From: Russ Combs (rucombs) Date: Wed, 17 May 2017 18:13:44 +0000 (-0400) Subject: Merge pull request #896 in SNORT/snort3 from appidz to master X-Git-Tag: 3.0.0-239~80 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f60dcbe2ea798d09e3f26e960f36477702c518f8;p=thirdparty%2Fsnort3.git Merge pull request #896 in SNORT/snort3 from appidz to master Squashed commit of the following: commit f74a4934f522d20201f3e9607352205171979874 Author: Russ Combs Date: Wed May 17 12:20:47 2017 -0400 detection: rename method for clarity commit c9c1f77634e1d7926e103135a56476e2ea7a8323 Author: Russ Combs Date: Wed May 17 11:52:48 2017 -0400 detection: ensure reassembly is in next context commit 3cc411a86df37df167e1246d20c438bee0216d99 Author: Russ Combs Date: Tue May 16 21:43:59 2017 -0400 search tool: refactor to remove dependencies commit 7b38d3db78bf7a1f11ad65627dd724fdf0962674 Author: Russ Combs Date: Tue May 16 16:32:34 2017 -0400 search tool: refactor unit test commit b4ae4ce14603a5e730145e4231fccee78eb03af6 Author: Russ Combs Date: Tue May 16 12:49:47 2017 -0400 search tool: use configured or default method commit fd996bdb1f947cb9ed3ac547e5ed2227ccdfef89 Author: Russ Combs Date: Tue May 16 12:23:25 2017 -0400 search tool: refactor ctor commit fc758793dbc64bb3db8a72362a32c10b9f18a682 Author: Russ Combs Date: Tue May 16 12:24:32 2017 -0400 appid: master key must be thread local commit 7d4db6cfc221d5ac0b98916b88839c3e77e3d359 Author: Russ Combs Date: Tue May 16 12:22:39 2017 -0400 appid: use actual referer length for search --- diff --git a/src/detection/detection_engine.cc b/src/detection/detection_engine.cc index 393edbc40..ef4c0b662 100644 --- a/src/detection/detection_engine.cc +++ b/src/detection/detection_engine.cc @@ -110,7 +110,8 @@ Packet* DetectionEngine::get_encode_packet() // we need to stay in the current context until rebuild is successful // any events while rebuilding will be logged against the current packet -Packet* DetectionEngine::set_packet() +// however, rebuild is always in the next context, not current. +Packet* DetectionEngine::set_next_packet() { const IpsContext* c = Snort::get_switcher()->get_next(); Packet* p = c->packet; @@ -141,6 +142,12 @@ uint8_t* DetectionEngine::get_buffer(unsigned& max) return Snort::get_switcher()->get_context()->buf; } +uint8_t* DetectionEngine::get_next_buffer(unsigned& max) +{ + max = IpsContext::buf_size; + return Snort::get_switcher()->get_next()->buf; +} + DataBuffer& DetectionEngine::get_alt_buffer(Packet* p) { assert(p); diff --git a/src/detection/detection_engine.h b/src/detection/detection_engine.h index 37ad0b06d..0531947e4 100644 --- a/src/detection/detection_engine.h +++ b/src/detection/detection_engine.h @@ -22,7 +22,7 @@ #define DETECTION_ENGINE_H // DetectionEngine manages a detection context. To detect a rebuilt -// packet (PDU), first call set_packet(). If rebuild is successful, +// packet (PDU), first call set_next_packet(). If rebuild is successful, // then instantiate a new DetectionEngine to detect that packet. #include "actions/actions.h" @@ -52,7 +52,8 @@ public: static IpsContext* get_context(); static Packet* get_current_packet(); - static Packet* set_packet(); + static Packet* set_next_packet(); + static uint8_t* get_next_buffer(unsigned& max); static bool offloaded(Packet*); static bool offload(Packet*); diff --git a/src/detection/fp_config.cc b/src/detection/fp_config.cc index 101a86823..3f5bd8d3c 100644 --- a/src/detection/fp_config.cc +++ b/src/detection/fp_config.cc @@ -32,6 +32,7 @@ #include #include +#include "framework/mpse.h" #include "log/messages.h" #include "managers/mpse_manager.h" @@ -51,7 +52,7 @@ FastPatternConfig::FastPatternConfig() FastPatternConfig::~FastPatternConfig() { } -bool FastPatternConfig::set_detect_search_method(const char* method) +bool FastPatternConfig::set_search_method(const char* method) { const MpseApi* api = MpseManager::get_search_api(method); @@ -63,6 +64,14 @@ bool FastPatternConfig::set_detect_search_method(const char* method) return true; } +const char* FastPatternConfig::get_search_method() +{ + if ( !search_api ) + return nullptr; + + return search_api->base.name; +} + void FastPatternConfig::set_max_pattern_len(unsigned int max_len) { if (max_pattern_len != 0) diff --git a/src/detection/fp_config.h b/src/detection/fp_config.h index c5a2659df..302914d22 100644 --- a/src/detection/fp_config.h +++ b/src/detection/fp_config.h @@ -118,7 +118,9 @@ public: int get_search_opt() { return search_opt; } - bool set_detect_search_method(const char*); + bool set_search_method(const char*); + const char* get_search_method(); + void set_max_pattern_len(unsigned); const struct MpseApi* get_search_api() diff --git a/src/flow/flow.cc b/src/flow/flow.cc index 4a8a2d0fb..21e6ca0bf 100644 --- a/src/flow/flow.cc +++ b/src/flow/flow.cc @@ -128,7 +128,7 @@ inline void Flow::clean() void Flow::reset(bool do_cleanup) { DetectionEngine::onload(this); - DetectionEngine::set_packet(); + DetectionEngine::set_next_packet(); DetectionEngine de; if ( session ) diff --git a/src/main/modules.cc b/src/main/modules.cc index 6e2d3a54c..9c20a0e6f 100644 --- a/src/main/modules.cc +++ b/src/main/modules.cc @@ -331,7 +331,7 @@ bool SearchEngineModule::set(const char*, Value& v, SnortConfig* sc) else if ( v.is("search_method") ) { - if ( !fp->set_detect_search_method(v.get_string()) ) + if ( !fp->set_search_method(v.get_string()) ) return false; } else if ( v.is("search_optimize") ) diff --git a/src/managers/mpse_manager.cc b/src/managers/mpse_manager.cc index 5719a1797..bcb5c907a 100644 --- a/src/managers/mpse_manager.cc +++ b/src/managers/mpse_manager.cc @@ -25,8 +25,10 @@ #include +#include "detection/fp_config.h" #include "framework/mpse.h" #include "log/messages.h" +#include "main/snort_config.h" #include "module_manager.h" @@ -95,6 +97,12 @@ Mpse* MpseManager::get_search_engine( Mpse* MpseManager::get_search_engine(const char* type) { + if ( !type and snort_conf->fast_pattern_config ) + type = snort_conf->fast_pattern_config->get_search_method(); + + if ( !type ) + type = "ac_bnfa"; + const MpseApi* api = get_search_api(type); if ( !api ) @@ -103,6 +111,10 @@ Mpse* MpseManager::get_search_engine(const char* type) Module* mod = ModuleManager::get_module(api->base.name); Mpse* eng = api->ctor(nullptr, mod, nullptr); eng->set_api(api); + + if ( snort_conf->fast_pattern_config and snort_conf->fast_pattern_config->get_search_opt() ) + eng->set_opt(1); + return eng; } diff --git a/src/mime/file_mime_process.cc b/src/mime/file_mime_process.cc index f4772a30c..35327feb6 100644 --- a/src/mime/file_mime_process.cc +++ b/src/mime/file_mime_process.cc @@ -700,7 +700,7 @@ void MimeSession::init() const MimeToken* tmp; /* Header search */ - mime_hdr_search_mpse = new SearchTool(); + mime_hdr_search_mpse = new SearchTool; if (mime_hdr_search_mpse == nullptr) { // FIXIT-M make configurable or at least fall back to any diff --git a/src/network_inspectors/appid/app_forecast.cc b/src/network_inspectors/appid/app_forecast.cc index afd825204..886e670a8 