_CURRENT_BINARY_DIR}) - -endmacro (create_txt_header) - -# Use this macro to create hex files -macro (create_pro_header txt_file hdr_file) - - add_custom_command( OUTPUT ${hdr_file} - COMMAND - "${SNORT_EXECUTABLE}" --rule-to-hex < "${CMAKE_CURRENT_LIST_DIR}/${txt_file}" > "${CMAKE_CURRENT_BINARY_DIR}/${hdr_file}" - DEPENDS "${txt_file}" - WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR} - COMMENT "so_rules: Building ${hdr_file}" - ) - include_directories(${CMAKE_CURRENT_BINARY_DIR}) -endmacro (create_pro_header) - - -create_txt_header(sid_18758.txt sid_18758.h) -add_example_library(18758 so_rules sid_18758.cc sid_18758.h) - - -# if we had a .pro file name 187589.pro and a source file names sid_18759.cc -#create_txt_header(187589.pro 187589.h) -#add_example_library(187589 so_rules 187589.cc 187589.h) diff --git a/extra/src/so_rules/Makefile.am b/extra/src/so_rules/Makefile.am deleted file mode 100644 index 1c5f14022..000000000 --- a/extra/src/so_rules/Makefile.am +++ /dev/null @@ -1,17 +0,0 @@ - -optlibdir = $(pkglibdir)/so_rules -optlib_LTLIBRARIES = lib18758.la -lib18758_la_CXXFLAGS = $(AM_CXXFLAGS) -lib18758_la_LDFLAGS = -export-dynamic -shared -lib18758_la_SOURCES = sid_18758.cc sid_18758.h - -# to make plain text rule header: -%.h : %.txt - snort --rule-to-text < $< > $@ - -# to make compressed rule header: -%.h : %.pro - snort --rule-to-hex < $< > $@ - -AM_CXXFLAGS = @AM_CXXFLAGS@ - diff --git a/extra/src/so_rules/sid_18758.cc b/extra/src/so_rules/sid_18758.cc deleted file mode 100644 index 9cd30b0a6..000000000 --- a/extra/src/so_rules/sid_18758.cc +++ /dev/null @@ -1,84 +0,0 @@ -//-------------------------------------------------------------------------- -// Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved. -// -// This program is free software; you can redistribute it and/or modify it -// under the terms of the GNU General Public License Version 2 as published -// by the Free Software Foundation. You may not use, modify or distribute -// this program under any other version of the GNU General Public License. -// -// This program is distributed in the hope that it will be useful, but -// WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. -//-------------------------------------------------------------------------- -// sid_18758.cc author Russ Combs - -#ifdef HAVE_CONFIG_H -#include "config.h" -#endif - -#include -#include - -#include "main/snort_types.h" -#include "framework/so_rule.h" -#include "detection/detection_defines.h" -#include "sid_18758.h" - -static int eval(void*, Cursor&, Packet*) -{ - return DETECTION_OPTION_MATCH; -} - -static SoEvalFunc ctor(const char* /*so*/, void** pv) -{ - // so == "eval" here because that's our only so: option - // but we could use multiple so: options and bind to - // different functions based on the value of so - // *pv can point to any data we need to use with so - *pv = nullptr; - return eval; -} - -static void dtor(void* /*pv*/) -{ - // cast pv to your type here - // and then delete it -} - -static const SoApi so_api = -{ - { - PT_SO_RULE, - sizeof(SoApi), - SOAPI_VERSION, - 8, - API_RESERVED, - API_OPTIONS, - "3|18758", - "SO rule example", - nullptr, - nullptr - }, - (uint8_t*)rule_18758, - rule_18758_len, - nullptr, // pinit - nullptr, // pterm - nullptr, // tinit - nullptr, // tterm - ctor, - dtor, -}; - -// other snort plugins can be put in this list as needed -// eg multiple rules in one so, custom rule options, etc. -SO_PUBLIC const BaseApi* snort_plugins[] = -{ - &so_api.base, - nullptr -}; - diff --git a/extra/src/so_rules/sid_18758.h b/extra/src/so_rules/sid_18758.h deleted file mode 100644 index 1b3654f8f..000000000 --- a/extra/src/so_rules/sid_18758.h +++ /dev/null @@ -1,36 +0,0 @@ -const uint8_t rule_18758[] = -{ - 0x61, 0x6C, 0x65, 0x72, 0x74, 0x20, 0x74, 0x63, 0x70, 0x20, 0x24, 0x48, 0x4F, 0x4D, 0x45, 0x5F, - 0x4E, 0x45, 0x54, 