pax_global_header00006660000000000000000000000064145743325750014531gustar00rootroot0000000000000052 comment=bd6cbf1bbd3dcad9cd09261786b664d819357d94 snort3-3.1.82.0/000077500000000000000000000000001457433257500132125ustar00rootroot00000000000000snort3-3.1.82.0/.clang-tidy000066400000000000000000000006201457433257500152440ustar00rootroot00000000000000Checks: '-*,clang-diagnostic-*,clang-analyzer-*,readability-redundant-*,readability-non-const-parameter,readability-container-size-empty,misc-string-compare,misc-macro-parentheses,bugprone-*,performance-*,modernize-use-equals-default,modernize-use-bool-literals,modernize-redundant-void-arg,modernize-make-shared,modernize-deprecated-headers,modernize-use-override,modernize-use-nullptr' snort3-3.1.82.0/.gitignore000066400000000000000000000014461457433257500152070ustar00rootroot00000000000000*.gcda *.gcno *.gcov *.log *.out *.rej *.swp *.trs *~ ._Xcode* .vscode/ Cbuild/ Xcode*/ doc/basic.txt doc/builtin.txt doc/codec.txt doc/commands.txt doc/config.txt doc/config_changes.txt doc/connector.txt doc/counts.txt doc/data.txt doc/docbook-xsl.css doc/gids.txt doc/help.txt doc/images.tgz doc/inspector.txt doc/ips_action.txt doc/ips_option.txt doc/logger.txt doc/modules.txt doc/options.txt doc/plugins.txt doc/search_engine.txt doc/signals.txt doc/snort2lua_cmds.txt doc/snort_manual.chunked.tgz doc/snort_manual.chunked/ doc/snort_manual.tgz doc/snort_manual.xml doc/version.txt extra/rule.xxd extra/snort_examples-1.0.tar.gz snort.pc src/framework/api_options.h GPATH GRTAGS GTAGS HTML # These are related to the build-scripts alt/ install/ build.env coverage.info coverage.txt src/uncovered.txt snort3-3.1.82.0/CMakeLists.txt000066400000000000000000000121021457433257500157460ustar00rootroot00000000000000cmake_minimum_required (VERSION 3.4.3) project (snort CXX C) set (VERSION_MAJOR 3) set (VERSION_MINOR 1) set (VERSION_PATCH 82) set (VERSION_SUBLEVEL 0) set (VERSION "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}.${VERSION_SUBLEVEL}") if (DEFINED VERSION_BUILD) set (BUILD "${VERSION_BUILD}") endif () set (CMAKE_CXX_STANDARD 17) set (CMAKE_CXX_STANDARD_REQUIRED ON) set (CMAKE_CXX_EXTENSIONS OFF) set (CMAKE_C_STANDARD 99) set (CMAKE_C_STANDARD_REQUIRED ON) set (CMAKE_C_EXTENSIONS ON) set (CMAKE_MODULE_PATH "${PROJECT_SOURCE_DIR}/cmake") # Pull in definitions of various install directories include (GNUInstallDirs) include (${CMAKE_MODULE_PATH}/macros.cmake) include (${CMAKE_MODULE_PATH}/create_options.cmake) include (${CMAKE_MODULE_PATH}/include_libraries.cmake) include (${CMAKE_MODULE_PATH}/platforms.cmake) include (${CMAKE_MODULE_PATH}/configure_options.cmake) #include (${CMAKE_MODULE_PATH}/compiler_features.cmake) include (${CMAKE_MODULE_PATH}/sanity_checks.cmake) set (INSTALL_SUFFIX "${CMAKE_PROJECT_NAME}") set (INCLUDE_INSTALL_PATH "${CMAKE_INSTALL_INCLUDEDIR}/${INSTALL_SUFFIX}") set (LIB_INSTALL_PATH "${CMAKE_INSTALL_LIBDIR}/${INSTALL_SUFFIX}") set (PLUGIN_INSTALL_PATH "${LIB_INSTALL_PATH}/plugins") configure_file ( "${PROJECT_SOURCE_DIR}/config.cmake.h.in" "${PROJECT_BINARY_DIR}/config.h" ) add_definitions( -DHAVE_CONFIG_H ) # Set these after all tests are done but *before* any subdirectories are included # or other targets declared. string(APPEND CMAKE_C_FLAGS " ${EXTRA_C_FLAGS}") string(APPEND CMAKE_CXX_FLAGS " ${EXTRA_CXX_FLAGS}") string(APPEND CMAKE_EXE_LINKER_FLAGS " ${EXTRA_LINKER_FLAGS}") string(APPEND CMAKE_MODULE_LINKER_FLAGS " ${EXTRA_LINKER_FLAGS}") include_directories (${PROJECT_BINARY_DIR}) include_directories (${PROJECT_SOURCE_DIR}) if (ENABLE_UNIT_TESTS) include(CTest) endif (ENABLE_UNIT_TESTS) if (ENABLE_UNIT_TESTS OR ENABLE_BENCHMARK_TESTS) add_custom_target (check COMMAND ${CMAKE_CTEST_COMMAND}) endif (ENABLE_UNIT_TESTS OR ENABLE_BENCHMARK_TESTS) add_subdirectory (src) add_subdirectory (tools) add_subdirectory (lua) add_subdirectory (daqs) if ( MAKE_DOC ) add_subdirectory (doc) endif ( MAKE_DOC ) # Miscellaneous stuff. Does NOT directly affect Snort's build environment. include (${CMAKE_MODULE_PATH}/packaging_data.cmake) include (${CMAKE_MODULE_PATH}/create_pkg_config.cmake) # uninstall target configure_file( "${CMAKE_CURRENT_SOURCE_DIR}/cmake_uninstall.cmake.in" "${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake" IMMEDIATE @ONLY) add_custom_target(uninstall COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/cmake_uninstall.cmake) string(TOUPPER "${CMAKE_BUILD_TYPE}" CMAKE_BUILD_TYPE_UPPER) message(" -------------------------------------------------------") if (DEFINED BUILD) message("${CMAKE_PROJECT_NAME} version ${VERSION} build ${BUILD}") else() message("${CMAKE_PROJECT_NAME} version ${VERSION}") endif() message(" Install options: prefix: ${CMAKE_INSTALL_PREFIX} includes: ${CMAKE_INSTALL_FULL_INCLUDEDIR}/${INSTALL_SUFFIX} plugins: ${CMAKE_INSTALL_FULL_LIBDIR}/${INSTALL_SUFFIX} Compiler options: CC: ${CMAKE_C_COMPILER} CXX: ${CMAKE_CXX_COMPILER} CFLAGS: ${CMAKE_C_FLAGS} ${CMAKE_C_FLAGS_${CMAKE_BUILD_TYPE_UPPER}} CXXFLAGS: ${CMAKE_CXX_FLAGS} ${CMAKE_CXX_FLAGS_${CMAKE_BUILD_TYPE_UPPER}} EXE_LDFLAGS: ${CMAKE_EXE_LINKER_FLAGS} MODULE_LDFLAGS: ${CMAKE_MODULE_LINKER_FLAGS} Feature options:\ ") if (ENABLE_STATIC_DAQ) message("\ DAQ Modules: Static (${DAQ_STATIC_MODULES})") else () message("\ DAQ Modules: Dynamic") endif () if (HAVE_ATOMIC) message("\ libatomic: User-specified") else () message("\ libatomic: System-provided") endif () if (HAVE_HYPERSCAN) message("\ Hyperscan: ON") else () message("\ Hyperscan: OFF") endif () if (HAVE_ICONV) message("\ ICONV: ON") else () message("\ ICONV: OFF") endif () if (HAVE_LIBUNWIND) message("\ Libunwind: ON") else () message("\ Libunwind: OFF") endif () if (HAVE_LZMA) message("\ LZMA: ON") else () message("\ LZMA: OFF") endif () if (USE_TIRPC) message("\ RPC DB: TIRPC") else () message("\ RPC DB: Built-in") endif () if (HAVE_SAFEC) message("\ SafeC: ON") else () message("\ SafeC: OFF") endif () if (HAVE_TCMALLOC) message("\ TCMalloc: ON") else () message("\ TCMalloc: OFF") endif () if (HAVE_JEMALLOC) message("\ JEMalloc: ON") else () message("\ JEMalloc: OFF") endif () if (HAVE_UUID) message("\ UUID: ON") else () message("\ UUID: OFF") endif () if (HAVE_NUMA) message("\ NUMA: ON") else () message("\ NUMA: OFF") endif () if (HAVE_LIBML) message("\ LibML: ON") else () message("\ LibML: OFF") endif () message("-------------------------------------------------------\n") snort3-3.1.82.0/COPYING000066400000000000000000000510231457433257500142460ustar00rootroot00000000000000***************************************************************************** The text that follows is the GNU General Public License, Version 2 (GPL V2) and governs your use, modification and/or distribution of SNORT. Section 9 of the GPL V2 acknowledges that the Free Software Foundation may publish revised and/or new versions of the GPL V2 from time to time. Section 9 further states that a licensee of a program subject to the GPL V2 could be free to use any such revised and/or new versions under two different scenarios: 1. "Failure to Specify." Section 9 of the GPL V2 allows a licensee of a program governed by an unspecified version of the General Public License to choose any version of the General Public License ever published by the Free Software Foundation to govern his or her use of such program. This provision is not applicable to your use of SNORT because we have expressly stated in a number of instances that any third party's use, modification or distribution of SNORT is governed by GPL V2. 2. "Any Later Version." At the end of the terms and condition of the GPL V2 is a section called "How to Apply these Terms to Your New Program," which provides guidance to a developer on how to apply the GPL V2 to a third party's use, modification and/or distribution of his/her program. Among other things, this guidance suggests that the developer attach certain notices to the program. Of particular importance is the following notice: "This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version." Thus if a developer follows strictly the guidance provided by the Free Software Foundation, Section 9 of the GPL V2 provides the licensee the option to either use, modify or distribute the program under GPL V2 or under any later version published by the Free Software Foundation. SNORT is an open source project that is governed exclusively by the GPL V2 and any third party desiring to use, modify or distribute SNORT must do so by strictly following the terms and conditions of GPL V2. Anyone using, modifying or distributing SNORT does not have the option to chose to use, modify or distribute SNORT under any revised or new version of the GPL, including without limitation, the GNU General Public License Version 3. For ease of reference, the comparable notice that is used with SNORT (contained in the 'README' file) is as follows: "This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License Version 2 as published by the Free Software Foundation. You may not use, modify or distribute this program under any other version of the GNU General Public License." If you have any questions about this statement, please feel free to email snort-info@snort.org. ***************************************************************************** GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) 19yy This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) 19yy name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. snort3-3.1.82.0/ChangeLog.md000066400000000000000000007762051457433257500154040ustar00rootroot000000000000002024-03-12: 3.1.82.0 * appid: broadcast commands with ctrlcon * appid: change eve pattern matching logic * appid: replaced warning log with logging api for CBD * file_api: do not clear the file capture and user file data pointers when updating the verdict from the cache * filters: updated dyn array with vector * flow: updated flow_data linklist with STL container * framework: validate parameter of number type in a string form * kaizen: rename to Snort ML * main: clear lua stack when registering commands in a shell * main: reset main-thread stats from the main thread * main: update limits help * packet_capture: add packet capturing per tenant * sfip: remove references to unused mode feature * sfip: zero out var/node pointers after operations to remedy heap-use-after-free on reload * smb: fix for improper session cache destruction in tterm during config reload * snort2lua: change deprecated use of ptr_fn to lambda * stats: fix timing stats * stats: perf improvement changes * stream: remove splitter from session before inspectors * stream_tcp: add reasons for drops due to trims * stream_tcp: implement support for proxy mode normalization behavior * stream_tcp: update documentation for stream TCP alerts to include the new 129:21 and 129:22 alerts * trace: add tenants logging 2024-02-20: 3.1.81.0 * appid: check tenant_match() if required * appid: log error message instead of fatal error if appid stats logfile is not accessible * appid: Lowering max packet count before service fail * control: Adds counting to ctrlcon blocked to allow for nested commands * detection: add c'tors, use new instead of snort_calloc * detection: copy ip var name in dup_rtn * flow: added ips event suppression flags * host_cache: fixed update_stats to remove race_condition * http_inspect: recreate JSNorm if reload takes place inside transaction * ips_context: add lazy-allocation of alt buffer * kaizen: provide an option to enable Kaizen's mock * kaizen: remove redundant semicolon and add explicit cast * kaizen: rename modules * lua: improve spell of wizard for HTTP * memory: prevent data race between main and packet threads * service_inspectors: add check for JSNorm config actuality * stream_tcp: add alerts for exceeding thresholds for max queued bytes or segments * stream_tcp: add check to verify seglist head is not nullptr and only initialize PAF when it is not * utils: add macro for setting thread name 2024-02-01: 3.1.79.0 * appid: add tenants filter for appid debug * appid: process organization unit instead of organization name * appid: return false in is_appid_inspecting_session for quic if not decrypting * appid: update peg counts to be thread safe * coverity: fix for stream and hash * filters: make rate_filter multithreaded + some cleanup * kaizen: add dev_notes.txt * kaizen: change default value of uri_depth to -1 * kaizen: change kaizen gid to 411 * kaizen: extend mock object with simple matching mechanism * kaizen: make kaizen configurable per policy * kaizen: register module only when LibML present or REG_TEST defined * kaizen: update copyright * mercury: updating alpn info without sni in 7.6 * network_inspectors: add kaizen ML based exploit detector * packet_tracer: add tenants to filters * profiler: improve multithread rule percentage calculation * ssl: heap overflow issue when processing handshake records * stream_tcp: correct labeling of in-sequence and out-of-sequence packets * stream_tcp: persist disable_reassembly in Flow * stream_tcp: set packet direction flag based on direction saved in reassembly state 2024-01-16: 3.1.78.0 * appid: print odp version and odp detector count on startup * copyright: update year to 2024 * doc: update arg list for "generate_builtin.sh". Add parity to "generate_" scripts arg list, thanks to @puck(https://github.com/puck) * main: fix inconsistent lua variables assignment * parser: fix --dump-rule-meta for negated ports 2023-12-20: 3.1.77.0 * appid: add http3 to the list of ssl protocols as http3 will always be inside quic and encrypted * appid: do not delete hsession for http3 * appid: fix coverity issues * appid: lua logging doc update * build: arm compilation support * catch: add boost software license for catch.hpp * detection: adjust built-in GID range to 40-999 * detection: collect matched buffers on IpsContext * flow: add tenant ID to FlowKey * host_cache: fix race condition on peg counts * http_inspect: publish HTTP/1 request bodies, track MIME boundary * main: fix reload_id data race * parser: add CWD to conf search order * profiler: change time tracking for "rule_time (%)" field in rule_profiler output * profiler: dump memory profiler stats at frequent interval * pub_sub: add get_client_body and is_mime methods * ssl: stopping inspection once client or server app packet is found * utils: add get_file_size 2023-12-03: 3.1.76.0 * appid: added missed cppcheck warning * appid: adding support for memory profiling of third party lib * appid: additional check for lua logging * appid: fixing coverity issues * dns: fix parsing 'additionals' section in dns response * flow_cache: added new protocol base counters * pegs: make add_peg_count and set_peg_count protected to be available for the derived class * perf_mon: fix variable name issue reported by cppcheck 2023-11-19: 3.1.75.0 * appid: add appId for DNS over QUIC and DNS over HTTP/3 to application_ids.h * decompress: use list for OLE file entries to guarantee their order in file_data * detection: setting flag for flows with affected logging due to event filter 2023-11-07: 3.1.74.0 * actions, detection, file_api, flow, stream: coverity fixes * appid: clean up main thread appid debug and make appid on, off, on work * appid: lua log function with appiddebug check * build: address miscellaneous cppcheck warnings * build: fix up 32-bit compilation * build: fix coverity and cppcheck issues * build: remove unused functions reported by cppcheck * codecs: fix bad checksum when auth(51) protocol header is present between IP and TCP layer. * dce_rpc: added SMB Redesigned Multichannel enabled code * http_inspect: add correct handling of configuration error * ips_options: fix ack option * ips_options: fix flow bits * packet_io: fix incorrect counters caused by data plane counters reset * search_tool: allow an override of the search method * search_tool: fall back to normal mpse if no snort config 2023-10-23: 3.1.73.0 * appid: added support for appid trace logs with multiple logging levels * appid: fixing cppcheck issue * control: code refactor to support all unix flavors * detection: fix cleaning of rule profiling stats when profiling starts * host_cache: added segmented cache * http_inspect: handle reserved gzip flags * http_inspect: response to 0.9 isn't necessarily 0.9 * profiler: extend field length to support uint64 * stream: skip duplicated alerts in TcpReassemblerState's list. Thanks wenhao-in-chengdu for reporting the issue and suggesting a fix. * stream_tcp: ignore normalization checks when in midstream state 2023-10-10: 3.1.72.0 * active: added API for printing delayed action string * appid: support to get correct http session based on stream_id * control: allow one command at a time * dce_rpc: using reset_using_rpkt() inline to what is there in eval() of SMB inspector code as well * flow_cache: added protocol base LRU caches * helpers: increase buffer space for function names, allow printing truncated names * http_inspect: clear fake headers snapshot for 0.9 response * http_inspect: run detection on failed utf decoding * memory: change NOW type counts to SUM type, where necessary * packet_io: fix daq stats * stream_tcp: accept 1 byte of trimmed probe data after zero window * stream_tcp: update rcv_nxt appropriately for each segment * tcp: timeout for embryonic and idle session 2023-09-25: 3.1.71.0 * appid, http_inspect, http2_inspect: create appid session if not present in decrypt event handler, add message section as part of StreamFlowIntf for httpx * codecs: Add IPv6 Reserved Address to GID:116 Rules * detection: avoid multiple fixups of duplicated trees * detection: fix of default ips policy switching * flow: allow reinspection for blocked icmp flows after reload * flow: generate flow setup and established events for ha flows * host_cache: cppcheck fix * http2_inspect: fix http2 frame length for logging * main: fix signals handling after failed started instances * main: reset_stats argument type improvement * parser: add file_id rule syntax evaluation * smtp: add alert for mixed LF and CRLF * smtp: process DATA\n (no \r) * stream: extend list of arguments for extra data logging * stream_tcp: ensure all data segments after a zero window are blocked when NAP is inline * stream_tcp: examine whether a segment plugs a hole before blocking due to exceeding queue_limit 2023-09-10: 3.1.70.0 * appid: makes regex error more of a warning * detection: fix assert expression * helpers: improve hyperscan_search error message * host_cache: added segmented host cache * main: prevent reloading unprepared thread * search_engines: allow a snort config to be passed to find_all 2023-08-27: 3.1.69.0 * appid: mark ssl appid lookup successful if a service id is available * appid: prefer eve client over appid detected client after decryption and use appid detected client version if eve client equals appid client * dce_rpc: fix stats for client/server segments reassembled. Thanks to Bader-eddine Ouaich for addressing the issue. * dns: updates to allow DNS to be compiled dynamically. * framework: add virtual for inspectors that publish data when no ips policy is enabled. * http2_inspect: add frame when logging a packet * http2_inspect: handle empty header name * http2_inspect: update connection settings on ack * http2_inspect: update test tool configurations * http_inspect: adjust formatting * inspector: export get_service_inspector_by_service method * mime: fix boundary search * mime: postpone boundary-look-alike data till the next PDU arrives * mime: support transport padding in boundary strings 2023-08-14: 3.1.68.0 * appid, cip: parsing cip safety segments * dns: parse and publish dns response with ip, fqdn/ttl data * doc: udpate tutorial * http_inspect: disable rule evaluation caching for MIME attachments * managers: fix get_inspector to use the passed in snort config for context and inspection inspectors * sfip: Add < operator so SfIp can be used in std::map and std::set. * src: remove ips option asn1 * stream: init meta ack packet action field * wizard: refactoring - split curses to multiple files by protocol 2023-07-30: 3.1.67.0 * appid: do not raise SMTP response overflow IPS alert on SSL traffic * appid: SSL regex pattern implementation * build: fix cstdint related clearlinux errors * build: fix issues with local build * build: fix type resolution for OSX build environment * control: fix descriptor polling implementation (POSIX) * control: follow code style and formatting * detection: service_extension config * flow: fix ha_test use of stack variable * flow: make sure cpputest mock objects are initialized * ips_options: remove FIXIT comment from sd_pattern * lua: change cip binder rule from 22222 to 2222 (thanks to animator-ra on GitHub for this fix). * main: increase the user policy id range to 0 - 2^64-1 * perf_mon: continue even when pegcounts can't be resolved * profiler: handle reload scenarios and tsan issues * profiler: remove interdependency with time and memory for accumulation * profiler: shell commands for time profiler * ssl: extract common name in the SSL certificate using openssl apis * ssl: parse and publish server common name from server certificate * ssl: remove wildcard character from common name string extracted from ssl certificate * style: fix whitespace 2023-07-14: 3.1.66.0 * appid: cache Complex HTTP Pattern glossary before detectors reload * appid: early detection of ssh and ignoring third-party detection * appid: fix for opportunistic tls detected as ssl * binder: in case of a service change, remove flags indicating an abort of the direction * flow: changes to support derived classes of parent class Flow * ftp: remove file_data dependency on file_id * helpers: added additional log in print_backtrace for debugging purpose * ips_options: add gadget check for vba_data * ips_options: add unit tests for vba_data * ips_options: update dev_notes about IPS options input values * perf_mon: fix dump_stats collision with perf mon * rna: add stats for rna graphs * stream_tcp: validate proper update of stream_tcp state when seglist head follows a hole 2023-06-29: 3.1.65.0 * analyzer: poison memory segment after msg->data * appid: add support for cip multiple service packet * appid: check size boundaries before header validation * appid: do not use global pointers to service and client detectors for packet processing during reload detectors * appid: fix FTP parsing * codecs: fix ipv6_mobility parsing * codecs: fix tcp options parsing * detection: update condition since the negated stuff can be matched in such cases * file_api: avoid file cache lookup after creating new file cache entry. * icmp6: allow rules to match packet data after header * ips_content: add flag for non-default value of depth * ips_content: clean-up of function * ips_content: make the negated content be opposite to normal content * ips_content: update condition checks * log: fix out-of-bounds read access * netflow: fix raw data conversion * parser: base service_only on services not cursor type * profiler: fix date related problems in rule_profiling json output * protocols: remove of unnecessary old_opt check * regex: clear flags reused by module to construct ips option * rna: fix icmpv6 decoding * thread_config: added thread level mempolicy * utils: fix out-of-bound access 2023-06-15: 3.1.64.0 * appid: always publish a change message after do not decrypt * detection: handle case when no rule tree node is found for a policy ID. * flow: introduced granular counters for idle_prunes * http_inspect: remove stream interface abstraction for http/1.1 flows * stream_ip: fix session counters in timeout and cleanup cases 2023-06-01: 3.1.63.0 * appid: changes logic in ssl pattern matching * http_inspect: rebuild start line * loggers: reuse sensor_id u2 event field for tenant_id value * main: add Pig destructor to free dynamic memory * main: allow network IDs to use up to 32 bits. * main: handling the return code in case of error in creation of daq instance * perf_monitor: fix data bus subscription * stream_tcp: account for data from zero window probes 2023-05-21: 3.1.62.0 * appid: added logic to check for encrypted appid before assigning SSL service based on port * decompress, detetion, file_api, framework: cppcheck fixes * flow: clean up flow termination * flow: do not recycle flow cache entries * http_inspect: add support for file transfer using Partial Content * main: disable watchdog when Snort 3 process exits gracefully * main, managers: set the network policy using the user id during inspector delete * memory: add extra jemalloc counts for tracking * memory: use jemalloc stats.mapped for process total * profiler: add json formatter * protocols: add check for missing Geneve layer in get_geneve_options. * protocols,codecs: decode Geneve variable length options. * sfip/test: fix a miscalculation of the number of codes entries. * snort2lua: remove 'reference' option during conversion 2023-05-04: 3.1.61.0 * appid: appIdPegCounters thread data handling refactored to prevent data races * appid: ensure that TP SSL detection is not overwrite SMTPS service and client in a starttls session * appid: validate data size of SSL certificate record before parsing * build: remove unused header. Thanks to Rui Chen for reporting the issue. * cmake: update sed call. Thanks to graysky for reporting the issue. * flow: defensive fix to prevent crash if flow->prev is nullptr. * flow, hash, stream: add a free list node count that is output as a peg count * managers: check main SnortConfig pointer in InspectorManager::get_inspector() to avoid memory bad access calls * memory: fix memory pruning race condition and bail on reap failure * memory: provide a default value for pointers if the module has not been initialized * profiler: add shell commands * profiler: move profiler module to separate files * snort: add show_config_generation() command * stream_tcp: populate TCP pseudopackets with VLAN ids in TCP reassembler to avoid issues with secondary flow creation / expected flow cache 2023-04-20: 3.1.60.0 * appid: fixed TSAN warnings * appid: log max rss difference and pattern count during appid initialization and reload detectors * appid: make ssl app group id lookup set payload and client * appid: making free_servicematch_list thread local * src: change a few operator bool functions to named functions * src: fix broken unit test/tweak define related to previous operator bool fixes 2023-04-06: 3.1.59.0 * file_api: handling file cache context * flow_cache: prune multiple flows * http2_inspect: clear flow stream_intf with flow_data * http2_inspect: make flow data reload safe * memory: subtract the allocated memory from the thread pruned before comparing to the target * stream: store thread local flow control pointer in global * thread_config: add preemptive watchdog kick for flow deletion * thread_config: remove message use in watchdog timer 2023-03-22: 3.1.58.0 * actions: restore rtn check in Actions::alert and add to Actions::log * appid: give precedence to eve detected client over appid when eve_http_client_mapping config is set * detection: fix queue_limit pegcounter evaluation * host cache: removed some log to prevent log flooding * js_norm: initialize normalization context only when script is detected * loggers: fix pcap flushing * memory: add shell command to dump heap stats 2023-03-09: 3.1.57.0 * ftp_telnet: updated flushing around subnegotiation parameters * search_engine: allocate a single shared scratch space * profiler: add rule time percentage table field 2023-02-22: 3.1.56.0 * appid: add validation for rpcbind universal address * appid: merge cname pattern matchers with ssl pattern matchers * configure: fix typo in jemalloc with tcmalloc error message * copyright: update for year 2023 * doc: update sd_pattern docs after obfuscation changes * sd_pattern: keep obfuscation blocks per buffer 2023-02-08: 3.1.55.0 * appid: first packet detector creation support in appid detector builder script * appid: support for IPv4 and IPv6 subnets for First Packet API * appid: updating lua API to accomodate netbios domain extraction, substring search, and substring index. * appid: use packet thread's odp context instead of inspector's context for packet processing * build: fix configure_cmake.sh 'too many arguments' error * detection: add new pegcount * main: avoid race conditions when accessing id to tid map * ssl: refactor ssl client hello parser to be used by appid/ssl inspectors * stream_tcp: fix passive pickups with missing packets. Thanks to nagmtuc and hedayat for reporting and helping debug the issue. * wizard: ensure Wizard is refcounted by MagicSplitter to prevent snort crashes due to memory corruption 2023-01-25: 3.1.53.0 * appid: publish tls host set in eve process event handler only when appid discovery is complete * detection: show search algorithm configured * file_api: handling filedata in multithreading context * flow: add stream interface to get parent flow from child flow * memory: added memusage pegs * memory: fix unit test build w/o reg test 2023-01-18: 3.1.52.0 * dce_rpc: add errno resets during uuid parsing * dce_rpc: handling dcerpc over smbv2 * flow: update flow creation to exclude non-syn packets with no payload * framework: change range check types to int64_t to fix ILP32 bit issues * main: Fix missing include file that caused build error on some platforms. * memory: add final epoch to capture stats * memory: add regression test hooks * memory: fix init sequence; thanks to amishmm and Xiche for reporting and debugging the problem * netflow: grab the proto off of the netflow record - not the wire packet * rna: reset host_tracker type when visibility changes * stream: fix iss and irs and mid-stream sent post processing * stream: refactor tcp state machine to handle mid-stream flow and more established cases 2023-01-11: 3.1.51.0 * appid: add support for cip service, client and payload detection * appid: do not create snmp future flow for udp reversed session * appid: use packet thread's odp context for future flow creation * build: error out if both jemalloc and tcmalloc are configured * build: exclude unused memory related sources * js_norm: add benchmark tests for PDF parser * js_norm: decode UTF-16BE to UTF-8 for JS in PDF * js_norm: delete unused method * js_norm: tune PDF parser performance * lua: add Adobe JavaScript related identifiers to snort_defaults * lua: fix typo in Sensitive Data classifications name * main: fix const issues causing compile warnings * memory: delete unnecessary includes * memory: incorporate overloads into profiler * memory: refactor jemalloc code and add relevant pegs * memory: rename manager to overloads to better indicate purpose * memory: update developer notes * memory: update stats regardless of state; add unit tests * memory: use the process total instead of per thread totals to enforce cap * watchdog: print thread id as well for better identification of unresponsive threads 2022-12-19: 3.1.50.0 * alert_fast: fix initialization of http_inspect cheat codes * config: ensure table state is reset when starting a new shell * config: fix talos tweaks for the daq module * data_bus: improve pub-sub performance * host_cache: fix initialization from Lua * pop, imap, smtp: gracefully decline buffer requests when flow data is not present 2022-12-15: 3.1.49.0 * appid: appid_detector_builder.sh addPortPatternService call fixed * appid: do not reset session data when built-in discovery is not done * appid: fixed assert condition for odp_ctxt and odp_thread_local_ctxt * doc: add decompression mention to js_norm reference * doc: update user/js_norm.txt for PDF in email protocols * geneve: if daq has the capability, do not bypass geneve tunnel * ips_options: fix offset related bug in byte_test eval() * js_norm: add PDF stream processing * js_norm: add support for email protocols * js_norm: fix pdf_tokenizer_test on FreeBSD platform * js_norm: update PDF tokenizer to use glue input streambuf * stream: ignore PAWS timestamp checks when in no_ack mode * wizard: remove client_first option 2022-12-01: 3.1.48.0 * appid: added config for logging alpn service mappings * appid: fixed addition of duplicate entries in app_info_table * appid: make appid availability independent from TP state * cmake: add FLEX build macro * doc: update sensitive data documentation * doc: update user/js_norm.txt for PDF * flow: add an event for retry packets * flow: added an event to allow post processing of new expected flows * flow: fix deferred trust clear when packet is dropped * flow, stream: added code to track and event for one-sided TCP sessions and generate an event for established or one-sided flows * http_inspect: add decompression failure check before normalization * http_inspect: remove port from xff header * ips_option: keep cursor intact for a negated content mismatched * ips_option: keep cursor intact for a negated hash mismatched * js_norm: implement Enhanced JS Normalization for PDF * js_norm: use FLEX macro to build parser * process: watchdog to abort snort when multiple packet thread becomes unresponsive * smb: handling smb duplicate sessions * stream: add logic to ensure metaACKs cause flushing 2022-11-17: 3.1.47.0 * appid: add a changed bit for discovery finished * appid: ntp detection improvements * appid: service, client and payload detection by lua detectors and third-party when first packet re-inspection is enabled * doc: add JavaScript Normalization section to user manual * doc: add js_norm alerts to builtin_stubs.txt * http_inspect: subdivide dev_notes into topics * http_inspect: move Enhanced JS Normalizer from NHI to a standalone component * js_norm: implement standalone Enhanced JavaScript Normalizer * main: dump packet trace after publishing finalize event since verdict could be modified. * main: update to improve performance by making packet tracer checks before calling function. * netflow: implement deferred trust, cleanup * packet_io: allow ACT_TRUST to be used as a delayed action. * packet_io: the most strict delayed action takes precedence. * smtp: do not accumulate cmds across policies and reloads. Avoids memory and performance problem. * stream: add info about the splitter lifetime to dev_notes * stream: ignore flushing from meta-ack if sent after FIN * stream: remove splitter from session before inspectors * stream: set splitter only on initialized tcp sessions or if midstream sessions are allowed * wizard: remove inspector's ref counter increments from MagicSplitter 2022-11-04: 3.1.46.0 * appid: check for empty patterns in lua detector api input * appid: publish client and payload ids set in eve process event handler and ssl lookup api only after appid discovery is complete * detection: add config option for SSE * detection: skip a rule variable copy for a single-branched node * doc: add information about handling multiple detection in SSE * doc: specified which packages are sent on rejection * helpers: fix duplicate scratch_handler * http_inspect: add override to destructor * http_inspect: move LiteralSearch::setup for http_param to its module * main: add variables to lua environment * netflow: if LAST_SWITCHED isn't provided, use packet time * parser: improve port_object hash function * ports: align fields of PortObject and PortObject2 * ports: enable checks in debug build only 2022-10-25: 3.1.45.0 * detection: check Pig run number in node state conditions. Fixes crash introduced in 3.1.44.0. 