100644 --- a/src/network_inspectors/appid/app_forecast.cc +++ b/src/network_inspectors/appid/app_forecast.cc @@ -31,7 +31,7 @@ #include "time/packet_time.h" #include "appid_session.h" -static AFActKey master_key; +static THREAD_LOCAL AFActKey master_key; static THREAD_LOCAL SFXHASH* AF_indicators = nullptr; // list of "indicator apps" static THREAD_LOCAL SFXHASH* AF_actives = nullptr; // list of hosts to watch diff --git a/src/network_inspectors/appid/appid_discovery.cc b/src/network_inspectors/appid/appid_discovery.cc index 41182b626..2c1dd7da0 100644 --- a/src/network_inspectors/appid/appid_discovery.cc +++ b/src/network_inspectors/appid/appid_discovery.cc @@ -49,8 +49,8 @@ AppIdDiscovery::AppIdDiscovery() { - tcp_patterns = new SearchTool("ac_full"); - udp_patterns = new SearchTool("ac_full"); + tcp_patterns = new SearchTool; + udp_patterns = new SearchTool; } AppIdDiscovery::~AppIdDiscovery() diff --git a/src/network_inspectors/appid/appid_utils/sf_mlmp.cc b/src/network_inspectors/appid/appid_utils/sf_mlmp.cc index 410ac1c9a..7ad7f508e 100644 --- a/src/network_inspectors/appid/appid_utils/sf_mlmp.cc +++ b/src/network_inspectors/appid/appid_utils/sf_mlmp.cc @@ -212,7 +212,7 @@ static int createTreesRecusively(tMlmpTree* rootNode) tPatternNode* ddPatternNode; /* set up the MPSE for url patterns */ - patternMatcher = rootNode->patternTree = new SearchTool("ac_full"); + patternMatcher = rootNode->patternTree = new SearchTool; for (primaryPatternNode = rootNode->patternList; primaryPatternNode; diff --git a/src/network_inspectors/appid/appid_utils/sf_multi_mpse.cc b/src/network_inspectors/appid/appid_utils/sf_multi_mpse.cc index 4bdb39a6f..a96e7d8da 100644 --- a/src/network_inspectors/appid/appid_utils/sf_multi_mpse.cc +++ b/src/network_inspectors/appid/appid_utils/sf_multi_mpse.cc @@ -184,7 +184,7 @@ static int createTreesRecusively(void* root) tPatternList* patternNode; /* set up the MPSE for url patterns */ - if (!(patternMatcher = rootNode->patternTree = new SearchTool("ac_full"))) + if (!(patternMatcher = rootNode->patternTree = new SearchTool)) return -1; for (patternNode = rootNode->patternList; diff --git a/src/network_inspectors/appid/detector_plugins/detector_dns.cc b/src/network_inspectors/appid/detector_plugins/detector_dns.cc index 717663b4d..889f53408 100644 --- a/src/network_inspectors/appid/detector_plugins/detector_dns.cc +++ b/src/network_inspectors/appid/detector_plugins/detector_dns.cc @@ -184,7 +184,7 @@ static int dns_host_detector_create_matcher(DetectorDNSHostPattern* list) if (serviceDnsConfig.dns_host_host_matcher) delete serviceDnsConfig.dns_host_host_matcher; - serviceDnsConfig.dns_host_host_matcher = new SearchTool("ac_full"); + serviceDnsConfig.dns_host_host_matcher = new SearchTool; if (!serviceDnsConfig.dns_host_host_matcher) return 0; diff --git a/src/network_inspectors/appid/detector_plugins/detector_imap.cc b/src/network_inspectors/appid/detector_plugins/detector_imap.cc index e942d8962..a2a36df7c 100644 --- a/src/network_inspectors/appid/detector_plugins/detector_imap.cc +++ b/src/network_inspectors/appid/detector_plugins/detector_imap.cc @@ -516,7 +516,7 @@ ImapClientDetector::~ImapClientDetector() void ImapClientDetector::do_custom_init() { unsigned index = 0; - cmd_matcher = new SearchTool("ac_full"); + cmd_matcher = new SearchTool; if ( tcp_patterns.size() ) for (auto& pat : tcp_patterns) diff --git a/src/network_inspectors/appid/detector_plugins/detector_pattern.cc b/src/network_inspectors/appid/detector_plugins/detector_pattern.cc index 180086e0c..c2885bd98 100644 --- a/src/network_inspectors/appid/detector_plugins/detector_pattern.cc +++ b/src/network_inspectors/appid/detector_plugins/detector_pattern.cc @@ -122,7 +122,7 @@ static void register_pattern(SearchTool** patterns, Pattern* pattern) { if (!