From: Russ Combs Date: Tue, 28 Oct 2014 12:03:49 +0000 (-0400) Subject: refactored inspector groups X-Git-Tag: 3.0.0-233~1317 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fcf9b79080a5818b1121f0316038476e6afc28cb;p=thirdparty%2Fsnort3.git refactored inspector groups --- diff --git a/ChangeLog b/ChangeLog index 73827db04..b6dd3b073 100644 --- a/ChangeLog +++ b/ChangeLog @@ -33,6 +33,7 @@ -- added missing ip|tcp|udp|icmp options to checksum_drop/eval -- pulled in latest from Josh -- pulled in HI defaults patch from Bhagya +-- refactored inspector groups 125 -- discovered can't catch exceptions thrown from Lua to C++; need to diff --git a/src/framework/inspector.h b/src/framework/inspector.h index 396f4ec51..01fd1901d 100644 --- a/src/framework/inspector.h +++ b/src/framework/inspector.h @@ -128,10 +128,10 @@ enum InspectorType IT_BINDER, IT_WIZARD, IT_PACKET, - IT_PROTOCOL, + IT_NETWORK, IT_STREAM, - IT_SESSION, IT_SERVICE, + IT_PROBE, IT_MAX }; diff --git a/src/main/snort.cc b/src/main/snort.cc index 2ff293c6a..1f690ddd2 100644 --- a/src/main/snort.cc +++ b/src/main/snort.cc @@ -747,7 +747,7 @@ DAQ_Verdict ProcessPacket( p->proto_bits = PROTO_BIT__OTHER; #if 0 - // FIXIT-J required until decoders are fixed + // FIXIT-H-J required until decoders are fixed else if ( !p->family && (p->proto_bits & PROTO_BIT__IP) ) p->proto_bits &= ~PROTO_BIT__IP; #endif diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc index d55b58528..c11ff6ed4 100644 --- a/src/managers/inspector_manager.cc +++ b/src/managers/inspector_manager.cc @@ -147,10 +147,11 @@ struct FrameworkPolicy { PHInstanceList ilist; - PHVector session; + PHVector packet; PHVector network; - PHVector generic; + PHVector session; PHVector service; + PHVector probe; Inspector* binder; Inspector* wizard; @@ -160,27 +161,27 @@ struct FrameworkPolicy void FrameworkPolicy::vectorize() { - session.alloc(ilist.size()); + packet.alloc(ilist.size()); network.alloc(ilist.size()); + session.alloc(ilist.size()); service.alloc(ilist.size()); - generic.alloc(ilist.size()); + probe.alloc(ilist.size()); for ( auto* p : ilist ) { switch ( p->pp_class.api.type ) { - case IT_STREAM: - if ( !p->pp_class.api.ssn ) - session.add(p); + case IT_PACKET: + packet.add(p); break; - case IT_PACKET: - case IT_PROTOCOL: + case IT_NETWORK: network.add(p); break; - case IT_SESSION: - generic.add(p); + case IT_STREAM: + if ( !p->pp_class.api.ssn ) + session.add(p); break; case IT_SERVICE: @@ -195,6 +196,10 @@ void FrameworkPolicy::vectorize() wizard = p->handler; break; + case IT_PROBE: + probe.add(p); + break; + case IT_MAX: break; } @@ -604,7 +609,7 @@ static inline void execute( // FIXIT-P these checks can eventually be optimized // but they are required to ensure that session and app // handlers aren't called w/o a session pointer - if ( !p->flow && (ppc.api.type >= IT_SESSION) ) + if ( !p->flow && (ppc.api.type == IT_SERVICE) ) break; if ( ((unsigned)p->type() & ppc.api.proto_bits) ) @@ -638,9 +643,9 @@ void InspectorManager::execute (Packet* p) // FIXIT-M structure lists so stream, normalize, etc. aren't // called on reassembled packets + ::execute(p, fp->packet.vec, fp->packet.num); ::execute(p, fp->session.vec, fp->session.num); ::execute(p, fp->network.vec, fp->network.num); - ::execute(p, fp->generic.vec, fp->generic.num); Flow* flow = p->flow; @@ -661,5 +666,7 @@ void InspectorManager::execute (Packet* p) } else DisableDetect(p); + + ::execute(p, fp->probe.vec, fp->probe.num); } diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc index 4ca4f56ae..6ed79d5cd 100644 --- a/src/network_inspectors/arp_spoof/arp_spoof.cc +++ b/src/network_inspectors/arp_spoof/arp_spoof.cc @@ -307,7 +307,7 @@ static const InspectApi as_api = mod_ctor, mod_dtor }, - IT_PROTOCOL, + IT_NETWORK, (uint16_t)PktType::ARP, nullptr, // buffers nullptr, // service diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc index defc10778..e33400600 100644 --- a/src/network_inspectors/perf_monitor/perf_monitor.cc +++ b/src/network_inspectors/perf_monitor/perf_monitor.cc @@ -382,7 +382,7 @@ static const InspectApi pm_api = mod_ctor, mod_dtor }, - IT_PACKET, + IT_PROBE, (uint16_t)PktType::ANY, nullptr, // buffers nullptr, // service diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc index 2dbd471e3..ae5f002e9 100644 --- a/src/network_inspectors/port_scan/port_scan.cc +++ b/src/network_inspectors/port_scan/port_scan.cc @@ -1002,7 +1002,7 @@ static const InspectApi sp_api = mod_ctor, mod_dtor }, - IT_PROTOCOL, + IT_PROBE, (uint16_t)PktType::ANY_IP, // FIXIT-L dynamic assign nullptr, // buffers nullptr, // service diff --git a/src/service_inspectors/back_orifice/back_orifice.cc b/src/service_inspectors/back_orifice/back_orifice.cc index 1de84b30b..30552e53c 100644 --- a/src/service_inspectors/back_orifice/back_orifice.cc +++ b/src/service_inspectors/back_orifice/back_orifice.cc @@ -606,7 +606,7 @@ static const InspectApi bo_api = mod_ctor, mod_dtor }, - IT_PROTOCOL, + IT_NETWORK, (uint16_t)PktType::UDP, nullptr, // buffers nullptr, // service diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc index bac7757e1..3759e6005 100644 --- a/src/service_inspectors/ftp_telnet/ftp_data.cc +++ b/src/service_inspectors/ftp_telnet/ftp_data.cc @@ -288,7 +288,7 @@ const InspectApi fd_api = mod_ctor, mod_dtor }, - IT_SERVICE, // FIXIT-M does this still need to be session?? + IT_SERVICE, (uint16_t)PktType::TCP, nullptr, // buffers "ftp-data",