2022-10-20: 3.1.44.0 * appid: return APP_ID_NONE only if hsession is not present for http3 * detection: add stateful signature evaluation * flow, reputation, protocols: remove reputation information from packet and flow * http_inspect: inspect multiple MIME attachments per message section * http_inspect: maximum_pipelined_requests * http_inspect: MIME partial inspections * http_inspect: remove rule option timing features * lua: add sensitive data rules * reputation: added profiling to the event handlers * reputation: fix for array indexing error when searching for reputation file entries * reputation: refactor event generation for matches * s7commplus: adding wizard support for s7commplus * utils: add possibility to process keywords as identifiers 2022-10-05: 3.1.43.0 * actions: fix action logging for suppressed events * appid: handle multistream http protocols(http2,http3) together * appid: return appid set by eve for http/3 if no hsession is present, but prefer hsession appid over eve * appid: updating devnotes for first packet API * detection: refactor set next packet to use the dummy active object when there is no packet * flow: disable inspection for and HA flow unless the state is setup or inspect * http2_inspect: std::list - remove indirection from stream list * http_inspect: allowed and disallowed methods * reputation, sfrt: refactor reputation to remove global variables 2022-09-22: 3.1.42.0 * appid: custom lua detector api to map ip and port to appids on the first packet * appid: added a snort config to control client-process mapping * appid: dppid service detection prioritized over third party detection * appid: cache support for unprocessed ssl packets * appid: handle http event for httpx(2,3) traffic * content: fix retry * content: fix adjustment of depth/within when offset/distance are negative * detection: add http3 to http ips buffers * detection: add option to reduce rtns by port values * doc: added smtp rule 124:17 * flow: abstract class added to work on stream based connections * http2_inspect: updated with abstracted httpx(2,3) flags * http_inspect: abstract inspection of httpx(2,3) * http_inspect: http_max_header_line and http_max_trailer_line rule options * http_inspect: rework range rule options * ips_options: change ips.obfuscate_pii to be true by default * ips: trace all node evaluations * memory: fix typo in peg counter help text * netflow: evaluate all matching netflow rules, not just the first match * parser: add implicit http3 to http ips options otn * parser: remove platform dependency from parse_int function * payload_injector: accomodate httpx(2,3) stream id values * pub_sub: handle httpx(2,3) traffic * reputation: use the thread specific reputation data for aux ip event * rna: handle httpx(2,3) traffic * stream: export support for creating udp session * trace: ips variables are dumped as hex * utils: remove alert for an opening tag in string literals * wizard: deprecate client_first option 2022-09-07: 3.1.41.0 * appid: send intermediate messages for appid reload commands to the socket * file_api: corrected the formatting of File Statistics output * file_id: Update Office Documents rules * flow: update flow statistics before processing a flow * framework, rna, pub_sub: make data bus get_packet method a const * netflow: log even when not all info is present * sd_pattern: add and improve built-in patterns * stream: free flow data, if flow is blocked * stream: use a const packet to populate the flow key * utils: refactor JS normalizer unit tests 2022-08-25: 3.1.40.0 * appid: activate appid debug object before printing logs from http event handler * appid: do not clear client version when deleting appid session data * ChangeLog: change to md format * daq: Remove duplicate entries from static module list; thanks to raging-loon for reporting the issue * doc: add section on commit messages to the dev guide * doc: specify parallelization in make in tutorial; Thanks to nitronarcosis for reporting the issue and suggesting a fix * ffi: add get_module_version(name, type) for conditional config * flow: fix deferred trust for trust followed by defer * gid: upper bound changed to match event_filter and rate_filter implementation limits * help: enclose --help-config string defaults in single quotes * helpers: make install_oops_handle and remove_oops_handle so_public, install process.h and sigsafe.h * http_inspect: add doc for http_num_cookies * http_inspect: add more identifiers to js_norm lists * http_inspect: http_num_cookies rule option * http_inspect: parameters for header alerts * hyperscan: add warning when deserialization fails that includes error code * ip_proto: enable match on PDUs * managers: only publish the reloaded flow event for existing flows with an old policy * parameter: add int_list * parameter: simplify multi validation * reputation: make reputation handle flow setup, reloaded, and packet without flow events * stream: typo in dev_notes; Thanks to RobinLanglois for the fix * style: change max line length to 120 including \n * telnet: use the same splitter as ftp_server * utils: allow closing tag in external scripts * vlan: add configurable TPIDs; Thanks to ozkankirik for reporting the issue 2022-08-10: 3.1.39.0 * cmake: add --enable-luajit-static option to enable LuaJit linked statically * http_inspect: request and response shouldn't be available for pkt_data * ips_options: remove obfuscate_pii caching in sd_pattern option * main, managers: remove the reload_module command * netflow: pass a flag if the initiator and responder were swapped * parser: remove 138 from builtin GID exceptions * rna: Added log message for missing 'rna.conf' path * utils: fix compilation warning [-Wcomma] * utils: fix JS split to reflect tokens correction and re-normalization * utils: validate escaped JavaScript identifiers 2022-07-28: 3.1.38.0 * appid: restart inspection for ssl session inside http tunnel * appid: set persistent flag for sunrpc expected session * appid: send more packets to third-party for FTP user name extraction * detection: separate the branch/leaf result to different variables * http_inspect: remove dependency of JS normalization depth on HTTP depth * http_inspect: add more explicit js type values to otag type check * http_inspect: do not stop normalization in case of opening script tag * http2_inspect: add support for GOAWAY frames * http2_inspect: add support for PRIORITY frames * http_inspect: directly call detection * http2_inspect: interface to http_inspect now uses real reassembled packet * pub_sub: add definitions for ssl block and block with reset messages * snort2lua: change the conversion of sensitive data rules * stream: removed all instances of 'cap_weight' config parameter * stream: removed macro references for 'cap_weight' config parameter * utils: add static initialization of norm_names * utils: continue JS normalization after opening tag seen 2022-07-19: 3.1.37.0 * reputation: print LogMessage in reputation only when in verbose mode * utils: fix Unicode LS PS handling in JavaScript 2022-07-14: 3.1.36.0 * appid: fix stats cleanup * dce_smb: fix stats cleanup * file_api: fix stats cleanup * http_inspect: do not abort midstream pickups * normalizer: make normalizer and tcp_normalizer peg counts shared * stream: fix stats cleanup * utils: fix arrow functions parsing * utils: fix parsing of decimal number literals 2022-07-08: 3.1.35.0 * sandbox: must propagate file_id for includer logic 2022-07-07: 3.1.34.0 * build: remove unnecessary type casts * dce_rpc: set presistent flag for dcerpc pinhole session * file_id: fix rules_file path resolution * http2_inspect: consider continuation when checking headers length * log: add log_value and log_limit overloads with built-in integer types * utils: make shutdown timing stats more precise; Thanks to trevor tao for the update 2022-06-30: 3.1.33.0 * file_api: implement file type identification over ips engine * filters: check if a configured gid value is supported by filter's implementation * framework: update base API version to 14 * ftp_telnet: make active ftp expected session in the correct direction * http2_inspect: fix unit tests depending on REG_TEST * http_inspect: implement uniform alerts when splitter aborts * hyperscan: delete databases upon error * lua: update sid and rev fields * main: move trace related code to trace folder * netflow: fix v5 header time value * parser: update do_hash() function to work correctly with port variables * parser: use std::string in ExpandVars * rna: allow rna to fire an event when a new netflow connection is detected * rna: use the longest user agent fingerprint among multiple matches * wizard: update wizard's patterns to follow the proto option 2022-06-16: 3.1.32.0 * appid: config for logging eve process to client mappings * dce_smb: reduce smb_max_credit range to avoid uint16_t overflow * detection: remove redundant FIXIT * ftp_telnet: correct the implementation for check_encrypted and encrypted_data config, handle form-feed as non-encrypted traffic * ftp_telnet: handle all space characters as a seperator between FTP request command and arguments * http_inspect: add explicit check for HTML script opening tag ending * http_inspect: remove unneeded header inclusions and improve cleanup before trailers * ips_options: improve ips_hash and ips_cvs code coverage * log: Fixed missing include for Clear Linux build * logger: added reload function to create new files when snort reloads * main: add null check for scratch handler * mime: cleanup * modules: resolve int type mismatch in config options * netflow: fix build on MacOS * netflow: implement RNA integration for host/service discovery * netflow: support memcap reconfiguration upon reload * openssl: Openssl minimum version is set to 1.1.1 * profiler: fix issue with negative number cast to unsigned for max_depth * rna: reduce range for ttl, fix cast for df, minor and major options; Thanks to liangxwa01 for pointing this out * stream_tcp: fix splitter abort handling * stream_tcp: flip the server_side flag in fallback() and assert what it should be * utils, parser: remove redundant fixits * utils: remove curly brace parsing from regex literals * utils: remove redundant checks in regex groups * wizard: use const reference instead of copying 2022-06-02: 3.1.31.0 * appid: add lock_guard to prevent data race on reload * appid: do not delete third-party connection when third-party reload is in progress and the context swap is not complete * dce_rpc: convert tree tracker to shared ptr * doc: add class track description to user doc * filters: add correct handling of by_src and by_dst; Thanks to Albert O'Balsam for reporting the bug * host_tracker: rename generic files and classes * http2_inspect: add alert and infraction for non-Data frame too long * http_inspect: add Content-Type header validation for Enhanced JS Normalizer * http_inspect: add field for raw_body * http_inspect: add handling of binary, octal and big integers to JS Normalizer * http_inspect: change js processed data tracking * http_inspect: implement general approach of checking Content-Type header * hyperscan: reallocate hyperscan scratch space when patterns are reloaded during appid detector reload * netflow: enforce memcap for session record and template LRU caches * perf_monitor: fix timestamp for idle processing * utils: add keyword new support and object tracking * utils: allow script closing tag in single-line comments 2022-05-19: 3.1.30.0 * build: Update dependent libdaq version to 3.0.7 * doc: update clone link in README; Thanks to billchenchina * doc: user documentation update for obfuscate_pii and --help-module * framework: add method to get unquoted string from configuration value * http2_inspect: Templatize variable length integer decoding of integer and string * http_inspect: add ignoring defined object properties for Enchanced JS normalizer * http_inspect: avoid sending compressed data to JS normalizer * http_inspect: check if input available before JavaScript normalization * mime: set partial_header to null after deletion * perf_monitor: remove unused flatbuffers support * piglets: remove unused test harness * smb: handle file context cleanup * snort3: remove SMB detection from service_netbios.cc * stream: refactor flush_queued_segments * stream_tcp: add null check for get_current_wire_packet() in dce too * stream_tcp, pop: add sync_on_start method to StreamSplitter * stream_tcp: provide a context and a wire packet where needed, when calling into reassembly from outside regular processing (handle_timeouts) * utils: add Latin-1 decoding of JavaScript unescape-like functions * utils: allow regex literals after operator * utils: fix regex char classes parsing * utils: turn debug-build assertion into a product-build code * wizard: fix code style 2022-05-04: 3.1.29.0 * appid: add alpn matchers * dce_rpc: update address space id in the smb keys * doc: rule text updates * flow, network_inspectors, policy_selectors, stream: make address space id 32 bits and add a tenant id to the daq header * flow, side_channel, utils: fix clang issues * flow: add inline cppcheck suppressions * flow: change the padding and bits in the flow key to make it more clear * http_inspect: install header files, create a virtual base class for http_inspect and http_stream_splitter * http_inspect: move mime processing outside of file and detect depth * main: update analyzer command log message to copy the variable arguments before using them for the remote response * wizard: update glob storage due to shared memory 2022-04-25: 3.1.28.0 * appid: add bytes_in_use and items_in_use peg counts * appid: ssl service detection for segmented server hello done * binder: add binder actions to flow reassignment; Thanks to Meridoff for the original report of the issue * bufferlen: add missing relative override * conf: add cip and s7commplus to the default snort.lua * content: auto no-case non-alpha patterns * dce_rpc: Handling only named ioctls for smb * detection: add missing fast pattern buffer translations * detection: make CursorActionType generic * detection: map buffers to services * detection: rearrange startup rule counts * detection: remove now obsolete get buf support * doc: add clarification on default bindings in developer notes and user notes * events: add action logging to the event * flow, managers, binder: only publish flow state reloaded event from internal execute * flow: only select policies when deleting flow data if there is a policy selector * flow, snort_config: change service back to a pointer and add a method to return a non-volatile pointer for service * flow: use a flag instead off shared pointer use count for has service check * framework: make Cursor SO_PUBLIC * ftp: fix FTP response parsing * ftp: flush FTP cmds ending in just carriage return * host_cache: bytes_in_use and items_in_use peg counts * host_cache: fix unit test broken on some platforms * inspectors: add / update api buffer lists * ips: eliminate direct dependence on get_fp_buf of all ibt (by using rule options) * ips: eliminate PM_TYPE_* to make fast pattern buffers generic * ips: further limit port group rules * ips_options: eliminate obsolete RULE_OPTION_TYPE_BUFFER_* * ips_options: fix cursor action type overrides * main: check policy exists instead of index when setting network policy by id * mime: handle MIME header lines split between inspection sections and improve folded header line processing * mms: add check that BerElement argument isn't null before calling BerReader::read * mms: adding manual updates for the new service inspector for the IEC61850 MMS protocol * mms: adding new service inspector for the IEC61850 MMS protocol * mms_data: make a fast pattern buffer * mms: moved creation of TpktFlowData inspector ID to process init * module_manager: fix memory pegs display issue during packet processing, while also correctly computing the memory pegs in Analyzer::term * netflow: framework for netflow V5 and V9 events * packet_io: add rewrite action logging * parser: update dev notes * raw_data: only search pkt_data if no alt buffer or raw_data rules included in group * service inspectors: update fast pattern access * sfip: improve warning suppression * smtp: SMTPData initialization changed from memset to constructor * smtp: STARTTLS command injection event processing * stream: add can_set_no_ack() api to check if policy allows no-ack mode * stream: add current_flows, uni_flows and uni_ip_flows peg counts * utils: limit JS regex stack size * utils: track groups and escaped symbols in JavaScript regex literals 2022-04-07: 3.1.27.0 * ac_full: refactor api access * ac_full: remove cruft * ac_std: fix case translation buffer size * alerts: remove obsolete stateful parameter * appid: provide client appid set by encrypted visibility engine to ssl through the ssl appid lookup api * build: compile against libatomic if present; Thanks to W. Michael Petullo * control, shell: add a command to set the network policy to be used by subsequent commands * dce_rpc: handle cleanup path and race conditions for dce traffic * detection: do not check ips policy when builtin events are queued * detection: fixup dump of detection option tree * detection: minor refactoring of rule header access * detection: override match queue limit for offload * detection: remove cruft * detection: skip match deduplication for hyperscan * file_api: handle user_file_data cleanup * hext: change stdin designation from tty to - since the trough uses dash * http2_inspect: reduce holes in objects * http_inspect: add unescape text processing for Enhanced JS Normalizer * http_inspect: decode String.fromCodePoint() JavaScript function * http_inspect: delete alerts 119:279 and 119:280 * http_inspect: provide current packet to trace * http_inspect: support headers Restrict-Access-To-Tenants, Restrict-Access-Context * hyperscan: ensure adequate scratch when deserializing * rate_filter: move to inspection policy * search_engine: add fast pattern only count at startup * search_engine: always build ac_full since it is a hard default case * search_engine: fix .debug = true output * search_engine: fix adjustment for fast_pattern_offset * search_engine: fix fast pattern only eligibility check * search_engine: remove obsolete warning on max_pattern_len change * search_engine: remove search_optimize parameter (always true) * search_engine: truncated patterns not eligible as fast pattern only contents * search_engines: add and refactor unit tests * search_engines: ensure SearchTool with hyperscan gets multi-match mode * search_engines: remove the legacy ac_banded algorithm * search_engines: remove the legacy ac_sparse algorithm * search_engines: remove the legacy ac_sparse_bands algorithm * search_engines: remove the legacy ac_std algorithm * sfip: suppress compiler warning * utils: add string concatenation for Enchanced JS Normalizer * utils: allow opening/closing tags in external scripts * utils: fix JS Normalizer benchmark build * utils: fix tracking variable when the output buffer is reset * utils: harden script opening tag sequence 2022-03-23: 3.1.26.0 * actions: revert bf62a22d43bb2d15b7425c5ec3e3118ead470e8d * actions: set a delayed action on Reject IPS Action hit * analyzer: avoid distilling sticky verdicts * appid: appid api to provide the path to appid detector directory * appid: make appid a global inspector * appid: sum stats at tterm and null the thread local stats pointer after delete * control: make sure reload commands with empty argument is handled correctly * event: add new static member update_and_get_event_id() * file_api: Handling user_file_data cleanup * flow: make service a shared pointer to handle reload properly * framework: update base API version to 13 * http_inspect: do file decompression and utf decoding on non-MIME uploads * http_inspect, mime: VBA macro decompression for HTTP MIME file uploads * inspector, main, inspector_manager: add support for thread local data in inspectors and commands updating reload_id * main: add the control connection to the analyzer command and a method to log a message to both console and the remote connection * main: fix and reenable the distill_verdict unit test * managers: add a faster get_inspectors method * managers: add get_inspector unit tests * managers: move inspection policies into the corresponding network policy * packet_io: fix active action so the first reset occurred takes effect * policy_selectors: add a method to select policies based on DAQ_FlowStats_t * reputation: add a command to reload repuation data * stream: reusable stream splitter 2022-03-09: 3.1.25.0 * appid: do not add duplicate process to client app mapping for the same process name * file_id: remove unused decompression and decode depth parameters * http_inspect: add http_header_test, http_trailer_test rule options * http_inspect: add override to fix warning * http_inspect: add unescape function tracking for Enhanced JS Normalizer * http_inspect: call mime in a loop for each attachment * http_inspect: remove feature to disable raw detection upon flow depth * http_inspect: use http_inspect decompression config parameters for HTTP MIME traffic instead of file_id * mime: fix resetting state after every attachment and check state instead of decode object * mime: return at the end of each attachment and set the file_data for http * process: add watchdog to detect packet threads dead lock or dead loop * ssh: NULL check for session pointer before access * stream_tcp: call final flush only when the seglist has no gaps * stream_tcp: clarify small segments help text and remove usage from lua * utils: check for NULL before calling fclose() * utils: check more likely branches at first * utils: combine ignore list with normalization map * utils: fix compilation issues in js_tokenizer * utils: improve Flex matching patterns * utils: pre-compute ID normalized names * utils: refactor the alias lookup * utils: wrap unordered set with a fast lookup table * watchdog: remove unused code 2022-02-23: 3.1.24.0 * detection_filter: update dev notes to show multithreaded behavior * doc: fix typos in text; Thanks to Greg Myers for reporting the issue * http_inspect: refactor HttpIpsOption * latency: disabling time out functionality on implicit enable * mime: stop setting the file_data buffer for raw non-file MIME parts * netflow: add dev_notes.txt * sfdaq: fix for underflow of outstanding counter * stream: Remove preemptive prunes peg count 2022-02-09: 3.1.23.0 * detection: add dir abort check in skip_raw_tcp * doc: add notes about CLI/Lua precedence * doc: fix incorrect http builtin rule sid * event: make apis SO_PUBLIC to access in .so * filters: allow detection filter to sum events across threads * http_inspect: HttpStreamSplitter::reassemble verifies gzip file magic and checks for FEXTRA flag * main: ignore Snort module's option if it duplicates CLI option * main: parse snort module before others * main: remove default values for other-module parameters in snort module * main: stop with error on include(nil) attempt * packet_io: decrease daq module's parameters priority * stream: defer flush_queued_segments() if flow->clouseau * stream_tcp: better place for setting delayed_finish_flag * stream_tcp: fix a bug in which in some cases we did not call splitter finish() in each direction, by calling flush_queued_segments() in perform_fin_recv_flush() on FIN with data packets * stream_tcp: introduce TcpStreamTracker::delayed_finish_flag and call splitter finish from flush_on_data_policy if delayed_finish_flag is true * stream_tcp: wrap flow->clouseau in searching_for_service() 2022-01-31: 3.1.22.0 * appid: give priority to custom process to app mappings over ODP mappings * appid: rename efp (encrypted fingerprint) to eve (encrypted visibility engine) * detection: change output format of dump-rule-state * pub_sub: export assistant_gadget_event.h header file * stream: set the max number of flows pruned while idle to 400 2022-01-25: 3.1.21.0 * appid: do not delay detection of SMB service for the sake of version detection * control: fix macro definitions * copyright: Update year to 2022 * http_inspect: correct comment regarding header splitting rules * http_inspect: forward 0.9 request lines to detection * http_inspect: http_version_match uses msg section version id * http_inspect: webroot traversal * main: move policy selector and flow tracking from snort config to policy map * main: only add policies to the user policy map at the end of table processing * policy: add a file_policy to the network policy and use it * stream: QUIC stream dependent changes * stream_tcp: ensure that we call splitter finish() only once per flow, per direction * wizard: remove extra semicolon 2022-01-12: 3.1.20.0 * appid: handle SNI in efp event * appid: make peg counts consistent with what is reported to external components * appid: update appid api to include ssh in the list of service inspectors that need inspection * dnp3, gtp, file_type: fix assert while parsing string param * doc: update JavaScript normalization docs * http2_inspect: don't send data frames to the http stream splitter when it's not expecting them * http2_inspect: hardening * http_inspect: version update, http_version_match rule option * stream_tcp: limit reassembly size for AtomSplitter; Thanks to barosch78 and DAKOIT for their help in the process of finding the root cause * stream_tcp: Skip seglist gap in post-ack mode if data is acked beyond the gap * stream_user: change packet type from PDU to USER for hext daq, user codec, and stream_user * wizard: make max_search_depth applicably for curses 2021-12-15: 3.1.19.0 * appid,ssh: roll AppId's SSH detector into SSH service inspector * appid: remove hard-coded SSH client patterns which are available as part of ODP * build: add cppcheck suppressions for unusedFunctions * build: clean up some cppcheck style issues * build: move flex options to the template file * cmake: fix CMP0115 Warning * daq: sort --daq-list output by module name * dce_smb: add new smb counters * file_api: add null check for user file data * file_api: handle file_data * framework,appid: generate NO_SERVICE event when no inspector can be attached to a flow; wait for the event in appid before declaring service as unknown for the flow * http_inspect,http2_inspect: refuse midstream pickups * http_inspect: add JavaScript builtin de-aliasing * http_inspect: rename js normalization options * http_inspect: use correct detect_length for partial inspection cleanup * loggers: fix truncated alert_syslog messages * lua: configure a list of JS ignored IDs in default_http_inspect table * managers: continue inspectors probe when packet has disable_inspect flag * mime: add the support for vba macro data extraction of MS office files transferred over mime protocols * parser: fix missing-prototypes warning in parse_ports.cc * parser: fix parsing of portsets * rpc: remove RpcSplitter altogether and use LogSplitter instead * snort2lua: fix conversion of variable sets * stream: add PKT_MORE_TO_FLUSH flag and use it in TcpReassembler::scan_data_post_ack() to signal AtomSplitter whether to flush or not * stream: fix issue with atom splitter not returning FLUSH * stream_tcp: remove unnecessary special adjustment methods * utils: (JSTokenizer) fix braces initialization compilation error (gcc5) * utils: fix state adjustment in JS Tokenizer * utils: place init/deinit routine under a single function * utils: update JS normalizer unit tests * vlan: implement vlan encode function 2021-12-01: 3.1.18.0 * alert_sf_socket: remove obselete logger * appid: exclude stubs from coverage * build: remove config.h from headers * build: remove unreachable code * build: update configure options * catch: update catch to v2.13.7 * dev_notes.txt: fix miscellaneous typos * doc: remove mention of Automake * doc: update builtin_subs.txt with EVENT_JS_SCOPE_NEST_OVERFLOW alert * doc: update module usage and inspector types in the dev guide * doc: update user/http_inspect.txt with http_inspect.js_norm_max_scope_depth option description * doc: update wizard documentation * file_api: file_data changes * framework: add support for multiple tenant * framework: don't call a gadget's eval() or clear() after its stream splitter aborted * framework: replace Value::get_long() with a platform-independent type * framework: update base API version to 11 * helpers: fix stream unit test on 32 bit platforms * http2_inspect: discard with padding * http_inspect: fix total_bytes peg count * http_inspect: new rule options num_headers, num_trailers * http_inspect: store ole data in msg_body * http_inspect: update comments for asserts in eval and clear * http_inspect: update dev_notes.txt * hyperscan: disable bogus unit test leak warnings * ips_options: create LiteralSearch object for vba decompression at the time of snort initialization * memory: add max rss to verbose memory output * memory: add original overload manager * memory: add support for jemalloc * memory: expand profile report field widths * memory: fix accounting issues * memory: free space per DAQ message, not per allocation * memory: move mem_stats to MemoryCap * memory: refactoring * memory: refactor pruning and update unit tests * memory: remove explicit allocation tracking * memory: update dev notes * perf_monitor: allow constraint seconds = 0 * piglets: refactor support code * reputation: remove unused sfrt code * rna: refactor unit test stubs * search_engines: remove unused test code * stream_tcp: delete unused unit test cruft * stream_tcp: only fallback if stream splitter aborted and don't keep processing fragments after MagicSplitter returned STOP * stream_tcp: remove unused unit test code * stream_user: refactor, remove cruft * unified2: remove cruft * utils: do output adjustment in case of carryover * utils: enable batch mode for Flex * utils: (JSNormalizer) add program scope tracking and alias resolution * utils: (JSNormalizer) rework the split over multiple chunks behavior * utils: pass an address into memset instead of object * utils: reduce flex generation of unused js normalizer code * utils: reset Normalizer context when new script starts * vba: fix buffer overflow in ole parser * wizard: add patterns to match unknown HTTP and SIP methods * wizard: change default value of max_search_depth from 64 to 8192 * wizard: remove telnet IAC pattern 2021-11-17: 3.1.17.0 * appid: restore the log of reload detectors complete message * build: remove HAVE_HYPERSCAN conditional from installed header * detection: add allow_missing_so_rules * detection: ensure PDUs indicate parent when available * dnp3: update builtin rule description * doc: arp_spoof builtins * doc: back orifice builtin rules * doc: spell correction * doc: update builtin alerts description for dnp3 * doc: update builtin alerts description for modbus, HTTP/2 * doc: update builtin alerts description for portscan * doc: update builtin rule documentation for http_inspect * doc: update builtin rules documentation for dce_smb, dce_tcp, dce_udp, rpc_decode * doc: updated builtin rules documentation for ssh * http2_inspect: hardening * http2_inspect: http1_header buffer always created immediately after decode_headers * http2_inspect: push promise error state check * http2_inspect: truncated trailers without frame data * ips_option: Enabling trace for vba_data options and fixing memory leak while extracting vba_data * main: use dynamic buffer on demand in trace print functions * u2spewfoo: Fixed incorrect usage line 2021-11-03: 3.1.16.0 * appid: during initialization, skip loading of Lua detectors that don't have validate function * appid: in packet threads, skip loading of detectors that don't have validate function on reload * appid: provide API to give client_app_detection_type * codec: geneve - ensure injected packets have geneve port in outer udp header * detection: refactor mpse serialization * detection: rename PortGroup to the more apt RuleGroup (and related) * detection: replace PortGroup::alloc/free with ctor/dtor * doc: add SIP built-in rule documentation * doc: update built-in rule doc for SMTP, IMAP and POP inspectors * doc: update built-in rules documentation for dns module * doc: update built-in rules documentation for ftp-telnet * doc: updated builtin rules documentation for gtp module * flow: fix warning in flow_cache.cc * flow: use the same pkt_type to link and unlink unidirectional flows * http2_inspect: refactor decoded_headers_buffer for hpack decoding * http_inspect: eliminate cumulative js data processing * http_inspect: handle unordered PDUs for inline/external JavaScript normalization * http_inspect: improve file decompression * hyperscan: sort patterns for dump / load stability * ips: correct fast pattern port group counts * mpse: add md5 check to deserialization * reload: add logs to track reload process * reload: move out reload progress flag to reload tracker * search_engine: support hyperscan serialization * search_engine: support port group serialization * sip: track memory for sip sessions * ssl: disable inspection on alert only at fatal level * stream_tcp: fix init_wscale() to take into account the DECODE_TCP_WS flag * tcp: remove the obsolete __GNUC__ block from TcpOption::next() * tcp: stop on the EOL option in TcpOptIteratorIter::operator++() * utils: add get methods to peek in internal buffer * utils: correct Normalizer's output upon the next scan * wizard: update globbing and max_pattern 2021-10-21: 3.1.15.0 * appid: detect client based on longest matching user agent pattern * appid: update the name of the lua API function that adds process name to client app mappings * build: fix in CodeCoverage.cmake to generate *.gcda *.o files as needed by gcov * dce_smb: optimize handling pruning of flows in stress environment * decompress, http_inspect: add support for processing ole files and for vba_data ips option * doc: add punctuation to builtin stubs, fix formatting * doc: builtin rule documentation updates * http2_inspect: partial header with priority flag set * http_inspect: add automatic semicolon insertion * http_inspect: document built-in alerts * http_inspect: do not normalize JavaScript built-in identifiers * http_inspect: hardening * http_inspect: implement JIT (just-in-time) for JavaScript normalization * http_inspect, ips_option: decouple the vba_data ips option from http_inspect and add the trace debug option to vba_data * policy: update policy clone code to avoid corrupting active configuration * protocols: prevent infinite loop over tcp options * rna: call set_smb_fp_processor function in reload tuner * rna: do not do service discovery for future flows 2021-10-07: 3.1.14.0 * appid: enhance RPC service detector to handle RPC Bind version 3 * appid: fix update_allocations signature in unit test * appid: log appid daq trace first followed by subscriber modules * appid: provide api for Lua detectors to map process name to client app * doc: add descriptions for 119:265-271 builtin alerts * doc: update builtin stub rule reference strings * file: add file policy id and other config data as part of packet tracer command under File phase * file_api: add decompress_buffer_size * flow: add total flow latency to flowstats * http2_inspect: compare scanned bytes to total received during reassemble * http2_inspect: protect against reassemble with more than MAX_OCTETS * http_inspect: change format of normalized JS identifiers * ips_options: rename script_data buffer to js_data * latency: add configuration for implicit enable * lua: fix Talos tweak snaplen * rna: support CPE new os RNA event * snort_config: adding api for enabling latency module * utils: add custom i/o stream buffers to JS normalizer * utils: adjust output streambuffer expanding strategy and reserved memory * utils: fix compilation error of js_identifier_ctx_test for clang 2021-09-22: 3.1.13.0 * appid: prioritize appid's client detection over third-party * appid: stay in success state after RPC is detected * builtins: add --dump-builtin-options * catch: enable benchmarking * cip, iec104: update stub rule messages for consistent format * control: explicitly include ctime header in control.h * detection: add fast patterns only once per service group * doc: add support for details on builtin rules in the reference * doc: update reference for 2:1 and 129:13 * doc: update the documentation of "replace" option and "rewrite" action * doc: update user tutorial with '--enable-benchmark-tests' option * file_api: new api added for url * file_api: revert store processing flow in context * flow: don't do memcap pruning if pruning is in progress * host_cache: Avoid data race in cache size access * host_tracker: Removing unused methods * http_inspect: http_raw_trailer fast pattern * http_inspect: pass file_api the uri with the filename and extract the filename from the uri path * http_inspect: remove memrchr for portability * netflow: use device ip and template id to ensure that the template cache keys are unique * output: adopt the orphaned tag alert (2:1) * rna: Avoid data races in vlan and mac address * rna: Avoid infinite loop in ICMPv6 options * smb: added a null check when current_flow is not present * snort2lua: Fixed version output (issue #213); Thanks to A-Pisani for the fix * stream: change session_timeout default for tcp, ip, icmp and user * stream: fix session timeout of expired flows * trough: Avoid data race in file count * utils: add benchmark tests for JSNormalizer * utils: add reference and description for ClamAV test cases * utils: avoid using pubsetbuf which is STL implementation dependent * utils: fix typo in js_normalizer_test 2021-09-08: 3.1.12.0 * decoder: icmp6 - use source and destination addresses from packet to compute icmp6 checksum when NAT is in effect * http_inspect: enable traces for JS Normalizer * http_inspect: include cookies in http_raw_header * http_inspect: reduce void space in HttpFlowData * stream_tcp: add pegs for maximum observed queue size * stream_tcp: normalize data when queue limits are enabled * stream_tcp: only update window on right edge acks * stream_tcp: set sequence number in trimmed packets up to the queue limit and increase defaults 2021-08-26: 3.1.11.0 * build: update help for --enable-tsc-clock to include arm; Thanks to liangxwa01 for reporting the issue * codec: geneve: fix incorrect parsing of option header length * data_bus: support ordered call of handlers * dns, ssh: remove obsolete stream insert checks * doc: Add js_norm_max_template_nesting description * flow: introduce bidirectional flag for expected session * flow: set the client initiated flag before publishing the flow state setup event * framework: update base API version to 8 * framework: version rollback * http_inspect: add builtin rule for consecutive commas in accept-encoding header * http_inspect: Add JavaScript template literals normalization * http_inspect: check if Normalizer has consumed input * http_inspect: hard-code infraction enum numbers * http_inspect: http_raw_header, http_raw_trailer field support * http_inspect: refactor NormalizedHeader * http_inspect: support more infractions and events * http_inspect: two new built-in rules * inspection: process wizard matches on defragged packets * ips: add action_map table to map rule types, eg block -> alert * ips: add action_override which applies to all rules * lua: update comments in the default config * modbus: check record length for write file record command * normalize: remove tcp.trim config * payload_injector: check if stream is established on flow rather than the packet flag to handle retries * policy: put inspection policy accessors in public space * policy: reorganize for sanity * README: mention vars in default config * sip: deprecate max_requestName_len in favor of max_request_name_len * smb: Invoke SMB debug in destructor when packet thread available * stream_tcp: update API called by payload_injector to check for unflushed queued TCP segments * style: remove crufty comments * style: remove C style (void) arglists * style: remove or update crufty preprocessor comments * utils: address compiler warning * utils: support streamed processing of JS text * wizard: support more HTTP and SIP methods 2021-08-11: 3.1.10.0 * appid: update netbios-ss (SMB) detector to extract SMB domain from SMBv2, and more intelligently handle payload appid detection * appid: use packet thread odp context while creating SIP session * build: install DAQ modules and Snort plugins in separate folders * dce_smb: restore file tracker size post deletion * dns: add DNS splitter * doc: update user manual for identifier normalization * file_api: add infra and file debugs to existing debugging framework * ftp: remove unused defines and crufty comments * http_inspect: add JavaScript identifiers normalization * http_inspect: change the default value of request_body_app_detection config parameter to true * smtp: remove unused defines * ssh: handle traffic with invalid version string * ssh: handle version string packets that also contain key exchange data * stream_tcp: skip unordered segments if last flushed position already moved past * telnet: correct help for ayt_attack_thresh * wizard: add wizard max_pattern option and update HTTP/SIP aware methods patterns 2021-07-28: 3.1.9.0 * actions: allow session data to stay accessible for loggers for reject rule action * byte_options: address compiler warnings * control: add idle expire removal to control channels * dump_stats: direct output back to command channel * events: use instance_id to make event_id unique across threads * file_api: handle file_cache inspection for non-zero offset * http2_inspect: change xor to or in assert that was failing due to uninitialized variable * http2_inspect: fix HPACK dynamic table size update management * http2_inspect: remove unused variables * http_inspect: add peg count for script bytes processed * http_inspect: add rule option http_raw_header_complete * http_inspect: don't allocate 0-length partial inspection buffer * ips_options: add catch tests for byte_test, byte_jump, byte_math, byte_extract * ips_options: address compiler warnings * ips_options: refactor byte_extract, byte_test, byte_math, byte_jump and related tests * lua: update HTTP/2 default_wizard hex with S2C pattern match * stats: update file and appid stats to use Log functions provided from stats.cc 2021-07-15: 3.1.8.0 * appid: support SSH client detection through lua detector * dce_rpc: fix crash when expected session comes after snort reload * dce_rpc: handling raw packets * dce_smb: added trace messages and multiple level logging for SMB module * dce_smb: fixed macro definition for SMB_DEBUG * doc: fix build warnings; Thanks to jiangrj (github.com/jiangrij) for reporting the issue * dump_config: support modules without config options in text format * file_api: handling overlap segments * http2_inspect: clean data cutter internal state after exhausting flow depth * http_inspect: add built-in alert for script tags in a short form * packet_io: check if unreachable_candidate before sending unreachable * packet_io: unreachable packets shouldn't be sent for ICMP * snort2lua: set raw_data buffer for rawbytes and B flag in PCRE * wizard: make SSH spell more specific 2021-06-30: 3.1.7.0 * appid: enhance netbios service detector to identify SMB versions as web app * appid: update documentation * appid: update the DNS detector to support the all record request * control: resolve socket issues due to race conditions * doc: updates for http2_inspect * framework: update base API version to 3 * main: implement test_features run flag to enable debug-like output * mime: track memory for mime sessions * payload_injector: don't inject if there are unflushed S2C TCP packets queued * reputation: include list id for daq trace log * sfip: fix unit tests for non-regtest builds * snort2lua: fix lua conversion of unsupported http preproc options without parameters * snort2lua: remove footprint size config * stream: fix is_ack_valid to return true even when current ack is to the left of snd_una, per RFC793 2021-06-16: 3.1.6.0 * appid: extract auxiliary ip when uri is provided by third-party * appid: perform detection on request body for HTTP2 traffic * appid: remove error message when userappid.conf is not present * appid: remove unused metadata offset functionality * appid: support fragmented metadata * appid: use 32 bits for storing protocol field in RPC port map message * codecs: geneve - add support for Geneve encapsulation * codecs: geneve - add vni to alert_csv and alert_json * codecs: support inner flow NAT * control: allow compile with shell disabled * control: clean up cppcheck issues * control: expose ContrlConn API * control: refactor control channel management to better handle control responses * control: remove SHELL compile flag from header * control: remove unused IdleProcessing functionality * dce_rpc: SMB multichannel - add smb multichannel file support * dce_rpc: SMB multichannel - handle negotiate command to create expected flow * dce_rpc: SMB multichannel - introduce locks * dce_rpc: SMB multichannel - make session cache global * dce_rpc: SMB multichannel - own memory tracking in global cache * dce_rpc: fix warnings * dce_rpc: handle reload prune for smb session cache * dce_rpc: store shared pointer of session tracker * doc: update JS normalizer options * file_api: increase file count only once per file * file_api: store processing flow in context * filters: change rate filter to use network policy id instead of ips policy id * filters: support rate filter to work with PDUs * flow: enable support for multiple expected sessions * ftp: create additional expected session if negotiated IP is different from server IP on packet * gtp : check protocol type according to gtp version * host_cache: remove unused lua mock code from the tests * http2_inspect: don't perform valid sequence check on rst_stream frame * http2_inspect: improve request line generation and checks * http2_inspect: rule options and doc clean up * http2_inspect: track dynamic table memory allocation * http_inspect: add JS Normalizer to dev_notes * http_inspect: add JS normalization for external scripts * http_inspect: additional memory tracking * http_inspect: extend built-in alerts for Javascript processing * http_inspect: improve MPSE in HttpJsNorm (script start conditions) * http_inspect: limit section size target for file processing * http_inspect: publish event for http/2 request bodies * http_inspect: support partial detect for Javascripts * http_inspect: track memory footprint of zlib inflation * http_inspect: update test mock api * iec104: delete trailing spaces * ips_options: fix intrusion alerts generation for tcp rpc PORTMAP traffic when rpc_decode is bound to the flow * main: add support for resuming particular thread * main: fix config dump for list-based inspector aliases * mime: store extra data in stash * packet_io: enable expected session flags * protocols: remove inline specifiers for functions defined within a structure declaration * pub_sub: add get_uri_host() to HttpEvent * pub_sub: update HttpEvent::get_host to get_authority - now always includes port if there is one * reputation: daq trace log * reputation: support auxiliary IP matching upon reload * rna: filter DHCP events and some refactoring * rna: update last seen time on deleted host rediscovery * stream: enable support for multiple expected sessions * stream_tcp: populate flow contents in context for non-wire packets * time: make Periodic class SO_PUBLIC * trace: place trace options under the DEBUG_MSGS macro * utils: fix warning about empty statement * utils: refactor JSTokenizer * utils: rework JSNormalizer class 2021-05-20: 3.1.5.0 * appid: Publish an event when appid debug command is issued * appid: do memory accounting of api stash object, dns/tls/third-party sessions * appid: mark payload detection as done after either http request or response is inspected * appid: set monitor flags on future flows * dce_rpc: fix expected session protocol id * dce_rpc: update memory tracking for smb session data * dce_rpc: use find_else_insert in smb session cache to avoid deadlock * file_api: fix spell source error * flow: Adding stash API to save auxiliary IP * flow: Enhancing APIs to stash auxiliary IP * flow: memory tracking updates * hash: add new insert method in lru_cache_shared * http2_inspect: add assert in clear * http2_inspect: concurrent streams limit is configurable * http2_inspect: fix non-standard c++ * http2_inspect: handle trailer after reaching flow depth * http2_inspect: implement window_update frame * http2_inspect: optimize processing after reaching flow depth * http2_inspect: track stream memory incrementally instead of all up front * http2_inspect: update discard print * http2_inspect: update state and delete streams after reaching flow depth * http_inspect: IP reputation support * http_inspect: don't disable detection for flow if it's an HTTP/2 flow * ips_options: fix relative base64_decode * memory: free_space cleanup * netflow: additional check before v5/v9 decode * netflow: version 9 decoding and filtering * packet_tracer: IPS daq trace log * packet_tracer: file daq trace log * parser: Remove rule merge in dump mode * parser: reduce RTNs only after states applied * reputation: track monitor ID via flow; minor code cleanup * shell: exit gracefully when sanbox lua is misconfigured * stream_tcp: Deleting session when both talker and listener are closed * stream_tcp: Using window base for reset validation 2021-04-21: 3.1.4.0 * appid: (fix style) Local variable 'version' shadows outer variable * appid: Delete third-party connections with context only if third-party reload is not in progress * appid: clean up lua stack on C->lua function exit * appid: clean-up parameters in service_bootp * appid: detect payload based on dns host * appid: in continue state for ftp traffic, do not change service to unknown on validation failure * appid: monitor only the networks specified in rna configuration * appid: refactor to set http scan flags in one place * appid: remove detectors which are available in odp * appid: remove duplicate rtmp code * binder: update flow data inspector on a service change * build: add better support for flex lexer; Thanks to Özkan KIRIK and Moin for reporting the issue * codecs: use held packet SYN in Tcp header creation * copyright: Update year to 2021 * dce_rpc: Added a cleanup condition for DCERPC in close request * dce_rpc: DCERPC Support over SMBv2 * dce_rpc: Fixed prototype mismatch. Smb2Tid doesn't need to be inline * doc: add documentation for script_data ips option * doc: revert documentation related to script_data ips option * framework: Adding IT_FIRST inspector type to analyze the first packet of a flow * hash: prepond object creation in LRU cache find_else_create * host_tracker: fix bug in set_visibility * http2_inspect: fix possible read-after-free in hpack decoder * http2_inspect: free streams in completed/error state * http_inspect: fix end of script match after reload * http_inspect: remove detained inspection config * ips: allow null detection trees with negated lists * ips_options: add sticky buffer script_data ips option within normalized javascripts payload * main: Adding reload id to track config/module/policy reloads * main: Log holding verdict only if packet was actually held * main: Update memcap for detained packets * netflow: add device list configuration * netflow: add filter matching for v5 decoder * netflow: get correct zone info from packet * packet_io: If packet has no daq_instance, use thread-local daq_instance * packet_tracer: Appid daq trace log * packet_tracer: fix trace condition for setting IP_PROTO * payload_injector: send go away frame * pcre: revert change that disabled jit * reputation: Registering inspector to the IT_FIRST type * rna: add the smb fingerprint processor to the get_or_create / set processor api * ssl: refactoring SSLData out so it can be reused * stream: Add held packet to retry queue when requested * stream: Add partial_flush. Flush one side of flow immediately * stream: IP frag packets won't have a flow so do not try to hold them * stream: fetch held packet SYN * stream: fix race condition in HPQReloadTuner * stream: store held packet SYN * utils: enable Flex C++ mode via its option 2021-03-27: 3.1.3.0 * actions: Dynamically construct the default eval order for all the loaded IPS actions * actions: Make all IPS actions pluggable * appid: Make netbios domain available through appid API * appid: SMB fingerprinting support * cmake: Add flex build dependency * dce_rpc: Refactor SMB code * detection: Update detection.alert, to be used instead of reputation.total_alerts * detection: Update dump_rule_meta function to only print rules from default IPS policy * detection: Update the rtn's listHead to reflect the new action set in the rule state * doc: Update http_inspect feature documentation * flow: Add packet tracer output to DAQ expected flow requests * host_tracker: Fully populate local hostclient before logging * http2_inspect: Alert on uppercase header name encoded in HPACK * http_inspect: Add JavaScript whitespace normalization * http_inspect: Add normalization_depth config option * http_inspect: Alert on HTTP/2 upgrade attempts * http_inspect: Integrate JSNormalizer (whitespace normalization) keeping the old one * packet_io: Update for the removal of the RETRY DAQ verdict * packet_tracer: Do not log non-IP packets when enabled from shell and a constraint is set * parser: Support duped RTN if its header has been changed * rate_filter: Get the available IPS actions dynamically to configure the new_action * rna: Make discovery filter use client and server interfaces if they are not unknown * rna: SMB fingerprinting support * snort2lua: Delete conversion of disable_replace option * snort2lua: Fix lua conversion of http preproc options * snort: Add -h to output the help overview (same as --help) * snort_config: Remove is_active_enabled and set_active_enabled functions * style: Change C++ comment NULL to null * style: Remove unnecessary cruft * style: Remove unused cruft * utils: Add JSNormalizer 2021-03-11: 3.1.2.0 * action_manager: Remove unused cached reject action * appid: Always get appid inspector from default inspection policy * appid: Fixes for cppcheck warnings * appid: Get uri from http event even when http host is not present * appid: Load lua detectors for packet threads from compiled lua bytecode during detector reload * appid: Remove app forecast method * appid: Remove detectors for obsolete apps - AOL instant messenger and Yahoo messenger * appid: Send reloading detectors message to socket immediately * appid: Update IMAP service detector pattern * appid: Use opportunistic tls event to set decryption countdown for SMTP detector * binder: Apply host attribute table information at the beginning of flow setup * binder: Clean up std namespace usage * binder: Use service inspector caching to improve get_gadget() performance * binder: Use the first match for non-terminal binding usage * build: Do one more pass of modernizing the C++ code * dce_rpc: Handle async responses in smbv2 * dce_rpc: Pass proper file id in file api from smb1 * decompress: Add support for streaming ZIPs * detection: Use IP and port variables from the targeted policy * doc: Remove http detained inspection from user manual * doc: Update documentation for ips.states * file_magic: Add pattern for pcapng * flow: Add new flag to indicate elephant flow * ftp_telnet: Implement init_partial_flush for ftp data * ftp_telnet: Respect telnet_cmds config for raising 125:1 * host_attributes: Update api to reduce use of shared_pointer * http2_inspect: Limit number of concurrent streams * http2_inspect: Process rst_stream frame * http_inspect: IPv6 authority in URI * http_inspect: Javascript support cleanup * http_inspect: Partial inspection for 0 length chunk * http_inspect: Remove detained inspection * http_inspect: Remove unused events * http_inspect: Temporarily restore detained_inspection parameter * iec104: Add documentation for iec104 service inspector * iec104: Additional input sanitization, syntax, and style changes * iec104: Integrate new iec104 protocol service inspector * inspector_manager: Instantiate default binder as long as a wizard or stream are present * ips_options: Update cursor position for relative pcre * ipv4: Correct the calculation for illegal fragment offset checks * log: Add printf format attribute to TextLog_Print() and clean up the fallout * log: Base logging the Ethernet header on proto bits rather than DLT * loggers: Fix excessive byte reordering when printing MPLS labels in CSV and JSON * main: Fix accumulating and printing codec stats at run time * managers: Enforce strict parsing for binder aliases * managers: Pass the configuration to default module's end() * managers: Perform sanity checks on set_alias() parameters * memory: Free memory space while updating allocation * module: Introduced new api to clear global active module counters * module_manager: Enforce interest in global modules only in the default policy * mpls: Add next layer autodetection and implement codec logging * mpls: Refactor mpls.enable_mpls_overlapping_ip into packet.mpls_agnostic * mpls: Remove enable_mpls_multicast option * packet_capture: Add group filter for packet capture * packet_tracer: Add daq buffer to hold daq logs * perf_monitor: Fix finalizing JSON output files for trackers * portscan: Fix decoy and distributed scan logic * portscan: Fix delimiter for ports in config * portscan: Fix IP scans not alerting * protocols: Add initial support for multilayer compound codecs * protocols: Add peg count for decodes that exceeded the max layers * protocols: Consistently encapsulate exported protocol headers in the snort namespace * reputation: Add peg count for total alerts * reputation: Remove deprecated redundant terms * rna: Discover NetBIOS name * snort: Clear snort counter for modules, daq, file_id, appid * snort: Update for DAQ_FlowStats_t structure and field name changes * snort_config: Clean up and annotate command line config merge process * snort_config: Remove unnecessary command line options * stream: Always use latest splitter from tracker after paf_check * stream: Do not update service from appid to host attributes if nothing is changed * stream: Set block pending flag when a flow is dropped * stream_tcp: Ensure flows aren't pruned while processing a PDU * stream_tcp: Flush queued segments when FIN is received * stream_tcp: Support data on SYN by default with or without Fast Open option * trans_bridge: Lift the log() implementation from the root Ethernet codec * wizard: Add support for sslv2 detection 2021-01-28: 3.1.1.0 * appid: Add support for snmpv3 report pdu * appid: Always store container session api object in stash * appid: Do not process sip event for an existing session after detector reload * appid: Remove unused code; cleanup FIXIT comments related to reload * appid: Send reload detectors and third-party messages to socket immediately if appid is not enabled * codecs: Update tcp naptha check to make sure it is ipv4 traffic * file_api: Remove file context after file name set if processing is complete * file_api: Stop processing signature when type verdict is 'FILE_VERDICT_STOP' * flow: Update direction and interface info in HA flow * ftp: Use Stream packet holding to handle ftp-data EoF * http_inspect: Add chunked processing to dev notes * http_inspect: Provide file_id to set file name and read new return value * http_inspect: Validate and normalize scheme * http_inspect: Validate URI scheme length * inspector: Add a global reference count for uses that are not thread specific * lrucache: Changes for memcap for support constant cache objects with variable size * managers: Clean all inactive inspectors warning about ones that are still referenced * mime: Provide file_id to set file name and read new return value * payload_injector: Inject settings frame * rna: Minimize synchronization overhead 2021-01-13: 3.1.0.0 * appid: Store stats in map * appid: Tear down third-party when appid gets disabled * build: Add support for version sublevel and build via CMake * dce_rpc: Handle Flow from File inspection * host_cache: Add command to output host_cache usage, pegs, and memcap * http2_inspect: Add total_bytes peg to track HTTP/2 data bytes inspected * http_inspect: Abort on HTTP/2 connection preface * http_inspect: Add total_bytes peg to track HTTP data bytes inspected * http_inspect: Alert on truncated chunked and content-length message bodies * http_inspect: Support stretch for Http2 * log: Reuse TextLog buffer for a large data; Thanks to Chris White for reporting the issue * packet_io: IDS mode should not give blacklist verdict for Intrusion event * rna: Fix version, vendor and user string comparison at maximum length * rna: Perform appropriate filter check based on the event type * rna: Revert rna performance optimizations * rpc_decode: Implement adjust_to_fit for RPC splitter * stream_tcp: Delete redundant calls to check if the tcp packet contains a data payload * stream_tcp: Fix issues causing overrun of the pdu reassembly buffer, make splitters authoritative of size of the reassembled pdu * stream_tcp: On midstream pickup, when first packet is a data segment, set flag on talker tracker to reinit seglist base seg on first received data packet * stream_tcp: Remove obsolete flush_data_ready() function 2020-12-20: 3.0.3 build 6 * active: Fix falling back on using raw IP for active responses when no device is specified * appid: Add support for apps, http host, url and tls host in HA * appid: Allow checking appid availability for a given http/2 stream * appid: Change terms used in code, logs and peg counts * appid: Do not override http fields with empty values * appid: Dump userappid configurations upon reloading third-party * appid: For http2 flow, return service id as http2 when no streams are yet created * appid: Mark reload third-party complete after unloading old library and creating new third-party context * appid: Print more descriptive error message when lua detector registers invalid pattern * binder: Pass service to get_bindings on flow service change * binder: Specify service inspector type when getting a gadget instance * build: Clean up various cppcheck warnings * catch: Avoid using INTERNAL_CATCH_UNIQUE_NAME in our headers * catch: Update to Catch v2.13.3 * dce_rpc: Fixed incorrect access of FileFlows while pruning the flow * file_api: Fixed stats which weren't cleared when there were no stats for signature processing * file_api: Handle resume block when multiple file rules are configured with store option enabled * flow: Pause logging during timeout processing * helpers: Handle SIGILL and SIGFPE with the oops handler * high_availability: Add check for packet key equals HA key before consume * host_attributes: Better error handling for reload to eliminate double free and memory leaks * http2_inspect: Check for invalid flags * http2_inspect: Fix bug with exceeding inspection depth * http2_inspect: Fix empty queue access and some bookkeeping * http2_inspect: Handle connection close during headers frames * http2_inspect: Handle discard * http2_inspect: HI error handling improvements * http2_inspect: Improve error handling * http2_inspect: Remove 0 length scan for most cases * http_inspect: Explicit memory allocation for transactions and partial inspections * http_inspect: Script detection for HTTP/2 * inspector_manager: Remove unused inspector_exists_in_any_policy() function * inspector: Remove obsolete metapacket processing functionality * main: Convert Request to shared_ptr to avoid memory problems * main: Fix memory leak in reload_config() caused by incorrect code merge * managers: Add inspector type in the help module output * managers: Don't allow a referenced inspector to stall emptying the trash * managers: Track removed inspectors during reload and call tear_down and tterm to release resources * packet_io: Export forwarding_packet() function * packet_tracer: Fix the debug session information for non-ip packets * parser: Add escaping for double quotes and special chars in a rule body * parser: Fix escape logic for --dump-rule-meta output * reload: Reset default policies after failed reload * request: Expose methods to be used in plugins * rna: Do null check in the Inspector rather than the Module in the control commands * rna: Generate new host event for CDP traffic * rna: Make the mac cache persist over reload config * rna: Reduce host cache lock usage to improve performance * rna: Remove unused function * rna: Replace some tabs with spaces as per style guidelines * rna: Support data purge command * rna: Support DHCP fingerprint matching and event generation * rna: Use service ip and port provided by appid for DHCP discovery events * shell: Change terms used in code, logs and peg counts * shell: Support for loading configuration in lua sandbox * snort: Add OopsHandlerSuspend for suspending Snort's crash handler * stream: Fix stream clean up when going from enabled to disabled * stream_ha: Only flush on HA deactivate if not in STANDBY, set HA state to STANDBY when new Flow is created * stream_tcp: Initialize the alerts array to empty when a TcpReassembler instance is initialized or reset * stream_tcp: Set interfaces in both directions 2020-11-16: 3.0.3 build 5 * appid: Add unit test to verify HA data for flow unmonitored by appid * appid: Handle cppcheck warnings * appid: Prefix http/2 decrypted urls with https:// * appid: Support client login failure event * flow: Do not remove the flow during pruning/reload during IPS event with block action * flow: Flesh out swap_roles() to swap more client/server fields * flow: Set client initiated flag based on DAQ reverse flow flag, track on syn config, and syn-ack packet * ftp: Handle FTP detection when ftp data segment size changes * host_tracker: Ignore IP family when comparing SfIp keys in the host cache * http2_inspect: Data frame redesign * http2_inspect: Multi-segment reassemble discard bug fix * http2_inspect: Perform hpack decoding on push_promise frames * http2_inspect: Refactor data cutter * http2_inspect: Refactor scan() * http2_inspect: Remove const cast * http2_inspect: Send push_promise frames through http_inspect * ips_options: Don't move cursor in byte_math * main: Set up logging flags globally to avoid dependencies on a particular SnortConfig object * payload_injector: Refactoring * payload_injector: Remove content length and connection for HTTP/2 * rna: Add command to delete MAC hosts and protos * rna: Delete payloads when clients, services are deleted; add unit tests * rna: Discover banner on service version or response events * rna: Don't process packet in eval if eth bit not set * rna: Log src mac from packet containing CDP message when host type change event is generated * rna: Support banner discovery * rna: Support change service event with null version and vendor * rna: Support user login failure discovery * smtp: Make sure the ssl search abandoned flag is preserved for reset * stream_tcp: Remove redundant/unneeded asserts that check if tcp event is for a meta-ack psuedo-packet * thread_config: Show thread ID when logging binding information * trace: Add missing packet information to some of the messages 2020-10-27: 3.0.3 build 4 * actions: Add support to react for HTTP/2 * appid: Fix -Wunused-private-field Clang warning in service_state.h * build: Various build fixes for OS X * file_api: Remove deletion of file_mempool * framework: Fix ConnectorConfig dtor to be virtual * ips: Move IPS variables to sub-tables which designate type * lua: Update default_variables with 'nets', 'paths', and 'ports' tables in snort_defaults.lua * module: Fix modules that accept their configuration as a list * payload_injector: Support pages > 16k * rna: Add unit tests for TCP fingerprint methods * snort: Remove support for -S option * src: Clean up zero-initialization of arrays * tools: Update snort2lua to convert custom variables into ips.variables.nets/.paths/.ports tables * trace: Add timestamps in trace log messages for stdout logger 2020-10-22: 3.0.3 build 3 * actions: Update react documentation * actions: Use payload_injector for react * appid: Add service group and asid in AppIdServiceStateKey * appid: Continue appid inspection after third-party identifies an application * appid: Do not reset third-party session after third-party reload * build: Updates for libdaq changes that introduce significant groups in flow stats * codecs: Remove PIM and Mobility from bad protocol lists * dce_rpc: Add ingress/egress group and asid in SmbFlowKey and Smb2SidHashKey * doc: Tweak the template regex in get_differences.rb * dump_config: Don't print names for list elements * file_api: Add ingress/egress group and asid in FileHashKey * file_magic: Update POSIX tar archive pattern * flow: Add source/dest group id in flow key * flow: Stale and deleted flows due to EOF should generate would have dropped event * ftp_data: Add can_start_tls() support and generate ssl search abandoned event for unencrypted data channels * host_cache: Add delete host, network protocol, transport protocol, client, service, tcp fingerprint and user agent fingerprint commands * host_tracker: Implement client and server delete commands * http2_inspect: Handle stream creation for push promise frames * ips_options: Fix retry calculation in IPS content when handling "within" field * lua: Use default IPS variables in the default config * main: Add lua variables for snort version and build * managers: Delete obsolete variable parsing code * managers: Skip snort_set lua function for non-table top level keys in finalize.lua * meta: Do not dump elided header fields or default message * meta: Dump full rule field * meta: Dump missing port field * packet: Add two new apis to parse ingress/egress group from packet's daq pkt_hdr * packet_tracer: Add groups in logging based on significant groups flag * port_scan: Add group and asid in PS_HASH_KEY * rna: Change ip to client instead of server for login events * rna: Change logic for payload discovery, eventing * rna: Conditionalize reload tuner registration on get_inspector() * rna: Log user-agent device information * rna: Move registration of reload tuner to configure() * snort2lua: Update comments for deleted rule_state options * ssh: Fix code indentation and CI breakage * ssh: SSH splitter implementation * stream: Initialize flow key's flags.ubits with 0 * stream_tcp: Don't attempt to drop 'meta_ack packets', there is no wire packet for these acks * style: Clean up accumulated tabs and trailing whitespace * trace: Refactor the test code * trace: Skip trace reload if no initial config present * utils: Add a generic function to get random seeds 2020-10-07: 3.0.3 build 2 * appid: Create events for client user name, id and login success * appid: Inform third-party about snort's idle state during reload * appid: Reload detector patterns on reload_config for the sake of hyperscan * appid: Update appid to use instance based reload tuner * binder: Allow binding based on address spaces * binder: Allow directional binding based on interfaces * binder: Enforce directionality, add intfs, rename groups, cleanup * framework: Update packet constraints comparison to check only set fields * host_tracker: Update host tracker to use instance based reload tuner * http2_inspect: Fix frame padding handling * http2_inspect: Free up HI flow data when we are finished with it * http2_inspect: Stream state tracking * http_inspect: Implement can_start_tls(), add support of ssl search abandoned event * http_inspect: Support for custom xff type headers * main: Change reload memcap framework to use object instances * main: Remove deprecated rule_state module * main: Update host attribute class to use instance based reload tuner * normalizer: Move TTL configuration toggle to inspector configure() * perf_monitor: Update perf monitor to use instance based reload tuner * policy: Copy uuid, user_policy_id, and policy_mode when an inspection policy is cloned * pop: Generate alert for unknown command if file policy is attached * port_scan: Update port scan to use instance based reload tuner * rna: Add event_time to rna logger events * rna: Add payload discovery logic * rna: Check user-agent processor early to skip some work * rna: Port host type discovery logic * rna: Set the thread local fingerprint processors during reload_config * rna: Update rna to use instance based reload tuner * rna: Update methods for user-agent processor * rna: User discovery for successful login * snort2lua: Convert rule_state into ips.states * stream_tcp: Update trace messages to use trace framework * stream: Update stream to use instance based reload tuner * trace: Update parser unit tests * wizard: Clean up parameter parsing and make it a bit stricter 2020-09-23: 3.0.3 build 1 * ac_bnfa: Disable broken fail state reduction * appid: Check third party context version while deleting connections * appid: Use third party payload if available for HTTP tunneled * cmake: Support cmake build type configuration * dce_rpc: Handle compound requests for upload * dce_rpc: Modify logs to show if file context is found or not found * dump_config: Sort config options before printing * file_api: Update lookup and block timeout from config at file cache creation * flowbits: Evaluate checkers after setters for fast pattern matches * ftp: Add APPE to upload commands * http2_inspect: Convert to new stream states * http2_inspect: Fix how implement_reassemble uses frame_type * http2_inspect: Refactor HI interactions out of frame constructors * http_inspect: Extract filename from content-disposition header for HTTP uploads * module_manager: Keep a list of modules supporting reload_module * netflow: Cache support and more v5 decoding * payload_injector: Don't inject if stream id is even * profiler: Fix issue where flushed pattern matches caused rule_eval to be profiled under mpse * reputation: Change terms used in code, logs, and peg counts * rna: Add unit test to validate VLAN handling * rna: Avoid conflicts with other fingerprint definitions * rna: Service discovery with multiple vendor and version support * rna: Support user agent fingerprints * s7commplus: V3 header support * search_engine: Fix peg type for max_queued * stream_tcp: Add an assert to catch tcp state/event combination that should not occur * stream_tcp: Add PegCount for tcp packets received with an invalid ack * stream_tcp: Arrange TCP tracker member vars to optimize storage requirements, add helper functions to access private splitter functions * stream_tcp: Delete redundant calls to flush data when FIN is received * stream_tcp: Delete unused packet action flags, set action flags via its setter * stream_tcp: Fix issues with stream_tcp handling of the TCP MSS option * stream_tcp: Handle bad tcp packets consistently when normalizing in ips mode * stream_tcp: Implement helper function to return true if the TCP packet is a data segment, false otherwise * stream_tcp: Merge the setup methods of the TcpStreamSession and TcpSession classes into a single method in TcpSession * stream_tcp: Refactor tcp handling of no flags to drop packet before any processing, don't generate event * stream_tcp: Refactor tracker and reassembler classes to improve encapsulation and move member variables to appropriate class * stream_tcp: Remove FIXIT-H because by definition an Ack Sent event in TcpStateNone means the SYN-ACK was not seen, so no way to do the check suggested * stream_tcp: Remove FIXIT-H to add ack validation, the ack is already validated when processed on the listener side * target_based: Support reload of host attribute table via signal as well as control channel command 2020-09-13: 3.0.2 build 6 * active: Remove per packet prevent trust action * appid: Add check for nullptr before setting tls host * appid: Clear services set in host attribute table upon detector reload * appid: Detect SMTP after decryption * appid: Dump user appid configuration on reload detectors * appid: Generate events for service info changes * appid: Pass snort protocol id instead of appid while creating future flow * appid: Reorder third-party reload to keep only one handle open at a time * appid: Send swap response for reload_odp and reload_third_party commands in control thread * appid: Set payload to unknown for out-of-order flows * appid: Skip detection for existing sessions after detector reload; rename reload_odp command to reload_detectors * appid: Support json logging in appid_listener * appid: Update appid stats for decrypted flows * appid: Update appid warning messages to print module name in lowercase * build: Fix minor cppcheck warnings * build: Updates for libdaq changes to interface group field width and naming * byte_jump: Fix jump relative to extracted length w/o relative offset * cmake: Restore accidentally removed caching of static DAQ modules * dce_rpc: Introduce smb2 logs * doc: Update the config dump in JSON format (all policies) * doc: Update the config dump in JSON format (main policy) * doc: Update trace.txt with info about 'trace.modules.all' option * dump_config: Add --dump-config="top" to dump the main policy config only * dump_config: Dump config in JSON format to stdout * file_api: Increase default max_files_per_flow limit to 128 * flow: Add a deferred trust class to allow plugins to defer trusting sessions * flow: Disabled inspection for FlowState::RESET * flow: Reset the flow before removing * helpers: Add unit tests for special characters escaping * helpers: Fix build on systems without sigaction * helpers: Rework DiscoveryFilter to monitor IP lists based on interface rather than group * helpers: Use sig_t instead of sighandler_t for better BSD compatibility * host_tracker: Fix allocator unit test to work on 32-bit systems again * http2_inspect: Convert circular_array to std:vector * http2_inspect: Fix continuation frame check * http2_inspect: Fix hpack dynamic table init * http2_inspect: Prepare http2_inspect and http_inspect for HTTP/2 trailers * http2_inspect: Refactor hpack decoding and send trailer to http_inspect for processing * http_inspect: Declare get_type_expected const * http_inspect: Don't use the URL to cache file verdicts for uploads * http_inspect: Script detection * http_inspect: Script detection and concurrency fixes * http_inspect: Support hyperscan literal search for accelerated blocking * http_method: Make available for fast pattern with first body section * imap: Publish OPPORTUNISTIC_TLS_EVENT on successfull completion on START_TLS, add a new state to avoid publishing start_tls events multiple times * ips_options: Ensure all options use base class hash and compare methods * ips: Use the policies in the flow when creating pseudo packet * main: Turn off signal handlers later to catch more during snort shutdown * managers: Immediately stop executing inspectors when inspection is disabled * mime: Fix off-by-1 error with filename and email id capture * mime: Minor code cleanup * netflow: Introduce netflow as a service inspector * packet_io: Added reason for ActiveStatus WOULD * packet_io: Do not allow trust unless the action is allow or trust * payload_injector: Assume http1, if packet does not have a gadget * payload_injector: Fix warning * payload_injector: Support http2 injection * payload_injector: Support translation of header field value with length > 127 * perf_monitor: Convert the perf_monitor inspector configure warnings to errors * pop: Publish start_tls events, support for ssl search abandoned * reputation: Change from group-based to interface-based IP lists * rna: Add protocols on logging host trackers * rna: Implement update_timeout for MAC hosts * rna: Remove dependency on uuid library * rna: Remove redefinition of USHRT_MAX * rna: Removing unused command and exporting swapper * rna: Support client discovery from appid event changes * rna: Support service discovery from appid event changes * rna: Tcp fingerprints configuration, storage, matching and event generation * snort2lua: Remove obsolete and unused code * snort2lua: Remove unused unit test files * snort: Address fatal shutdown stability issues * stream_ip: Fix zero fragment built-in rule triggering for some reassembly policies * style: Replace some tabs that snuck in with proper spaces * tests: Fix the majority of memory leaks in CppUTest unit tests * trace: Add support for modules.all option * trace: Update loggers to support extended output with n-tuple packet info * utils: Add sys/time.h to util.h for struct timeval definition * wizard: Fix the error message about invalid pattern 2020-08-12: 3.0.2 build 5 * cip: Fix the trailing parameter for the module * dce_rpc: Set dce_rpc as a control channel inspector * flow: Check expected flows in flow control and add direction swap flag to expected flows * framework: Add an API to check if the module can be bound in the binder * ftp: Add opportunistic TLS support * ftp: Fix direction for active FTP data transfers * helpers: Extend printed JSON syntax * http2_inpsect: Fix for flush on data frame boundray w/o end of stream * http_inspect: Do finish() after partial inspection * lua: Add TCP port 80 binding to the connectivity and balanced tweaks * main: Add printing modules help in JSON format * managers: Print the instance type of the inspector module with --help-module * rna: Add RNA MAC-based discovery logic * rna: Discover network and transport protocols * stream_tcp: Add check to prevent reentry to TCP session cleanup when flushing a PDU 2020-08-06: 3.0.2 build 4 * appid: Clear service appid entries in dynamic host cache on ODP reload * appid: Generate event notification when dns host is set * dce_rpc: Fix for smb crash while tcp session pruning * dce_rpc: Fix for smb session cleanup issue * dce_rpc: Use file name hash as file id * doc: Add documentation for dumping consolidated config in text format * flow: Fixing free_flow_data logic * http_inspect: Code clean up * http_inspect: Test tool enhancement * main: Dump consolidated config in the text format * rna: Fix redefined macro warnings in between unit-test tools * rna: TCP fingerprint input and retrieval * utils: Keep deprecated attribute table pegcounts 2020-07-28: 3.0.2 build 3 * active: Move Active enabled flag into SnortConfig * appid: For http traffic, if payload cannot be detected, set it to unknown * appid: Move appid data needed by external components to stash * appid: Support ODP reload for multiple packet threads and new session * dce_rpc: Improve PAF autodetection for heavily segmented TCP traffic * doc: Split Snort manual into separate user, reference, and upgrade docs * doc: Update default text manuals * doc: Update extending.txt about TraceLogger plugin * file_api: Log event generated when lookup timedout * ftp_telnet: Remove global config variable shared between multiple threads to prevent data race * http2_inpsect: Fix interaction with tool tcpclose * http2_inspect: Fix stream_in_hi * http2_inspect: General code cleanup * http_inspect: Do partial inspections incrementally * http_inspect: Reduce memory used by partial inspections * main: Rename the config options to ignore flowbits and rules warnings * parser: Add support for variables with each ips policy * payload_injector: Add HTTP page translation * payload_injector: Extend utility to support HTTP/2 (no injection) * pub_sub: Added a method in HttpEvent to retrieve true client-ip address from HTTP header based on priority * rna: Fingerprint reader class and lookup table for tcp fingerprints * snort_defaults: Remove the NOTIFY, SUBSCRIBE, and UPDATE HTTP methods * stream_tcp: Only perform paws validation on real packets, skip this on meta-ack packets * stream_tcp: When clearing a session during meta-ack processing pass a nullptr as the Packet* parameter * target_based: Add mutex lock to ensure host service accesses are thread safe * target_based: Move host attribute peg counts from the process pegs to stats specific to host attribute operations * target_based: Refactor host attribute to use the LruCacheShared data store class to support thread safe access * target_based: Streamline host attribute table activate and swap logic on startup and reload * trace: Add support for extending TraceLogger as a passive inspector plugin * wizard: Abandon the wizard on UDP flows after the first packet * wizard: Abort the splitter once we've hit the max PDU size * wizard: Add peg counts for abandoned searches per protocol * wizard: Improve wizard tracing to indicate direction and abandonment * wizard: Properly terminate hex matching * wizard: Report spell and hex configuration errors and warnings 2020-07-15: 3.0.2 build 2 * appid: Moving thread local ODP stuff to a new class * binder: delete obsolete network_policy parsing code * build: Fix static analyzer complaints about unused stored values * daq: Fix calculation of outstanding packets stat to properly use the delta * dce_rpc: adding support for multiple smbv2 sessions for same tcp connection * dce_rpc: Invalid endpoint mapper message * dce_rpc: SMB ID invalid memory access * http_inspect: send MIME full message body for file processing * main: add config options --ignore-warn-rules and --ignore-warn-flowbits to snort module * mime: mime no longer overwrites file_data buffer for http packets * smtp: generate SSL_SEARCH_ABANDONED event when no STARTTLS is detected * smtp: support opportunistic SSL/TLS switch over * stream_tcp: coding style improvements * stream_tcp: eliminate direct references to the Packet* wherevever possible within the TCP state machine context * stream_tcp: eliminate use of STREAM_INSERT_OK as return code, it conveyed no useful information and was ultimately unused * stream_tcp: implement meta-ack pseudo packet as thread local that is reused on each meta-ack TSD * stream_tcp: implement support for processing meta-ack information when present * stream_tcp: meta-ack from daq is in network order not host, remove conversion from host to network * stream_tcp: process meta-ack info in any flush policy mode * trace: add support for DAQ trace filtering 2020-07-06: 3.0.2 build 1 * appid: Appid coverity issues * appid: Create lua states and lua detectors in control thread * appid: Delete stale third-party connections when reloading third-party on midstream * appid: Fix the format of the IPv6 strings in the Service State unit tests * appid: include appid session api in appid event * appid: use configured search method for multi-pattern matching * build: Eradicate u_int usage * build: Fix unit tests to build and work properly on a 32-bit system * build: Fix various cppcheck warnings about constness * build: Increment version to 3.0.2 * build: Miscellaneous 32-bit build fixes * build: Use sanity check results (HAVE_*) for optional packages in CMake * cmake: Properly handle SIGNAL_SNORT_* options in configure_cmake.sh * codecs: add tunnel bypass logic based on DAQ payload_offset * dce_tcp: parse only endpoint mapper messages * detection: remove checksum drop fixit * detection: remove unused code * framework: fix global data bus cloning during reload module and policy * helpers: Add a signal-safe formatted printing utility class * helpers: Add support for dumping a backtrace via libunwind on fatal signals * helpers: Dump additional information to stderr when a fatal signal is received * helpers: Revamp signal handler installation and removal * http2_inspect: Make print_flow_issues() regtest-only * inspectors: add a virtual disable method for controls * ips: add http fast pattern buffers * ips: add ips service vs buffer checks; add missing services * ips: enable non-service rules when service is detected * ips: minimize port group construction for any-any and bidirectional rules * ips: refactor fast pattern selection * ips: update detection trees for earliest header checks * main: configure and set main thread affinity * main: set thread type for main thread * managers: format lua whitelist output and ignore internal whitelist keywords * max_detect: detained inspection disabled pending further work * mpse: remove unused pattern trimming support * oops_handler: Operate on DAQ message instead of Snort Packets * payload_injector: add payload injection utility * regex: convert to same syntax as pcre plus fast_pattern option * rna: Adding initial support for reload_fingerprint command * rna: remove custom_fingerprint_dir from configuration * snort_defaults.lua: remove unused AIM_SERVERS var * snort: fix --dump-rule-meta with ips.states * stream_ip: Avoid modifying the original fragmented packet during rebuild * stream_ip: use lowercase fragmentation policy names for verbose output * stream: lock xtradata stream_impl to avoid data race on logging * trace: add thread type and thread instance id to each log message for stdout logger * tweaks: enable file signature for sec and max until depth issue resolved * tweaks: updates for efficacy and performance * wizard: Add FTP pattern to recognize FileZilla FTP Server 2020-06-18: 3.0.1 build 5 * actions: on a reload_config() free the memory allocated for react page on previous configuration loading * actions: refactor to store react page response in std::string * active: add a facility to prevent a DAQ whitelist verdict * appid: add api to check if appid needs inspection * appid: add braces to fix static analysis complaint * appid: add response message to reload_third_party * appid: check fqn before registering rrt * appid: for http2, if metadata doesn't give a match on payload, set payload id to unknown * appid: free memory allocated when appid is configured initially and then not configured on a subsequent reload * appid: lua APIs to get IP and port tunneled through a proxy * appid: match http2 response to request * appid: remove unnecessary stuff from appid apis * appid: revert snort protocol id changes and fixed warnings * appid: set appid_tlshost_bit when we set tls_cname * appid: set snort protocol id on the flow and remove ssl squelch code * appid: update cert viz API to handle subject alt name and SNI mismatch * codecs: fix issues found by static analysis * dce_rpc: suppport for DCE/RPC future session * detection: do not apply global rule state to the empty policy * doc: update user manual for trace feature * file_api: making sure that file malware inspection is turned off and only file-type detection is enabled when file_id config is defined without any parameter * flow: make client_initiated flag depend on the DAQ reverse flow flag * hash: replace the cache entry if found * host_cache: add new peg to module test * host_cache: allowing module to accept 64 bit memcap value * http2_inspect: fix hpack infractions * http2_inspect: partial inspect with less than 8 bytes of frame header in the same packet * http2_inspect: track memory usage for http_inspect flows in http2_inspect * log: fix issues found by static analysis * managers: add inspector execution and timing traces to InspectorManager * packet: add client and server direction methods that use the client initiator flow flag * parser: free memory allocated for RTN when SO rule load fails * parser: print loaded and shared rules for each ips policy * perf_monitor: fix count and interval during disable cli execution * port_scan: cleanup port scan memory allocations in module tterm * rpc_decode: remove unused config object * search_engines: fix potential memory leaks and an error in a printed value * service_inspectors: remove some redundant initializations and lookups, move some field initializations into the constructor * shell: if initial load of snort configuration fails release memory allocated for modules and plugins * snort2lua: deprecate react::msg option, display of rule message in react page not currently supported * snort2lua: fix issues found by static analysis * snort_config: only perform FatalError cleanup from main thread * stream: add final check to free allocated memory when module tterm is called * stream: fixed ip family in the flow->key during StreamHAClient::consume * stream_tcp: fix issues for tcp simultaneous close * stream_tcp: unconditionally release held packets that have timed out, regardless of flushing * trace: add control channel command * trace: add support for passing in the packet pointer to loggers * trace: filter traces by packet constraints * trace: fix for trace messages in the test-mode ('-T' option) * trace: remove redundant include 2020-05-20: 3.0.1 build 4 * appid: Do not allocate DNS session for non-DNS flows and update memory tracker for HTTP sessions * appid: Get inspector for the current snort config during reload * binder: print configured bindings in show() method * build: fix cppcheck warnings and typos * coverity: fixed issues discovered by Coverity tool * daq: Configure DAQ instances with total instances and instance IDs * dce_rpc: code style cleanups * dce_rpc: generate alert when dce splitter aborts due to invalid fragment length * flow: If a retry packet does not belong to a flow, block it * ftp_telnet: fix FTP race condition * http2_inspect: change partial flush handling * log: do not truncate config option names in ConfigLogger * loggers: when logging alert only use inspector buffers and name when the inspector's paf splitter is assigned for the direction of the alert" * main: Fixing some issues reported by Coverity * managers: print alphabetically sorted verbose inspector config output within an inspection policy * mpse: constify snort config args * network_inspectors: Fixing a few minor issues reported by Coverity * parser: print enabled rules for each ips policy * search_tool: refactor initialization * snort_config: constify Inspector::show and remove unnecessary logger args * snort_config: make const for packet threads * snort_config: minimize thread local access to snort_config * snort_config: pseudo packet initialization * snort_config: refactor access methods * snort_config: use provided conf * stream: add a configurable timeout for held packets * stream: move held packet timeout to Stream and support changing it on reload * stream_tcp: call splitter->finish() before reassemble() when flushing when PAF aborts due to gap in queued data * stream_tcp: change the DAQ verdict from drop to blacklist for held packets that timed out * stream_tcp: clear gadget from Flow object once fallback has happened in both directions * stream_tcp: only clear gadget after both splitters have aborted * stream_tcp: when paf aborts due to gap in data set splitter state to ABORT * trace: move module trace configuration into the trace module 2020-05-06: 3.0.1 build 3 * appid: Do not process retry packets but continue processing future packets in AppId * appid: Extract metadata for tunneled HTTP session * appid: Make unit tests multithread safe * appid: On API call store new values and publish an event for them immediately * appid: remove old http2 support * appid: store appids for http traffic in http session * appid: support for multi-stream http2 session * appid: Update miscellaneous appid on first decrypted packet * build: add support for ccache * file_api: fix file stats * file_api: mark processing of file complete after type detection if signature not enabled * http2_inspect: add peg count to track max concurrent http2 file transfers * http2_inspect: fix handling leftover data with padding * http2_inspect: protect against unexpected eval calls * http2_inspect: support stream multiplexing * http2_inspect: update padding check only for header and data frames * http_inspect: add support for http2 file processing * json: add stream formatter helper * managers: sort the inspector list in inspection policy using the instance name * memory: expose memory_cap.h to plugins * parameter: reject reals assigned to ints * rna: Update dev notes to describe usage * snort: add classtype, priority, and references to --dump-rule-meta output * snort: convert --dump-rule-{meta,state,deps} to json format * so rules: allow #fragments in references in so rule stubs * stream: Fix for stream pegs dumping zero values into perf_monitor_base.csv 2020-04-23: 3.0.1 build 2 * appid: Change sessionAPI to accomodate stream_index * appid: detect payload for first http2 stream * appid: Fix thread-safety issues in appid * appid: mark third-party inspection as done for expected flows * appid: Populate url for QUIC sessions by extracting QUIC SNI metadata from third-party * appid: remove thirdparty processing for http2 traffic * appid: remove unused code * appid: remove unused config options and rename "debug" option * appid: set up packet counters to make sure flows with one-way data don't pend forever * appid: Support org unit in SSL lookup API and do not overwrite the API provided data * codecs: Clean up CiscoMetaData implementation * codecs: GRE checksum updated for injected and rewritten packets * codecs: Update GRE flags and offset for injected packets * control: Disable request unit-test in cmake if shell is disabled * control: Fixing data races in request read and response * file: apply cached verdict on already seen file * file_magic: Update category for HWP and MSOLE2 * flowbits: eliminate extraneous FlowBitState * flowbits: fix reload mapping * flowbits: refactor implementation * flowbits: relocate bitop.h to helpers * flowbits: remove extraneous count * flowbits: remove unused group support * flow: track allocations for each flow, update cap_weights * framework: Remove unused InspectorData template * ftp_data: fix ids flushing at EOF * ftp: whitelisting reason support * host_tracker: Move all HostCacheAlloc template implementions to the header * http2_inspect: discard split connection preface * http2_inspect: flush pending data when a non-data frame is received * http2_inspect: handle the case of leftover header only (no body) * http2_inspect: support 0 length data frames * http_inspect: add fragment to http_uri * http_inspect: cut over to wizard on successful CONNECT response * http_inspect: enhance processing of connect messages * http_inspect: fix duplicated detained_inspection print in show() * http_inspect: make script tag check case insensitive * http_inspect: register extra-data callbacks in constructor * hyperscan: simplify scratch memory initialization * inspectors: designate service inspectors control channels for avc only * inspectors: designate service inspectors for file carving * inspectors: designate service inspectors for start tls * inspectors: update verbose config output in show() method to a new format * ips_context: add support to fallback to avc only * ips: fix rule state mapping and policy lookup * ips: remove plugins cruft from option tree node (rule body) * latency: check if ip header is present before deferring it * latency: use test_timeout config option to deterministically trigger latency events for ifdef REG_TEST * loggers: Add SGT field to CSV and JSON loggers * main: Make test_log() static in snort_debug.cc * managers: print inspectors' config output for every inspection policy configured * metadata-filter: apply to so rule stubs * output: allow error messages in quiet mode * packet_io: log daq batch size * packet_io: log daq pool size * perf_monitor: Enable or disable flow-ip-profiling using shell commands * plugin_manager: make erase from plug_map safer * plugin_manager: make sure --show-plugins option picks up SO plugins * reload: update ReloadError response messages to use consistent wording across all messages * session: remove unused IPS option * sip: Support pinhole for sip early media * snort2lua: make qos configuration values deleted from firewall * snort: add --dump-rule-deps * snort: add --dump-rule-state * snort: add flowbits set and checked to --dump-rule-meta * snort: add rule text to --dump-rule-meta * snort: enable --dump-rule-meta to work without a conf * snort: initial implementation of --dump-rule-meta * snort: remove inappropriate fatal errors * snort: remove unused --pcap-reload option * so rules: allow stub gid:sid:rev to override so * so rules: allow stub header to override so header * stream_tcp: remove unused session printing cruft * target_based: refactor host attribute table logic into a c++ class, eliminate dead code * target_based: refactor to improve design of the host attribute classes * target_based: refactor to load host attribute table from file * time: make packet_gettimeofday public * trace: refactor stdout/syslog logging of trace into logger framework 2020-03-31: 3.0.1 build 1 * analyzer: Send detained packet event when a packet is held * appid: use http2 inspector for detection even if third-party module is present * build: Increment version to 3.0.1 * dce_rpc: Fixed missing space in string * doc: add FIXIT-E description * http2_inspect: handle Cl and TE headers, and end_stream flags set on headers frames * http2_inspect: multiple data frames support * http_inspect: added FIXIT for thread safety * http_inspect: eliminate empty body sections for missing message bodies * latency: remove action config option and convert the log handler to trace_log message * mime: fix data race in mime config * modules: Support verbosity level for module trace options, modify trace logging macros * service_inspectors: standardize verbose config startup output for SMTP, POP and IMAP inspectors * snort2lua: remove conversion of deprecated options pkt-log and rule-log * so_rule: fix reload of shared object rules that use flow data * src: update high priority "to be fixed" comments (FIXIT-H) * stream_tcp: Out-of-order ACK processing fix 2020-03-25: build 270 * active: Base hold_packet() decision on DAQ message pool usage * active: Fix direction of RST packet being sent to server * active: Move packet hold realization for Stream detainment to verdict handling * active: Send entire buffer at once when send_data uses ioctl * appid: Adding UT for client_app_aim_test * appid: Fix SMB session data memory leak * appid: Include DNS over TLS port for classification * appid: Restart service detection on start of decryption * appid: Support appid detection for outer protocol service * appid: Support detection for first stream in http/2 session * binder: Ignore the network_policy binding * build: Bump the C++ compiler supported feature set requirement to C++14 * build: Don't try to use libuuid headers/libraries when not found; Thanks to James Lay for reporting the issue * build: Refactor included headers * codecs: Add new proto bit for udp tunneled traffic * codecs: Add vxlan codec * dce_rpc: Inspect midstream sessions for file inspection * file_api: Reading the new data for the overlapped file_data * filters: Update threshold tracking functions * flow: Allow the ExpectCache to force prune, so that we can always make room when the cache is full * flow: Change the ExpectCache prune logic to only remove a specified number of oldest entries, regardless of node expiration time * flow: Do away altogether with the loop in ExpectCache::prune, just remove one, only when the cache is full * http2_inspect: Refactor data cutter - preparation for multi packet processing * http2_inspect: Support single data frame sent to http, multiple flushes * http2_inspect: Update dev notes with memory calculations * http_inspect: Create http2 message body type * http_inspect: Gzip detained inspection * http_inspect: Refactor print_section for message bodies * loggers: Update usage to GLOBAL for all loggers * lua: Enable a rewrite plugin in a default config * main: Check if flow state is blocked while applying verdicts * main: Setting higher maximum pruning when idle * snort2lua: Convert a replace option to a rewrite plugin/action * snort2lua: Don't print out network_policy binding * stream: Short-circuit stream when handling retry packets in no-ack mode * stream_tcp: Cancel hold requests on the current packet when flushing * stream_tcp: Finalize held packets in TcpSession::clear_session() * stream_tcp: Moved retry check to TcpSession::process 2020-03-12: build 269 * active: Add ability to inject resets and payload via IOCTLs * appid: Add support for third-party reload on midstream session * appid: detect apps using x-working-with http field in response header * appid: Enhance ssl appid lookup api to store SNI and CN provided by SSL for app detection * appid: fix thread-safety issues in mdns detector * appid: handle CERTIFICATE STATUS handshake type in SSL detector * appid: move client/service pattern detectors and service discovery manager to odp context * appid: Support third-party reload when snort is running with multiple packet threads * base64_decode: use standard detection context data buffer * build: fix build on big-endian systems * build: Fix LibUUID detection on OS X * build: Fix various build issues on FreeBSD and OS X * build: refactor trace logs * build: tweak includes * build: use const and auto references where possible * byte_math: Snort2 bug fix port of integer over and under flow detection * classifications: update implementation with unordered map * classifications: use consistent variable names * cmake: Fix building without lzma library * detection: added support for trace config option to take a list of strings with verbosity level instead of bitmask * detection: refactoring updates to detection, moved DetectionModule into a separate file * flow: added initiator bytes/packets onto flow * flow: Add missing time.h include for struct timeval * flow: free the flow data before deleting the actual flow * flow: turn off deferred whitelist on DONE if no whitelist was seen * flow_cache: fix memory deallocation bug due to inverted return value from hash release node * framework: add generic conversion of trace strings to bitmaks * ftp: Whitelist ftp session after max sig depth reached * ghash: fix thread race condition with GHash member variables when a GHash instance is global * hash: add unit tests for new HashLruCache class * hash: delete unused sfmemcap.[h|cc] and remove unnecessary includes * http2_inspect: abort for nhi errors * http2_inspect: send data frames to http - full frames only in a single flush * http_inspect: change http_uri to only include path and query for absolute and absolute path uris * http_inspect: improve precautions for stream interactions * http_inspect: Properly mock HttpModule::peg_counts in http_transaction_test * main: do FileService::post_init after inspectors are configured * parser: remove legacy parsing code * plugin_manager: add support for reload so_rule plugins * pub_sub: add http2 info to http pub messages * reference: update implementation with unordered map * reload: add description of reload error to the response message of the reload_config command * reputation: remove reputation monitor flag from packet, track verdict on flow * rules: add constructors for references and classifications * rules: fix warnings and startup counts for duplicates * rules: remove cruft * rules: simplify implementation of services, classifications, and references by using std::string * rules: update --gen-msg-map to include all configured rules with references * service_inspectors: added counters to track total number of data bytes processed in SMTP, POP, SSH and FTP * service: update implementation to vector * sfdaq: convert parsing related error messages in DAQ init to ParseErrors * sfdaq: Made get_stats public for plugins * smb: Fix malware over size 131kb not being detected in SMBv2/SMBv3 * snort_config: footprint REG_TEST, no check for stream inspector add/rm, etc * stats: update shutdown timing stats * stream: Addressing inconsistent stream stats and some data races * stream_ip: added counters to track total number of data bytes processed * stream_tcp: no_ack applies only to ips mode * stream_udp: added counters to track total number of data bytes processed * style: remove tabs and too long lines * utils: add unit tests for MemCapAllocator class * utils: create memory allocation class based on sfmemcap functionality * utils: handle out-of-range time * xhash: refactor XHash and HashFnc to eliminate c-style callbacks and simplify ctor options * xhash: rename hashfcn.[cc|h] to hash_keys.[cc|h] * xhash/zhash: refactor duplicated code into a common base class, xhash/zhash will subclass this new base class * zhash: make zhash a subclass of xhash, eliminate duplicate code * zhash: refactor to use hash_lru_cache and hash_key_operations classes 2020-02-21: build 268 * appid: Adding support for appid detection on decrypted SSL sessions * appid: Adding support for wildcard ports in static host port cache * appid: clean up ENABLE_APPID_THIRD_PARTY from configure_cmake * appid: cleanup terminology * appid: delete odp context on exit * appid: detect payload for http tunnel traffic * appid: do not reload third party on reload_config * appid: Don't mark HTTP session done if the ssl detector is still in progress * appid: Fix array initialization on Appid * appid: get rid of ENABLE_APPID_THIRD_PARTY flag * appid: handle invalid uri in http tunnel traffic * appid: load app mapping data to odp context * appid: move dns, sip, ssl and http pattern matchers to odp context; move client discovery manager to odp context * appid: move odp config, host-port cache and length cache to a separate class OdpContext; remove obsolete port detector code * appid: reset tp packet counters each time we do reinspect * appid: support third party reload when snort is running with single packet thread * bufferlen: match on total length unless remaining is specified * build: Clean up accumulated tabs and trailing whitespace in the code * build: clean up non-hyperscan builds * build: Fix more Clang 9 compiler warnings * build: Remove some extraneous semicolons (compiler warnings) * build: Rename parameters that shadow class members (compiler warnings) * build: Updates across the board for stricter Clang const-casting warnings * catch: Update to Catch v2.11.1 * cip: explicitly include sys/time.h header * codecs: Use unions for checksum pseudoheaders * content: add hyperscan content literal matching alternative to boyer-moore * content: delete flawed hyper search test * content: use hs_compile if hs_compile_lit is not available * copyright: update year to 2020 * dce_tcp: fixup flow data handling * detection: add config option to enable conversion of pcre expressions to use the regex engine * detection: add hyperscan_literals option * detection: add pcre_override to enable/disable pcre/O * detection: signature evaluation looping based on literal contents only (exclude regex) * doc: manual updates for HTTP/2 * doc: update documentation for lua whitelist * doc: update reload_limitations.txt * file_api: enable Active when there are reset rules in the file policy * framework: introduce ScratchAllocator class to help with scratch memory management * gtp_inspect: fix default port binding * hash: refactor ghash implementation to convert it to an actual C++ class * hash: refactor key compare function prototype and functions to return boolean * hash: refactor to move common definitions into hash_defs.h * hash: refactor xhash to be a real C++ class * host_tracker: Check lock in a separate thread in unit-test * host_tracker: make current_size atomic to save some locks * host_tracker: Support host_cache reload with RRT when memcap changes * http2_inspect: add transfer encoding chunked at end of decoded http1 header block * http2_inspect: data frame http inspection walking skeleton first phase * http2_inspect: fast pattern support * http2_inspect: fix string decode error * http2_inspect: frame data no longer in file_data * http2_inspect: integration with NHI * http2_inspect: support disabling detection for uninteresting HTTP/2 frames * http2_inspect: support HPACK dynamic table size updates * http_inspect: add http_param rule option * http_inspect: gzip splitting beyond request_depth should use correct target size * http_inspect: no duplicate built-in events for a flow * http_inspect: patch H2I-related xtra data crash * http_inspect: process multiple files simultaneously over HTTP/1.1 * http_inspect: refactoring * http_inspect: update test tool to support the HTTP/2 macros and new insert command * http_inspect: when detection is disabled, disable all rules not just content rules * http_inspect/http2_inspect: H2I unified2 extra data logging * hyperscan: convert thread locals to scan context * inspectors: ensure correct lookup by type, name, or service * inspectors: print label for type and alias in inspector manager. Remove printing module name in inspectors ::show() method * ips: alert service rules check ports * ips_pcre: compile/evaluate pcre rule option regular expressions with the hyperscan regex engine when possible * ips_pcre: support the O & R modifiers when converting pcre to regex * ips: refactor rule parsing * ips: remove dead code from rule parser * ips: use service "file" instead of "user" * loggers: update vlan logging in csv and json loggers * lua: Added missing file magic pattern for FLIC * lua: Added missing file magic pattern for IntelHEX * lua: fix typo in default smtp's alt_max_command_line_len * lua: update default lua files to whitelist the defined tables * main: add verbose inspector output during reload * main: make IPS actions (reject, react, replace) configurable per-IPS policy * main: move config_lua to Shell::configure * memory: Treating config value memory.cap as per thread instead of global * metadata: add --metadata-filter to load matching rules only * mime: support simultaneous file processing of MIME-encoded files over HTTP/1.1 * module_manager: add snort_whitelist_append and snort_whitelist_add_prefix FFIs * normalizer: disable all normalizations by default except for tcp.ips * packet_io: provide default reset action (bidirectional reset for TCP, ICMP unreachable for the rest) * packet_io: refactor Active and IPS Actions to start disentangling them * parser: add service http2 to http rules * parser: store local copy of service name * pcre: ensure use of maximal ovector size and simplify logic * port_scan: Supporting reload config when memcap changes * protocols: provide direct access to the CiscoMetaData layer * regex: convert thread locals to scan context * reload: eliminate FatalError calls that can't happen because snort_calloc always returns valid memory * rna: use standard uint8_t type instead of u_int8_t * search_engine: trivial reformatting * smtp: update defaults to better align with Snort 2 * snort2lua: conversion of path containing variables * snort: add new warn flag warn-conf-strict that will throw out warning when table is not found * snort: Adding some verbose logs for appid, file_id, and reputation inspectors * stream_tcp: ensure that flows with mss and timestamps are picked up on syn * tweaks: set reasonable stream_ip.min_fragment_length values * tweaks: update per new normalizer defaults * tweaks: update policy configs to better align with Snort 2 2019-12-20: build 267 * appid: Adding command for third-party reload * appid: cleanup unused code * binder: assitant gadget support * build: Const-ify reference arguments as suggested by cppcheck * catch: Add infrastructure for standalone Catch unit tests * catch: Update to Catch v2.11.0 * codec: Added GRE::encode method * control: Convert IdleProcessing unit tests to standalone Catch * dce_rpc: Convert HTTP proxy and server splitter unit tests to standalone Catch * file_api: When multiple files are processed simultaneously per flow, store the files on the flow, not in the cache. Don't cache files until the signature has been computed * file_magic: add file magic for .jar, .rar, .alz, .egg, .hwp and .swf files * framework: Convert parameter and range unit tests to standalone Catch * gtp: alerts should be raised for missing TEID in gtp msg * helpers: Convert Base64Encoder unit tests to standalone Catch * http2_inspect: add Stream class * http2_inspect: parse settings frames * http_inspect: support limited response depth * ips: do not use includer for any rules file includes * ips: fix --show-file-codes for inclusion from -c file * lru_cache_shared: added find_else_insert to add user managed objects to the cache * lua: Convert LuaStack unit tests to standalone Catch * lua: Link lua_stack_test against libdl to handle the static luajit case * packet_capture: ignore PDUs and defragged packets, include non-IP packets * perf_monitor: Convert CSV, FBS, and JSON formatter unit tests to standalone Catch * perf_monitor: tuning for flow_ip_memcap on reload * profiler: Convert MemoryContext and ProfilerStatsTable unit tests to standalone Catch * reload: fix issue where resource tuning was not being called when in idle context * rule_state: allow empty tables * search_engine: fix expected count of MPSEs when offloading * sfip: Convert SfIp unit tests to standalone Catch * sfip: Use REG_TEST-style IP stringification for standalone Catch tests * stream_tcp: fix TcpState post increment operator to stop increment at max value (and use correct max value) * stream_tcp: refactor stream_tcp initialization to create reassemblers during plugin init * stream_tcp: refactor to initialize tcp normalizers during plugin init * stream/tcp: Remove some unused Catch includes * time: Convert periodic and stopwatch unit tests to standalone Catch * utils: Convert bitop unit tests to standalone Catch 2019-12-04: build 266 * appid: Add new pattern to pop3, don't concatenate ssl certs, use openssl-1.1 compliant APIs * appid: Enabling host cache for unknown SSL flows * appid: Fix for better classification on pinholed data session and control session for rshell/rexec * appid: Format detected apps stats in columns akin to file stats * appid: Handle memcap during reload_config using RRT * appid: Minor cleanup * cmake: Cache static DAQ module info in FindDAQ * file_api: Fixed eventing when FILE_SIG_DEPTH failed when store files enabled * flow: Add ability to defer whitelist verdict * flow: Clean up unit test compiler warnings * flow: Disabling the inspection if the Flow state is BLOCK * http2_inspect: Generate status lines for responses and be more lenient on RFC violations * http2_inspect: Implement hpack dynamic index lookups * http_inspect: Implement show method for verbose config output * http_inspect: Update user manual for detained inspection * hyperscan: Select max scratch from among all compiler threads * ips: Add support for parallel fast-pattern MPSE FSM compilation * ips: Only use multiple threads for rule group compilation at startup * ips: Support 2 rule vars same as Snort 2 * mpse: Only hyperscan currently supports parallel compilation * port_scan: Only update scanner for ICMP if we have one * profiler: Fix module profile for multithreaded runs * search_engine: Ensure configured search_method is applied to search tools * search_engine: Process intermediate fast-pattern matches in batches of 32 same as Snort 2 * search_engine: Raise an error if any MPSE compilation fails * sfip: Replace copy setter with implicit copy constructor * stats: Removal of mallinfo as it only support 32bit * stream_tcp: Move and update the libtcp source files to the tcp source directory to consolidate the stream tcp code into one component (libtcp goes away) * stream_tcp: Updates from PR review comments 2019-11-22: build 265 * analyzer_command: support resource tuning on reload * appid: Adding Lua-C API to handle midstream traffic * cip: ips rule support for Common Industrial Protocol (CIP) * ftp: handling multiple ftp server config validation * detection: disable rule evaluation when detection is disabled for offload packets * detection: fix post-inspection state clearing issue * flow: check if there are offloaded packets in the flow before clearing out the alert count * http2_inspect: add frame class and refactor stream splitter * http2_inspect: fix unit tests to build without REGTEST defined * main: Improve performance of control connection polling * plugin_manager: allow loading individual plugin files in plugin-path * reject: Setting defaults for reset and control options * snort: update reload resource tuner to return status indicating if there is work to be done in the packet thread * stream: register reload resource tuner unconditionally. move checks for config changes to the tuner tinit method * stream_tcp: fix state machine instantiation * wizard: handle NBSS startup in dce_smb_curse 2019-11-06: build 264 * appid: Handle DNS responses with compression pointers at last record * dce_smb: deprecate config for smb_file_inspection, use smb_file_depth only * detection: negated fast patterns are last choice * http2_inspect: fix bugs in splitting long data frames and padding * http_inspect: change accelerated_blocking to detained_inspection * http_inspect: remove deprecated @fileclose command from test tool * imap, pop, smtp: changed default decode depths to unlimited * ips: define a builtin GID range to prevent unloaded SIDs from firing on all packets * ips_option::enable: fix dynamic plugin build * lua: tweak default conf and add tweaks for various scenarios * normalizer: make tcp.ips defaults to true * port_scan: increase default memcap to a more reasonable 10M * s7commplus: Initial working version of s7commplus service inspector * search_engine: stop searching if queue limit is reached * stream: implement reload resource tuner for stream to adjust the number of flow objects as needed when the stream 'max_flows' configuration option changes * telnet: fix check_encrypted help string 2019-10-31: build 263 * appid: for ssl sessions, set payload id to unknown after ssl handshake is done if the payload id was not not found * appid: check inferred services in host cache only if there were updates * appid: Updating the path to userappid.conf * build: Clean up snort namespace usage * build: generate and tag build 263 * binder: Use reloaded snort config when getting inspector * codecs: Relax requirement for DAQ packet decode data offsets when bypassing checksums * content: rewrite boyer_moore for performance * data_bus: add unit test cases * detection: enhance fast pattern match queuing * dns: made changes to make sure DNS parsing is thread safe * doc: update default manuals * file_api: Put FileCapture in the snort namespace * ftp: fix for missing prototype warning * ftp: catch invalid server command format * http_inspect: test tool single-direction abort fix * http_inspect: add more config initializers * http2_inspect: generate request start line from pseudo-headers * http2_inspect: abort on header decode error * http2_inspect: stop sharing a variable between scan and reassemble * http2_inspect: decode indexed header fields in the HPACK static table * http2_inspect: Move HPACK decompression out of stream splitter into a separate class * http2_inspect: Abort on bad connection preface * http2_inspect: cleanup * http2_inspect: discard connection preface * ips: add states member, similar to rules, by convention use for rule state stubs with enable * mime: Put MailLogConfig in the snort namespace * packet: fix reset issues * packet_io: do not retry packets that do not have a daq instance * policy: Avoid unintended insertion of policy into map if it does not exist * pub_subs: made default pub_subs policy-independent * rule_state: deprecat, replace with ips option enable to avoid LuaJIT limitations * stream_tcp: fix stability issues * stream_tcp: If no-ack is on, rewrite ACK value to be the expected ACK 2019-10-09: build 262 * analyzer: move setting pkth to nullptr to after publishing finalize event * analyzer: publish other message event for unknown DAQ messages * appid: add support for bittorrent detection over standard ports * appid: add support for Lua detector callback mechanism * appid: add support for wildcard ports in host tracker * appid: extract forward ip from http tunneled traffic and use it for dynamic host cache lookup * appid: fix populating dns_query for DNS traffic * binder: allow binder to support global level service inspectors * binder: remove global check for stream inspectors and revert module_map changes * codecs: fix checksumming a single byte of unaligned data * codecs: use checksum validation from DAQ packet decode data when available * detection: consistently prefer service rules over port rules * detection: do not split service groups by ip proto to avoid extra searches * detection: map file rules to services * detection: non-service rules must match on rule header proto * detection: remove cruft from match accumulator * detection: remove more cruft from match tracker * detection: remove the inappropriate match tracker from mpse batch setup * detection: remove unnecessary match data from eval context * detection: support alert file rules w/o optional services * detection: update trace to indicate eval task * detection: use reference for signature eval data * doc: add Snort2Lua note on ips rule action rewrite * flow: check if control packet has a valid daq instance before setting up daq expected flow and add pegcounts for expected flows * flow: patch to allocate Flow objects individually on demand. Once allocated the Flow objects are reused until snort exits or reload changes the max_flows setting * flow: when walking uni_list stop before reaching head * helpers: discovery filter support for zone matching * helpers: implement port exclusion in discovery filter * http2_inspect: cut headers from frame_data buffer * http2_inspect: parse hpack header representations and decode string literals * http2_inspect: validate connection preface * ips_options: minor code style changes * libtcp: turn off no-ack mode if packet is out of order * lua: added move constructor and move assignment operator to Lua::State to fix segv * lua: fixed whitespace to match style guidelines * managers: add null check in reload_module to prevent crash when trying to reload module that has not been configured * profiler: increase width of checks and alloc fields so values don't run together * protocols: remove reference to obsolete DAQ_PKT_FLAG_HW_TCP_CS_GOOD flag * pub_sub: replace DaqMetaEvent and OtherMessageEvent with DaqMessageEvent * reputation: prevent reload module crash when reputation is not configured in lua at startup * reputation: SIDs for source and destination-triggered events added * snort2lua: convert snort2 port bindings into snort3 service bindings for inspectors configured in wizard and add --bind-port option to enable port bindings conversion * snort2lua: remove identity related options from firewall * snort2lua: reset the sticky buffer name while converting unchanged sticky rule options and file_data * stream: clean up cppcheck warnings * stream: clean up update_direction * stream: code cleanup and dead-code removal * unit-tests: fix compiler warnings that snuck into CppUTest unit tests * utils: prevent integer overflow/underflow when reading BER elements 2019-09-12: build 261 * analyzer: Process retry queue and onloads when no DAQ messages are received * appid: Enabled API for SSL to lookup appid * appid: Support FTP banners on multiple packets with split response code * build: Address miscellaneous cppcheck warnings * build: Const-ify reference arguments as suggested by cppcheck * build: Update CMake logic for unversioned LibSafeC pkg-config name * doc: add bullets for $var parameter names and maxXX limits * http_inspect: accelerated blocking for chunked message bodies * http2_inspect: send raw encoded headers to detection * managers: Make InspectorManager::thread_stop() a no-op if thread_init() was never called * rna: generate an RNA_EVENT_CHANGE when a host is seen after the last log event and the current time is past the update timeout * rna: support for bidirectional flow with UDP, IP, and ICMP traffic * rna: Support for filtering rna events by host ip * rule_state: switch from regex parameter names to simpler parsing * snort2lua: only emit max_flows and pruning_timeout options in converted lua file if the option is used in the snort2 conf file * stream: fix problem with accelerated blocking partial inspection * style: update link for google c++ style guide 2019-08-28: build 260 * appid: handle 'change cipher spec' in 'server hello' to allow some app detection for tls 1.3 traffic * binder: updated change_service event to support service reset via wizard * host_tracker: derive LruCacheSharedMemcap from the general LruCacheShared that tracks size in bytes, rather than number of items and instantiate host_cache from LruCacheSharedMemcap * http2_inspect: Remove pkt_data