*patterns) { - *patterns = new SearchTool("ac_full"); + *patterns = new SearchTool; if (!*patterns) { ErrorMessage("Error initializing the pattern table\n"); diff --git a/src/network_inspectors/appid/detector_plugins/detector_pop3.cc b/src/network_inspectors/appid/detector_plugins/detector_pop3.cc index 39f5619e6..6ad92ce8c 100644 --- a/src/network_inspectors/appid/detector_plugins/detector_pop3.cc +++ b/src/network_inspectors/appid/detector_plugins/detector_pop3.cc @@ -209,7 +209,7 @@ Pop3ClientDetector::~Pop3ClientDetector() void Pop3ClientDetector::do_custom_init() { unsigned index = 0; - cmd_matcher = new SearchTool("ac_full"); + cmd_matcher = new SearchTool; if ( tcp_patterns.size() ) for (auto& pat : tcp_patterns) diff --git a/src/network_inspectors/appid/detector_plugins/http_url_patterns.cc b/src/network_inspectors/appid/detector_plugins/http_url_patterns.cc index f3fca7aff..46b3cb33b 100644 --- a/src/network_inspectors/appid/detector_plugins/http_url_patterns.cc +++ b/src/network_inspectors/appid/detector_plugins/http_url_patterns.cc @@ -698,7 +698,7 @@ int HttpPatternMatchers::process_host_patterns(DetectorHTTPPatterns patterns) int HttpPatternMatchers::process_chp_list(CHPListElement* chplist) { for (size_t i = 0; i <= MAX_PATTERN_TYPE; i++) - chp_matchers[i] = new SearchTool("ac_full"); + chp_matchers[i] = new SearchTool; for (CHPListElement* chpe = chplist; chpe; chpe = chpe->next) chp_matchers[chpe->chp_action.ptype]->add(chpe->chp_action.pattern, @@ -739,7 +739,7 @@ static FieldPattern http_field_patterns[] = static SearchTool* process_http_field_patterns(FieldPattern* patternList, size_t patternListCount) { - SearchTool* patternMatcher = new SearchTool("ac_full"); + SearchTool* patternMatcher = new SearchTool; for (size_t i=0; i < patternListCount; i++) patternMatcher->add( (char*)patternList[i].data, patternList[i].length, @@ -1690,8 +1690,9 @@ bool HttpPatternMatchers::get_appid_from_url(char* host, char* url, char** versi APPINFO_FLAG_REFERRED))) { char* referer_start = referer; + size_t ref_len = strlen(referer); - char* referer_offset = (char*)service_strstr((uint8_t*)referer_start, URL_SCHEME_MAX_LEN, + char* referer_offset = (char*)service_strstr((uint8_t*)referer_start, ref_len, (uint8_t*)URL_SCHEME_END_PATTERN, sizeof(URL_SCHEME_END_PATTERN)-1); if ( !referer_offset ) diff --git a/src/network_inspectors/appid/service_plugins/service_mdns.cc b/src/network_inspectors/appid/service_plugins/service_mdns.cc index 9ca5048c9..ccc4f484b 100644 --- a/src/network_inspectors/appid/service_plugins/service_mdns.cc +++ b/src/network_inspectors/appid/service_plugins/service_mdns.cc @@ -104,7 +104,7 @@ MdnsServiceDetector::MdnsServiceDetector(ServiceDiscovery* sd) { 5353, IpProtocol::UDP, false }, }; - matcher = new SearchTool("ac_full"); + matcher = new SearchTool; for (unsigned i = 0; i < sizeof(patterns) / sizeof(*patterns); i++) matcher->add((char*)patterns[i].pattern, patterns[i].length, &patterns[i]); matcher->prep(); diff --git a/src/network_inspectors/appid/service_plugins/service_ssl.cc b/src/network_inspectors/appid/service_plugins/service_ssl.cc index ec76549df..80a9854d5 100644 --- a/src/network_inspectors/appid/service_plugins/service_ssl.cc +++ b/src/network_inspectors/appid/service_plugins/service_ssl.cc @@ -238,7 +238,7 @@ static int ssl_detector_create_matcher(SearchTool** matcher, DetectorSSLCertPatt if (*matcher) delete *matcher; - if (!