From: Josh Date: Tue, 22 Jul 2014 19:36:09 +0000 (-0400) Subject: adding configuration differences to manual. Adding to .gitignore X-Git-Tag: 3.0.0-233~1175^2~14^2~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ff6dc06326fb2d290d4c59ca46e7a018c0635dac;p=thirdparty%2Fsnort3.git adding configuration differences to manual. Adding to .gitignore --- diff --git a/.gitignore b/.gitignore index d7359c62b..0c4894885 100644 --- a/.gitignore +++ b/.gitignore @@ -54,3 +54,7 @@ stamp-h1 tools/u2boat/u2boat tools/u2spewfoo/u2spewfoo ylwrap +*results +*snort.alert* +*snort.out* +*snort.log* diff --git a/cmake/includePredefinedPackages.cmake b/cmake/includePredefinedPackages.cmake index b6cd86185..8c542379f 100644 --- a/cmake/includePredefinedPackages.cmake +++ b/cmake/includePredefinedPackages.cmake @@ -14,4 +14,4 @@ find_package(DNET REQUIRED) # optional libraries find_package(Asciidoc QUIET) find_package(DBLATEX QUIET) -find_package(Ruby QUIET) +find_package(Ruby QUIET 1.8.7) diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt index 0a5cd2294..505513514 100644 --- a/doc/CMakeLists.txt +++ b/doc/CMakeLists.txt @@ -20,8 +20,9 @@ set(BUILT_SOURCES config.txt options.txt gids.txt -# modules.txt Requires Special formatting. manually added below. -# version.txt Required special formatting. manually added below. +# modules.txt Requires Special formatting. manually added below. +# version.txt Required special formatting. manually added below. +# config_changes.txt If ruby executable found CACHE INTERNAL "sources to be built" FORCE ) @@ -31,7 +32,7 @@ set (UNBUILT_SOURCES style.txt tips.txt plugins.txt -# images/snort.png # images directory is manually included as an a2x option +# config_changes.txt If ruby executable is NOT found ) if (MAKE_HTML_DOC) @@ -105,6 +106,23 @@ if (MAKE_PDF_DOC OR MAKE_HTML_DOC) list (APPEND ALL_SOURCES ${output}) + # If ruby is present, built the configuration differences + if (RUBY_EXECUTABLE) + set (output ${CMAKE_CURRENT_BINARY_DIR}/config_changes.txt) + add_custom_command( + OUTPUT ${output} + COMMAND ${RUBY_EXECUTABLE} + ${CMAKE_CURRENT_SOURCE_DIR}/get_differences.rb + ${CMAKE_SOURCE_DIR}/tools/snort2lua + > ${output} + DEPENDS snort2lua + COMMENT "Documents: building config_changes.txt" + ) + list (APPEND ALL_SOURCES ${output}) + else() + list(APPEND UNBUILT_SOURCES conf_differences.txt) + endif() + # next, Copy all distributed files into the binary tree (necessary for asciidocs). # Then create a dependency between the new and old files. foreach (file ${UNBUILT_SOURCES}) diff --git a/doc/Makefile.am b/doc/Makefile.am index cba73eceb..e5193988f 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -13,6 +13,7 @@ version.txt unbuilt_sources = \ snort_manual.txt \ +config_changes.txt \ differences.txt \ plugins.txt \ style.txt \ diff --git a/doc/config_changes.txt b/doc/config_changes.txt new file mode 100644 index 000000000..dc49e74bc --- /dev/null +++ b/doc/config_changes.txt @@ -0,0 +1,229 @@ +change: ac ==> ac_full_q +change: ac-banded ==> ac_banded +change: ac-bnfa ==> ac_bnfa_q +change: ac-bnfa-nq ==> ac_bnfa +change: ac-bnfa-q ==> ac_bnfa_q +change: ac-nq ==> ac_full +change: ac-q ==> ac_full_q +change: ac-sparsebands ==> ac_sparse_bands +change: ac-split ==> ac_full_q +change: ac-split ==> split_any_any +change: ac-std ==> ac_std +change: accumulate ==> reset = false +change: acs ==> ac_sparse +change: addressspace_agnostic ==> address_space_agnostic +change: alert_unified2 ==> unified2 +change: alertfile ==> alert_file +change: alt_max_param_len ==> cmd_validity +change: autogenerate_preprocessor_decoder_rules ==> enable_builtin_rules +change: bind_to ==> bindings +change: bleedover-port-limit ==> bleedover_port_limit +change: bleedover-warnings-enabled ==> bleedover_warnings_enabled +change: block ==> base +change: checksum_mode ==> checksum_eval +change: config file: file_block_timeout ==> block_timeout +change: config file: file_lookup_timeout ==> lookup_timeout +change: config file: file_signature_depth ==> signature_depth +change: config file: file_type_depth ==> type_depth +change: config file: signature ==> enable_signature +change: config file: type_id ==> enable_type +change: config mpls_payload_type: ethernet ==> mpls_payload_type = eth +change: config mpls_payload_type: ipv4 ==> mpls_payload_type = ip4 +change: config mpls_payload_type: ipv6 ==> mpls_payload_type = ip6 +change: daq ==> name +change: daq_dir ==> dir +change: daq_mode ==> mode +change: daq_var ==> var +change: data_chan ==> ignore_data_chan +change: debug-pkts ==> debug_pkts +change: debug-print-fast-pattern ==> debug_print_fast_pattern +change: debug-print-nocontent-rule-tests ==> debug_print_nocontent_rule_tests +change: debug-print-rule-group-build-details ==> debug_print_rule_group_build_details +change: debug-print-rule-groups-compiled ==> debug_print_rule_groups_compiled +change: debug-print-rule-groups-uncompiled ==> debug_print_rule_groups_uncompiled +change: detection_filter ==> detection_filter_memcap +change: dgmlen ==> dgm_len +change: disable_inline_init_failopen ==> enable_inline_init_failopen +change: disabled ==> enable +change: dont_reassemble_async ==> reassemble_async +change: dstport ==> dst_port +change: dynamicdetection ==> plugin_path +change: dynamicengine ==> plugin_path +change: dynamicpreprocessor ==> plugin_path +change: dynamicsidechannel ==> plugin_path +change: enable-single-rule-group ==> enable_single_rule_group +change: enable_cookie ==> enable_cookies +change: enable_deep_teredo_inspection ==> deep_teredo_inspection +change: enabled ==> enable +change: ethdst ==> eth_dst +change: ethlen ==> eth_len +change: ethsrc ==> eth_src +change: event_filter ==> event_filter_memcap +change: fastpath-expensive-packets ==> fastpath_expensive_packets +change: filename ==> file +change: flow-file ==> flow_file = true +change: flow-ip ==> flow_ip +change: flow-ip-file ==> flow_ip_file = true +change: flow-ip-memcap ==> flow_ip_memcap +change: flow-ports ==> flow_ports +change: flow_depth ==> server_flow_depth +change: footprint ==> use_static_footprint_sizes +change: gen_id ==> gid +change: icmpcode ==> icmp_code +change: icmpid ==> icmp_id +change: icmpseq ==> icmp_seq +change: icmptype ==> icmp_type +change: intel-cpm ==> intel_cpm +change: iplen ==> ip_len +change: log_alert ==> level = alert +change: log_auth ==> facility = auth +change: log_authpriv ==> facility = authpriv +change: log_cons ==> options = cons +change: log_crit ==> level = crit +change: log_daemon ==> facility = daemon +change: log_debug ==> level = debug +change: log_emerg ==> level = emerg +change: log_err ==> level = err +change: log_info ==> level = info +change: log_local0 ==> facility = local0 +change: log_local1 ==> facility = local1 +change: log_local2 ==> facility = local2 +change: log_local3 ==> facility = local3 +change: log_local4 ==> facility = local4 +change: log_local5 ==> facility = local5 +change: log_local6 ==> facility = local6 +change: log_local7 ==> facility = local7 +change: log_ndelay ==> options = ndelay +change: log_notice ==> level = notice +change: log_perror ==> options = perror +change: log_pid ==> options = pid +change: log_unified2 ==> unified2 +change: log_user ==> facility = user +change: log_warning ==> level = warning +change: lowmem ==> lowmem_q +change: lowmem-nq ==> lowmem +change: lowmem-q ==> lowmem_q +change: max-pattern-len ==> max_pattern_len +change: max-pkt-time ==> max_pkt_time +change: max-rule-time ==> max_rule_time +change: max_active_responses ==> max_responses +change: max_attribute_hosts ==> max_hosts +change: max_attribute_services_per_host ==> max_services_per_host +change: max_icmp ==> max_sessions +change: max_ip ==> max_sessions +change: max_queued_bytes ==> queue_limit.max_bytes +change: max_queued_segs ==> queue_limit.max_segments +change: max_tcp ==> max_sessions +change: max_udp ==> max_sessions +change: min_fragment_length ==> min_frag_length +change: min_response_seconds ==> min_interval +change: non_rfc_char ==> non_rfc_chars +change: nopcre ==> pcre_enable +change: overlap_limit ==> max_overlaps +change: pad ==> base +change: pkt-log ==> pkt_log +change: pkt_count ==> limit +change: pktcnt ==> packets +change: policy_mode ==> mode +change: ports ==> bindings +change: ports ==> gtp_ports +change: ports both ==> both_ports +change: ports client ==> client_ports +change: ports server ==> server_ports +change: preprocessor normalize_icmp4 ==> icmp4 == +change: preprocessor normalize_icmp6 ==> icmp6 == +change: preprocessor normalize_ip6 ==> ip6 == +change: print ==> count +change: proto ==> protos +change: prune_log_max ==> histogram +change: rate_filter ==> rate_filter_memcap +change: req_pay ==> base +change: req_urg ==> base +change: req_urp ==> base +change: rsv ==> base +change: rule-log ==> rule_log +change: scan_type ==> scan_types +change: search-method ==> search_method +change: search-optimize ==> search_optimize +change: sid_id ==> sid +change: sig_generator ==> gid +change: sig_id ==> sid +change: sig_rev ==> rev +change: snortfile ==> file = true +change: sort avg_ticks_per_nomatch ==> sort = avg_ticks_per_no_match +change: split-any-any ==> split_any_any +change: srcport ==> src_port +change: suspend-expensive-rules ==> suspend_expensive_rules +change: suspend-timeout ==> suspend_timeout +change: tcp_cache_nominal_timeout ==> pruning_timeout +change: tcp_cache_pruning_timeout ==> idle_timeout +change: tcpack ==> tcp_ack +change: tcpflags ==> tcp_flags +change: tcplen ==> tcp_len +change: tcpseq ==> tcp_seq +change: tcpwindow ==> tcp_win +change: threshold ==> event_filter_memcap +change: time ==> seconds +change: timeout ==> session_timeout +change: trim_mss ==> trim +change: trim_rst ==> trim +change: trim_syn ==> trim +change: trim_win ==> trim +change: udp_cache_nominal_timeout ==> idle_timeout +change: udp_cache_pruning_timeout ==> pruning_timeout +change: unified2 ==> unified2 +deleted: action +deleted: alert_fragments +deleted: atexitonly +deleted: atexitonly: base-stats +deleted: atexitonly: events-stats +deleted: atexitonly: flow-ip-stats +deleted: atexitonly: flow-stats +deleted: check_session_hijacking +deleted: config cs_dir +deleted: config disable_attribute_reload_thread +deleted: config disable_decode_alerts +deleted: config disable_decode_drops +deleted: config disable_ipopt_alerts +deleted: config disable_ipopt_drops +deleted: config disable_tcpopt_alerts +deleted: config disable_tcpopt_drops +deleted: config disable_tcpopt_experimental_alerts +deleted: config disable_tcpopt_experimental_drops +deleted: config disable_tcpopt_obsolete_alerts +deleted: config disable_tcpopt_obsolete_drops +deleted: config disable_tcpopt_ttcp_alerts +deleted: config disable_ttcp_alerts +deleted: config disable_ttcp_drops +deleted: config dump_dynamic_rules_path +deleted: config enable_decode_drops +deleted: config enable_decode_oversized_alerts +deleted: config enable_decode_oversized_drops +deleted: config enable_ipopt_drops +deleted: config enable_tcpopt_drops +deleted: config enable_tcpopt_experimental_drops +deleted: config enable_tcpopt_obsolete_drops +deleted: config enable_tcpopt_ttcp_drops +deleted: config enable_ttcp_drops +deleted: config flexresp2_attempts +deleted: config flexresp2_interface +deleted: config flexresp2_memcap +deleted: config flexresp2_rows +deleted: config include_vlan_in_alerts +deleted: config interface +deleted: config layer2resets +deleted: config policy_version +deleted: config so_rule_memcap +deleted: default +deleted: detect_ack_scans +deleted: detect_anomalies +deleted: disabled +deleted: dont_store_large_packets +deleted: flush_on_alert +deleted: logfile +deleted: mwm +deleted: no_alert_incomplete +deleted: no_alert_large_fragments +deleted: no_alert_multiple_requests +deleted: no_alerts +deleted: no_midstream_drop_alerts diff --git a/doc/get_differences.rb b/doc/get_differences.rb new file mode 100755 index 000000000..27fc8b6df --- /dev/null +++ b/doc/get_differences.rb @@ -0,0 +1,73 @@ +#!