buffer option * reload: fix coding style issues, support multiple in progress analyzer commands, support associated AC state for execute method, move reload tune logic for ACSwap to the execute command * rna: Support for rna unified2 logging * stream_tcp: clear consecutive small segs count upon non-small segs only 2019-08-21: build 259 * analyzer_command: Import into snort namespace and add the ability to retrieve the DAQ instance from an Analyzer * appid: delay port-based detection until a non-zero payload packet is seen for the session * appid: fix discovery unit test that was failing intermittently * appid: Fix for app name not getting evaluated for port/protocol based detectors * appid: support for bittorrent detection when UDP tracker packet arrives after the TCP resumed session has already started * build: Fix miscellaneous cppcheck warnings * codec: Adapt to new DAQ message metadata source for Real IP/port info * file_api: generate events each time file is seen, not just first time * finalize_packet: pass verdict by reference in inspector event * flow: add virtual destructor to stash generic object * flow: Bypass HA write for unsupported Tunnel flows * flow: delete stale flow on receiving NEW_FLOW flag * flow: if no 'get_ssn' handler configured then skip processing of the flow * flow: introduced variable for handling idle session timeouts and flag for actively pruning flows based on the expire_time * flow: make a single flow cache for all the protocols * flow: refactor flow config object to work with single flow cache concept * flow: refactor uni list managment into a separate class and instantiate an instance for ip flows and another for all non-ip flows * flow: release session object allocated for a flow when the Flow object is reused and the PktType of the new flow is different from the previous use * flow: Add packet tracer message when a new session is started * ftp_telnet: add support for ftp file resume block by calculating path hash used as file id * hash: add back size(), get_max_size() and remove() functions to lru_cache_shared * hash: add unit test for explicitly testing get / set max size * host_cache: Refactoring code to fix multithreading issues and to remove redundancy * http2: huffman string decode * http2_inspect: add HI test tool * http_inspect: remove 0-byte workaround * ips_options: add ber_data and ber_skip * main: Implement reload memcap framework * pcre: add peg counts for PCRE_ERROR_MATCHLIMIT and PCRE_ERROR_RECURSIONLIMIT return status from pcre_exec() * reputation: Fixed issues with reputation monitor * rna: Add new hosts with IP-address into host cache * snort2lua: Combine proto specific cache options for max_session in one max_flows option * stream_tcp: add API for switching to no_ack mode * stream_tcp: fix 3-1-2 ordering markup * stream: update checks for modified stream config to work with updates to stream config options * stream: updated the protocol setup and process logic of TCP,UDP,IP,ICMP and USER sessions for setting and updating idle session timeouts * time: Make TscClock fail to compile on non-x86/AArch64 systems * wizard: Avoid host cache service insertion since we are using flow service * xhash: Ported sfxhash_change_memcap() from snort2 to snort3 2019-07-17: build 258 * analyzer: 1024 contexts max is a better default until configurable * appid: fix header order in appid_session * codec: add support of ignore_vlan flag from daq header * detection: allocate scratch after configuration * detection: immediately onload after offloading when running regression tests * detection: on PDUs change search order to set check_ports correctly * detection: reduce hard number of contexts to work with pcap default * detection: start offload threads before packet threads are pinned * detection: use offload_threads = N with -z = 1 * flow: Extend stash to support uint32_t and make it SO_PUBLIC * flow: Fixes for DAQ-backed HA implementation * flow: remove config.h from flow_stash_keys * high_availability: high availability support in Snort2Lua * host_cache: Adding command and config option to dump hosts * host_cache: Closing va_list after usage using va_end * http2: decode HPACK uint * http2: hpack string decode * http_inspect: perf improvements * http_inspect: send headers to detection separately * ips: add missing non-fast-pattern warning * ips: refactor fast pattern searching * mpse: api init and print methods are optional * no_ack: Purge segment list withouth waiting for ack when using no_ack feature * pcre: cap the pcre_match_limit_recursion based on the stack size available * profiler: convert ips options to use optional profiles * profiler: eliminate deep profiling * profiler: implement general exclusion * profiler: include onload/offload efforts in mpse * profiler: refactor * profiler: split out paf from stream_tcp * profiler: track DAQ message receives and finalizes * snort: remove out-of-date Snort 2 version from -V * stream: add convenient method for flow deletion * stream_tcp: Add no-ack policy to handle flows that have no ACKs for data * stream_tcp: fix non-deep detect profile exclusion * talos.lua: various fixes for command line usage 2019-06-19: build 257 * analyzer: publish finalize packet event before calling finalize_message * appid: Protocol based detection for non-TCP non-UDP traffic * appid: support for dynamic host cache lookup-based app detection * build: Fix unused parameter warnings in unit tests * check: Fix missing semicolons on CHECK calls * detection: adding pegcounts for fallback, offload failures * detection: add peg for onload wait conditions * detection: fix check for disabled rules * detection: fix creation of service map to use ips policy id * detection: on PDUs search TCP/UDP portgroups even when user_mode services exist * doc: Remove perpetually out-of-date copy of LibDAQ's README * doc: Update documentation to reflect post-DAQng reality * flow: check if flow is actually deleted before updating memstats * flow: Implement storing and importing HA data via DAQ IOCTLs * http_inspect: stop clearing http data snapshots from ips contexts on flow deletion * http_inspect/stream: accelerated blocking * http_inspect: test tool enhancement * icmp4: verify checksum before the type validation * ips_options: add relative parameter to so option * perf_mon: removed flow_ip_handler from PerfMonitor * regex: fix repeated search offset * rna: Fixing doc build failure due to asciidoc format issue * rna: Implementing event-driven RNA inspections * rna: Introducing barebone RNA module and inspector * rna: Renaming peg counts and adding a warning when config changes * smtp: Fix handle_header_line and normalize_data unit tests * smtp: pass packet pointer instead of nullptr to SMTP_CopyToAltBuffer * stream: Do not validate timestamp until peer timestamp is set * stream_ip: Checking null inspector while updating session 2019-05-22: build 256 * DAQng: Port Snort and its DAQ modules to DAQ3 - Massive refactoring of the Analyzer thread - Handle multiple offloaded wire packets - Port hext and file DAQ modules to DAQng - Reimplement the RETRY verdict internal to Snort - Revamp skip-n/exit-after-n/pause-after-n handling - Update lua tweaks with new DAQ configuration format - Update sfdaq unit tests for DAQng - Update snort2lua to convert to new DAQ configuration * filters: add peg count for when the thd_runtime XHash table gets full * filters: make thd_runtime and rf_hash thread local and allocate them from thread init rather than from Module::end() * http_inspect: fix status_code_num bug in HttpMsgHeader::update_flow() that leads to assert on input.length()>0 in norm_decimal_integer * main: Fix File Descriptor leaks * main: Include analyzer.h in snort.c * packet_io: Refactor the Trough a bit * perf_mon: Fixed time stamp and memory leak issue - Add real timestamp to empty perf_stats data - Updated dbus default subscription code and perf_mon event subscirption code to resolve memory leak and invalid event subscription from reloading - Moved flow_ip_tracker to thread local * perf_monitor: Fixing heap-use-after-free after reload failure * port_scan: Change minimum memcap value to 1024 to avoid divide by zero crash * rule_state: change enable values "true" / "false" to "yes" / "no" * snort2lua: Remove sticky buffer duplicates * stream: disable inspection of flow on reset 2019-05-03: build 255 * ips: add includer for better relative path support * module_manager: Fix potential null deref in module parameter dumping 2019-04-26: build 254 * analyzer: Print pause indicator from analyzer threads * appid: remove inspector reference from detectors * build: Remove perpetually stale reference to lua_plugffi.h * build: remove unused cruft; clean up KMap * config: replace working dir overrides with --include-path * context: only clear ids_in_use in dtor * file_type: remove redundant error message * log_pcap, packet_capture: Don't try to use a DAQ pkthdr as a PCAP pkthdr * Lua: update tweaks per latest include changes * main: Use epoll (for linux systems) instead of select to get rid of limit on fd-set-size and for time efficiency * snort2lua: fix histogram option change comment * snort2lua: Integer parameter range check * stream_tcp: Try to work with a cleaner Packet when purging at shutdown * test: remove cruft 2019-04-17: build 253 * build: delete unused code called out by cppcheck * doc: remove mention of obsolete LUA_PATH, SNORT_LUA_PATH, and required snort_config library * flow_cache: Pruning one stream when excess pruning skips even if max_sessions is reached * ftp_server: fix normalization and PDU parsing issues * helpers: directory: use readdir instead of readdir_r * Lua: apply the necessary builtin defaults from one place * Lua: internalize snort_config.lua dependency * Lua: build-time stringify Lua files for use as C++ variables * Lua: remove dependency on SNORT_LUA_PATH * mime: fix decompression for multiple files * parser: update include file handling * parser: fix defaults for alerts.order and network.checksum_eval 2019-04-10: build 252 * appid: Fix NetworkSet compilation on big-endian systems * appid: Reduce variable scope in service_mdns * appid: Reduce variable scope in service_rpc * codecs/ipv4: Use struct in_addr when calling inet_ntop() * dce_rpc: Fix const cast warnings in dce_smb2 * detection: Don't send zero size searches to the regex offloader If a batch search request had nothing in it to be searched for there is no purpose in sending it to the offloader * detection: Ensure offload search engine started with appropriate regex offloader If the offload_search_method is not specified then by default it will be the same as the normal search_method If this search method is an async mpse it needs started using the MpseRegexOffload offloader otherwise it needs started using the ThreadRegexOffload offloader * file_api: add extract filename to FileFlow from mime header * file_api: Add timer to limit how long we want for pending file lookup * file_api: If configured, reset session when lookup times out * file_api: Make expiration timers more granular * file_api: use more generic form of timercmp and fix timersub call * file_api: use timersub_ms, updates to packettracer logs * flow: add the override keyword to some member function to keep cppcheck happy * flow: add test to check that a handler is not getting stash events that it's not listening to * flow: stash publish event * flow: unit test for stash publish * ftp_telnet: Fix potential NULL pointer arithmetic in check_ftp() * ftp_telnet: Fix val-never-used warning in DoNextFormat() * http_inspect: Fix val-never-used warning in check_oversize_dir() * http_inspect: Give HttpTestInput a destructor to clean up its file handle * log: Fix potential NULL pointer arithmetic warning in log_text * mpse: Adding performance profiling stats to Mpse batch search The Mpse batch search function does not have any performance profiling so this function is now wrapped to facilitate the addition of performance stats * normalize: Remove redundant check during configuration * offload: simplify zero byte bypass * offload: Framework changes to support polling for completed batch searches When a batch search is issued, currently we poll to determine if that batch has completed its search This change facilitates polling to return any batch that has completed its search * packet_io: Changes to allow daq retries to work properly * packet_io: add entry for retry in act_str due to re-ordering * packet_io: re-order ACT_RETRY to be before ACT_DROP * packet_tracer: Pass filename string parameter by reference * perf_monitor: Pass ModuleConfig string parameter by reference * port_scan: Reduce variable scope in configuration * rule_state: rule_state: do not require rules in all policies * rules: remove cruft from tree nodes * sfip: Reduce variable scopes in sf_ipvar * sfip: Switch test debug flag to a cpp macro * sfrt: Reduce variable scope in _dir_remove_less_specific() * sip: Give SipSplitterUT a proper copy constructor * snort2lua: Adding support for appid tp_config_path conversion * snort2lua: Convert rawbytes to raw_data sticky buffer * so rules: fixup shutdown sequencing * so rules: make plain stubs same as protected * so rules: use stub strictly as a key * stream: set retransmit flag * stream_ip: Fix sign comparison and val-never-used issues in defrag * stream_tcp: Fix shadowed variable when profiling deeply * u2spewfoo: update due to re-ording of retry action 2019-03-31: build 251 * ActionManager: actions are tracked per packet for accurate packet suspension * DetectionEngine: make onload safe for reentrance * DetectionEngine: stall when out of contexts * Flow: is_offloaded is now is_suspended * IpsContext: removed useless SUSPENDED_OFFLOAD state * Mpse: Addition and use of offload search method/engine * Mpse: fixed build warning about constness of get_pattern_count * MpseBatch: refactor into separate files * Packet: fixed thread safety in onload flag checks * RegexOffload: onload whatever is ready * RegexOffload: refactor into mode-specific subclasses * appid: Fix for FTP detection with multiline server response split across multiple packets * appid: add unit test to make sure the AppIdServiceStateKey::operator<() is OK and modify existing service cache memcap test to alternate ipv4 and ipv6 addresses * appid: change the service queue to store map iterators rather than the actual keys, as (a) map iterators are stable and (b) sizeof(map::iterator)=8 while sizeof(key)=28 * appid: compute the size of the memory used for a service cache entry only once, as it is constant, and make it global * appid: fix AppIdServiceStateKey::operator<() * appid: fix client discovery to only check on the first data packet * appid: fix comment in client_discovery.cc * appid: fix double free in service_state_queue and address reviewers comments * appid: fixup profiling * appid: get rid of the map::find() in MapList::add(), just try to emplace directly * appid: implement service cache touch(). Must figure out where to call it from * appid: implement service discovery state queue to honor memcap * appid: introduce min memcap of 1024 with a default of 1Mb and refactor AppIdServiceState::remove() to accept a ServiceCache_t::iterator rather than ip, proto, port and decrypted * appid: introduce the do_touch flag to the add/get functions and call those functions with the appropriate flag * appid: keep cppcheck happy * appid: more cppcheck clean-up * appid: pass HostPortKey by reference in HostPortKey::operator<() * appid: put the service_state_cache and the service_state_queue into a class in its own right and refactor the code * appid: remove forgotten WhereMacro * appid: rename some global variables in http_url_patterns_test.cc to suppress cppcheck messages * appid: replace the custom AppIdServiceCacheKey::operator< with memcmp in both service_state.h and host_port_app_cache.cc * appid: return void in ClientDiscovery::exec_client_detectors() and set client_disco_state to FINISHED in all cases except when the client validate returns APPID_INPROCESS * appid: set a range for app_stats_period parameter * appid: skip empty detectors * appid: the service queue should be of type AppIdServiceStateKey * appid: unit test for service cache and call the touch function * appid: untabify service_state.h and test/service_state_test.cc * appid: update unit test file * binder: Reset flow gadget and protocol ID on failed rebinding * binder: store user set ips policy id from lua * build: Add better support for libiconv on systems with iconv-providing libc * build: fix always true warning * build: fix constness warnings * build: fix cppcheck warnings for file_connector, tcp_connector, ports, snort2lua, and piglet_plugins, * build: fix override warning * catch: Update to Catch v2.7.0 * cd_tcp: some light refactoring * conf: remove obscure and slow automatic iface var assignments; use Lua instead * config: Use basename_r() function for FreeBSD versions < 12.0.0 * control: Avoid deleting objects on write failures so that they get deleted from main thread during read polling * copyright: update year to 2019 * cppcheck: fix some basic warnings * dce_rpc: Added support to handle smb header compounding * dce_rpc: Limiting each signature alert to once per session using 'limit_alerts' config * dce_rpc: fix cppcheck warnings * dce_rpc: fix style warning non-boolean returned * decompress: add zip file decompression * detection, snort2lua: added global rule state options for legacy conversions * detection: Add search batching infrastructure * detection: allow suspension of entire chains of contexts * detection: fixed incorrect log messages * detection: only swap offload configs when they change * detection: split fast pattern processing when using context suspension * doc: add a section for reload limitations * doc: update default manuals * doc: update reload limitations - adding/removing stream_* * file: fixed data race at shutdown * file_api: Added nullptr checking to prevent segfaults when file mempool is not configured * file_api: call FileContext::set_file_name() from FileFlows::set_file_name with fname = nullptr, in order to generate file event * file_api: fail the reload if max_files_cache is changed or if capture was initially enabled and capture_memcap or capture_block_size change * file_api: fix policy lookup * file_capture: refactor max size handling * filters: call get_ips_policy instead of get_network_policy when building the key for rate filter * flow: Added a support to store generic objects in a stash * flow: support for flow stash - allows storage of integers and strings * flow_control: remove unused session flag * fp_detect: suspend instead of onload if fp_local can't occur yet * hash: Added lru_cache_shared.h to HASH_INCLUDES * hash: Moved list_iter assignment inside to avoid improper memory access in LruCacheShared * http_inspect: disable reg test assertion until interface with stream_tcp is updated * http_inspect: patch around buffer ownership confusion * ips_context: minimize iterations to clear data * ips_options: implement FileTypeOption::hash() and FileTypeOption::operator==(), inherited from IpsOption, using the types bitset array, in order to distinguish between different file type options * loggers: add alert_talos, use in talos tweak * loggers: alert_talos: fix copyright, author, unneeded check * loggers: alert_talos: fix copyright, warnings * loggers: alert_talos: fix cppcheck error * loggers: alert_talos: fix include order * loggers: alert_talos: fix memory leak * loggers: workaround for cppcheck's false warning * lua: make RTF file magic more generic * main: log message when all pthreads started (REG_TEST only) * main: shell commands and signals executed only after snort finish startup * memory: Use only one variable to keep track of allocated and deallocated memory * memory: add configurable L3/L4 specific weights for better estimation against cap * memory: add size_of to various FlowData subclasses * memory: apply fudge factor to tracking to better align with RSS * memory: basic flow data allocation tracking * memory: basic flow pruning * memory: beware the perf_monitor, for she stealeth your numbers * memory: do not re-enter the pruner * memory: fix re-entry check * memory: increase default tcp cache cap weight; fix default values * memory: initial preemptive pruning based on flow data * memory: refactor stats * memory: remove overloading manager to make way for new implementation * memory: remove useless thread local * memory: require subclass implementation of FlowData::size_of() * memory: track session allocations * mime: add file decompression * misc: fixed warnings generated from latest gcc * packet tracer: initialize sf_ip structs * policy: allow an empty policy be set explicitly assigned to it * policy: Rename TRUE/FALSE to ENABLE/DISABLED * port_scan: Fail reload if memcap changed * profile: convert remaining layer 2 or greater profile scopes to the deep, dark underbelly * profiler: add quick exit if not configured to minimize overhead * profiler: add quick exit if not configured to minimize overhead (rule times) * protocols: fix style warning non-boolean value returned * react: sending reset to server only * regex_offload: fix stats for thread * reload: differentiate between restart required and bad config * reload: fail reload if stream is in the original config and stream_* is added/removed * reload: prompt reload failure and require restart when stream cache were changed * reload: send reload completed message to control channel instead of logging it * rule eval: ensure leaf children are properly counted * rule_state: add rtn but disable if block is set on non-inline deployment * rule_state: added default rule state to ips policy * rule_state: added per-ips-policy rule states * rules: do not preallocate actions * safec: Update to work with modern versions of LibSafeC * sfip: add a FIXIT for checking that the current implementation of _is_lesser(), which only compares same-family ips is OK * sip: update sip options to use has_tcp_data instead of is_tcp * snort2lua: Create dev_notes.txt for sticky buffers * snort2lua: adding when.role for specific inspectors * snort2lua: change the -l short option to --dont-convert-max-sessions * snort2lua: combining multiple zone in one binder rule * snort2lua: comment gid 147 file rules * snort2lua: convert file_capture config options * snort2lua: do generate the tcp_cache instance even when we don't convert tcp_max to max_sessions * snort2lua: do not translate max_sessions from snort.conf to snort.lua * snort2lua: fix pcre option issues * snort2lua: fix sticky buffer duplication * snort2lua: fixed duplication of split_any_any from config: detection * snort2lua: introduce command line option -l to suppress conversion of max_tcp, max_udp, max_icmp and max_ip to max_sessions * snort2lua: move obfuscate_pii to the ips table from the output table * snort_config: Add a setter for setting run_flags and set it to TRACK_ON_SYN for hs_timeout config * ssl: Count calls to disable_content for ssl sessions * stream: Change StreamSplitter::scan to take a Packet instead of a Flow * stream: Pass Packet in flush_pdu_* -> paf_eval -> paf_callback chain * stream: fixed ignore_flow segfault bug caused by allocating generic flow data instead of inspector specific flow data * stream: log StreamBase::config in StreamBase::show() * stream: purge remaining flows before shutdown counts * stream_tcp: add track_only to disable reassembly * stream_tcp: consolidate segment node and data * stream_tcp: disambiguate seglist trace * stream_tcp: do not purge partially acked segment * stream_tcp: fix up stream order flags * stream_tcp: fixup allocation tracking for overlapped segments * stream_tcp: implement reserve seglist * stream_tcp: initialize priv_ptr for pdus * stream_tcp: patch around premature application of delayed actions that yoink the seglist * stream_tcp: remove seglist node cruft * stream_tcp: reset paf segment when switching splitters * stream_tcp: simplify paf init * stream_tcp: support unidirectional flushing similar to Snort 2 * stream_tcp: tweak PAF scanning * stream_tcp: tweak ips mode flushing * stream_udp: ensure all flows are cleared fully * time: Adding timersub_ms function to return timersub in milliseconds 2018-12-06: build 250 * actions: Fix incorrect order of IPS reject unreachable codes and adding forward option * active: added peg count for injects * active, detection: active state is tied to specific packet, not thread * appid: Don't build unit test components without ENABLE_UNIT_TESTS * appid: Fix heap overflow issue for a fuzzed pcap * build: accept generator names with spaces in configure_cmake.sh * build: clean up additional warnings * build: fix come cppcheck warnings * build: fix some int format specifiers * build: fix some int type conversion warnings * build: reduce variable scope to address warnings * detection: enable offloading non-pdu packets * detection, stream: fixed assuming packets were offloaded when previous packets on flow have been offloaded * file_api: choose whether to get file config from current config or staged one * file: fail the reload if capture is enabled for the first time * framework: Clone databus to new config during module reload * loggers: Use thread safe strerror_r() instead of strerror() * main: support resume(n) command * managers: update action manager to support reload * module_manager: Fix configuring module parameter defaults when modules have list parameters * parameter: add max31, max32, and max53 for int upper bounds * parameter: add maxSZ upper bound for int sizes * parameter: build out validation unit tests * parameter: clean up some signed/unsigned mismatches * parameter: clean up upper bounds * parameter: remove arbitrary one day limit on timers * parameter: remove ineffective -1 from pcre_match_limit* * parameter: reorgranize for unit tests * parameter: use bool instead of int for bools * parameter: use consistent default port ranges * perf_monitor: Actually allow building perf_monitor as a dynamic plugin * perf_monitor: fix benign parameter errors * perf_monitor: fixed fbs schema generation when not building with DEBUG * protocols: add vlan_idx field to Packet struct and handle multiple vlan type ids; Thanks to ymansour for reporting the issue * regex worker: removed assert that didn't handle locks cleanly * reputation: Fix iterations of layers for different nested_ip configs and show the blacklisted IP in events * sip: Added sanity check for buffer boundary while parsing a sip message * snort2lua: add code to output control = forward under the reject module * snort2lua: Fix compiler warning for catching exceptions by value * snort2lua: Fix pcre H and P option conversions for sip * snort: add --help-limits to output max* values * snort: Default to a snaplen of 1518 * snort: fix command line parameters to support setting in Lua; Thanks to Meridoff for reporting the issue * snort: remove obsolete and inadequate -W option; Thanks to Jaime González for reporting the issue * snort: terminate gracefully upon DAQ start failure; Thanks to Jaime González for reporting the issue * so rules: add robust stub parsing * stream: fixed stream_base flow peg count sum_stats bug * stream tcp: fixed applying post-inspection operations to wrong rebuilt packet * stream tcp: fixed sequence overlap handling when working with empty seglist * style: clean up comment to reduce spelling exceptions * thread: No more breaks for pigs (union busting) * tools: Install appid-detector-builder.sh with the other tools; Thanks to Jonathan McDowell for reporting the issue 2018-11-07: build 249 * appid: Fixing profiler data race and registration issues * appid: make third party appid stats configurable * appid: Remove detector flows from the list for faulty lua detectors * build: remove dead code * build: support dynamic imap, pop, and smtp * comments: additional cleanup * comments: delete obsolete comments * comments: fixup format, spelling, priority, etc * comments: remove XXX and convert to FIXIT where appropriate * connectors: Fix TCP connector unit test compilation on Alpine Linux (musl) * cppcheck: cleanup some warnings * dcerpc: fixed build warning with struct packing * dcerpc: fixed setting endianness on one packet and checking on another * detection : add function to clear ips_id from unit tests * detectionengine: Only clear inspector data after offloads have completed * detection/http_inspect: Save a snapshot HTTP buffers in the IPS context to support offload of HTTP flows * doc: Adding performance consideration for developers * file_api: revert deleting gid 146 so existing 146 rulesets dont attempt empty rule eval * fixits: prioritize for RC * flow: fixed build warning * flow: track multiple offloads * fp_detect: onload before running local to ensure event ordering * framework: replace the newly introduced loop to reset the reload_type flags with the existing Inspector::update_policy function * framework: set the reload_type flags to RELOAD_TYPE_NONE at the end of reload, in anticipation of future reloads * host_tracker: fixed uppcase IP param issue * http2_inspect: Change http2 GID from 219 to 121 * ips_flowbits: move static structures to snort config * main: initialize shell_map and other maps in PolicyMap::clone() * main: size analyzer notification ring appropriately * manual: fix some typos * mime: made the mime hdr info and current search thread local * mime: move the decode buffer used by mime attachments to mime context data * packet_tracer: can't emplace vector until c++14 * parser: bad filename during reload is not a fatal error * perfmon: fix issue for report correct stats after passing -n pkts * perf_monitor: trackers keep copy of the relevant config items from the inspector * reload: fixed smtp seg fault when reload failed * reputation: delete old conf before allocating a new one in ReputationModule::begin() if conf not null * rule_state: indicate list format * search_tool: include bytes searched in pattern match stats * search_tool: validate ac_full and ac_bnfa wrt search and search_all * snort2lua: Add support for enable/disable iprep logging using suppress mechanism * snort2lua: Avoid returning reference of local variable * snort2lua: comment out deleted gid 146 rules * snort2lua: Enable address_anomaly_detection during snort2lua and fixed missing string sanity checks * snort2lua: fixed paf_max to stream_tcp.max_pdu convertion * snort2lua: tweak for style consistency * snort: add --rule-path to load rules from all files under given dir * snort: Code refactoring - replacing push_back/insert by emplace_back/emplace, keeping reputation_id in flow instead of flow_data, and appid code improvements * source: fix some typos * source: minor refactoring * spell: fix typo * stream, detection, flow: don't force onloads between pdus unless absolutey necessary * stream: fixed build warning * stream: only delete flows after all onloads * stream tcp: don't delete flow data on rst, let session close handle it * textlog: removed unused TextLog_Tell function * thread_idle: call timeout flows with packet time for pcap replay * utils: fixed deprecation build warning on register keyword 2018-09-26: build 248 * appid: adding detector builder and fixing stats to recognize custom appid; Thanks to Wang Jun for reporting the issue * appid: fixing ubuntu check tests * appid: fix valgrind issues in SIP event handler * appid: FreeBSD unit-test fix * appid: supporting pub-sub mechanism for app changes * build: add libnsl and libsocket to Snort for Solaris builds * build: fall back on TI-RPC if no built-in RPC DB is found * build: introduce a more robust check for GNU strerror_r * daqs: include unistd.h directly for better cross-platform compatibility * dce_rpc: add DCE2_CO_REM_FRAG_LEN_LT_SIZE (133:31) to the TCP rule map * dce_rpc: add DCE2_SMB_NB_LT_COM (133:11) to the SMB rule map * detection: added post-onload callbacks * detection: allocate ips context data using hard coded max_ips_id == 32 * detection: don't use s_switcher to get file data * detection: run active actions at onload * detection: use packet to reference context * file_api: fix off-by-one bug that was hurting performance * file_api: move the check on REJECT or BLOCK inside an upper if clause for performance reasons * file_api: set disable flow inspection as soon as the verdict is REJECT * file_api: treat a BLOCK verdict the same as a REJECT verdict, for good measure * http_inspect: split and inspect immediately upon reaching depth * latency: added cleanup for RegexOffload threads * lua: changing default FTP EPSV string format * main: pause-after-n support * managers: handle tinit for inspectors added during reload * managers: if a plugin doesn't have tinit, still mark it as initialized * reputation: early return on parsing error causing uninitialized id * reputation: fix SI doesn't block traffic if Any Zone is specified 2018-08-27: build 247 - Beta * appid: change map to unordered map * appid: declare SMTPS early in STARTTLS state on success response code * appid: fix data-race issues from ips_appid_option and improve app_name search * detection: avoid repeating detection by always doing non-fast-pattern rules immediately (applies to experimental offload only) * docs: update default html, pdf, and text user manuals * reputation: reevaluate current flows upon reload * stream_tcp: avoid duplicating split sement data * build: removing use of u_char and u_short macros (github #53) 2018-08-13: build 246 * active: Add an upper limit of 255 to min_interval * appid: Avoid snort crash upon lua file errors * appid: Fixes for TNS, eDonkey, and debug logs in Lua detectors * appid: Single lua-state per thread * appid: code clean-up * appid: create developer notes document * appid: make the code compatible with the latest version of snort2 * appid: refactor detector initialization * appid: fix multithreading issues (data races) from app_forecast * appid: many other updates * binder: Make two passes at binder rules - one for policy IDs and then everything else * binder: Refactor binder as a passive, event-driven inspector * byte_test: update operator parsing, remove dead code * catch: Update to Catch v2.2.3 * codecs: Handle raw IP packets in Snort proper * codecs: fix dynamic build of root codecs * decode: alternate checksum calculation to improve runtime performance * detection: don't offload when 0 threads are configured * detection: save the ropts used for dce rule options in ips context to support offload * detection: various bug fixes for offload emulation * doc: Update regarding the build issue with --enable-tcmalloc flag and known workarounds * doc: added active response section to user manual * doc: corrections to tutorial section * doc: update known problems * events: remove manager cruft * file_id: fix uninitialized * file_magic: Update file_magic.lua to cover all file types and versions * framework: Enable dynamic building of ips_{pcre,regex,sd_pattern} + Hyperscan MPSE * framework: Scratch handlers for SnortState * framework: fixed adding probe to wrong SnortConfig * http_inspect: URI normalization added to dev_notes * http_inspect: add perfmon to splitter * http_inspect: bug fix and cleanup * http_inspect: memory reduction and misc cleanup * http_inspect: renumbered events to avoid current and future conflicts with Snort 2.X * inspector: Rename ::update() to ::remove_inspector_binding() to better reflect what it does * ips: Remove unused IPS module stats * ips_fragbits: Removed dead code * packet_tracer: Report user policy IDs and add network policy * parser: reset parse error count before reload to avoid confusion * perf_monitor: fix for reload * perf_monitor: format error in dev_notes * policy: Add the ability to set network policy based on user-specified ID * policy: Export querying policies by user ID and setting runtime policies * profiler: Don't clobber max entry count when recursing * reload: do not set policies for incremental reload case * reload: set policies upon swap to avoid dangling pointers when idle * reputation: make sure reputation inspector is called in default policy * reputation: support reload module * sfip: if ips_policy doesn't exist, allow for ipvar parsing without vartable * sip: Ported sip-splitter implementation from snort2 * snort.lua: add inline tweaks * snort.lua: add talos defaults * snort.lua: fix tweaks path; Thanks to brastult@cisco.com for reporting the issue * snort.lua: fix community rules filename; Thanks to mike@flyn.org for reporting the issue * snort2lua: Handle sidechannel config * snort2lua: add conversion for shared memory * snort2lua: added missing keyword to nap parsing * snort2lua: don't try to index into empty lines * snort2lua: fixed nap ip parsing * snort2lua: merge multiple nap rules with the same id * snort2lua: translate file_type rule option * snort: match delete[] with new[] * snort: wrap snort SO_PUBLIC symbols in the snort namespace * ssh: added test code * stream_ip: match delete[] with new[]; don't create zero length trackers * stream_tcp: 86 r_nxt_ack as tracker state for next rx seq, use rcv_nxt instead * stream_tcp: back out fin handling changes for bug not relevant to snort3 * tcp_connector_test: fixed version-sensitive build problem 2018-05-21: build 245 * CodecManager: removed unused code * DataBus: fixed creating DataHandler when one doesn't exist * Debug messages: cleanup for service inspectors. New traces for detection, stream * Debug: Final debug messages cleanup, removal of macros from snort_debug * Ipv4Codec: removed random ip id pool and replaced randoms on demand * PacketManager: moved encode storage to heap * PerfMonitor: fixed subscribing to flow events multiple times * ProtoRef: Converge on single name for SnortProtocolId. Fix threading problems * Reset: Always queue reject and test packet type in RejectAction::exec * SFDAQModule: moved daq stats here. fixed stats not being output from perfmon * Snort2lua: Add ftp_data to multiple files when needed, once per file * Snort2lua: Translate ftp_server relative to default configurations * Snort: moved s_data to heap * active: Enable when max_responses is enabled * alert: moved alert json. unixsock out from extra to snort3 * appid: Add AppID debug command * appid: Enable Third-Party Code for Packet Processing * appid: Fix bug where Service and Application ID's set to port number instead of service appid * appid: Fixing service discovery states * appid: Only import dynamic detector pegcounts once * appid: Refactor debug command * appid: Refactor debug command, use SfIp, and fix non-Linux compilation * appid: Third party integration support * appid: appid session unit test changes * appid: change metadata buffers from std::string to pointers, to avoid extra copying * appid: clean-up code for performance and implement is_tp_processing_done() * appid: create referer object only for non-null string * appid: do not inspect out-of-order flows, ignore zero-payload packets for client/service discovery * appid: fix memory leak in appid_http_event_test and warning in appid_http_session.cc * appid: fix segfault due to dereferencing null host pointer * appid: fix tabs and indentation * appid: fixed http fields, referer payload and appid debug * appid: make tp_attribute_data more localized, so we only allocate/deallocate it if needed * appid: moved HttpFieldIds to appid_http_session * appid: peg count / dynamic peg count update. Split peg counts into the ones known at compile time and dynamic ones. Update stats , module manager and module to support dumping dynamic stats * appid: report when third party appid is done inspecting * appid: sip: moved pattern thread local to class instance * base64_decode: moved buffer storage to regular heap * binder: Fix UBSAN invalid value type runtime error * build: 244 * build: Add --enable-ub-sanitizer option for undefined behavior sanitizer * build: Add some header includes for FreeBSD * build: Clean up CMake string APPENDing for configure options * build: Clean up HAVE_* definition checks * build: Define NDEBUG if debugging is not enabled * build: Fix building unit tests on FreeBSD * build: Modernize code with =default for special member functions * build: Modernize code with virtual/override/final cleanups * build: Remove bashisms from most shell scripts * build: add cmake configure switches for NO_PROFILER, NO_MEM_MGR and DEEP_PROFILING * build: add disable-docs to disable doc build * build: fix various drops const qualifier cases * build: fix various warnings: * build: propogate snort3 tsc build option to the extra build system * byte_extract: fix cursor update * byte_jump: fix from_beginning * byte_math: allow rvalue == 0 except for division * catch: Update to Catch v2.2.1 * clock: Allow use of ARM64 CNTVCT_EL0 register for timing (#46); Thanks to j.mcdowell@titan-ic.com for the patch * clock: use uint64_t with tsc clock instead of std::chrono for performance * cmake: Add --enable-appid-third-party to configure_cmake.sh * cmake: Add support for building with tcmalloc * cmake: Rework FindPCAP logic and ignore SFBPF * cmake: fixed checks for functions * cmake: update for iconv * codecs: add config option to detection to enable check and alert for address anomalies * daq_hext: Make IpAddr() static to fix compiler warning * dce_co_process_ctx_id needs to update its caller's (DCE2_CoCtxReq) frag_ptr as it is called in a loop in order to parse each dce/rpc ctx item, otherwise it ends up parsing the same ctx item over and over * dce_rpc: fix parsing of dce/rpc ctx items * dce_rpc: pass frag_ptr by reference * debug: Remove debug messages from appid, arp_spoof, and perf_monitor * debug: Remove debug messages from detection and ips_options * debug: Remove debug messages from stream * decompress/file_decomp_pdf.cc: implicit fallthrough * detect: moving thread locals identified to ips context * detection: fixed uninitialized MpseStash * doc: add doc for module trace * encoders: fixed off-by-one error in underlying buffer handling * extra: Port some CMake options from Snort prime * extra: splitted extra out to snort3_extra repo * file_api: combine file cache for file resume and partial file processing * file_connector: Fix address-of-packed-member compiler warnings * file_decomp_pdf.cc: unreachable code return * file_type: Require strings instead of integers for types. Handle versions * flow: SO_PUBLIC FlowKey * framework: align PktType and proto bits * framework: remove bogus PktType for ARP and just use proto bits instead * ftp_server: Added Flow::set_service and fixed FtpDataFlowData::handled_expected * ftp_server: Added ability get TCP options length from TcpStreamSession * ftp_server: Added accessors to Stream so TcpStreamSession can be private * ftp_server: Base last_seg_size off of MSS * ftp_server: Provide FLOW_SERVICE_CHANGE pub/sub event * ftp_server: ftp_server requires that ftp_client and ftp_data be configured * hashfcn: Fix UBSAN integer overflow runtime error * hashfcn: Fix UBSAN left shift of negative value runtime error * http_inspect: broken chunk performance improvement * http_inspect: bugfix and new alert for gzip underrun * http_inspect: embedded white space in Content-Length * http_inspect: handling of run-to-connection-close bodies beyond depth * http_inspect: know more Content-Encodings by name * http_inspect: patch around regression failures until a permanent solution is implemented * http_inspect: performance enhancements for file processing beyond detection depth * ip: replaced REG_TEST with -H option for ipv4 codec fixed seed * ips_byte_jump: Fix UBSAN left shift of negative value runtime error * ips_byte_math: Fix UBSAN left shift of negative value runtime error * ips_flags: remove dead code * javascript: moved decode buffer to stack * memory: disable with -DNO_MEM_MGR * memory_manager.cc: dangling references * packet_capture, cmake: Remove SFBPF dependencies * packet_capture: adding analyzer command to initialize dump file * packet_tracer: Fix compiler warning when compiling with NDEBUG * packet_tracer: Modularize and add constraint-based shell enablement * parameter: Fix UBSAN shift exponent is too large for 32-bit type runtime error * parser: allow arbitrary rule gids * pop, imap, and smtp: changes to MIME configuration parameters * port_scan: include open ports with alerts instead of separate * profile: disable with -DNO_PROFILER * profiler: add deep profiler option * reload: enabled reloading ips_actions; added parse error check for reloading * repuation: remove the limit for zone id * reputation: add zone support * search_engine: revert default detect_raw_tcp to false * service inspectors: debug cleanup * sfip: A version of set() which automatically determines the family * sfip: removed ntoa. use ntop(SfIpString) instead * snort2lua: Add reject action when active responses is enabled * snort2lua: conversion of gid 120 to 119 * snort2lua: enable reject action when firewall is enabled * snort: -r- will read packets from stdin * spell check: fix memeory and indicies typos * steam_tcp: change singleton names from linux to new_linux to avoid spurious collisions with defines * stream ip: refactored to use MemoryManager allocators * stream: assume gid 135 so those rules are handled as standard builtins * stream: be selective about flow creation for scans * stream: refactor flow control for new PktTypes * stream: remove usused ignore_any_rules from tcp and udp * stream: respect tcp require_3whs * stream: warning: potential memory leaks * stream_tcp: refactor tcp normalizer and reassembler to eliminate dynamic heap allocations per flow * stream_tcp: switch to splitter max * stream_tcp: tweak seglist cursor handling * target_based: 100% coverage on snort_protocols.cc * target_based: unit tests for ProtocolReference class * tcp codec: count bad ip6 checksums correctly; Thanks to j.mcdowell@titan-ic.com for reporting the issue * tcp: allow data handlding for packet with invalid ack * time: initialize Stopwatch::start_time member variable to 0 ticks when TSC clock is enabled * trace: add traces for deleted debug messages * wizard: Fix UBSAN out-of-bounds access runtime error * zhash: cleanup cruftiness 2018-03-15: build 244 * appid: unit-tests for http detector plugins * build: address compiler warnings, spell check and static analyzer issues * build: extirpate autotools usage * build: fix compilation issue on FreeBSD with extra * byte_jump: updated byte_jump post_offset option to support variable * cmake: update CMake config to use GNUInstallDirs and match automake * daq: hext DAQ can generate start of flow and end of flow meta events * doc: add documentation for ftp telnet * doc: fix including config_changes.txt when ruby is not present * doc: update ftp time format link * doc: updates for HTTP/2 * http_inspect: handle white space before chunk length * inspectors: probes run regardless of active policy * logger: update Hext Logger to subscribe and log DAQ Meta Packets * main: reload hosts while reloading config * memory: override C++14 delete operators as well * packet tracer: added ability to direct logging to file * perf_monitor: fixed flow_ip outputting erroneous values * perf_monitor: query modules for stats only after they have all loaded * snort: --rule-to-text [] raw string output * snort: allow colon separated directories for --daq-dir * snort: wrap SO_PUBLIC APIs (classes, functions exported public from snort) in the 'snort' namespace 2018-02-12: build 243 * build: enable gdb debugging info by default * build: fix cppcheck warnings * build: fix static analysis issue * comments: fix 6isco typos * copyright: update year to 2018 * detection: use detection limit (alt_dsize) * detection: trace fast pattern searches with 0x20 * detection: do not change search_engine.inspect_stream_inserts configuration * doc: update default manuals * flow: support episodic detection * help: upper case proto acronyms etc * http_inspect: apply request/response depth to packet data * http_inspect: suppress raw packet inspection beyond request/response depth * main: Export AnalyzerCommand and main_broadcast_command() * rules: fix path variable expansion * search_engine: rename inspect_stream_inserts to detect_raw_tcp for clarity default to true for 2.X rule sets * rules: update fast pattern selection to exclude redundant port groups when service groups are present * wizard: count user scans and hits separate from tcp 2018-01-29: build 242 * build: add STATIC to add_library call of port_scan to build it statically otherwise link will fail (Makefile.am already build only the static version); Thanks to Fabrice Fontaine * doc: update snort2lua for .rules files * doc: fixed some typos * expect: removed a single-element structure ExpectFlows * file_api: give FilePolicyBase a default virtual destructor * file: gracefully handle not having file policy configured in dce_smb * flow: provided access to all expected flows created by a packet * inspection events: added mandatory expected flow pub sub support * inspector_manager: fix acquire and use of default policy * profiler: fixed missing include * sfdaq: export can_whitelist() and modify_flow_opaque()file_api: move VerdictName array out of file_api.h * snort2lua: fix file_rule_path and fw_log_size handling in firewall preprocessor * snort2lua: make sure file_magic table comes before file_id table * snort2lua: detect commented 'alert' rules and convert them from snort to snort3 format Leave the rules commented out in the snort3 rules file * snort2lua: convert *.rules files line-by-line * unit tests: updated Catch * unit tests: added ability to run Catch tests from dynamic modules * utils, flatbuffers: added a uniform interface for 64-bit endian swaps 2017-12-15: build 241 * add back the ref count for file config * alert_csv: various fixes to match alert_json * alert_json: tcp_ack, tcp_seq, and tcp_win are (base 10) integers * alert_json: various fixes; Thanks to Noah Dietrich for reporting the issues * appid: close all Lua states when thread exits * appid: gracefully handle failed Lua state instantiation; Thanks to Noah Dietrich for reporting the issue * appid: only update session flags and discovery state if service id actually set to http * appid: patch to update the appid discovery state when an http event results in setting of the service id for a flow * appid: return false from is_third_party_appid_available when no third party module is available * appid: tweak warnings and errors * binder: activate profiler support * binder: add FIXIT re creating default bindings when the wizard is not configured * binder: fix ingress / egress test * binder: minor perf and readability tweaks * build: fixed build issues on OSX with clang with cd_pbb, alert_json * build: fixed several dyanmic modules on OSX / clang * build: suppress appid warnings for valid case statement fall throughs * byte_test: fix string bounds check * catch: Update to Catch v2.0.1 * cmake: add --define to configure_cmake.sh for arbitrary defines * codec: added wlan support for arp_spoof * codec: updated MIPv6 and merged cd_pim.cc, cd_swpie.cc and cd_sun_ud.cc to cd_bad_proto.cc * conf: remove OPTIONS from SIP and HTTP spells to avoid confusion with RTSP * conf: remove client to server spells for FTP, IMAP, POP, and SMTP to avoid false pickups * control: must execute from default policy only * control: process flow first * cppcheck: More miscellaneous fixes, mostly for new Catch * daq: explicitly initialize more fields in SFDAQInstance constructor * daq: handle real IP and port * data_bus: also publish to default policy * data_bus: refactor basic access for pub / sub * dce: use service names from rules (dce_smb = netbios-ssn; dce_tcp / dce_udp = dcerpc) * detection: fix option tree looping issue * detection: rename ServiceInfo to SignatureServiceInfo * doc: fix type in style section * doc: update default manuals * file api: move file verdict enforcement out of file policy * file api: support file verdict delay during signature lookup * file policy and file config update to allow user define customized file policy through file api * file policy: add support for file event logging * file_api: Set the FileContext verdict, not a local verdict * file_id: add interface to access file info from file capture * file_id: support groups * hash: Rename SFGHASH, SFXHASH, SFHASHFCN to something resonable * http_inspect: add profiler support * http_inspect: fix bugs related to stream interaction * http_inspect: use configured max_pdu as base target reassembly size * inspection: default policy mode depends on adaptor mode * ips options: error if lookup fails due to bad case, typos, etc; Thanks to Noah Dietrich for reporting the issue * memory: no stats output unless configured * normalizer: added test mode * normalizer: fix enable checks * parsing: resolve paths from the current config directory instead of process directory * policy: added inspection policy config * port_scan: add alert_all to make alerting on all events in window optional * port_scan: fix flow checks * profiler: fix focus of eventq * reputation: tweak warning message * rules: default msg = "no msg in rule" * sfrt: remove cruft and reformat header * shell: fixed crash when issuing control commands * sip: use log splitter for tcp * snort2lua: --bind-wizard will add a trailing binding to the default wizard in each binder * snort2lua: Convert file_magic.conf to Lua format * snort2lua: added inspection uuid * snort2lua: added na_policy_mode. added ability amend tables if created * snort2lua: added normalize_tcp: ftp * snort2lua: fix stream_size: to_client, to_server conversion * snort2lua: future proof --bind-wizard binding order * snort2lua: no sticky buffer for relative pcre * snort2lua: remove when udp from binding to support tcp too * snort2lua: tweak const name for clarity (internal) * snort2lua: urilen:<> --> bufferlen:<=> * snort: do not dlclose plugins at shutdown during REG_TEST to avoid borked backtraces from LeakSanitizer * soid: allow stub to contain any or all options --rule-to-*: use whole soid arg as suffix to rule and len identifiers; make static * stream: change tcp idle timeout to 3600 to match 2.X nominal timeout * stream_*: separate session profiler data from flow cache profiler data * stream_ip: fix non-frag counting * stream_size: fix eval packet checks * stream_tcp: delete superfluous memsets to zero * stream_tcp: ignore flush requests on unitialized sessions (early abort condition) * stream_tcp: instantiate wizard only when needed * stream_tcp: remove empty default state action * stream_user: clear splitter properly * target_based: Install header * wizard: abort if no match * wizard: activate profiler support * wizard: usage is inspect 2017-10-31: build 240 * active: fix packet modify vs resize handling * alert_csv: rename dgm_len to pkt_len * alert_csv: add b64_data, class, priority, service, vlan, and mpls options * alert_json: initial json event logger * alerts: add log_references to store and log rule references with alert_full * appid: enable SSL certificate pattern matching * appid: fix build with LuaJIT 2.1 * appid: reorganize AppIdHttpSession to minimize padding * appid: add count for applications detected by port only * appid: create exptected flow immediately after ftp PORT command for active mode * appid: handle sip events before packets * appid: overhaul peg counting for discovered appids * appid: use ac_full search method since it supports find_all; force enable dfa flag * binder: added network policy selection * binder: added zones * binder: allow src and dst specifications for ports and nets * binder: check interface on packet instead of flow * binder: fixed nets check falling through on failure * build: clean up a few ICC 2018 and GCC 7 warnings * build: fix linking against external libiconv with autotools * build: fix numerous analyzer errors and leaks * build: fix numerous clang-tidy warnings * build: fix numerous cppcheck warnings * build: fix numerous valgrind errors * build: fixed issues on OSX * catch: update to Catch v1.10.0 * cd_icmp6: fix encoded cksum calculation * cd_pbb: initial version of codec for 802.1ah; Thanks to jan hugo prins for reporting the issue * cd_pflog: fix comments; Thanks to Markus Lude for the 2X patch * content: fix relative loop condition * control: delete the old binder while reloading inspector * control: update binder with new inspector * daq: add support for DAQ_VERDICT_RETRY * daq: add support for packet trace * daq: add support tunnel bypass for IP 4IN4, IP 6IN6, GRE and MPLS by config and flags * data_log: update to new http_inspect * dce_rpc: remove connection-oriented rules from dce_smb module * dce_smb: unicode filename support * doc: add module usage and peg count type * doc: add POP, IMAP and SMTP to user manual features * doc: add port scan feature * flow key: support associating router solicit/reply packets to a single session * http_inspect: HTTP headers no longer avoid detection when message unexpectedly ends after status line or headers * http_inspect: add random increment to message body division points * http_inspect: added http_raw_buffer rule option * http_inspect: create message sections with body data that has been dechunked and unzipped but not otherwise nortmalized * http_inspect: handle borked reassembly gracefully; Thanks to João Soares for reporting the issue * http_inspect: support for u2 extra data logging * http_inspect: test tool improvements * http_inspect: true IP enhancements * inspectors: add control type and ensure appid is run ahead of other controls * inspectors: add peg count for max concurrent sessions * ips: add uuid * loggers: add base64 encoder based on libb64 from devolve * loggers: use standard year/mon/day format * main: fix potential memory leak when queuing analyzer commands * memory: align allocator metadata such that returned memory is also max_align_t-aligned * memory: output basic startup heap stats * messages: output startup warnings and errors to stderr instead of stdout * messages: redirect stderr to syslog as well * modules: add usage designating global, context, inspect, or detect policy applicability * mss: add extra rule option to check mss * parser: disallow invalid port range !:65535 (!any) * parser: tweak performance * pcre: fix relative search with ^ * pop: service name is pop3 * replace: fix activation sequence * rules: warn only once per gid:sid of no fast pattern * search_engine: port the optimized port table compilation from 2.9.12 * search_engines: Fix case sensitive ac_full DFA matching * shell: delete inspector from the default inspection policy * shell: fix --pause to accept control commands while in paused state * sip: sip_method can use data from any sip inspector of any inspection policy * snort.lua: align default conf closer to 2.X * snort.lua: expand default conf for completeness and clarity * snort_defaults.lua: update default servers and ports * snort2lua: correctly identify ftpbounce and sameip as unsupported rule options * snort2lua: added XFF configuration to unsupported list * snort2lua: added config protected_content to deleted list * snort2lua: added config_na_policy_mode to unsupported list * snort2lua: added dynamicoutput to deleted list * snort2lua: added firewall to unsupported list * snort2lua: added nap.rules zone translation * snort2lua: added nap_selector support * snort2lua: added nap_selector to unsupported list * snort2lua: added sf_unified2 to unsupported list and matching log/alert to deleted * snort2lua: bindings now merge and propagate to top level of corresponsing policy * snort2lua: config policy_id converts to when ips_policy_id * snort2lua: convert dsize:a<>b to dsize:a<=>b for consistency with other rule options * snort2lua: do not convert sameip; handle same as ftpbounce (no longer supported) * snort2lua: enforced ordering to bindings in binder table * snort2lua: fix null char in -? output * snort2lua: fixed extra whitespace generation * snort2lua: logto is not supported * snort2lua: removed port dce proxy bindings to fix http_inspect conflicts * snort2lua: search_engine.split_any_any now defaults to true * snort: -T does not compile mpse; --mem-check does * snort: add warnings count to -T ouptut * snort: add --dump-msg-map * snort: exit with zero from usage * snort: fix --dump-builtin-rules to accept optional module prefix * stdlog: support snort 3> log for text alerts * target: add rule option to indicate target of attack * thread: add logging directory ID offset controlled by --id-offset option * u2spewfoo: fix build on FreeBSD * unified2: add legacy_events bool for out-of-date barnyard2 * unified2: log buffers as cooked packets with legacy events * wscale: add extra rule option to check tcp window scaling 2017-07-25: build 239 * rules: remove sample.rules; Talos will publish Snort 3 rules on snort.org * logging: fix handling of out of range timeval; Thanks to kamil@frankowicz.me for reporting the issue * wizard: fix direction issue * wizard: fix imap spell 2017-07-24: build 238 * check: update hyperscan and regex tests * cpputests: clean up some header include issues * daq_socket: update to support query of pci * detection: fix debug print of fast pattern only * detection: rule evaluation trace utility * doc: update concepts and differences * file_api: memory leak fixed * file_id: fixes for file capture exit * http_inspect: added 119:97 for lower case letters in version field * http_inspect: alert 119:96 added for unsolicited 206 response * http_inspect: specific alert added 119:95 for Content-Encoding chunked * ipv6: fix flow label access method; Thanks to schrx3b6 for the patch * loggers: remove units options; all limits expressed in MB * mpse: Remove Intel Soft CPM support * mpse: make regex capability generic * mpse: only use literals for fast patterns if search_method is not hyperscan * output: add packet trace feature * perf_monitor: fixed main table (perf_monitor) having same name as pegs for * perfmon field * regex: fix pass through of mpse flags to hyperscan * replace: do not trip over fast pattern only * rpc: revert to positional params, fix tcp logic, clean up formatting * rules: promote metadata:service to a separate option since it is not metadata * snort2lua: Fixed incorrect file names errors * snort2lua: move footprint to stream from stream_tcp * spell check: fix message and comment typos * stream: add ip_proto as part of flow key * stream: fix user dependency on flush bucket * text logs: fix default unlimited file size * u2: add event3 to u2spewfoo * u2: convert thread local buffers to heap * u2: deprecate ip4 and ip6 specific events and add a single event for both * u2: remove obsolete configurations * u2: support mixed IP versions 2017-07-13: build 237 * build: add support for appending EXTRABUILD to the BUILD string * build: Clean up some ICC 2017 warnings * build: clean up some GCC 7 warnings * build: support OpenSSL 1.1.0 API * build: clean up some cppcheck warnings * appid: port some missing 2.9.X FEAT_OPEN_APPID code * appid: fix thread-unsafe sharing of HTTP pattern tables * DAQ: fix leaking instance memory when configure fails * daq_hext and daq_file: pass PCI via query method * icmp6: reject non-ip6, raise 116:474 * http_inspect: header normalization improvements * http_inspect: port fixes for UTF decoding * http_inspect: added 119:87 - 119:90 for expect / continue issues * http_inspect: added 119:91 for Transfer-Encoding header not valid for HTTP 1.0 * http_inspect: added 119:92 for Content-Transfer-Encoding * http_inspect: added 119:93 for issues with chunked message trailers * PDF decompression: fix missing reset in state machine transition * ftp_server: implement splitter to improve EOF processing * port_scan: merge global settings into main module and other improvements * perf_monitor: add JSON formatter * ssl: add splitter to improve PDU processing * detection: fix segfault in DetectionEngine::idle sans thread_init * rules: tolerate spaces in positional parameters; Thanks to Joao Soares for reporting the issue * ip and tcp options: fix max length handling and clean up logging * cmg: improved alert formatting * doc: updates re control channel * snort2lua: added line number and file name to error output * snort2lua: fix removal of ignore_ports in stream_tcp.small_segments * snort2lua: fix heap-use-after-free for preprocessors and configs with no arguments * snort2lua: update for port_scan 2017-06-15: build 236 * appid: clean up shutdown stats * appid: fix memory leak * conf: update defaults * decode: updated ipv6 valid next headers * detection: avoid superfluous leaf nodes in detection option trees * http_inspect: improved handling of badly terminated chunks * http_inspect: improved transfer-encoding header processing * ips options: add validation for range check types such as dsize * perf_monitor: add more tcp and udp peg counts * perf_monitor: update cpu tracker output to thread_#.cpu_* * port_scan: alert on all scan attempts so blocking is possible * port_scan: make fully configurable * sip: fix get body buffer for fast patterns * ssl: use stop-and-wait splitter (protocol aware splitter is next) * stream_ip: fix 123:7 2017-06-01: build 235 * http_inspect: improve handling of improper bare \r separator * appid: fix bug where TNS detector corrupted the flow data object * search_engine: set range for max_queue_events parameter; Thanks to Navdeep.Uniyal@neclab.eu for reporting the issue * arp_spoof: reject non-ethernet packets * stream_ip: remove dead code and tweak formatting * ipproto: remove unreachable code * control_mgmt: add support for daq module reload * control_mgmt: add support for unix sockets * doc: update default manuals * doc: update differences section * doc: update README 2017-05-21: build 234 * byte_math: port rule option from 2X and add feature documentation * pgm: don't calculate checksum if header length is not divisible by 4 * appid: fix sip event handling, http pattern lists, thread locals * build: fix issues with OpenSolaris and FreeBSD builds * cmake: fix issues with libpcap and miscellaneous * offload: refactor for initial (experimental) version of regex offload to other threads * cmg: revamp hex buffer dump format with 16 or 20 bytes per line * rules: reject positional parameters containing spaces 2017-05-11: build 233 * packet manager: ensure ether type proto ids don't masquerade as ip proto ids; Thanks to Bhargava Shastry for reporting the issue * codec manager: fix off-by-1 mapping array size; Thanks to Bhargava Shastry for reporting the issue * codec: fix extraction of ether type from cisco metadata * appid: add new unit tests to the cmake build, fix missing lib reference to sfip * sfghash: clean up and add unit tests * http: fix 119:38 false positive * main: fix compiler warnings when SHELL is not enabled * perf_monitor: fix flatbuffers handling of empty strings * modbus: port fix for false positives on length field * http: port simple UTF decoding w/o byte order mark * build: updated code to resolve cppcheck warnings * cleanup: fix typos in source code string literals and comments * doc: fix typos 2017-04-28: build 232 * build: clean up Intel compiler warnings and remarks * build: fix FreeBSD compilation issues * cmake: fix building with and without flatbuffers present * autoconf: check for lua.hpp as well as luajit.h to ensure C++ support * shell: make commands non-blocking * shell: allow multiple remote connections * snort2lua: fix generated stream_tcp bindings * snort2lua: fix basic error handling with non-conformant 2.X conf * decode: fix 116:402 * dnp3: fix 145:5 * appid: numerous fixes and cleanup * http_server: removed (use new http_inspect instead) * byte_jump: add bitmask and from_end (from 2.9.9 Snort) * byte_extract: add bitmask (from 2.9.9 Snort) * flatbuffers: add version to banner if present * loggers: build alert_sf_socket on all platforms 2017-04-07: build 231 * add decode of MPLS in IP * add 116:171 and 116:173 cases (label 0 or 2 in non-bottom of stack) * cleanup: remove dead code 2017-03-27: build 230 * require hyperscan >= 4.4.0, check runtime support; Thanks to justin.viiret@intel.com for submitting the patch * fix search tool issue with empty pattern database; Thanks to justin.viiret@intel.com for reporting the issue * fix sip_method to error out if sip not instantiated * major appid overhaul to address lingering concerns: refactor, cleanup, simplify * major detection overhaul to address lingering concerns: refactor, cleanup, release memory ASAP * add FlatBuffers output format to perf_monitor also added tool to convert FlatBuffers files to yaml * add regex.fast_pattern; do not use for fast pattern unless explicitly indicated * update copyrights to 2017 2017-03-17: build 229 * fixed mpse to ensure all search methods return consistent results * updated search tool to use fast pattern config's search method (benefits appid, http_inspect, imap, pop, and smtp) * snort2lua parsing bug fixes to recognize incomplete constructs * http_inspect: added alert 119:81 for nonprinting character in header name * http_inspect: added alert 119:82 for bad Content-Length value * http_inspect: added alert 119:83 for header wrapping; CR and LF parsed as whitespace 2017-03-02: build 228 - Alpha 4 * update hypercsan mpse: print error message and erroneous pattern when compilation fails * update rule parser: add multiple byte orders warning * fix pid file: create regardless of priv drop settings * fix dce_rpc: mark generated iface patterns as literal * snort2lua: mark appid conf and thirdparty_appid_dir as unsupported (temporary) * snort2lua: fix a couple of typos in table API output * snort2lua: fix sticky buffer following uricontent * doc: add DAQ configuration documentation * doc: move LibDAQ README to Reference, update, and fix typos * doc: update default manuals 2017-02-24: build 227 * allow arbitrary / unused gids in text rules * support DAQs w/o explicit sources (nfq, ipfw) * fix up peg help (remove _) * fix u2 logging of PDUs 2017-02-16: build 226 * add PDF/SWF decompression to http_inspect * add connectors to generated reference parts of manual * add feature documentation for HA, side_channel, and connectors * add feature documentation for http_inspect * update default manuals * fix privilege dropping and chroot behavior * fix perf_monitor segfault when tterm is called before tinit * fix stream_tcp counter underflow bug and handle max and instant stats * fix lzma length calculation bug * fix bogus 129:20 alerts * fix back orifice compiler warning with -O3 * fix bug that could cause hang on ctl-C * fix memory leak after reload w/o changing search engine * fix off by one error when reassembling after TCP FIN received * fix cmake doc build to include plugins on SNORT_PLUGIN_PATH * fix compiler warnings in dce_http_server and dce_http_proxy * fix appid reload issue * snort2lua - changes for rpc over http * snort2lua - changes to convert config alertfile: * snort2lua - changes to add file_id when smb file inspection is on * snort2lua - add deprecated option stream5_tcp: log_asymmetric_traffic 2017-02-01: build 225 * implement RPC over HTTP by adding dce_http_server and dce_http_proxy * port disable_replace option from snort 2.x and add snort2lua support * port ssh tunnel over http detection * fix stream splitter handling during final flush of session data * fix appid to use HTTP inspection events to detect webdav methods * fix unit test build to work w/o REG_TEST * fix shell to add missing newline to Lua execution error responses * fix support for content strings with escaped quotes ("foo\"bar"); Thanks to secres@linuxmail.org for reporting the issue * fix various reload issues * fix various thread sanitizer issues * fix session disposal to always be after logging * fix appid pattern matching issues * fix appid dns flow counts * fix shell resume after command line --pause * fix sd_pattern validation boundary conditions * build: don't disable asserts when compiling with code coverage * autoconf: update to latest versions of autoconf-archive macros * main: add asynchronous, broadcastable analyzer commands * add salt to flow hash * normalize peg names to lower snake_case * update default manuals 2017-01-17: build 224 * fix various stream_tcp flush issues * fix various cmake issues * fix appid counting of kerberos flows * fix expected flow leak when expiring nodes during lookup; Thanks to João Soares for reporting the issue * fix autoconf retrieving PCRE cppflags from pkg-config * fix stream_user reassembly * remove unused appid.thirdparty_appid_dir * build and install plugins as modules instead of libraries * obfuscate stream rebuilt payload * updates for latest zlib * disable smb2 processing when file service is disabled * refactor includes; prune the set of installed headers * don't build alert_sf_socket on OSX * added CPP flags used to build Snort to snort.pc for extras and other plugins to use 2016-21-16: build 223 * port 2983 smb active response updates * fix reload crash with file inspector * fix appid service dispatch handling issue; Thanks to João Soares for reporting the issue * fix paf-type flushing of single segments; Thanks to João Soares for reporting the issue * fix daemonization; Thanks to João Soares for reporting the issue * also fixes double counting of reassembled buffers * fix fallback from paf to atom splitter if flushing past gap * fix thread termination segfaults after DAQ module initialization fails * fix non-x86 builds - do not build tsc clock scaling * added appid to user manual features * update default user manuals * minor refactor of flush loop for clarity * improve http_inspect Field class * refactor plugin loading 2016-12-16: build 222 * add JavaScript Normalization to http_inspect * fix appid service check dispatch list * fix modbus_data handling to not skip options; Thanks to FabianMalte.Kopp@b-tu.de for reporting the issue * fix sensitive data filtering documentation issues * build: Illumos build fixes * build: Address some cppcheck concerns * miscellaneous const tweaks * reformat builtin rule text for consistency * reformat help text for consistency * refactor user manual for clarity * update default user manuals 2016-12-09: build 221 * fix appid handling of sip inspection events * fix wizard to prevent use-after-free of service name * fix various issues reported by cppcheck * fix reload race condition * fix cmake + clang builds * add padding guards around hash key structs * update manual for dce_* inspectors * refactor IP address handling 2016-12-01: build 220 * fixed uu and qp decode issue * fixed file signature calculation for ftp * fixed file resume blocking * fix 135:2 to be upon completion of 3-way handshake * fix memory leak with libcrypto use * fix multithreaded use of libcrypto * fix default snort2lua output for gtp and modbus * fix Lua ordering issue with net and port vars * fix miscellaneous multithreading issues with appid * fix comment in snort.lua re install directory use; Thanks to Yang Wang for sending the pull request * add alternate fast patterns for dce_udp endianness * removed underscores from all peg counts * document sensitive data use * user manual refactoring and updates 2016-11-21: build 219 * add dce auto detect to wizard * add MIME file processing to new http_inspect * add chapters on perf_monitor and file processing to user manual * appid refactoring and cleanup * many appid fixes for leaks, sanitizer, and analyzer issues * fix appid pattern matching for http * fix various race conditions reported by thread sanitizer * fix out-of-order FIN handling * fix cmake package name used in HS and HWLOC so that REQUIRED works * fix out-of-tree doc builds * fix image sizes to fit page; Thanks to wyatuestc for reporting the issue * fix fast pattern selection when multiple designated; Thanks to j.mcdowell@titanicsystems.com for reporting the issue * change -L to -K in README and manual; Thanks to jncornett for reporting the issue * support compiling catch tests in standalone source files * create pid file after dropping privileges * improve detection and use of CppUTest in non-standard locations 2016-11-04: build 218 * fix shutdown stats * fix misc appid issues * rewrite appid loading of lua detectors * add sip inspector events for appid * update default manuals 2016-10-28: build 217 * update appid to 2983 * add inspector events from http_inspect to appid * fix appid error messages * fix flow reinitialization after expiration * fix release of blocked flow * fix 129:16 false positive 2016-10-21: build 216 * add build configuration for thread sanitizer * port dce_udp fragments * build: clean up some ICC warnings * fix various unit test leaks * fix -Wmaybe-uninitialized issues * fix related to appid name with space and SSL position 2016-10-13: build 215 * added module trace facility * port block malware over ftp for clients/servers that support REST command * port dce_udp packet processing * change search_engine.debug_print_fast_pattern to show_fast_patterns * overhaul appid for multiple threads, memory leaks, and coding style * fix various appid patterns and counts * fix fast pattern selection * fix file hash pruning issue * fix rate_filter action config and apply_to clean up 2016-10-07: build 214 * updated DAQ - you *must* use DAQ 2.2.1 * add libDAQ version to snort -V output * add support http file upload processing and process decode/detection depths * port sip changes to avoid using NAT ip when calculating callid * port dce_udp autodetect and session creation * fix static analysis issues * fix analyzer/pig race condition * fix explicit obfuscation disable not working * fix ftp_data: Gracefully handle cleared flow data * fix LuaJIT rule option memory leak of plugin name * fix various appid issues - initial port is nearing completion * fix http_inspect event 119:66 * fix ac_full initialization performance * fix stream_tcp left overlap on hpux, solaris * fix/remove 129:5 ("bad segment") events * file_mempool: fix initializing total pool size * fix bpf includes * fix builds for OpenSolaris * expected: push expected flow information through the DAQ module * expected: expected cache revamp and related bugfixes * ftp_data: add expected data consumption to set service name and fix bugs * build: remove lingering libDAQ #ifdefs * defaults: update FTP default config based on Snort2's hardcoded one * rename default_snort_manual.* to snort_manual.