0x20, 0x61, 0x6E, 0x79, 0x20, 0x2D, 0x3E, 0x20, 0x24, 0x45, 0x58, 0x54, 0x45, - 0x52, 0x4E, 0x41, 0x4C, 0x5F, 0x4E, 0x45, 0x54, 0x20, 0x24, 0x48, 0x54, 0x54, 0x50, 0x5F, 0x50, - 0x4F, 0x52, 0x54, 0x53, 0x0A, 0x28, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x6D, 0x73, 0x67, 0x3A, 0x22, - 0x46, 0x49, 0x4C, 0x45, 0x2D, 0x49, 0x44, 0x45, 0x4E, 0x54, 0x49, 0x46, 0x59, 0x20, 0x4D, 0x69, - 0x63, 0x72, 0x6F, 0x73, 0x6F, 0x66, 0x74, 0x20, 0x57, 0x69, 0x6E, 0x64, 0x6F, 0x77, 0x73, 0x20, - 0x56, 0x69, 0x73, 0x75, 0x61, 0x6C, 0x20, 0x42, 0x61, 0x73, 0x69, 0x63, 0x20, 0x73, 0x63, 0x72, - 0x69, 0x70, 0x74, 0x20, 0x66, 0x69, 0x6C, 0x65, 0x20, 0x64, 0x6F, 0x77, 0x6E, 0x6C, 0x6F, 0x61, - 0x64, 0x20, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, - 0x6D, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x3A, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, - 0x20, 0x68, 0x74, 0x74, 0x70, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x66, 0x65, 0x72, - 0x65, 0x6E, 0x63, 0x65, 0x3A, 0x75, 0x72, 0x6C, 0x2C, 0x65, 0x6E, 0x2E, 0x77, 0x69, 0x6B, 0x69, - 0x70, 0x65, 0x64, 0x69, 0x61, 0x2E, 0x6F, 0x72, 0x67, 0x2F, 0x77, 0x69, 0x6B, 0x69, 0x2F, 0x56, - 0x62, 0x73, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x63, 0x6C, 0x61, 0x73, 0x73, 0x74, 0x79, 0x70, - 0x65, 0x3A, 0x6D, 0x69, 0x73, 0x63, 0x2D, 0x61, 0x63, 0x74, 0x69, 0x76, 0x69, 0x74, 0x79, 0x3B, - 0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, 0x69, 0x64, 0x3A, 0x31, 0x38, 0x37, 0x35, 0x38, 0x3B, 0x0A, - 0x20, 0x20, 0x20, 0x20, 0x72, 0x65, 0x76, 0x3A, 0x38, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x73, - 0x6F, 0x69, 0x64, 0x3A, 0x33, 0x7C, 0x31, 0x38, 0x37, 0x35, 0x38, 0x3B, 0x0A, 0x23, 0x20, 0x65, - 0x76, 0x65, 0x72, 0x79, 0x74, 0x68, 0x69, 0x6E, 0x67, 0x20, 0x61, 0x62, 0x6F, 0x76, 0x65, 0x20, - 0x61, 0x70, 0x70, 0x65, 0x61, 0x72, 0x73, 0x20, 0x69, 0x6E, 0x20, 0x73, 0x74, 0x75, 0x62, 0x0A, - 0x23, 0x20, 0x74, 0x68, 0x65, 0x20, 0x66, 0x6F, 0x6C, 0x6C, 0x6F, 0x77, 0x69, 0x6E, 0x67, 0x20, - 0x64, 0x65, 0x74, 0x65, 0x63, 0x74, 0x69, 0x6F, 0x6E, 0x20, 0x6F, 0x70, 0x74, 0x69, 0x6F, 0x6E, - 0x73, 0x20, 0x61, 0x72, 0x65, 0x20, 0x6E, 0x6F, 0x74, 0x20, 0x69, 0x6E, 0x20, 0x70, 0x72, 0x6F, - 0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x20, 0x73, 0x74, 0x75, 0x62, 0x0A, 0x20, 0x20, 0x20, 0x20, - 0x66, 0x6C, 0x6F, 0x77, 0x3A, 0x74, 0x6F, 0x5F, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2C, 0x65, - 0x73, 0x74, 0x61, 0x62, 0x6C, 0x69, 0x73, 0x68, 0x65, 0x64, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, - 0x68, 0x74, 0x74, 0x70, 0x5F, 0x75, 0x72, 0x69, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x63, 0x6F, - 0x6E, 0x74, 0x65, 0x6E, 0x74, 0x3A, 0x22, 0x2E, 0x76, 0x62, 0x73, 0x22, 0x2C, 0x20, 0x6E, 0x6F, - 0x63, 0x61, 0x73, 0x65, 0x3B, 0x0A, 0x20, 0x20, 0x20, 0x20, 0x70, 0x63, 0x72, 0x65, 0x3A, 0x22, - 0x2F, 0x5C, 0x78, 0x32, 0x65, 0x76, 0x62, 0x73, 0x28, 0x5B, 0x5C, 0x3F, 0x5C, 0x78, 0x35, 0x63, - 0x5C, 0x78, 0x32, 0x66, 0x5D, 0x7C, 0x24, 0x29, 0x2F, 0x73, 0x6D, 0x69, 0x22, 0x3B, 0x0A, 0x20, - 0x20, 0x20, 0x20, 0x73, 0x6F, 0x3A, 0x65, 0x76, 0x61, 0x6C, 0x3B, 0x0A, 0x29, 0x0A, 0x00, -}; -const unsigned rule_18758_len = 0; diff --git a/extra/src/so_rules/sid_18758.txt b/extra/src/so_rules/sid_18758.txt deleted file mode 100644 index 8daa4f343..000000000 --- a/extra/src/so_rules/sid_18758.txt +++ /dev/null @@ -1,17 +0,0 @@ -alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS -( - msg:"FILE-IDENTIFY Microsoft Windows Visual Basic script file download request"; - metadata:service http; - reference:url,en.wikipedia.org/wiki/Vbs; - classtype:misc-activity; - sid:18758; - rev:8; - soid:3|18758; -# everything above appears in stub -# the following detection options are not in protected stub - flow:to_server,established; - http_uri; - content:".vbs", nocase; - pcre:"/\x2evbs([\?\x5c\x2f]|$)/smi"; - so:eval; -)