/usr/bin/ruby + +# CONST REG_EX. DO NOT CHANGE +delete_pattern = /add_deleted_comment\(\"(.*)\"\);/ +diff_pattern = /add_diff_option_comment\(\"(.*)\",\s?\"(.*)\"\)/ +template_diff = /<\s*&(.*),.*,\s*&(.*)>/ +config_delete_template = /deleted_ctor<&(.*)>/ +paths_diff = /paths_ctor<\s*&(.*)\s*>/ # check kws_paths.cc +normalizers_diff = /norm_sans_options_ctor<\s?&(.*)>/ # check pps_normalizers +unified2_diff = /unified2_ctor<\s?&(.*)>/ # checkout out_unified2.cc +star_reg = /\*/ + +if ARGV.empty?() || ARGV.length() > 1 + abort("Usage: ruby get_differences.rb ") +end + +dir = ARGV[0]; + +if !File.directory?(dir) + abort("Cannot find directory #{dir}") +end + + +arr = Array.new() + +Dir.glob("#{dir}/**/*cc").each do |file| + File.open(file) do |f| + f.each_line do |line| + if line =~ star_reg + next + end + + if line =~ delete_pattern + arr << "deleted: #{$1}" + end + + if line =~ diff_pattern + arr << "change: #{$1} ==> #{$2}" + + end + + if line =~ template_diff + arr << "change: #{$1} ==> #{$2}" + end + + if line =~ config_delete_template + arr << "deleted: config #{$1}" + end + + # Files with special templates + + if line =~ paths_diff + arr << "change: #{$1} ==> plugin_path" + end + + if line =~ normalizers_diff + arr << "change: preprocessor normalize_#{$1} ==> #{$1} == " + end + + if line =~ unified2_diff + arr << "change: #{$1} ==> unified2" + end + + end + end +end + +arr.uniq! +arr.sort! + +arr.each do |elem| + puts "#{elem}" +end diff --git a/doc/snort_manual.txt b/doc/snort_manual.txt index d0ba037b0..7e33aa51d 100644 --- a/doc/snort_manual.txt +++ b/doc/snort_manual.txt @@ -18,6 +18,10 @@ include::tips.txt[] include::differences.txt[] +=== Configuration Changes + +include::config_changes.txt + == Modules include::modules.txt[] diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc index af363e564..47404c104 100644 --- a/src/codecs/ip/cd_ipv6.cc +++ b/src/codecs/ip/cd_ipv6.cc @@ -616,7 +616,9 @@ bool Ipv6Codec::update (Packet* p, Layer* lyr, uint32_t* len) // extension headers are decoded and we stop at frag6. // in such case we do not modify the packet length. if ( (p->packet_flags & PKT_MODIFIED) +#ifdef NORMALIZER && !(p->packet_flags & PKT_RESIZED) +#endif ) { *len = ntohs(h->ip6plen) + sizeof(*h); } diff --git a/src/codecs/ip/cd_ipv6_module.cc b/src/codecs/ip/cd_ipv6_module.cc index ba54e8b7e..dae3577b9 100644 --- a/src/codecs/ip/cd_ipv6_module.cc +++ b/src/codecs/ip/cd_ipv6_module.cc @@ -58,7 +58,7 @@ static const RuleMap ipv6_rules[] = { DECODE_IPV6_ISATAP_SPOOF, "(" CD_IPV6_NAME ") BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt" }, { DECODE_IPV6_BAD_FRAG_PKT, "(" CD_IPV6_NAME ") bogus fragmentation packet. Possible BSD attack" }, { DECODE_IPV6_ROUTE_ZERO, "(" CD_IPV6_NAME ") IPV6 routing type 0 extension header" }, - { DECODE_IP6_EXCESS_EXT_HDR, "(decode) too many IP6 extension headers" }, + { DECODE_IP6_EXCESS_EXT_HDR, "(" CD_IPV6_NAME ") too many IP6 extension headers" }, { 0, nullptr } }; diff --git a/tools/snort2lua/CMakeLists.txt b/tools/snort2lua/CMakeLists.txt index d9aa3982f..62b02f70d 100644 --- a/tools/snort2lua/CMakeLists.txt +++ b/tools/snort2lua/CMakeLists.txt @@ -33,7 +33,6 @@ target_link_libraries( snort2lua rule_states ) - install (TARGETS snort2lua RUNTIME DESTINATION bin )