(*matcher = new SearchTool("ac_full"))) + if (!(*matcher = new SearchTool)) return 0; patternIndex = &size; diff --git a/src/network_inspectors/binder/test/binder_test.cc b/src/network_inspectors/binder/test/binder_test.cc index b1680c7a6..cfb7b4930 100644 --- a/src/network_inspectors/binder/test/binder_test.cc +++ b/src/network_inspectors/binder/test/binder_test.cc @@ -88,7 +88,7 @@ bool sfvar_ip_in(sfip_var_t*, const SfIp*) { return false; } SO_PUBLIC Inspector* InspectorManager::get_inspector(const char*, bool) { return s_inspector; } InspectorType InspectorManager::get_type(const char*) { return InspectorType::IT_BINDER; } Inspector* InspectorManager::get_binder() { return nullptr; } -uint8_t* DetectionEngine::get_buffer(unsigned&) { return nullptr; } +uint8_t* DetectionEngine::get_next_buffer(unsigned&) { return nullptr; } int16_t ProtocolReference::find(const char*) { return 0; } const char* ProtocolReference::get_name(uint16_t) { return ""; } diff --git a/src/search_engines/search_tool.cc b/src/search_engines/search_tool.cc index 0f627b16b..4a78d4aaf 100644 --- a/src/search_engines/search_tool.cc +++ b/src/search_engines/search_tool.cc @@ -23,26 +23,14 @@ #include "search_tool.h" -#include "managers/mpse_manager.h" -#include "main/snort_config.h" -#include "detection/fp_config.h" +#include -SearchTool::SearchTool() : SearchTool("ac_bnfa") -{ -} +#include "managers/mpse_manager.h" SearchTool::SearchTool(const char* method) { - if ( snort_conf->fast_pattern_config ) - { - const struct MpseApi* mpse_api = snort_conf->fast_pattern_config->get_search_api(); - mpse = MpseManager::get_search_engine(snort_conf, mpse_api, nullptr); - - if ( mpse && snort_conf->fast_pattern_config->get_search_opt() ) - mpse->set_opt(1); - } - else - mpse = MpseManager::get_search_engine(method); + mpse = MpseManager::get_search_engine(method); + assert(mpse); max_len = 0; } diff --git a/src/search_engines/search_tool.h b/src/search_engines/search_tool.h index 1842e3db1..1c87ec829 100644 --- a/src/search_engines/search_tool.h +++ b/src/search_engines/search_tool.h @@ -25,13 +25,13 @@ class SO_PUBLIC SearchTool { public: - SearchTool(); - SearchTool(const char* method); + SearchTool(const char* method = nullptr); ~SearchTool(); void add(const char* pattern, unsigned len, int s_id, bool no_case = true); - void add(const uint8_t* pattern, unsigned len, int s_id, bool no_case = true); void add(const char* pattern, unsigned len, void* s_context, bool no_case = true); + + void add(const uint8_t* pattern, unsigned len, int s_id, bool no_case = true); void add(const uint8_t* pattern, unsigned len, void* s_context, bool no_case = true); void prep(); diff --git a/src/search_engines/test/search_tool_test.cc b/src/search_engines/test/search_tool_test.cc index 0c54cec80..bc185a478 100644 --- a/src/search_engines/test/search_tool_test.cc +++ b/src/search_engines/test/search_tool_test.cc @@ -38,7 +38,6 @@ #include #include - //------------------------------------------------------------------------- // base stuff //------------------------------------------------------------------------- @@ -53,6 +52,7 @@ SnortConfig::SnortConfig() state = &s_state; memset(state, 0, sizeof(*state)); num_slots = 1; + fast_pattern_config = nullptr; } SnortConfig::~SnortConfig() { } @@ -116,32 +116,24 @@ static MpseAgent