From: Russ Combs Date: Wed, 22 Oct 2014 19:25:02 +0000 (-0400) Subject: refactored flow state X-Git-Tag: 3.0.0-233~1345 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=bd79ac32c9ac5cdaa6ebe799416ce0c46ea90bc6;p=thirdparty%2Fsnort3.git refactored flow state --- diff --git a/ChangeLog b/ChangeLog index cd4b5c200..ef4905a25 100644 --- a/ChangeLog +++ b/ChangeLog @@ -8,6 +8,7 @@ -- ip defrag fixes -- refactored splitter fallback -- fix binder.use.service +-- refactored flow state 125 -- discovered can't catch exceptions thrown from Lua to C++; need to diff --git a/src/flow/flow.cc b/src/flow/flow.cc index 1da4f0e63..1c8f4695c 100644 --- a/src/flow/flow.cc +++ b/src/flow/flow.cc @@ -135,10 +135,15 @@ void Flow::restart(bool freeAppData) expire_time = 0; } +//static const char* fsxlt[] = +//{ +// "setup", "inspect", "allow", "block" +//}; + void Flow::clear(bool freeAppData) { restart(freeAppData); - flow_state = 0; + set_state(SETUP); if ( ssn_client ) { diff --git a/src/flow/flow.h b/src/flow/flow.h index c5e9c2b9c..96e8395cd 100644 --- a/src/flow/flow.h +++ b/src/flow/flow.h @@ -115,7 +115,7 @@ private: unsigned id; }; -struct FlowState +struct LwState { uint32_t session_flags; @@ -126,16 +126,24 @@ struct FlowState char ignore_direction; /* flag to ignore traffic on this session */ }; -typedef enum { +enum Stream_Event +{ SE_REXMIT, SE_EOF, SE_MAX -} Stream_Event; +}; // this struct is organized by member size for compactness class Flow { public: + enum FlowState + { + SETUP, + INSPECT, + BLOCK, + ALLOW + }; Flow(); Flow(PktType); ~Flow(); @@ -171,6 +179,9 @@ public: bool was_blocked() const { return (s5_state.session_flags & SSNFLAG_BLOCK) != 0; }; + void set_state(FlowState fs) + { flow_state = fs; }; + void set_client(Inspector* ins) { ssn_client = ins; @@ -224,8 +235,8 @@ public: // FIXIT-M privatize if possible unsigned policy_id; - int flow_state; // FIXIT-H wow - this is poorly encapsulated! did i do that? :( - FlowState s5_state; // FIXIT-L rename this (s5 not appropriate) + FlowState flow_state; + LwState s5_state; // FIXIT-L rename this (s5 not appropriate) // FIXIT-L can client and server ip and port be removed from flow? sfip_t client_ip; // FIXIT-L family and bits should be changed to uint16_t diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc index 4b0e01f58..57e131ecf 100644 --- a/src/flow/flow_control.cc +++ b/src/flow/flow_control.cc @@ -342,36 +342,35 @@ unsigned FlowControl::process(FlowCache* cache, Packet* p) { init_roles(p, flow); Inspector* b = InspectorManager::get_binder(); + if ( b ) b->eval(p); + + if ( !flow->ssn_client || !flow->session->setup(p) ) + flow->set_state(Flow::ALLOW); + ++news; } switch ( flow->flow_state ) { - case 1: // block - stream.drop_packet(p); - flow->flow_state = 1; - break; - - case 2: // allow - stream.stop_inspection(flow, p, SSN_DIR_BOTH, -1, 0); + case Flow::SETUP: + flow->set_state(Flow::ALLOW); break; - case 3: // setup - if ( !flow->ssn_client || !flow->session->setup(p) ) - { - flow->flow_state = 2; - break; - } - flow->flow_state = 4; - // now process - - case 4: // inspect + case Flow::INSPECT: assert(flow->ssn_client); assert(flow->ssn_server); flow->session->process(p); break; + + case Flow::ALLOW: + stream.stop_inspection(flow, p, SSN_DIR_BOTH, -1, 0); + break; + + case Flow::BLOCK: + stream.drop_packet(p); + break; } if ( flow->next && is_bidirectional(flow) ) diff --git a/src/network_inspectors/binder/bind_module.cc b/src/network_inspectors/binder/bind_module.cc index 8268ab1e9..3e9ebfb22 100644 --- a/src/network_inspectors/binder/bind_module.cc +++ b/src/network_inspectors/binder/bind_module.cc @@ -163,7 +163,7 @@ bool BinderModule::set(const char* fqn, Value& v, SnortConfig*) // use else if ( v.is("action") ) - work->use.action = (BindAction)(v.get_long() + 1); + work->use.action = (BindAction)(v.get_long()); else if ( v.is("file") ) { diff --git a/src/network_inspectors/binder/binder.cc b/src/network_inspectors/binder/binder.cc index 175bb1e3e..c1207c334 100644 --- a/src/network_inspectors/binder/binder.cc +++ b/src/network_inspectors/binder/binder.cc @@ -211,9 +211,16 @@ void Binder::eval(Packet* p) flow->iface_out = p->pkth->egress_index; Binding* pb = get_binding(flow); - flow->flow_state = apply(flow, pb); + BindAction action = apply(flow, pb); - ++bstats.verdicts[flow->flow_state - 1]; + switch ( action ) + { + case BA_BLOCK: flow->set_state(Flow::BLOCK); break; + case BA_ALLOW: flow->set_state(Flow::ALLOW); break; + case BA_INSPECT: flow->set_state(Flow::INSPECT); break; + } + + ++bstats.verdicts[action]; ++bstats.packets; } diff --git a/src/network_inspectors/binder/binding.h b/src/network_inspectors/binder/binding.h index 0951761c7..4f1a654ef 100644 --- a/src/network_inspectors/binder/binding.h +++ b/src/network_inspectors/binder/binding.h @@ -37,7 +37,7 @@ enum BindRole enum BindAction { - BA_BLOCK = 1, + BA_BLOCK, BA_ALLOW, BA_INSPECT }; diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc index 9095da573..a20fadfac 100644 --- a/src/stream/stream_api.cc +++ b/src/stream/stream_api.cc @@ -229,7 +229,7 @@ void Stream::stop_inspection( /* TODO: Handle bytes/response parameters */ DisableInspection(p); - flow->flow_state = 2; + flow->set_state(Flow::ALLOW); } void Stream::resume_inspection(Flow* flow, char dir) @@ -297,7 +297,7 @@ void Stream::drop_packet(Packet *p) if (!flow) return; - flow->flow_state = 1; + flow->set_state(Flow::BLOCK); flow->session->clear(); if (!(p->packet_flags & PKT_STATELESS))