* * build docs only by explicit target (make html|pdf|text) * update default manuals to build 213 * tolerate more spaces in ip lists * add rev to rule latency logs * change default latency actions to none * deleted non-functional extra decoder for i4l_rawip 2016-09-27: build 213 * ported full retransmit changes from snort 2X * fixed carved smb2 filenames * fixed multithread hyperscan mpse * fixed sd_pattern iterative validation 2016-09-24: build 212 * add dce udp snort2lua * add file detection when they are transferred in segments in SMB2 * fix another case of CPPUTest header order issues * separate idle timeouts from session timeouts counts * close tcp on rst in close wait, closing, fin wait 1, and fin wait 2 * doc: update style guide for 'using' statements and underscores * packet_capture: Include top-level pcap.h for backward compatibility * main: remove unused -w commandline option * lua: fix conflict with _L macro from ctype.h on OpenBSD * cmake: clean dead variables out of config.cmake.h * build: fix 32-bit compiler warnings * build: fix illumos/OpenSolaris build and remove SOLARIS/SUNOS defines * build: remove superfluous LINUX and MACOS definitions * build: remove superfluous OPENBSD and FREEBSD definitions * build: entering 'std' namespace should be after all headers are included * build: clean up u_int*_t usage * build: remove SPARC support * build: clean up some DAQ header inclusion creep 2016-09-22: build 211 * fix hyperscan detection with nocase * fix shutdown sequence * fix --dirty-pig * fix FreeBSD build re appid / service_rpc 2016-09-20: build 210 * started dce_udp porting * added HA details to stream/* dev_notes * added stream.ip_frag_only to avoid tracking unwanted flows * updated default stream cache sizes to match 2.X * fixed tcp_connector_test for OSX build * fixed binder make files to include binder.h * fixed double counting of ip and udp timeouts and prunes * fixed clearing of SYN - RST flows 2016-09-14: build 209 * add dce iface fast pattern for tcp * add --enable-tsc-clock to build/use TSC register (on x86) * update latency to use ticks during runtime * tcp stream reassembly tweaks * fix inverted detection_filter logic * fix stream profile stats parents * fix most bogus gap counts * unit test fixes for high availability, hyperscan, and regex 2016-09-09: build 208 * fixed for TCP high availability * fixed install of file_decomp.h for consistency between Snort and extras * added smtp client counters and unit tests * ported Smbv2/3 file support * ported mpls encode fixes from 2983 * cleaned up compiler warnings 2016-09-02: build 207 * ported smb file processing * ported the 2.9.8 ciscometadata decoder * ported the 2.9.8 double and triple vlan tagging changes * use sd_pattern as a fast-pattern * rewrite and fix the rpc option * cleanup fragbits option implementation * finish up cutover to the new http_inspect by default * added appid counts for rsync * added http_inspect alerts for Transfer-Encoding and Content-Encoding abuse * moved file capture to offload thread * numerous fixes, cleanup, and refactoring for appid * numerous fixes, cleanup, and refactoring for high availability * fixed regex as fast pattern with hyperscan mpse * fixed http_inspect and tcp valgrind errors * fixed extra auto build from dist 2016-08-10: build 206 * ported appid rule option as "appids" * moved http_inspect (old) to http_server (in extras) * moved new_http_inspect to http_inspect * added smtp.max_auth_command_line_len * fixed asn1:print help * fixed event queue buffer log size * fixed make distcheck; Thanks to jack jackson for reporting the issue 2016-08-05: build 205 * ported smb segmentation support * converted sd_pattern to use hyperscan * fixed help text for rule options ack, fragoffset, seq, tos, ttl, and win * fixed endianness issues with rule options seq and win * fixed rule option session binary vs all 2016-07-29: build 204 * fixed issue with icmp_seq and icmp_id field matching * fixed off-by-1 line number in rule parsing errors * fix cmake make check issue with new_http_inspect * added new_http_inspect unbounded POST alert 2016-07-22: build 203 * add oversize directory alert to new_http_inspect * add appid counts for mdns, timbuktu, battlefield, bgp, and netbios services * continue smb port - write and close command, deprecated dialect check, smb fingerprint * fix outstanding strndup calls 2016-07-15: build 202 * fix dynamic build of new_http_inspect * fix static analysis issues * fix new_http_inspect handling of 100 response * port appid detectors: kereberos, bittorrent, imap, pop * port smb reassembly and raw commands processing * snort2lua updates for new_http_inspect * code refactoring and cleanup 2016-06-22: build 201 * initial appid port - in progress * add configure --enable-hardened-build * add configure --pie (position independent executable) * add new_http_inspect alert for loss of sync * add peg counts for new_http_inspect * add peg counts for sd_pattern * add file_log inspector to log file events * add filename support to file daq * add high availability support for udp and icmp * add support for safe C library * continue porting of dce_rpc - smb transaction processing (part 2) * various snort2lua updates and fixes * fix default prime tables for internal hash functions * fix new_http_inspect bounds issues * fix icc warnings * miscellaneous cmake and auto tools build fixes * openssl is now a mandatory dependency 2016-06-10: build 200 * continued porting of dce_rpc - smb transaction processing * tweaked autotools build foo * add / update unit tests * fix additional memory leaks * fix compiler warnings * fix static analysis issues * fix handling of bpf file failures 2016-06-03: build 199 * add new http_inspect alerts abusive content-length and transfer-encodings * add \b matching to sensitive data * add obfuscation for sensitive data * add support for unprivileged operation * fix link with dynamic DAQ * convert legacy allocations to memory manager for better memory profiling 2016-05-27: build 198 * add double-decoding to new_http_inspect * add obfuscation support for cmg and unified2 * cleanup compiler warnings and memory leaks * fixup cmake builds * update file processing configuration * prevent profiler double counting on recursion * additional unit tests for high availability * fix multi-DAQ instance configuration 2016-05-02: build 197 * fix build of extras * fix unit tests 2016-04-29: build 196 * overhaul cmake foo * update extras to better serve as examples * cleanup use of protocol numbers and identifiers * continued stream_tcp refactoring * continued dce2 port * more static analysis memory leak fixes 2016-04-22: build 195 * added packet_capture module * initial high availability for UDP * changed memory_manager to use absolute instead of relative cap * cmake and pkgconfig fixes * updated catch headers to v1.4.0 * fix stream_tcp config leak * added file capture stats * static analysis updates * DAQ interface refactoring * perf_monitor refactoring * unicode map file for new_http_inspect 2016-04-08: build 194 * added iterative pruning for out of memory condition * added preemptive pruning to memory manager * dce segmentation changes * dce smb header checks port - non segmented packets * added thread timing stats to perf_monitor * fixed so rule input / output * fixed protocol numbering issues * fixed 129:18 * update extra version to alpha 4 -; Thanks to Henry Luciano for reporting the issue * remove legacy/unused obfuscation api * fixed clang, gcc, and icc, build warnings * fixed static analysis issues * fixed memory leaks (more to go) * clean up hyperscan pkg-config and cmake logic 2016-03-28: build 193 * fix session parsing abort handling * fix shutdown memory leaks * fix building against LuaJIT using only pkg-config * fix FreeBSD build * perf_monitor config and format fixes * cmake - check all dependencies before fatal error * new_http_inspect unicode initialization bug fix * new_http_inspect %u encoding and utf 8 bare byte * continued tcp stream refactoring * legacy search engine cleanup * dcd2 port continued - add dce packet fragmentation * add configure --enable-address-sanitizer * add configure --enable-code-coverage * memory manager updates 2016-03-18: build 192 * use hwloc for CPU affinity * fix process stats output * add dce rule options iface, opnum, smb, stub_data, tcp * add dce option for byte_extract/jump/test * initial side channel and file connector for HA * continued memory manager implementation * add UTF-8 normalization for new_http_inspect * fix rule compilation for sticky buffers * host_cache and host_tracker config and stats updates * miscellaneous warning and lint cleanup * snort2Lua updates for preproc sensitive_data and sd_pattern option 2016-03-07: build 191 * fix perf_monitor stats output at shutdown * initial port of sensitive data as a rule option * fix doc/online_manual.sh for linux 2016-03-04: build 190 * fix console close and remote control disconnect issues * added per-thread memcap calculation * add statistics counters to host_tracker module * new_http_inspect basic URI normalization with configuration options * format string cleanup for parser logging * fix conf reload by signal 2016-02-26: build 189 * snort2lua for dce2 port (in progress) * replace ppm with latency * added rule latency * fixed more address sanitizer bugs * fixed use of debug vs debug-msgs * add missing ips option hash and == methods * perf_monitor configuration * fix linux + clang build errors * trough rewrite 2016-02-22: build 188 * added delete/delete[] replacements for nothrow overload; Thanks to Ramya Potluri for reporting the issue * fixed a detection option comparison bug which wasted time and space * disable perf_monitor by default since the reporting interval should be set * memory manager updates * valgrind and unsanitary address fixes * snort2lua updates for dce2 * build issue fix - make non-GNU strerror_r() the default case * packet latency updates * perfmon updates 2016-02-12: build 187 * file capture added - initial version writes from packet thread * added support for http 0.9 to new_http_inspect * added URI normalization of headers, cookies, and post bodies to new_http_inspect * configure_cmake.sh updates to better support scripting * updated catch header (used for some unit tests) * continued dce2 port * fixed misc clang and dynamic plugin build issues * fixed static analysis issues and crash in new_http_inspect * fixed tcp paws issue * fixed normalization stats * fixed issues reported by Bill Parker * refactoring updates to tcp session * refactoring updates to profiler 2016-02-02: build 186 * update copyright to 2016, add missing license blocks * fix xcode builds * fix static analysis issues * update default manuals * host_module and host_tracker updates * start perf_monitor rewrite - 1st of many updates * start dce2 port - 1st of many updates * remove --enable-ppm - always enabled 2016-01-25: build 185 * initial host_tracker for new integrated netmap * new_http_inspect refactoring for time and space considerations * fix profiler depth bug * fatal on failed IP rep segment allocation -; Thanks to Bill Parker * tweaked style guide wrt class declarations 2016-01-08: build 184 * added new_http_inpsect rule options * fixed build issue with Clang and thread_local * continued tcp session refactoring * fixed rule option string unescape issue 2015-12-11: build 183 * circumvent asymmetric flow handling issue 2015-12-11: build 182 - Alpha 3 * added memory profiling feature * added regex fast pattern support * ported reputation preprocessor from 2X * synced to 297-262 * removed '_q' search method flavors - all are now queued * removed PPM_TEST * build and memory leak fixes 2015-12-04: build 181 * perf profiling enhancements * fixed build issues and memory leaks * continued pattern match refactoring * fix spurious sip_method matching 2015-11-25: build 180 * ported dnp3 preprocessor and rule options from 2.X * fixed various valgrind issues with stats from sip, imap, pop, and smtp * fixed captured length of some icmp6 types * added support for hyperscan search method using rule contents (regex to follow) * fixed various log pcap issues * squelch repeated ip6 ooo extensions and bad options per packet * fixed arp inspection bug 2015-11-20: build 179 * user manaul updates * fix perf_monitor.max_file_size default to work on 32-bit systems,; Thanks to noah_dietrich@86penny.org for reporting the issue * fix bogus 116:431 events * decode past excess ip6 extensions and bad options * add iface to alert_csv.fields * add hyperscan fast pattern search engine - functional but not yet used * remove --enable-perf-profiling so it is always built * perf profiling changes in preparation for memory profiling * remove obsolete LibDAQ preprocessor conditionals * fix arp inspection * search engine refactoring 2015-11-13: build 178 * document runtime link issue with hyperscan on osx * fix pathname generation for event trace file * new_http_inspect tweaks * remove --enable-ppm-test * sync up auto tools and cmake build options 2015-11-05: build 177 * idle processing cleanup * fixed teredo payload detection * new_http_inspect cleanup * update old http_inspect to allow spaces in uri * added null check suggest by Bill Parker * fix cmake for hyperscan * ssl and dns stats updates * fix ppm config * miscellanous code cleanup 2015-10-30: build 176 * tcp reassembly refactoring * profiler rewrite * added gzip support to new_http_inspect * added regex rule option based on hyperscan 2015-10-23: build 175 * ported gtp preprocessor and rule options from 2.X * ported modbus preprocessor and rule options from 2.X * fixed 116:297 * added unit test build for cmake (already in autotools builds) * fixed dynamic builds (187 plugins, 138 dynamic) 2015-10-16: build 174 * legacy daemonization cleanup * decouple -D, -M, -q * delete -E * initial rewrite of profiler * don't create pid file unless requested * remove pid lock file * new_http_inspect header processing, normalization, and decompression tweaks * convert README to markdown for pretty github rendering (contributed by gavares@gmail.com) * perfmonitor fixes * ssl stats updates 2015-10-09: build 173 * added pkt_num rule option to extras * fix final -> finalize changes for extras * moved alert_unixsock and log_null to extras * removed duplicate pat_stats source from extras * prevent tcp session restart on rebuilt packets; Thanks to rmkml for reporting the issue * fixed profiler configuration * fixed ppm event logging * added filename to reload commands * fixed -B switch * reverted tcp syn only logic to match 2X * ensure ip6 extension decoder state is reset for ip4 too since ip4 packets may have ip6 next proto * update default manuals 2015-10-01: build 172 * check for bool value before setting fastpath config option in PPM * update manual related to liblzma * fix file processing * refactor non-ethernet plugins * fix file_decomp error logic * enable active response without flow * update bug list 2015-09-25: build 171 * fix metadata:service to work like 2x * fixed issues when building with LINUX_SMP * fixed frag tracker accounting * fix Xcode builds * implement 116:281 decoder rule * udpated snort2lua * add cpputest for unit testing * don't apply cooked verdicts to raw packets 2015-09-17: build 170 * removed unused control socket defines from cmake * fixed build error with valgrind build option * cleanup *FLAGS use in configure.ac * change configure.ac compiler search order to prefer clang over gcc * update where to get dnet * update usage and bug list * move extra daqs and extra hext logger to main source tree * fix breakloop in file daq * fix plain file processing * fix detection of stream_user and stream_file data * log innermost proto for type of broken packets 2015-09-10: build 169 * fix chunked manual install * add event direction bug * fix OpenBSD build * convert check unit tests to catch * code cleanup * fix dev guide builds from top_srcdir 2015-09-04: build 168 * fixed build of chunked manual; Thanks to Bill Parker for reporting the issue * const cleanup * new_http_inspect cookie processing updates * fixed cmake build issue with SMP stats enabled * fixed compiler warnings * added unit tests * updated error messages in u2spewfoo * changed error format for consistency with Snort * fixed u2spewfoo build issue * added strdup sanity checks; Thanks to Bill Parker for reporting the issue * DNS bug fix for TCP * added --catch-tags [footag],[bartag] for unit test selection 2015-08-31: build 167 * fix xcode warnings 2015-08-21: build 166 * fix link error with g++ 4.8.3 * support multiple script-path args and single files * piglet bug fixes * add usage examples with live interfaces; Thanks to Aman Mangal for reporting the problem * fixed port_scan packet selection * fixed rpc_decode sequence number handling and buffer setup * perf_monitor fixes for file output 2015-08-14: build 165 * flow depth support for new_http_inspect * TCP session refactoring and create libtcp * fix ac_sparse_bands search method * doc and build tweaks for piglets * expanded piglet interfaces and other enhancements * fix unit test return value * add catch.hpp include from https://github.com/philsquared/Catch * run catch unit tests after check unit tests * fix documentation errors in users manual 2015-08-07: build 164 * add range and default to command line args * fix unit test build on osx * DAQ packet header conditional compilation for piglet * add make targets for dev_guide.html and snort_online.html * cleanup debug macros * fix parameter range for those depending on loaded plugins; Thanks to Siti Farhana Binti Lokman for reporting the issue 2015-07-30: build 163 * numerous piglet fixes and enhancements * BitOp rewrite * added more private IP address; Thanks to Bill Parker for reporting the issue * fixed endianness in private IP address check * fix build of dynamic plugins 2015-07-22: build 162 * enable build dependency tracking * cleanup automake and cmake foo * updated bug list * added Lua stack manager and updated code that manipulated a persistent lua_State; Thanks to Sancho Panza (sancho@posteo.de) for reporting the issue * piglet updates and fixes * dev guide - convert snort includes into links * fixup includes 2015-07-15: build 161 * added piglet plugin test harness * added piglet_scripts with codec and inspector examples * added doc/dev_guide.sh * added dev_notes.txt in each src/ subdir * scrubbed headers 2015-07-06: build 160 - Alpha 2 * fixed duplicate patterns in file_magic.lua * warn about rules with no fast pattern * warn if file rule has no file_data fp * run fast patterns according to packet type * update / expand shutdown output for detection * binder sets service from inspector if not set * allow abbreviated rule headers * fix cmake build on linux w/o asciidoc * add bugs list to manual * fix memory leaks * fix valgrind issues * fix xcode analyzer issues 2015-07-02: build 159 * added file processing to new_http_inspect * ported sip preprocessor * refactoring port group init and start up output * standardize / generalize fp buffers * add log_hext.width * tweak style guide * fix hosts table parsing 2015-06-19: build 158 * nhttp splitter updates * nhttp handle white space after chunk length * refactor of fpcreate * refactor sfportobject into ports/* * delete flowbits_size, refactor bitop foo * rename PortList to PortBitSet etc. to avoid confusion * fix ssl assertion * cleanup cache config 2015-06-11: build 157 * port ssl from snort * fix stream_tcp so call splitter finish only if scan was called * changed drop rules drop current packet only * unchanged block rules block all packets on flow * added reset rules to function as reject * deleted sdrop and sblock rules; use suppressions instead * refactored active module * updated snort2lua 2015-06-04: build 156 * new_http_inspect switch to bitset for event tracking * fixed stream tcp handling of paf abort * fixed stream tcp cleanup on reset * fixed sequence of flush and flow data cleanup for new http inspect 2015-05-31: build 155 * update default manuals * fix autotools build of manual wrt plugins * file processing fixup * update usage from blog * add file magic lua * xcode analyzer cleanup 2015-05-28: build 154 * new_http_inspect parsing and event handling updates * initial port of file capture from Snort * stream_tcp reassembles payload only * remove obsolete REG_TEST logging * refactor encode_format*() * rewrite alert_csv with default suitable for reg tests and debugging * dump 20 hex bytes per line instead of 16 * add raw mode hext DAQ and logger; fix dns inspector typo for tcp checks * document raw hext mode * cleanup flush flags vs dir * add alert_csv.separator, delete alert_test * tweak log config; rename daq/log user to hext * cleanup logging * stream_tcp refactoring and cleanup 2015-05-22: build 153 * new_http_inspect parsing updates * use buckets for user seglist * fix u2 to output data only packets * added DAQs for socket, user, and file in extras * changed -K to -L (log type) * added extra DAQ for user and file * added stream_user for payload processing * added stream_file for file processing 2015-05-15: build 152 * fixed config error for inspection of rebuilt packets * ported smtp inspector from Snort * static analysis fix for new_http_inspect 2015-05-08: build 151 * doc tweaks * new_http_inspect message parsing updates * misc bug fixes 2015-04-30: build 150 * fixed xcode static analysis issues * updated default manuals * added packet processing section to manual * additional refactoring and cleanup * fix http_inspect mpse search * fixed urg rule option * change daq.var to daq.vars to support multiple params reported by Sancho Panza * ensure unknown sources are analyzed * pop and imap inspectors ported 2015-04-28: build 149 * fixed build issue with extras 2015-04-28: build 148 * fixed default validation issue reported by Sancho Panza * refactored snort and snort_config modules * file id refactoring and cleanup * added publish-subscribe handling of data events * added data_log plugin example for pub-sub 2015-04-23: build 147 * change PT_DATA to IT_PASSIVE; supports named instances, reload, and consumers 2015-04-16: build 146 * added build of snort_manual.text if w3m is installed * added default_snort_manual.text w/o w3m * add Flow pointer to StreamSplitter::finish() 2015-04-10: build 145 * nhttp clear() and related changes * abort PAF in current direction only * added StreamSplitter::finish() * allow relative flush point of zero * added Inspector::clear() * new http refactoring and cleanup * new http changes - events from splitter * fix dns assertion; remove unused variables 2015-03-31: build 144 * reworked autotools generation of api_options.h * updated default manuals * ported dns inspector 2015-03-26: build 143 * ported ssh inspector * apply service from hosts when inspector already bound to flow * ensure direction and service are applied to packet regardless of flow state * enable active for react / reject only if used in configuration * fixed use of bound ip and tcp policy if not set in hosts * eliminate dedicated nhttp chunk buffer * minor nhttp cleanup in StreamSplitter 2015-03-18: build 142 * fixed host lookup issue * folded classification.lua and reference.lua into snort_defaults.lua * apply defaults from parameter tables instead of relying on ctors etc * fix static analysis issues reported by xcode * change policy names with a-b form to a_b for consistency * make all warnings optional * fix ip and tcp policy defines * fix ip and icmp flow client/server ip init * added logging examples to usage 2015-03-11: build 141 * added build foo for lzma; refactored configure.ac * enhancements for checking compatibility of external plugins * added doc/usage.txt 2015-02-27: build 140 * uncrustify, see crusty.cfg * updated documentation on new HTTP inspector, binder, and wizard 2015-02-26: build 139 * additional http_inspect cleanup * documented gotcha regarding rule variable definitions in Lua * sync 297 http xff, swf, and pdf updates 2015-02-20: build 138 * sync ftp with 297; replace stream event callbacks with FlowData virtuals 2015-02-12: build 137 * updated manual from blog posts and emails * normalization refactoring, renaming * fixed icmp4 encoding * methods in codec_events and ip_util namespaces are now protected Codec methods * 297 sync of active and codecs 2015-02-05: build 136 * fix up encoders * sync stream with 297 * fix encoder check for ip6 extensions * sync normalizations with 297 2015-01-29: build 135 * fixed freebsd build error * fix default hi profile name * updated default snort manuals 2015-01-26: build 134 * sync Mpse to 297, add SearchTool * 297 sync for sfghash, sfxhash, tag, u2spewfoo, profiler and target based * addition of mime decoding stats and updates to mime detection limits * snort2lua changed to add bindings for default ports if not explicitly configured * added md5, sha256, and sha512 rule options based on Snort 2.X protected_content 2015-01-20: build 133 * fixes for large file support on 32-bit Linux systems (reported by Y M) * changed u2 base file name to unified2.log * updated doc based on tips/tricks blog * fixed active rule actions (react, reject, rewrite) * moved http_inspect profile defaults to snort_defaults.lua * add generalized infractions tracking to new_http_inspect * updated snort2lua to override default tables (x = { t = v }; x.t.a = 1) * additional codec refactoring * added pflog codecs * fixed stream_size rule option 2015-01-05: build 132 * added this change log * initial partial sync with Snort 297 including bug fixes and variable renaming * malloc info output with -v at shutdown (if supported) * updated source copyrights for 2015 and reformatted license foo for consistency 2014-12-16: build 131 * fix asciidoc formatting and update default manuals * updates to doc to better explain github builds * fix default init for new_http_inspect * fix cmake issues reported by Y M * add missing g++ dependency to doc reported by Bill Parker * add general fp re-search solution for fp buffers further restricted during rule eval; fixes issue reported by @rmkml * add missing sanity checks reported by bill parker * tweak READMEs 2014-12-11: build 130 * alpha 1 release snort3-3.1.82.0/LICENSE000066400000000000000000000510311457433257500142170ustar00rootroot00000000000000***************************************************************************** The text that follows is the GNU General Public License, Version 2 (GPL V2) and governs your use, modification and/or distribution of SNORT. Section 9 of the GPL V2 acknowledges that the Free Software Foundation may publish revised and/or new versions of the GPL V2 from time to time. Section 9 further states that a licensee of a program subject to the GPL V2 could be free to use any such revised and/or new versions under two different scenarios: 1. "Failure to Specify." Section 9 of the GPL V2 allows a licensee of a program governed by an unspecified version of the General Public License to choose any version of the General Public License ever published by the Free Software Foundation to govern his or her use of such program. This provision is not applicable to your use of SNORT because we have expressly stated in a number of instances that any third party's use, modification or distribution of SNORT is governed by GPL V2. 2. "Any Later Version." At the end of the terms and condition of the GPL V2 is a section called "How to Apply these Terms to Your New Program," which provides guidance to a developer on how to apply the GPL V2 to a third party's use, modification and/or distribution of his/her program. Among other things, this guidance suggests that the developer attach certain notices to the program. Of particular importance is the following notice: "This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version." Thus if a developer follows strictly the guidance provided by the Free Software Foundation, Section 9 of the GPL V2 provides the licensee the option to either use, modify or distribute the program under GPL V2 or under any later version published by the Free Software Foundation. SNORT is an open source project that is governed exclusively by the GPL V2 and any third party desiring to use, modify or distribute SNORT must do so by strictly following the terms and conditions of GPL V2. Anyone using, modifying or distributing SNORT does not have the option to chose to use, modify or distribute SNORT under any revised or new version of the GPL, including without limitation, the GNU General Public License Version 3. For ease of reference, the comparable notice that is used with SNORT (contained in the 'README' file) is as follows: "This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License Version 2 as published by the Free Software Foundation. You may not use, modify or distribute this program under any other version of the GNU General Public License." If you have any questions about this statement, please feel free to email snort-info@snort.org. ***************************************************************************** GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) 19yy This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) 19yy name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. snort3-3.1.82.0/README.md000066400000000000000000000146711457433257500145020ustar00rootroot00000000000000# Snort++ Snort 3 is the next generation Snort IPS (Intrusion Prevention System). This file will show you what Snort++ has to offer and guide you through the steps from download to demo. If you are unfamiliar with Snort you should take a look at the Snort documentation first. We will cover the following topics: --- * [Overview](#overview) * [Dependencies](#dependencies) * [Download](#download) * [Build Snort](#build-snort) * [Run Snort](#run-snort) * [Documentation](#documentation) * [Squeal](#squeal) # OVERVIEW This version of Snort++ includes new features as well as all Snort 2.X features and bug fixes for the base version of Snort except as indicated below: Project = Snort++ Binary = snort Version = 3.0.0 (Build 250) from 2.9.11 Here are some key features of Snort++: * Support multiple packet processing threads * Use a shared configuration and attribute table * Use a simple, scriptable configuration * Make key components pluggable * Autodetect services for portless configuration * Support sticky buffers in rules * Autogenerate reference documentation * Provide better cross platform support * Facilitate component testing * Use a shared network map Additional features on the roadmap include: * Support pipelining of packet processing * Support hardware offload and data plane integration * Support proxy mode * Windows support # DEPENDENCIES If you already build Snort, you may have everything you need. If not, grab the latest: * cmake to build from source * daq from https://github.com/snort3/libdaq for packet IO * dnet from https://github.com/dugsong/libdnet.git for network utility functions * flex >= 2.6.0 from https://github.com/westes/flex for JavaScript syntax parser * g++ >= 5 or other C++14 compiler * hwloc from https://www.open-mpi.org/projects/hwloc/ for CPU affinity management * LuaJIT from http://luajit.org for configuration and scripting * OpenSSL from https://www.openssl.org/source/ for SHA and MD5 file signatures, the protected_content rule option, and SSL service detection * pcap from http://www.tcpdump.org for tcpdump style logging * pcre from http://www.pcre.org for regular expression pattern matching * pkgconfig from https://www.freedesktop.org/wiki/Software/pkg-config/ to locate build dependencies * zlib from http://www.zlib.net for decompression Additional packages provide optional features. Check the manual for more. # DOWNLOAD There is a source tarball available in the Downloads section on snort.org: snort-3.0.0-a3.tar.gz You can also get the code with: git clone https://github.com/snort3/snort3.git There are separate extras packages for cmake that provide additional features and demonstrate how to build plugins. The source for extras is in snort3_extra.git repo. # BUILD SNORT Follow these steps: 1. Set up source directory: * If you are using a github clone: ```shell cd snort3/ ``` * Otherwise, do this: ```shell tar zxf snort-tarball cd snort-3.0.0* ``` 2. Setup install path: ```shell export my_path=/path/to/snorty ``` 3. Compile and install: * To build with cmake and make, run configure_cmake.sh. It will automatically create and populate a new subdirectory named 'build'. ```shell ./configure_cmake.sh --prefix=$my_path cd build make -j $(nproc) install ``` **_Note_**: * If you can do src/snort -V you built successfully. * If you are familiar with cmake, you can run cmake/ccmake instead of configure_cmake.sh. * cmake --help will list any available generators, such as Xcode. Feel free to use one, however help with those will be provided separately. # RUN SNORT Here are some examples. If you are using Talos rules and/or configs, you should first set any needed variables at the top of snort.lua and snort_defaults.lua. * Snort++ provides lots of help from the command line, including: ```shell $my_path/bin/snort --help $my_path/bin/snort --help-module suppress $my_path/bin/snort --help-config | grep thread ``` * Examine and dump a pcap. In the following, replace a.pcap with your favorite: ```shell $my_path/bin/snort -r a.pcap $my_path/bin/snort -L dump -d -e -q -r a.pcap ``` * Verify a config, with or w/o rules: ```shell $my_path/bin/snort -c $my_path/etc/snort/snort.lua $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules ``` * Run IDS mode. In the following, replace pcaps/ with a path to a directory with one or more *.pcap files: ```shell $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \ -r a.pcap -A alert_test -n 100000 ``` * Let's suppress 1:2123. We could edit the conf or just do this: ```shell $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \ -r a.pcap -A alert_test -n 100000 --lua "suppress = { { gid = 1, sid = 2123 } }" ``` * Go whole hog on a directory with multiple packet threads: ```shell $my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \ --pcap-filter \*.pcap --pcap-dir pcaps/ -A alert_fast --max-packet-threads 8 ``` Additional examples are given in doc/usage.txt. # DOCUMENTATION Take a look at the manual, parts of which are generated by the code so it stays up to date: ```shell $my_path/share/doc/snort/snort_manual.pdf $my_path/share/doc/snort/snort_manual.html $my_path/share/doc/snort/snort_manual/index.html ``` It does not yet have much on the how and why, but it does have all the currently available configuration, etc. Some key changes to rules: * you must use comma separated content sub options like this: content:"foo", nocase; * buffer selectors must appear before the content and remain in effect until changed * pcre buffer selectors were deleted * check the manual for more on Snort++ vs Snort * check the manual reference section to understand how parameters are defined, etc. It also covers new features not demonstrated here: * snort2lua, a tool to convert Snort 2.X conf and rules to the new form * a new HTTP inspector * a binder, for mapping configuration to traffic * a wizard for port-independent configuration * improved rule parsing - arbitrary whitespace, C style comments, #begin/#end comments * local and remote command line shell # SQUEAL `o")~` We hope you are as excited about Snort++ as we are. Let us know what you think on the snort-users list. In the meantime, we'll keep our snout to the grindstone. snort3-3.1.82.0/cmake/000077500000000000000000000000001457433257500142725ustar00rootroot00000000000000snort3-3.1.82.0/cmake/CodeCoverage.cmake000066400000000000000000000020621457433257500176220ustar00rootroot00000000000000# # Loosely based on: # https://raw.githubusercontent.com/peti/autoconf-archive/master/m4/ax_code_coverage.m4 # - and - # https://raw.githubusercontent.com/bilke/cmake-modules/master/CodeCoverage.cmake # find_program( GCOV_PATH gcov ) if(NOT GCOV_PATH) message(FATAL_ERROR "gcov not found! Aborting...") endif() if("${CMAKE_CXX_COMPILER_ID}" MATCHES "(Apple)?[Cc]lang") if("${CMAKE_CXX_COMPILER_VERSION}" VERSION_LESS 3) message(FATAL_ERROR "Clang version must be 3.0.0 or greater! Aborting...") endif() elseif(NOT "${CMAKE_CXX_COMPILER_ID}" STREQUAL "GNU") message(FATAL_ERROR "Compiler is not GNU gcc! Aborting...") endif() set(COVERAGE_COMPILER_FLAGS "-O0 -g -fprofile-arcs -ftest-coverage") set(CMAKE_CXX_OUTPUT_EXTENSION_REPLACE ON) if(CMAKE_C_COMPILER_ID STREQUAL "GNU") set(COVERAGE_LINKER_FLAGS "") set(COVERAGE_LIBRARIES "gcov") else() set(COVERAGE_LINKER_FLAGS "--coverage") set(COVERAGE_LIBRARIES "") endif() mark_as_advanced( COVERAGE_COMPILER_FLAGS COVERAGE_LINKER_FLAGS COVERAGE_LIBRARIES ) snort3-3.1.82.0/cmake/FindAsciidoc.cmake000066400000000000000000000016511457433257500176160ustar00rootroot00000000000000# - Find Asciidoc # this module looks for asciidoc, a2x, and w3m # the asciidoc package includes both asciidoc and a2x # # asciidoc, a2x, w3m: # *_EXE - the full path to the above command # *_FOUND - if false, don't attempt to use above command # to build: # html (single or chunked) - asciidoc needed # text - asciidoc and w3m needed # pdf - asciidoc and dblatex needed set(ERROR_MESSAGE "install asciidoc to build the html user manual" ) FIND_PROGRAM(ASCIIDOC_EXE asciidoc) find_program(ASCIIDOC_A2X_EXE a2x) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(Asciidoc REQUIRED_VARS ASCIIDOC_A2X_EXE ASCIIDOC_EXE FAIL_MESSAGE "${ERROR_MESSAGE}" ) mark_as_advanced( ASCIIDOC_EXE ASCIIDOC_A2X_EXE ) find_program(W3M_EXE w3m) find_package_handle_standard_args(W3M REQUIRED_VARS W3M_EXE FAIL_MESSAGE "install w3m to build all-in-one text user manual" ) mark_as_advanced(W3M_EXE) snort3-3.1.82.0/cmake/FindAtomic.cmake000066400000000000000000000004361457433257500173140ustar00rootroot00000000000000find_library(ATOMIC_LIBRARIES NAMES atomic HINTS ${ATOMIC_LIBRARIES_DIR_HINT}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(Atomic DEFAULT_MSG ATOMIC_LIBRARIES) mark_as_advanced(ATOMIC_LIBRARIES) if (ATOMIC_LIBRARIES) set(HAVE_ATOMIC "1") endif() snort3-3.1.82.0/cmake/FindCppUTest.cmake000066400000000000000000000014461457433257500176110ustar00rootroot00000000000000 find_package(PkgConfig) pkg_check_modules(PC_CPPUTEST cpputest) find_path(CPPUTEST_INCLUDE_DIR CppUTest/TestHarness.h HINTS ${PC_CPPUTEST_INCLUDEDIR} ${PC_CPPUTEST_INCLUDE_DIRS}) find_library(CPPUTEST_LIBRARY NAMES CppUTest HINTS ${PC_CPPUTEST_LIBDIR} ${PC_CPPUTEST_LIBRARY_DIRS}) find_library(CPPUTEST_EXT_LIBRARY NAMES CppUTestExt HINTS ${PC_CPPUTEST_LIBDIR} ${PC_CPPUTEST_LIBRARY_DIRS}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(CppUTest DEFAULT_MSG CPPUTEST_LIBRARY CPPUTEST_EXT_LIBRARY CPPUTEST_INCLUDE_DIR) if(CPPUTEST_LIBRARY AND CPPUTEST_EXT_LIBRARY) set(CPPUTEST_LIBRARIES ${CPPUTEST_LIBRARY} ${CPPUTEST_EXT_LIBRARY}) endif(CPPUTEST_LIBRARY AND CPPUTEST_EXT_LIBRARY) mark_as_advanced(CPPUTEST_INCLUDE_DIR CPPUTEST_LIBRARY CPPUTEST_EXT_LIBRARY) snort3-3.1.82.0/cmake/FindDAQ.cmake000066400000000000000000000053521457433257500165070ustar00rootroot00000000000000#[=======================================================================[.rst: FindDAQ ------- Locate LibDAQ include paths and library as well as static DAQ module libraries This module defines: :: DAQ_FOUND - system has libdaq DAQ_INCLUDE_DIR - the libdaq include directory DAQ_LIBRARIES - the libraries needed to use libdaq DAQ_STATIC_MODULES - the static DAQ modules available DAQ_STATIC_MODULE_LIBS - the set of additional libraries required by the available static DAQ modules #]=======================================================================] find_package(PkgConfig) pkg_check_modules(PC_DAQ libdaq>=3.0.13) # Use DAQ_INCLUDE_DIR_HINT and DAQ_LIBRARIES_DIR_HINT from configure_cmake.sh as primary hints # and then package config information after that. find_path(DAQ_INCLUDE_DIR NAMES daq.h HINTS ${DAQ_INCLUDE_DIR_HINT} ${PC_DAQ_INCLUDEDIR} ${PC_DAQ_INCLUDE_DIRS} NO_SYSTEM_ENVIRONMENT_PATH ) find_library(DAQ_LIBRARIES NAMES daq HINTS ${DAQ_LIBRARIES_DIR_HINT} ${PC_DAQ_LIBDIR} ${PC_DAQ_LIBRARY_DIRS} ) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(DAQ REQUIRED_VARS DAQ_LIBRARIES DAQ_INCLUDE_DIR FAIL_MESSAGE "${ERROR_MESSAGE}" ) mark_as_advanced( DAQ_INCLUDE_DIR DAQ_LIBRARIES ) if (PKG_CONFIG_EXECUTABLE AND ENABLE_STATIC_DAQ) execute_process(COMMAND ${PKG_CONFIG_EXECUTABLE} --list-all OUTPUT_VARIABLE _pkgconfig_list_result OUTPUT_STRIP_TRAILING_WHITESPACE) string(REGEX MATCHALL "libdaq_static_[^ ]+" AVAILABLE_STATIC_MODULES ${_pkgconfig_list_result}) list(REMOVE_DUPLICATES AVAILABLE_STATIC_MODULES) foreach (STATIC_MODULE IN LISTS AVAILABLE_STATIC_MODULES) string(REGEX REPLACE "^libdaq_static_" "" MODULE_NAME ${STATIC_MODULE}) list(APPEND DAQ_STATIC_MODULES ${MODULE_NAME}) pkg_check_modules(PC_${STATIC_MODULE} ${STATIC_MODULE}) foreach (STATIC_MODULE_LIBNAME IN LISTS PC_${STATIC_MODULE}_LIBRARIES) find_library(STATIC_MODULE_LIB NAMES ${STATIC_MODULE_LIBNAME} HINTS ${PC_${STATIC_MODULE}_LIBRARY_DIRS}) if (STATIC_MODULE_LIB) list(APPEND DAQ_STATIC_MODULE_LIBS ${STATIC_MODULE_LIB}) unset(STATIC_MODULE_LIB CACHE) endif() endforeach() endforeach() if (DAQ_STATIC_MODULE_LIBS) list(REMOVE_DUPLICATES DAQ_STATIC_MODULE_LIBS) set(DAQ_STATIC_MODULE_LIBS ${DAQ_STATIC_MODULE_LIBS} CACHE INTERNAL "Static DAQ module libraries") endif() if (DAQ_STATIC_MODULES) list(REMOVE_DUPLICATES DAQ_STATIC_MODULES) list(SORT DAQ_STATIC_MODULES) set(DAQ_STATIC_MODULES ${DAQ_STATIC_MODULES} CACHE INTERNAL "Static DAQ modules") endif() endif() snort3-3.1.82.0/cmake/FindDBLATEX.cmake000066400000000000000000000034221457433257500171610ustar00rootroot00000000000000# Find DocBook to LaTeX Publishing (http://dblatex.sourceforge.net/) # # The module defines the following variables: # # DBLATEX_EXECUTABLE - path to the dblatex executable # DBLATEX_FOUND - true if dblatex was found # DBLATEX_VERSION - the version of dblatex found #============================================================================= # Copyright (C) 2011 Daniel Pfeifer # # Distributed under the Boost Software License, Version 1.0. # See accompanying file LICENSE_1_0.txt or copy at # http://www.boost.org/LICENSE_1_0.txt #============================================================================= #if(DBLATEX_EXECUTABLE) # return() #endif() if(CMAKE_HOST_WIN32) find_package(PythonInterp QUIET) find_file(dblatex_py dblatex [HKEY_LOCAL_MACHINE\\SOFTWARE\\Python\\PythonCore\\2.7\\InstallPath]/Scripts [HKEY_LOCAL_MACHINE\\SOFTWARE\\Python\\PythonCore\\2.6\\InstallPath]/Scripts [HKEY_LOCAL_MACHINE\\SOFTWARE\\Python\\PythonCore\\2.5\\InstallPath]/Scripts [HKEY_LOCAL_MACHINE\\SOFTWARE\\Python\\PythonCore\\2.4\\InstallPath]/Scripts ) if(PYTHONINTERP_FOUND AND dblatex_py) set(DBLATEX_EXECUTABLE ${PYTHON_EXECUTABLE} ${dblatex_py} CACHE FILEPATH "dblatex executable" ) endif() unset(dblatex_py CACHE) else() find_program(DBLATEX_EXECUTABLE dblatex) endif() if(DBLATEX_EXECUTABLE) execute_process(COMMAND ${DBLATEX_EXECUTABLE} --version OUTPUT_VARIABLE DBLATEX_VERSION OUTPUT_STRIP_TRAILING_WHITESPACE) string(REGEX REPLACE "^dblatex version (.