s_agent = }; extern const BaseApi* se_ac_bnfa; -const MpseApi* mpse_api = (MpseApi*)se_ac_bnfa; -Mpse* acf = nullptr; +Mpse* mpse = nullptr; Mpse* MpseManager::get_search_engine(const char *type) { - acf = nullptr; + assert(!strcmp(type, "ac_bnfa")); - if(strcmp(type, "ac_bnfa") == 0) - { - CHECK(se_ac_bnfa); - mpse_api->init(); - acf = mpse_api->ctor(snort_conf, nullptr, &s_agent); - CHECK(acf); - } + const MpseApi* mpse_api = (MpseApi*)se_ac_bnfa; + mpse_api->init(); + mpse = mpse_api->ctor(snort_conf, nullptr, &s_agent); + CHECK(mpse); - return acf; -} - -Mpse* MpseManager::get_search_engine(SnortConfig*, const MpseApi*, const MpseAgent*) -{ - return MpseManager::get_search_engine("ac_bnfa"); + return mpse; } void MpseManager::delete_search_engine(Mpse*) { - mpse_api->dtor(acf); + const MpseApi* mpse_api = (MpseApi*)se_ac_bnfa; + mpse_api->dtor(mpse); } Mpse::Mpse(const char*) { } @@ -171,14 +163,12 @@ static int Test_SearchStrFound( TEST_GROUP(search_tool_tests) { void setup() - { - CHECK(se_ac_bnfa); - } + { CHECK(se_ac_bnfa); } }; TEST(search_tool_tests, ac_bnfa) { - SearchTool *stool = new SearchTool; + SearchTool *stool = new SearchTool("ac_bnfa"); CHECK(stool->mpse); pattern_id = 1; diff --git a/src/service_inspectors/dce_rpc/dce_common.cc b/src/service_inspectors/dce_rpc/dce_common.cc index 053519c1b..d462fabb5 100644 --- a/src/service_inspectors/dce_rpc/dce_common.cc +++ b/src/service_inspectors/dce_rpc/dce_common.cc @@ -364,7 +364,7 @@ static void dce2_fill_rpkt_info(Packet* rpkt, Packet* p) Packet* DCE2_GetRpkt(Packet* p,DCE2_RpktType rpkt_type, const uint8_t* data, uint32_t data_len) { - Packet* rpkt = DetectionEngine::set_packet(); + Packet* rpkt = DetectionEngine::set_next_packet(); dce2_fill_rpkt_info(rpkt, p); uint16_t data_overhead = 0; diff --git a/src/service_inspectors/http_inspect/http_js_norm.cc b/src/service_inspectors/http_inspect/http_js_norm.cc index 35714dedd..a828a3637 100644 --- a/src/service_inspectors/http_inspect/http_js_norm.cc +++ b/src/service_inspectors/http_inspect/http_js_norm.cc @@ -43,8 +43,8 @@ void HttpJsNorm::configure() if ( javascript_search_mpse || htmltype_search_mpse ) return; - javascript_search_mpse = new SearchTool(); - htmltype_search_mpse = new SearchTool(); + javascript_search_mpse = new SearchTool; + htmltype_search_mpse = new SearchTool; javascript_search_mpse->add(script_start, script_start_length, JS_JAVASCRIPT); javascript_search_mpse->prep(); diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc index 59decc2d0..ff4c9e377 100644 --- a/src/service_inspectors/imap/imap.cc +++ b/src/service_inspectors/imap/imap.cc @@ -182,7 +182,7 @@ static void IMAP_SearchInit() const IMAPToken* tmp; if ( imap_cmd_search_mpse ) return; - imap_cmd_search_mpse = new SearchTool(); + imap_cmd_search_mpse = new SearchTool; for (tmp = &imap_known_cmds[0]; tmp->name != NULL; tmp++) { @@ -191,7 +191,7 @@ static void IMAP_SearchInit() imap_cmd_search_mpse->add(tmp->name, tmp->name_len, tmp->search_id); } imap_cmd_search_mpse->prep(); - imap_resp_search_mpse = new SearchTool(); + imap_resp_search_mpse = new SearchTool; for (tmp = &imap_resps[0]; tmp->name != NULL; tmp++) { diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc index 01799f44f..b4627b531 100644 --- a/src/service_inspectors/pop/pop.cc +++ b/src/service_inspectors/pop/pop.cc @@ -139,7 +139,7 @@ static void POP_SearchInit() const POPToken* tmp; if ( pop_cmd_search_mpse ) return; - pop_cmd_search_mpse = new SearchTool(); + pop_cmd_search_mpse = new SearchTool; for (tmp = &pop_known_cmds[0]; tmp->name != NULL; tmp++) { @@ -148,7 +148,7 @@ static void POP_SearchInit() pop_cmd_search_mpse->add(tmp->name, tmp->name_len, tmp->search_id); } pop_cmd_search_mpse->prep(); - pop_resp_search_mpse = new SearchTool(); + pop_resp_search_mpse = new SearchTool; for (tmp = &pop_resps[0]; tmp->name != NULL; tmp++) { diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc index b1f486fbe..66e2e01fa 100644 --- a/src/service_inspectors/smtp/smtp.cc +++ b/src/service_inspectors/smtp/smtp.cc @@ -255,7 +255,7 @@ static void SMTP_TermCmds(SMTP_PROTO_CONF* config) static void SMTP_CommandSearchInit(SMTP_PROTO_CONF* config) { - config->cmd_search_mpse = new SearchTool(); + config->cmd_search_mpse = new SearchTool; config->cmd_search = (SMTPSearch*)snort_calloc(config->num_cmds, sizeof(*config->cmd_search)); for ( const SMTPToken* tmp = config->cmds; tmp->name != NULL; tmp++ ) @@ -281,7 +281,7 @@ static void SMTP_ResponseSearchInit() if ( smtp_resp_search_mpse ) return; - smtp_resp_search_mpse = new SearchTool(); + smtp_resp_search_mpse = new SearchTool; for (tmp = &smtp_resps[0]; tmp->name != NULL; tmp++) { diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc index d59e91457..de85eb458 100644 --- a/src/stream/ip/ip_defrag.cc +++ b/src/stream/ip/ip_defrag.cc @@ -592,7 +592,7 @@ static void FragRebuild(FragTracker* ft, Packet* p) Profile profile(fragRebuildPerfStats); size_t offset = 0; - Packet* dpkt = DetectionEngine::set_packet(); + Packet* dpkt = DetectionEngine::set_next_packet(); PacketManager::encode_format(ENC_FLAG_DEF|ENC_FLAG_FWD, p, dpkt, PSEUDO_PKT_IP); // the encoder ensures enough space for a maximum datagram diff --git a/src/stream/stream_splitter.cc b/src/stream/stream_splitter.cc index 5df95bf9e..32adf9200 100644 --- a/src/stream/stream_splitter.cc +++ b/src/stream/stream_splitter.cc @@ -37,7 +37,7 @@ const StreamBuffer StreamSplitter::reassemble( unsigned n, uint32_t flags, unsigned& copied) { unsigned max; - uint8_t* pdu_buf = DetectionEngine::get_buffer(max); + uint8_t* pdu_buf = DetectionEngine::get_next_buffer(max); assert(offset + n < max); memcpy(pdu_buf+offset, p, n); diff --git a/src/stream/tcp/tcp_reassembler.cc b/src/stream/tcp/tcp_reassembler.cc index 2cd06c874..b83b80324 100644 --- a/src/stream/tcp/tcp_reassembler.cc +++ b/src/stream/tcp/tcp_reassembler.cc @@ -593,7 +593,7 @@ int TcpReassembler::_flush_to_seq(uint32_t bytes, Packet* p, uint32_t pkt_flags) Profile profile(s5TcpFlushPerfStats); DetectionEngine::onload(session->flow); - Packet* pdu = DetectionEngine::set_packet(); + Packet* pdu = DetectionEngine::set_next_packet(); if ( !p ) { @@ -621,7 +621,7 @@ int TcpReassembler::_flush_to_seq(uint32_t bytes, Packet* p, uint32_t pkt_flags) footprint = pdu->max_dsize; DetectionEngine::onload(session->flow); - pdu = DetectionEngine::set_packet(); + pdu = DetectionEngine::set_next_packet(); DAQ_PktHdr_t pkth; session->GetPacketHeaderFoo(&pkth, pkt_flags); diff --git a/src/stream/user/user_session.cc b/src/stream/user/user_session.cc index 188474747..207758098 100644 --- a/src/stream/user/user_session.cc +++ b/src/stream/user/user_session.cc @@ -203,7 +203,7 @@ void UserTracker::flush(Packet* p, unsigned flush_amt, uint32_t flags) StreamBuffer sb = { nullptr, 0 }; trace_logf(stream_user, "flush[%d]\n", flush_amt); uint32_t rflags = flags & ~PKT_PDU_TAIL; - Packet* up = DetectionEngine::set_packet(); + Packet* up = DetectionEngine::set_next_packet(); while ( !seg_list.empty() and bytes_flushed < flush_amt ) {