+)$" "\\1" DBLATEX_VERSION "${DBLATEX_VERSION}") endif() include(FindPackageHandleStandardArgs) find_package_handle_standard_args(DBLATEX REQUIRED_VARS DBLATEX_EXECUTABLE VERSION_VAR DBLATEX_VERSION ) mark_as_advanced(DBLATEX_EXECUTABLE) snort3-3.1.82.0/cmake/FindDNET.cmake000066400000000000000000000030011457433257500166210ustar00rootroot00000000000000################################################################### # - Find the Dumb (not so!) Library: dnet # Find the DUMBNET includes and library # http://code.google.com/p/libdnet/ # # The environment variable DUMBNETDIR allows to specficy where to find # libdnet in non standard location. # # DNET_INCLUDE_DIR - where to find dnet.h, etc. # DNET_LIBRARIES - List of libraries when using dnet. # DNET_FOUND - True if dnet found. # HAVE_DUMBNET_H - True if found dumnet rather than dnet set(ERROR_MESSAGE " ERROR! dnet header not found, go get it from http://code.google.com/p/libdnet/ or use the --with-dnet-* options, if you have it installed in an unusual place. " ) # Check for libdumbnet first, then libdnet find_path(DUMBNET_INCLUDE_DIR dumbnet.h HINTS ${DNET_INCLUDE_DIR_HINT}) # If we found libdumbnet header, define HAVE_DUMBNET_H for config.h generation # and search for libdumbnet. if (DUMBNET_INCLUDE_DIR) set(HAVE_DUMBNET_H "1") set(DNET_INCLUDE_DIR ${DUMBNET_INCLUDE_DIR}) find_library(DNET_LIBRARIES NAMES dumbnet HINTS ${DNET_LIBRARIES_DIR_HINT}) else () find_path(DNET_INCLUDE_DIR dnet.h HINTS ${DNET_INCLUDE_DIR_HINT}) find_library(DNET_LIBRARIES NAMES dnet HINTS ${DNET_LIBRARIES_DIR_HINT}) endif() include(FindPackageHandleStandardArgs) find_package_handle_standard_args(DNET REQUIRED_VARS DNET_INCLUDE_DIR DNET_LIBRARIES FAIL_MESSAGE "${ERROR_MESSAGE}" ) mark_as_advanced( DNET_INCLUDE_DIR DNET_LIBRARIES ) snort3-3.1.82.0/cmake/FindFlexLexer.cmake000066400000000000000000000014251457433257500177750ustar00rootroot00000000000000 find_package(FLEX 2.6.0 REQUIRED) find_path(FLEX_INCLUDES "FlexLexer.h" HINTS ${FLEX_INCLUDE_DIR_HINT} PATHS ${FLEX_INCLUDE_DIRS} REQUIRED ) mark_as_advanced(FLEX_INCLUDES) macro(FLEX NAME LEXER_IN LEXER_OUT) FLEX_TARGET(${NAME} ${LEXER_IN} ${LEXER_OUT}.tmp COMPILE_FLAGS ${FLEX_FLAGS} ) # we use '|' as a separator for 'sed' to avoid conflicts with '/' in paths from LEXER_OUT add_custom_command( OUTPUT ${LEXER_OUT} COMMAND sed -e "s|void yyFlexLexer::LexerError|yynoreturn void yyFlexLexer::LexerError|;s|${LEXER_OUT}.tmp|${LEXER_OUT}|" ${FLEX_${NAME}_OUTPUTS} > ${LEXER_OUT} DEPENDS ${FLEX_${NAME}_OUTPUTS} VERBATIM ) set(${NAME}_OUTPUTS ${LEXER_OUT}) endmacro() snort3-3.1.82.0/cmake/FindHS.cmake000066400000000000000000000011771457433257500164150ustar00rootroot00000000000000 find_package(PkgConfig) pkg_check_modules(PC_HYPERSCAN libhs) # Use HS_INCLUDE_DIR and HS_LIBRARY_DIR from configure_cmake.sh as primary hints # and then package config information after that. find_path(HS_INCLUDE_DIRS hs_compile.h HINTS ${HS_INCLUDE_DIR} ${PC_HYPERSCAN_INCLUDEDIR} ${PC_HYPERSCAN_INCLUDE_DIRS}) find_library(HS_LIBRARIES NAMES hs HINTS ${HS_LIBRARIES_DIR} ${PC_HYPERSCAN_LIBDIR} ${PC_HYPERSCAN_LIBRARY_DIRS}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(HS REQUIRED_VARS HS_LIBRARIES HS_INCLUDE_DIRS VERSION_VAR PC_HYPERSCAN_VERSION) mark_as_advanced(HS_INCLUDE_DIRS HS_LIBRARIES) snort3-3.1.82.0/cmake/FindHWLOC.cmake000066400000000000000000000011441457433257500167510ustar00rootroot00000000000000 find_package(PkgConfig) pkg_check_modules(PC_HWLOC hwloc) if (NOT PC_HWLOC_FOUND) message(SEND_ERROR "\n\tERROR! hwloc library not found.\n" "\tGet it from https://www.open-mpi.org/projects/hwloc/\n" ) endif() find_path(HWLOC_INCLUDE_DIRS hwloc.h HINTS ${PC_HWLOC_INCLUDEDIR} ${PC_HWLOC_INCLUDE_DIRS}) find_library(HWLOC_LIBRARIES NAMES hwloc HINTS ${PC_HWLOC_LIBDIR} ${PC_HWLOC_LIBRARY_DIRS}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(HWLOC DEFAULT_MSG HWLOC_LIBRARIES HWLOC_INCLUDE_DIRS) mark_as_advanced(HWLOC_INCLUDE_DIRS HWLOC_LIBRARIES) snort3-3.1.82.0/cmake/FindICONV.cmake000066400000000000000000000050631457433257500167570ustar00rootroot00000000000000# Find the headers and library required for iconv functions. # Libc-based iconv test lifted from the upstream CMake FindIconv.cmake module. # First, try to find the iconv header, looking in the hinted directory first. find_path(ICONV_INCLUDE_DIR NAMES iconv.h HINTS ${ICONV_INCLUDE_DIR_HINT} ) if (ICONV_INCLUDE_DIR) # Test to see if iconv is available from libc and matches the header we found. # Assume that an explicit include dir or library dir hint means we're not going # to be using a libc implementation. if (UNIX AND NOT ICONV_INCLUDE_DIR_HINT AND NOT ICONV_LIBRARIES_DIR_HINT) include(CMakePushCheckState) cmake_push_check_state(RESET) # Make sure we're using the iconv.h we found above set(CMAKE_REQUIRED_INCLUDES ${ICONV_INCLUDE_DIR}) # We always suppress the message here: Otherwise on supported systems # not having iconv in their C library (e.g. those using libiconv) # would always display a confusing "Looking for iconv - not found" message set(CMAKE_FIND_QUIETLY TRUE) # The following code will not work, but it's sufficient to see if it compiles. # Note: libiconv will define the iconv functions as macros, so CheckSymbolExists # will not yield correct results. set(ICONV_IMPLICIT_TEST_CODE " #include #include int main() { char *a, *b; size_t i, j; iconv_t ic; ic = iconv_open(\"to\", \"from\"); iconv(ic, &a, &i, &b, &j); iconv_close(ic); } " ) if (CMAKE_C_COMPILER_LOADED) include(CheckCSourceCompiles) check_c_source_compiles("${ICONV_IMPLICIT_TEST_CODE}" ICONV_IS_BUILT_IN) elseif (CMAKE_CXX_COMPILER_LOADED) include(CheckCXXSourceCompiles) check_cxx_source_compiles("${ICONV_IMPLICIT_TEST_CODE}" ICONV_IS_BUILT_IN) endif() cmake_pop_check_state() endif() if (NOT ICONV_IS_BUILT_IN) find_library(ICONV_LIBRARY NAMES iconv libiconv HINTS ${ICONV_LIBRARIES_DIR_HINT} ) endif() else() unset(ICONV_INCLUDE_DIR) endif() include(FindPackageHandleStandardArgs) if (NOT ICONV_IS_BUILT_IN) find_package_handle_standard_args(ICONV REQUIRED_VARS ICONV_LIBRARY ICONV_INCLUDE_DIR) else() find_package_handle_standard_args(ICONV REQUIRED_VARS ICONV_INCLUDE_DIR) endif() mark_as_advanced(ICONV_INCLUDE_DIR) mark_as_advanced(ICONV_LIBRARY) snort3-3.1.82.0/cmake/FindJEMalloc.cmake000066400000000000000000000030001457433257500175140ustar00rootroot00000000000000# - Try to find jemalloc # Once done this will define # JEMALLOC_FOUND - System has jemalloc # JEMALLOC_INCLUDE_DIRS - The jemalloc include directories # JEMALLOC_LIBRARIES - The libraries needed to use jemalloc find_package(PkgConfig QUIET) pkg_check_modules(PC_JEMALLOC QUIET jemalloc) find_path(JEMALLOC_INCLUDE_DIR NAMES jemalloc/jemalloc.h HINTS ${PC_JEMALLOC_INCLUDE_DIRS} ) if ( STATIC_JEMALLOC ) find_library(JEMALLOC_LIBRARY NAMES libjemalloc.a jemalloc HINTS ${PC_JEMALLOC_LIBRARY_DIRS} ) else() find_library(JEMALLOC_LIBRARY NAMES jemalloc HINTS ${PC_JEMALLOC_LIBRARY_DIRS} ) endif() if(JEMALLOC_INCLUDE_DIR) set(_version_regex "^#define[ \t]+JEMALLOC_VERSION[ \t]+\"([^\"]+)\".*") file(STRINGS "${JEMALLOC_INCLUDE_DIR}/jemalloc/jemalloc.h" JEMALLOC_VERSION REGEX "${_version_regex}") string(REGEX REPLACE "${_version_regex}" "\\1" JEMALLOC_VERSION "${JEMALLOC_VERSION}") unset(_version_regex) endif() include(FindPackageHandleStandardArgs) # handle the QUIETLY and REQUIRED arguments and set JEMALLOC_FOUND to TRUE # if all listed variables are TRUE and the requested version matches. find_package_handle_standard_args(Jemalloc REQUIRED_VARS JEMALLOC_LIBRARY JEMALLOC_INCLUDE_DIR VERSION_VAR JEMALLOC_VERSION) if(JEMALLOC_FOUND) set(JEMALLOC_LIBRARIES ${JEMALLOC_LIBRARY}) set(JEMALLOC_INCLUDE_DIRS ${JEMALLOC_INCLUDE_DIR}) endif() mark_as_advanced(JEMALLOC_INCLUDE_DIR JEMALLOC_LIBRARY) snort3-3.1.82.0/cmake/FindLibunwind.cmake000066400000000000000000000017541457433257500200370ustar00rootroot00000000000000# FindLibunwind # --------- # # Find the libunwind includes and library. # # Result Variables # ^^^^^^^^^^^^^^^^ # # This module will set the following variables in your project: # # ``LIBUNWIND_INCLUDE_DIRS`` # where to find rpc.h, etc. # ``LIBUNWIND_LIBRARIES`` # the libraries to link against to use TIRPC. # ``LIBUNWIND_VERSION`` # the version of TIRPC found. # ``LIBUNWIND_FOUND`` # true if the TIRPC headers and libraries were found. # find_package(PkgConfig QUIET) pkg_check_modules(PC_LIBUNWIND libunwind) find_path(LIBUNWIND_INCLUDE_DIRS NAMES libunwind.h HINTS ${PC_LIBUNWIND_INCLUDE_DIRS} ) find_library(LIBUNWIND_LIBRARIES NAMES unwind HINTS ${PC_LIBUNWIND_LIBRARY_DIRS} ) set(LIBUNWIND_VERSION ${PC_LIBUNWIND_VERSION}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(Libunwind REQUIRED_VARS LIBUNWIND_LIBRARIES LIBUNWIND_INCLUDE_DIRS VERSION_VAR LIBUNWIND_VERSION ) mark_as_advanced(LIBUNWIND_INCLUDE_DIRS LIBUNWIND_LIBRARIES) snort3-3.1.82.0/cmake/FindLuaJIT.cmake000066400000000000000000000036171457433257500171740ustar00rootroot00000000000000# # Locate LuaJIT library # This module defines # LUAJIT_FOUND, if false, do not try to link to Lua # LUAJIT_LIBRARIES # LUAJIT_INCLUDE_DIR, where to find lua.h # LUAJIT_VERSION_STRING, the version of LuaJIT found set(ERROR_MESSAGE "\n\tCan't Find luajit! Get it from http://luajit.org/download.html or use the --with-luajit-* options if you have it installed inn an unusual place.\n" ) find_package(PkgConfig) pkg_check_modules(PC_LUAJIT luajit) # Use LUAJIT_INCLUDE_DIR_HINT and LUAJIT_LIBRARY_DIR_HINT from configure_cmake.sh as primary hints # and then package config information after that. find_path(LUAJIT_INCLUDE_DIR luajit.h HINTS ${LUAJIT_INCLUDE_DIR_HINT} ${PC_LUAJIT_INCLUDEDIR} ${PC_LUAJIT_INCLUDE_DIRS}) if (STATIC_LUAJIT) find_library(LUAJIT_LIBRARIES NAMES libluajit-5.1.a HINTS ${LUAJIT_LIBRARIES_DIR_HINT} ${PC_LUAJIT_LIBDIR} ${PC_LUAJIT_LIBRARY_DIRS}) else() find_library(LUAJIT_LIBRARIES NAMES luajit-5.1 HINTS ${LUAJIT_LIBRARIES_DIR_HINT} ${PC_LUAJIT_LIBDIR} ${PC_LUAJIT_LIBRARY_DIRS}) endif() if (APPLE) set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${LUAJIT_LIBRARIES} -pagezero_size 10000 -image_base 100000000") endif() if(LUAJIT_INCLUDE_DIR AND EXISTS "${LUAJIT_INCLUDE_DIR}/luajit.h") file(STRINGS "${LUAJIT_INCLUDE_DIR}/luajit.h" luajit_version_str REGEX "^#define[ \t]+LUAJIT_VERSION[ \t]+\"LuaJIT .+\"") string(REGEX REPLACE "^#define[ \t]+LUAJIT_VERSION[ \t]+\"LuaJIT ([^\"]+)\".*" "\\1" LUAJIT_VERSION_STRING "${luajit_version_str}") unset(luajit_version_str) endif() include(FindPackageHandleStandardArgs) # handle the QUIETLY and REQUIRED arguments and set LUA_FOUND to TRUE if # all listed variables are TRUE find_package_handle_standard_args(LuaJIT REQUIRED_VARS LUAJIT_LIBRARIES LUAJIT_INCLUDE_DIR VERSION_VAR LUAJIT_VERSION_STRING FAIL_MESSAGE "${ERROR_MESSAGE}" ) mark_as_advanced(LUAJIT_INCLUDE_DIR LUAJIT_LIBRARIES) snort3-3.1.82.0/cmake/FindML.cmake000066400000000000000000000005321457433257500164050ustar00rootroot00000000000000find_library(ML_LIBRARIES NAMES ml_static HINTS ${ML_LIBRARIES_DIR_HINT}) find_path(ML_INCLUDE_DIRS libml.h HINTS ${ML_INCLUDE_DIR_HINT}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(ML DEFAULT_MSG ML_LIBRARIES ML_INCLUDE_DIRS ) if (ML_FOUND AND NOT ENABLE_KAIZEN_MOCK) set(HAVE_LIBML TRUE) endif() snort3-3.1.82.0/cmake/FindNUMA.cmake000066400000000000000000000014031457433257500166330ustar00rootroot00000000000000find_path(NUMA_INCLUDE_DIRS numa.h) find_library(NUMA_LIBRARIES NAMES numa) if(NUMA_INCLUDE_DIRS AND NUMA_LIBRARIES) set(NUMA_FOUND TRUE) set(NUMA_LIBRARIES ${NUMA_LIBRARIES}) set(NUMA_INCLUDE_DIRS ${NUMA_INCLUDE_DIRS}) endif() if (NOT NUMA_FOUND) find_package(PkgConfig) pkg_check_modules(PC_NUMA libnuma) if(PC_NUMA_FOUND) set(NUMA_FOUND TRUE) set(NUMA_INCLUDE_DIRS ${PC_NUMA_INCLUDEDIR} ${PC_NUMA_INCLUDE_DIRS}) set(NUMA_LIBRARIES ${PC_NUMA_LIBDIR} ${PC_NUMA_LIBRARY_DIRS}) endif() endif() if(NUMA_FOUND) set(HAVE_NUMA "1") endif() include(FindPackageHandleStandardArgs) find_package_handle_standard_args(NUMA DEFAULT_MSG NUMA_LIBRARIES NUMA_INCLUDE_DIRS) mark_as_advanced(NUMA_INCLUDE_DIRS NUMA_LIBRARIES)snort3-3.1.82.0/cmake/FindPCAP.cmake000066400000000000000000000044351457433257500166260ustar00rootroot00000000000000# # - Try to find libpcap include dirs and libraries # # Usage of this module as follows: # # find_package(PCAP) # # Variables defined by this module: # # PCAP_FOUND System has libpcap, include and library dirs found # PCAP_INCLUDE_DIR The libpcap include directories. # PCAP_LIBRARIES The libpcap library set(ERROR_MESSAGE " ERROR! Libpcap library/headers (libpcap.a (or .so)/pcap.h) not found, go get it from http://www.tcpdump.org or use the --with-pcap-* options, if you have it installed in unusual place. Also check if your libpcap depends on another shared library that may be installed in an unusual place" ) # Call find_path twice. First search custom path, then search standard paths. if (PCAP_INCLUDE_DIR_HINT) find_path(PCAP_INCLUDE_DIR pcap.h HINTS ${PCAP_INCLUDE_DIR_HINT} NO_DEFAULT_PATH ) endif() find_path(PCAP_INCLUDE_DIR pcap.h) # Ditto for the library. if (PCAP_LIBRARIES_DIR_HINT) find_library(PCAP_LIBRARIES pcap HINTS ${PCAP_LIBRARIES_DIR_HINT} NO_DEFAULT_PATH ) endif() find_library(PCAP_LIBRARIES pcap) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(PCAP REQUIRED_VARS PCAP_LIBRARIES PCAP_INCLUDE_DIR FAIL_MESSAGE ${ERROR_MESSAGE} ) # Check if linking against libpcap also requires linking against a thread library. # (lifted from Bro's FindPCAP.cmake) include(CheckCSourceCompiles) set(CMAKE_REQUIRED_LIBRARIES ${PCAP_LIBRARIES}) check_c_source_compiles("int main() { return 0; }" PCAP_LINKS_SOLO) set(CMAKE_REQUIRED_LIBRARIES) if (NOT PCAP_LINKS_SOLO) find_package(Threads) if (THREADS_FOUND) set(CMAKE_REQUIRED_LIBRARIES ${PCAP_LIBRARIES} ${CMAKE_THREAD_LIBS_INIT}) check_c_source_compiles("int main() { return 0; }" PCAP_NEEDS_THREADS) set(CMAKE_REQUIRED_LIBRARIES) endif () if (THREADS_FOUND AND PCAP_NEEDS_THREADS) set(_tmp ${PCAP_LIBRARIES} ${CMAKE_THREAD_LIBS_INIT}) list(REMOVE_DUPLICATES _tmp) set(PCAP_LIBRARIES ${_tmp} CACHE STRING "Libraries needed to link against libpcap" FORCE) else () message(SEND_ERROR "Couldn't determine how to link against libpcap") endif () endif () mark_as_advanced( PCAP_INCLUDE_DIR PCAP_LIBRARIES ) snort3-3.1.82.0/cmake/FindPCRE.cmake000066400000000000000000000017331457433257500166320ustar00rootroot00000000000000# - Find pcre # Find the native PCRE includes and library # # PCRE_INCLUDE_DIR - where to find pcre.h, etc. # PCRE_LIBRARIES - List of libraries when using pcre. # PCRE_FOUND - True if pcre found. set(ERROR_MESSAGE "\n\tERROR! Libpcre library not found. \tGet it from http://www.pcre.org\n" ) find_package(PkgConfig) pkg_check_modules(PC_PCRE libpcre) # Use PCRE_INCLUDE_DIR_HINT and PCRE_LIBRARIES_DIR_HINT from configure_cmake.sh as primary hints # and then package config information after that. find_path(PCRE_INCLUDE_DIR pcre.h HINTS ${PCRE_INCLUDE_DIR_HINT} ${PC_PCRE_INCLUDEDIR} ${PC_PCRE_INCLUDE_DIRS}) find_library(PCRE_LIBRARIES NAMES pcre HINTS ${PCRE_LIBRARIES_DIR_HINT} ${PC_PCRE_LIBDIR} ${PC_PCRE_LIBRARY_DIRS}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(PCRE REQUIRED_VARS PCRE_INCLUDE_DIR PCRE_LIBRARIES FAIL_MESSAGE "${ERROR_MESSAGE}" ) mark_as_advanced( PCRE_LIBRARIES PCRE_INCLUDE_DIR ) snort3-3.1.82.0/cmake/FindSafeC.cmake000066400000000000000000000011031457433257500170510ustar00rootroot00000000000000 find_package(PkgConfig) pkg_check_modules(PC_SAFEC libsafec) find_path(SAFEC_INCLUDE_DIR NAMES safe_lib.h HINTS ${PC_SAFEC_INCLUDEDIR} ${PC_SAFEC_INCLUDE_DIRS} NO_SYSTEM_ENVIRONMENT_PATH ) find_library(SAFEC_LIBRARIES NAMES ${PC_SAFEC_LIBRARIES} HINTS ${PC_SAFEC_LIBDIR} ${PC_SAFEC_LIBRARY_DIRS} ) include(FindPackageHandleStandardArgs) find_package_handle_standard_args( SafeC REQUIRED_VARS SAFEC_INCLUDE_DIR SAFEC_LIBRARIES VERSION_VAR PC_SAFEC_VERSION ) mark_as_advanced( SAFEC_INCLUDE_DIR SAFEC_LIBRARIES ) snort3-3.1.82.0/cmake/FindTCMalloc.cmake000066400000000000000000000006151457433257500175350ustar00rootroot00000000000000 find_package(PkgConfig) pkg_check_modules(PC_TCMALLOC libtcmalloc) find_library(TCMALLOC_LIBRARIES NAMES tcmalloc tcmalloc_minimal HINTS ${PC_TCMALLOC_LIBDIR} ${PC_TCMALLOC_LIBRARY_DIRS}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(TCMalloc REQUIRED_VARS TCMALLOC_LIBRARIES VERSION_VAR PC_TCMALLOC_VERSION) mark_as_advanced(TCMALLOC_CFLAGS TCMALLOC_LIBRARIES) snort3-3.1.82.0/cmake/FindTIRPC.cmake000066400000000000000000000016751457433257500167670ustar00rootroot00000000000000# FindTIRPC # --------- # # Find the native TIRPC includes and library. # # Result Variables # ^^^^^^^^^^^^^^^^ # # This module will set the following variables in your project: # # ``TIRPC_INCLUDE_DIRS`` # where to find rpc.h, etc. # ``TIRPC_LIBRARIES`` # the libraries to link against to use TIRPC. # ``TIRPC_VERSION`` # the version of TIRPC found. # ``TIRPC_FOUND`` # true if the TIRPC headers and libraries were found. # find_package(PkgConfig QUIET) pkg_check_modules(PC_TIRPC libtirpc) find_path(TIRPC_INCLUDE_DIRS NAMES netconfig.h PATH_SUFFIXES tirpc HINTS ${PC_TIRPC_INCLUDE_DIRS} ) find_library(TIRPC_LIBRARIES NAMES tirpc HINTS ${PC_TIRPC_LIBRARY_DIRS} ) set(TIRPC_VERSION ${PC_TIRPC_VERSION}) include(FindPackageHandleStandardArgs) find_package_handle_standard_args(TIRPC REQUIRED_VARS TIRPC_LIBRARIES TIRPC_INCLUDE_DIRS VERSION_VAR TIRPC_VERSION ) mark_as_advanced(TIRPC_INCLUDE_DIRS TIRPC_LIBRARIES) snort3-3.1.82.0/cmake/FindUUID.cmake000066400000000000000000000015361457433257500166500ustar00rootroot00000000000000# Find the native UUID include file and library. find_package(PkgConfig) pkg_check_modules(PC_UUID uuid) if (PC_UUID_FOUND) set(UUID_LIBRARY_NAME ${PC_UUID_LIBRARIES}) else() set(UUID_LIBRARY_NAME "uuid") endif() find_path (UUID_INCLUDE_DIR NAMES uuid.h HINTS ${UUID_INCLUDE_DIR_HINT} ${PC_UUID_INCLUDEDIR} ${PC_UUID_INCLUDE_DIRS} PATH_SUFFIXES uuid ) if (UUID_LIBRARY_NAME) find_library(UUID_LIBRARY NAMES ${UUID_LIBRARY_NAME} HINTS ${UUID_LIBRARIES_DIR_HINT} ${PC_UUID_LIBDIR} ${PC_UUID_LIBRARY_DIRS} ) set(REQUIRED_UUID_LIBRARY "UUID_LIBRARY") else() set(REQUIRED_UUID_LIBRARY "") endif() include(FindPackageHandleStandardArgs) find_package_handle_standard_args( UUID REQUIRED_VARS UUID_INCLUDE_DIR ${REQUIRED_UUID_LIBRARY} ) mark_as_advanced( UUID_INCLUDE_DIR UUID_LIBRARY ) snort3-3.1.82.0/cmake/compiler_features.cmake000066400000000000000000000015261457433257500210100ustar00rootroot00000000000000set ( _SAVE_CMAKE_REQUIRED_FLAGS ${CMAKE_REQUIRED_FLAGS} ) set ( CMAKE_REQUIRED_FLAGS "-std=c++14 -fPIC -shared -Wl,-undefined,dynamic_lookup" ) unset ( HAVE_EXTERN_GNU_TLS ) check_cxx_source_compiles ( "extern __thread int x; void foo() { ++x; }" HAVE_EXTERN_GNU_TLS ) unset (HAVE_THREAD_LOCAL ) check_cxx_source_compiles ( "thread_local int x;" HAVE_THREAD_LOCAL ) unset ( USE_THREAD_LOCAL ) if ( NOT HAVE_EXTERN_GNU_TLS ) if ( HAVE_THREAD_LOCAL ) set ( USE_THREAD_LOCAL TRUE CACHE INTERNAL "Use thread_local keyword" ) else ( HAVE_THREAD_LOCAL ) message ( SEND_ERROR "Compiler does not support thread_local OR extern __thread declarations" ) endif ( HAVE_THREAD_LOCAL ) endif ( NOT HAVE_EXTERN_GNU_TLS ) set ( CMAKE_REQUIRED_FLAGS ${_SAVE_CMAKE_REQUIRED_FLAGS} ) snort3-3.1.82.0/cmake/configure_options.cmake000066400000000000000000000174601457433257500210400ustar00rootroot00000000000000# map cmake options to compiler defines and do miscellaneous further configuration work # cmake options are defined in cmake/create_options.cmake # features set ( SHELL ${ENABLE_SHELL} ) set ( UNIT_TEST ${ENABLE_UNIT_TESTS} ) if ( ENABLE_BENCHMARK_TESTS ) add_definitions( -DBENCHMARK_TEST ) add_definitions( -DCATCH_CONFIG_ENABLE_BENCHMARKING ) endif ( ENABLE_BENCHMARK_TESTS ) if ( NOT ENABLE_COREFILES ) set ( NOCOREFILE ON ) endif ( NOT ENABLE_COREFILES ) set ( _LARGEFILE_SOURCE ${ENABLE_LARGE_PCAP} ) set ( USE_STDLOG ${ENABLE_STDLOG} ) set ( USE_TSC_CLOCK ${ENABLE_TSC_CLOCK} ) set ( NO_PROFILER ${DISABLE_SNORT_PROFILER} ) set ( DEEP_PROFILING ${ENABLE_DEEP_PROFILING} ) set ( ENABLE_MEMORY_PROFILER ${ENABLE_MEMORY_PROFILER} ) set ( ENABLE_RULE_PROFILER ${ENABLE_RULE_PROFILER} ) if ( ENABLE_LARGE_PCAP ) set ( _FILE_OFFSET_BITS 64 ) endif ( ENABLE_LARGE_PCAP ) # Flex Lexer set ( FLEX_FLAGS "-Ca" ) # documentation if ( NOT ASCIIDOC_FOUND ) get_property ( MAKE_HTML_DOC_HELP_STRING CACHE "MAKE_HTML_DOC" PROPERTY HELPSTRING ) set ( MAKE_HTML_DOC OFF CACHE BOOL ${MAKE_HTML_DOC_HELP_STRING} FORCE ) endif() if ( NOT (DBLATEX_FOUND AND ASCIIDOC_FOUND) ) get_property ( MAKE_PDF_DOC_HELP_STRING CACHE "MAKE_PDF_DOC" PROPERTY HELPSTRING ) set ( MAKE_PDF_DOC OFF CACHE BOOL ${MAKE_PDF_DOC_HELP_STRING} FORCE ) endif() if ( NOT (W3M_FOUND AND ASCIIDOC_FOUND) ) get_property ( MAKE_TEXT_DOC_HELP_STRING CACHE "MAKE_TEXT_DOC" PROPERTY HELPSTRING ) set ( MAKE_TEXT_DOC OFF CACHE BOOL ${MAKE_TEXT_DOC_HELP_STRING} FORCE ) endif() # security if ( ENABLE_HARDENED_BUILD ) check_cxx_compiler_flag ( "-Wdate-time" HAS_WDATE_TIME_CPPFLAG ) if ( HAS_WDATE_TIME_CPPFLAG ) string ( APPEND HARDENED_CXX_FLAGS " -Wdate-time" ) endif () check_cxx_compiler_flag ( "-D_FORTIFY_SOURCE=2" HAS_FORTIFY_SOURCE_2_CPPFLAG ) if ( HAS_FORTIFY_SOURCE_2_CPPFLAG ) string ( APPEND HARDENED_CXX_FLAGS " -D_FORTIFY_SOURCE=2" ) endif () check_cxx_compiler_flag ( "-fstack-protector-strong" HAS_FSTACK_PROTECTOR_STRONG_CXXFLAG ) if ( HAS_FSTACK_PROTECTOR_STRONG_CXXFLAG ) string ( APPEND HARDENED_CXX_FLAGS " -fstack-protector-strong" ) endif () check_cxx_compiler_flag ( "-Wformat" HAS_WFORMAT_CXXFLAG ) if ( HAS_WFORMAT_CXXFLAG ) string ( APPEND HARDENED_CXX_FLAGS " -Wformat" ) endif () check_cxx_compiler_flag ( "-Werror=format-security" HAS_WERROR_FORMAT_SECURITY_CXXFLAG ) if ( HAS_WERROR_FORMAT_SECURITY_CXXFLAG ) string ( APPEND HARDENED_CXX_FLAGS " -Werror=format-security" ) endif () set ( CMAKE_REQUIRED_FLAGS "-Wl,-z,relro" ) check_cxx_compiler_flag ( "" HAS_ZRELRO_LDFLAG ) unset ( CMAKE_REQUIRED_FLAGS ) if ( HAS_ZRELRO_LDFLAG ) string ( APPEND HARDENED_LINKER_FLAGS " -Wl,-z,relro" ) endif () set ( CMAKE_REQUIRED_FLAGS "-Wl,-z,now" ) check_cxx_compiler_flag ( "-Wl,-z,now" HAS_ZNOW_LDFLAG ) unset ( CMAKE_REQUIRED_FLAGS ) if ( HAS_ZNOW_LDFLAG ) string ( APPEND HARDENED_LINKER_FLAGS " -Wl,-z,now" ) endif () endif ( ENABLE_HARDENED_BUILD ) if ( ENABLE_PIE ) set ( CMAKE_REQUIRED_FLAGS "-fPIE -pie" ) check_cxx_compiler_flag ( "-fPIE" HAS_PIE_SUPPORT ) unset ( CMAKE_REQUIRED_FLAGS ) if ( HAS_PIE_SUPPORT ) string ( APPEND HARDENED_CXX_FLAGS " -fPIE" ) string ( APPEND HARDENED_LINKER_FLAGS " -fPIE -pie" ) endif () endif ( ENABLE_PIE ) # debugging set ( DEBUG_MSGS ${ENABLE_DEBUG_MSGS} ) # FIXIT-L Properly handle NDEBUG through CMAKE_BUILD_TYPE if ( ENABLE_DEBUG ) string ( APPEND DEBUGGING_C_FLAGS " -g -DDEBUG" ) else () string ( APPEND DEBUGGING_C_FLAGS " -DNDEBUG" ) endif ( ENABLE_DEBUG ) if ( ENABLE_GDB ) string ( APPEND DEBUGGING_C_FLAGS " -g -ggdb" ) endif ( ENABLE_GDB ) if ( ENABLE_PROFILE AND CMAKE_COMPILER_IS_GNUCXX ) string ( APPEND DEBUGGING_C_FLAGS " -pg" ) endif ( ENABLE_PROFILE AND CMAKE_COMPILER_IS_GNUCXX ) # ASAN and TSAN are mutually exclusive, so have them absolutely set SANITIZER_*_FLAGS first. if ( ENABLE_ADDRESS_SANITIZER ) set ( ASAN_CXX_FLAGS "-fsanitize=address -fno-omit-frame-pointer" ) set ( ASAN_LINKER_FLAGS "-fsanitize=address" ) set ( CMAKE_REQUIRED_FLAGS "${ASAN_LINKER_FLAGS}" ) check_cxx_compiler_flag ( "${ASAN_CXX_FLAGS}" HAVE_ADDRESS_SANITIZER ) unset ( CMAKE_REQUIRED_FLAGS ) if ( HAVE_ADDRESS_SANITIZER ) set ( SANITIZER_CXX_FLAGS "${ASAN_CXX_FLAGS}" ) set ( SANITIZER_LINKER_FLAGS "${ASAN_LINKER_FLAGS}" ) else () message ( SEND_ERROR "Could not enable the address sanitizer!" ) endif () endif ( ENABLE_ADDRESS_SANITIZER ) if ( ENABLE_THREAD_SANITIZER ) set ( TSAN_CXX_FLAGS "-fsanitize=thread -fno-omit-frame-pointer" ) set ( TSAN_LINKER_FLAGS "-fsanitize=thread" ) set ( CMAKE_REQUIRED_FLAGS "${TSAN_LINKER_FLAGS}" ) check_cxx_compiler_flag ( "${TSAN_CXX_FLAGS}" HAVE_THREAD_SANITIZER ) unset ( CMAKE_REQUIRED_FLAGS ) if ( HAVE_THREAD_SANITIZER ) set ( SANITIZER_CXX_FLAGS "${TSAN_CXX_FLAGS}" ) set ( SANITIZER_LINKER_FLAGS "${TSAN_LINKER_FLAGS}" ) else () message ( SEND_ERROR "Could not enable the thread sanitizer!" ) endif () endif ( ENABLE_THREAD_SANITIZER ) if ( ENABLE_UB_SANITIZER ) set ( UBSAN_CXX_FLAGS "-fsanitize=undefined -fno-sanitize=alignment -fno-omit-frame-pointer" ) set ( UBSAN_LINKER_FLAGS "-fsanitize=undefined -fno-sanitize=alignment" ) set ( CMAKE_REQUIRED_FLAGS "${UBSAN_LINKER_FLAGS}" ) check_cxx_compiler_flag ( "${UBSAN_CXX_FLAGS}" HAVE_UB_SANITIZER ) unset ( CMAKE_REQUIRED_FLAGS ) if ( HAVE_UB_SANITIZER ) string ( APPEND SANITIZER_CXX_FLAGS " ${UBSAN_CXX_FLAGS}" ) string ( APPEND SANITIZER_LINKER_FLAGS " ${UBSAN_LINKER_FLAGS}" ) else () message ( SEND_ERROR "Could not enable the undefined behavior sanitizer!" ) endif () endif ( ENABLE_UB_SANITIZER ) if ( ENABLE_TCMALLOC ) if ( ENABLE_ADDRESS_SANITIZER ) message ( SEND_ERROR "TCMalloc cannot be used at the same time as address sanitizer!" ) endif () find_package ( TCMalloc REQUIRED ) set ( TCMALLOC_C_FLAGS "-fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-free" ) set ( HAVE_TCMALLOC "1" ) endif ( ENABLE_TCMALLOC ) if ( ENABLE_JEMALLOC ) if ( ENABLE_ADDRESS_SANITIZER ) message ( SEND_ERROR "JEMalloc cannot be used at the same time as address sanitizer!" ) endif () find_package ( JEMalloc REQUIRED ) set ( JEMALLOC_C_FLAGS "-fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-free" ) set ( HAVE_JEMALLOC "1" ) endif ( ENABLE_JEMALLOC ) if ( ENABLE_CODE_COVERAGE ) include(${CMAKE_MODULE_PATH}/CodeCoverage.cmake) endif ( ENABLE_CODE_COVERAGE ) # Accumulate extra flags and libraries #[[ message(" HARDENED_CXX_FLAGS = ${HARDENED_CXX_FLAGS} HARDENED_LINKER_FLAGS = ${HARDENED_LINKER_FLAGS} DEBUGGING_C_FLAGS = ${DEBUGGING_C_FLAGS} SANITIZER_CXX_FLAGS = ${SANITIZER_CXX_FLAGS} SANITIZER_LINKER_FLAGS = ${SANITIZER_LINKER_FLAGS} COVERAGE_COMPILER_FLAGS = ${COVERAGE_COMPILER_FLAGS} COVERAGE_LINKER_FLAGS = ${COVERAGE_LINKER_FLAGS} COVERAGE_LIBRARIES = ${COVERAGE_LIBRARIES} TCMALLOC_C_FLAGS = ${TCMALLOC_C_FLAGS} TCMALLOC_LIBRARIES = ${TCMALLOC_LIBRARIES} ") ]] set ( EXTRA_C_FLAGS "${EXTRA_C_FLAGS} ${HARDENED_CXX_FLAGS} ${DEBUGGING_C_FLAGS} ${SANITIZER_CXX_FLAGS} ${TCMALLOC_C_FLAGS} ${COVERAGE_COMPILER_FLAGS}" ) set ( EXTRA_CXX_FLAGS "${EXTRA_CXX_FLAGS} ${HARDENED_CXX_FLAGS} ${DEBUGGING_C_FLAGS} ${SANITIZER_CXX_FLAGS} ${TCMALLOC_C_FLAGS} ${COVERAGE_COMPILER_FLAGS}" ) set ( EXTRA_LINKER_FLAGS "${EXTRA_LINKER_FLAGS} ${HARDENED_LINKER_FLAGS} ${SANITIZER_LINKER_FLAGS} ${COVERAGE_LINKER_FLAGS}" ) foreach (EXTRA_LIBRARY IN LISTS COVERAGE_LIBRARIES TCMALLOC_LIBRARIES JEMALLOC_LIBRARY ) list ( APPEND EXTRA_LIBRARIES ${EXTRA_LIBRARY} ) endforeach () snort3-3.1.82.0/cmake/create_options.cmake000066400000000000000000000066661457433257500203300ustar00rootroot00000000000000# All of the possible user options. All of these options will show up # in the CACHE. If you'd like to change one of these values, # use `ccmake ${PATH_TO_SOURCE}`. # Alternatively, you can pass them to cmake on the command line using # the '-D' flag: # cmake -DENABLE_FOO=ON -DCMAKE_INSTALL_PREFIX=/my/install/path $cmake_src_path # static/dynamic switches option ( STATIC_CODECS "include codecs in binary" ON ) option ( STATIC_INSPECTORS "include inspectors in binary" ON ) option ( STATIC_LOGGERS "include loggers in binary" ON ) option ( STATIC_IPS_ACTIONS "include ips actions in binary" ON ) option ( STATIC_IPS_OPTIONS "include ips options in binary" ON ) option ( STATIC_SEARCH_ENGINES "include search engines in binary" ON ) option ( ENABLE_STATIC_DAQ "link static DAQ modules" ON ) # features option ( ENABLE_SHELL "enable shell support" OFF ) option ( ENABLE_UNIT_TESTS "enable unit tests" OFF ) option ( ENABLE_BENCHMARK_TESTS "enable benchmark tests" OFF ) option ( ENABLE_COREFILES "Prevent Snort from generating core files" ON ) option ( ENABLE_LARGE_PCAP "Enable support for pcaps larger than 2 GB" OFF ) option ( ENABLE_STDLOG "Use file descriptor 3 instead of stdout for alerts" OFF ) option ( ENABLE_TSC_CLOCK "Use timestamp counter register clock (x86 and arm only)" OFF ) # documentation option ( MAKE_HTML_DOC "Create the HTML documentation" ON ) option ( MAKE_PDF_DOC "Create the PDF documentation" ON ) option ( MAKE_TEXT_DOC "Create the text documentation" ON ) option ( MAKE_DOC "Create documentation" ON ) # security option ( ENABLE_HARDENED_BUILD "Detect and use compile-time hardening options" OFF ) option ( ENABLE_PIE "Attempt to produce a position-independent executable" OFF ) option ( ENABLE_SAFEC "Use bounds checked functions provided by libsafec" ON ) # debugging option ( ENABLE_DEBUG_MSGS "Enable debug printing options (bugreports and developers only)" OFF ) option ( ENABLE_DEBUG "Enable debugging options (bugreports and developers only)" OFF ) option ( ENABLE_GDB "Enable gdb debugging information" ON ) option ( ENABLE_PROFILE "Enable profiling options (developers only)" OFF ) option ( DISABLE_SNORT_PROFILER "Disable snort Profiler (developers only)" OFF ) option ( ENABLE_DEEP_PROFILING "Enable deep profiling of snort functions (developers only)" OFF ) option ( ENABLE_MEMORY_PROFILER "Enable memory profiler" OFF ) option ( ENABLE_RULE_PROFILER "Enable rule keyword profiler (developers only)" OFF ) option ( ENABLE_ADDRESS_SANITIZER "enable address sanitizer support" OFF ) option ( ENABLE_THREAD_SANITIZER "enable thread sanitizer support" OFF ) option ( ENABLE_UB_SANITIZER "enable undefined behavior sanitizer support" OFF ) option ( ENABLE_TCMALLOC "enable using tcmalloc for dynamic memory management" OFF ) option ( ENABLE_JEMALLOC "enable using jemalloc for dynamic memory management" OFF ) option ( ENABLE_CODE_COVERAGE "Whether to enable code coverage support" OFF ) # signals set ( SIGNAL_SNORT_RELOAD "SIGHUP" CACHE STRING "set the SNORT_RELOAD signal (must be a valid integer or signal name)" ) set ( SIGNAL_SNORT_DUMP_STATS "SIGUSR1" CACHE STRING "set the SNORT_DUMP_STATS signal (must be a valid integer or signal name)" ) set ( SIGNAL_SNORT_ROTATE_STATS "SIGUSR2" CACHE STRING "set the SNORT_ROTATE_STATS signal (must be a valid integer or signal name)" ) set ( SIGNAL_SNORT_READ_ATTR_TBL "SIGURG" CACHE STRING "set the SNORT_READ_ATTR_TBL signal (must be a valid integer or signal name)" ) snort3-3.1.82.0/cmake/create_pkg_config.cmake000066400000000000000000000040641457433257500207310ustar00rootroot00000000000000# creating pkg-config module. these will all be substituted into snort.pc # set pkgconfig vars set(prefix "${CMAKE_INSTALL_PREFIX}") set(exec_prefix "\${prefix}") set(bindir "\${exec_prefix}/bin") set(libdir "\${prefix}/${CMAKE_INSTALL_LIBDIR}") set(includedir "\${prefix}/include") set(datarootdir "\${prefix}/share") set(datadir "\${datarootdir}") set(mandir "\${datarootdir}/man") set(infodir "\${datarootdir}/info") if(DAQ_INCLUDE_DIR) set(DAQ_CPPFLAGS "-I${DAQ_INCLUDE_DIR}") endif() if(ENABLE_MEMORY_PROFILER) set(MEMORY_PROFILER_CPPFLAGS "-DENABLE_MEMORY_PROFILER") endif() if(ENABLE_RULE_PROFILER) set(RULE_PROFILER_CPPFLAGS "-DENABLE_RULE_PROFILER") endif() if(DISABLE_SNORT_PROFILER) set(NO_PROFILER_CPPFLAGS "-DNO_PROFILER") endif() if(DNET_INCLUDE_DIR) set(DNET_CPPFLAGS "-I${DNET_INCLUDE_DIR}") endif() if(ENABLE_DEEP_PROFILING) set(DEEP_PROFILING_CPPFLAGS "-DDEEP_PROFILING") endif() if(ENABLE_TSC_CLOCK) set(TSC_CPPFLAGS "-DUSE_TSC_CLOCK") endif() if(FLEX_INCLUDES) set(FLEX_CPPFLAGS "-I${FLEX_INCLUDES}") endif() if(HS_INCLUDE_DIR) set(HYPERSCAN_CPPFLAGS "-I${HS_INCLUDE_DIR}") endif() if(HWLOC_INCLUDE_DIR) set(HWLOC_CPPFLAGS "-I${HWLOC_INCLUDE_DIR}") endif() if(ICONV_INCLUDE_DIR) set(ICONV_CPPFLAGS "-I${ICONV_INCLUDE_DIR}") endif() if(LUAJIT_INCLUDE_DIR) set(LUAJIT_CPPFLAGS "-I${LUAJIT_INCLUDE_DIR}") endif() if(LZMA_INCLUDE_DIR) set(LZMA_CPPFLAGS "-I${LZMA_INCLUDE_DIR}") endif() if(OPENSSL_INCLUDE_DIR) set(OPENSSL_CPPFLAGS "-I${OPENSSL_INCLUDE_DIR}") endif() if(PCAP_INCLUDE_DIR) set(PCAP_CPPFLAGS "-I${PCAP_INCLUDE_DIR}") endif() if(PCRE_INCLUDE_DIR) set(PCRE_CPPFLAGS "-I${PCRE_INCLUDE_DIR}") endif() if(UUID_INCLUDE_DIR) set(UUID_CPPFLAGS "-I${UUID_INCLUDE_DIR}") endif() if(NUMA_INCLUDE_DIR) set(NUMA_CPPFLAGS "-I${NUMA_INCLUDE_DIR}") endif() # create & install pkgconfig file configure_file( "${CMAKE_SOURCE_DIR}/snort.pc.in" "${CMAKE_BINARY_DIR}/snort.pc" @ONLY ) install (FILES ${CMAKE_BINARY_DIR}/snort.pc DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig/" ) snort3-3.1.82.0/cmake/include_libraries.cmake000066400000000000000000000014301457433257500207510ustar00rootroot00000000000000 # required libraries find_package(Threads REQUIRED) find_package(DAQ REQUIRED) find_package(DNET REQUIRED) find_package(FlexLexer REQUIRED) find_package(HWLOC REQUIRED) find_package(LuaJIT REQUIRED) find_package(OpenSSL 1.1.1 REQUIRED) find_package(PCAP REQUIRED) find_package(PCRE REQUIRED) find_package(ZLIB REQUIRED) if (ENABLE_UNIT_TESTS) find_package(CppUTest REQUIRED) endif (ENABLE_UNIT_TESTS) # optional libraries find_package(Atomic QUIET) find_package(LibLZMA QUIET) find_package(Asciidoc QUIET) find_package(DBLATEX QUIET) find_package(Ruby QUIET 1.8.7) find_package(HS QUIET 4.4.0) if (ENABLE_SAFEC) find_package(SafeC QUIET) endif (ENABLE_SAFEC) find_package(ICONV QUIET) find_package(UUID QUIET) find_package(Libunwind) find_package(NUMA QUIET) find_package(ML QUIET) snort3-3.1.82.0/cmake/macros.cmake000066400000000000000000000054571457433257500165730ustar00rootroot00000000000000# TO CALL THIS MACRO... # PARAMS: # libname : The module's name # additional args : the module's sources. Must have at least one source macro (add_dynamic_module libname install_path) set (sources ${ARGN}) add_library ( ${libname} MODULE ${sources} ) set_target_properties ( ${libname} PROPERTIES COMPILE_FLAGS "-DBUILDING_SO" PREFIX "" ) if (APPLE) set_target_properties ( ${libname} PROPERTIES LINK_FLAGS "-undefined dynamic_lookup" ) endif() install ( TARGETS ${libname} LIBRARY DESTINATION "${PLUGIN_INSTALL_PATH}/${install_path}" ) endmacro (add_dynamic_module) macro (add_dynamic_daq_module libname ) set (sources ${ARGN}) add_library ( ${libname} MODULE ${sources} ) set_target_properties ( ${libname} PROPERTIES COMPILE_FLAGS "-DBUILDING_SO" PREFIX "" ) if (APPLE) set_target_properties ( ${libname} PROPERTIES LINK_FLAGS "-undefined dynamic_lookup" ) endif() install ( TARGETS ${libname} LIBRARY DESTINATION "${LIB_INSTALL_PATH}/daq" ) endmacro (add_dynamic_daq_module) function (add_cpputest testname) if ( ENABLE_UNIT_TESTS ) set(multiValueArgs SOURCES LIBS) cmake_parse_arguments(CppUTest "" "" "${multiValueArgs}" ${ARGN}) add_executable(${testname} EXCLUDE_FROM_ALL ${testname}.cc ${CppUTest_SOURCES}) target_compile_options(${testname} PRIVATE "-DUNIT_TEST_BUILD") target_include_directories(${testname} PRIVATE ${CPPUTEST_INCLUDE_DIR}) target_link_libraries(${testname} ${CPPUTEST_LIBRARIES} ${CppUTest_LIBS}) add_test(${testname} ${testname}) add_dependencies(check ${testname}) endif ( ENABLE_UNIT_TESTS ) endfunction (add_cpputest) function (add_catch_test testname) if ( ENABLE_UNIT_TESTS OR ENABLE_BENCHMARK_TESTS ) set(options NO_TEST_SOURCE) set(multiValueArgs SOURCES LIBS) cmake_parse_arguments(Catch "${options}" "" "${multiValueArgs}" ${ARGN}) if ( NOT Catch_NO_TEST_SOURCE ) set(Test_SOURCE ${testname}.cc) endif() add_executable(${testname} EXCLUDE_FROM_ALL ${Test_SOURCE} ${Catch_SOURCES} $ ) if ( ENABLE_UNIT_TESTS ) target_compile_options(${testname} PRIVATE "-DCATCH_TEST_BUILD") endif ( ENABLE_UNIT_TESTS ) target_link_libraries(${testname} PRIVATE ${Catch_LIBS}) add_test(${testname} ${testname}) add_dependencies(check ${testname}) endif ( ENABLE_UNIT_TESTS OR ENABLE_BENCHMARK_TESTS ) endfunction (add_catch_test) snort3-3.1.82.0/cmake/packaging_data.cmake000066400000000000000000000014531457433257500202140ustar00rootroot00000000000000 set (CPACK_GENERATOR TGZ) set (CPACK_PACKAGE_NAME "snort") set (CPACK_PACKAGE_VENDOR "Cisco") set (CPACK_PACKAGE_VERSION_MAJOR "${VERSION_MAJOR}") set (CPACK_PACKAGE_VERSION_MINOR "${VERSION_MINOR}") set (CPACK_PACKAGE_VERSION_PATCH "${VERSION_PATCH}") set (CPACK_PACKAGE_ICON "${CMAKE_SOURCE_DIR}/doc/images/snort.png") set (CPACK_PACKAGE_INSTALL_DIRECTORY "snort") set (CPACK_RESOURCE_FILE_LICENSE "${CMAKE_SOURCE_DIR}/LICENSE") set (CPACK_RESOURCE_FILE_README "${CMAKE_SOURCE_DIR}/README.md") set (CPACK_SOURCE_PACKAGE_FILE_NAME "${CPACK_PACKAGE_NAME}-${CPACK_PACKAGE_VERSION_MAJOR}.${CPACK_PACKAGE_VERSION_MINOR}.${CPACK_PACKAGE_VERSION_PATCH}") set (CPACK_SOURCE_IGNORE_FILES "tools/snort2lua/tests/;\\\\.git/;\\\\.gitignore;extra/;${CMAKE_BINARY_DIR}/*") set (CPACK_SOURCE_GENERATOR TGZ) include(CPack) snort3-3.1.82.0/cmake/platforms.cmake000066400000000000000000000017041457433257500173050ustar00rootroot00000000000000# # # Library containing all of the information regarding specific platforms, and their specific libraries. # # APPLE is defined by Cmake if (APPLE) set(CMAKE_MACOSX_RPATH OFF) endif() set (CMAKE_SKIP_RPATH ON) # the Clang compiler on MacOS X may need the c++ library explicitly specified if(${CMAKE_SYSTEM_NAME} MATCHES "Darwin") if ("${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang") set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -stdlib=libc++") find_library(CLANG_CXX_LIBRARY NAMES c++ ) endif() endif() include(CheckCCompilerFlag) include(CheckCXXCompilerFlag) CHECK_C_COMPILER_FLAG(-fvisibility=hidden HAS_C_HIDDEN) if (HAS_C_HIDDEN) set(EXTRA_C_FLAGS "${EXTRA_C_FLAGS} -fvisibility=hidden") set(HAVE_VISIBILITY 1) endif() CHECK_CXX_COMPILER_FLAG(-fvisibility=hidden HAS_CXX_HIDDEN) if (HAS_CXX_HIDDEN) set(EXTRA_CXX_FLAGS "${EXTRA_CXX_FLAGS} -fvisibility=hidden") set(HAVE_VISIBILITY 1) endif() snort3-3.1.82.0/cmake/sanity_checks.cmake000066400000000000000000000107551457433257500201330ustar00rootroot00000000000000include(CheckCXXSourceCompiles) include(CheckIncludeFileCXX) include(CheckFunctionExists) include(CheckLibraryExists) include(CheckSymbolExists) include(CheckTypeSize) include(CMakePushCheckState) include (TestBigEndian) test_big_endian(WORDS_BIGENDIAN) #-------------------------------------------------------------------------- # Checks for system library functions #-------------------------------------------------------------------------- check_function_exists(malloc_trim HAVE_MALLOC_TRIM) check_function_exists(memrchr HAVE_MEMRCHR) check_function_exists(sigaction HAVE_SIGACTION) check_function_exists(basename_r HAVE_BASENAME_R) check_cxx_source_compiles( " #include #include void check(char c) {} int main() { char buffer[1024]; /* This will not compile if strerror_r does not return a char* */ check(strerror_r(EACCES, buffer, sizeof(buffer))[0]); return 0; } " HAVE_GNU_STRERROR_R) # vvvvvvvvv GETRPCENT TEST vvvvvvvvv cmake_push_check_state(RESET) if ( CMAKE_SYSTEM_NAME STREQUAL SunOS ) set(CMAKE_REQUIRED_LIBRARIES nsl) endif () check_function_exists(getrpcent HAVE_GETRPCENT) if (NOT HAVE_GETRPCENT) find_package(TIRPC) set(CMAKE_REQUIRED_LIBRARIES ${TIRPC_LIBRARIES}) check_function_exists(getrpcent HAVE_TIRPC_GETRPCENT) if (HAVE_TIRPC_GETRPCENT) set(USE_TIRPC TRUE) else() message(SEND_ERROR "Couldn't find an RPC program number database implementation!") endif() endif() cmake_pop_check_state() # ^^^^^^^^^ GETRPCENT TEST ^^^^^^^^^ #-------------------------------------------------------------------------- # Checks for typedefs, structures, and compiler characteristics. #-------------------------------------------------------------------------- check_type_size("long int" SIZEOF_LONG_INT) check_type_size("unsigned long int" SIZEOF_UNSIGNED_LONG_INT) # vvvvvvvvv INLINE TEST vvvvvvvvv # Taken and edited from www.cmake.org/wiki/CMakeTestInline FOREACH(KEYWORD "inline" "__inline__" "__inline") IF(NOT DEFINED INLINE) check_cxx_source_compiles( " typedef int foo_t; static inline foo_t static_foo(){return 0;} foo_t foo(){return 0;} int main(int argc, char *argv[]){return 0;} " INLINE ) IF(INLINE) add_definitions("-Dinline=${KEYWORD}") break() ENDIF(INLINE) ENDIF(NOT DEFINED INLINE) ENDFOREACH(KEYWORD) IF(NOT DEFINED INLINE) add_definitions("-Dinline=") ENDIF(NOT DEFINED INLINE) # ^^^^^^^^^ INLINE TEST ^^^^^^^^^ # vvvvvvvvv RESTRICT TEST vvvvvvvvv # Taken directly from http://www.cmake.org/pipermail/cmake/2013-January/053113.html # Check for restrict keyword # Builds the macro A_C_RESTRICT form automake foreach(ac_kw __restrict __restrict__ _Restrict restrict) check_cxx_source_compiles( " typedef int * int_ptr; int foo (int_ptr ${ac_kw} ip) { return ip[0]; } int main(){ int s[1]; int * ${ac_kw} t = s; t[0] = 0; return foo(t); } " RESTRICT ) if(RESTRICT) set(ac_cv_c_restrict ${ac_kw}) break() endif() endforeach() if(RESTRICT) add_definitions("-Drestrict=${ac_cv_c_restrict}") else() add_definitions("-Drestrict=") endif() # ^^^^^^^^^ RESTRICT TEST ^^^^^^^^^ # set library variables if (HS_FOUND) check_library_exists (${HS_LIBRARIES} hs_scan "" HAVE_HYPERSCAN) if (HAVE_HYPERSCAN) cmake_push_check_state(RESET) set(CMAKE_REQUIRED_INCLUDES ${HS_INCLUDE_DIRS}) set(CMAKE_REQUIRED_LIBRARIES ${HS_LIBRARIES}) check_function_exists(hs_compile_lit HAVE_HS_COMPILE_LIT) cmake_pop_check_state() endif() endif() if (DEFINED LIBLZMA_LIBRARIES) check_library_exists (${LIBLZMA_LIBRARIES} lzma_code "" HAVE_LZMA) endif() if (ICONV_FOUND) # Not actually a sanity check at the moment... set (HAVE_ICONV "1") endif() if (NUMA_FOUND) check_library_exists (${NUMA_LIBRARIES} numa_num_possible_cpus "" HAVE_NUMA) endif() if (LIBUNWIND_FOUND) # We don't actually use backtrace from libunwind, but it's basically the # only symbol guaranteed to be present. check_library_exists (${LIBUNWIND_LIBRARIES} backtrace "" HAVE_LIBUNWIND) endif() if (SAFEC_FOUND) check_library_exists (${SAFEC_LIBRARIES} printf_s "" HAVE_SAFEC) endif() if (UUID_FOUND) check_library_exists ("${UUID_LIBRARY}" uuid_parse "" HAVE_UUID) endif() snort3-3.1.82.0/cmake_uninstall.cmake.in000066400000000000000000000020121457433257500177650ustar00rootroot00000000000000if(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") message(FATAL_ERROR "Cannot find install manifest: @CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") endif(NOT EXISTS "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt") file(READ "@CMAKE_CURRENT_BINARY_DIR@/install_manifest.txt" files) string(REGEX REPLACE "\n" ";" files "${files}") foreach(file ${files}) message(STATUS "Uninstalling $ENV{DESTDIR}${file}") if(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}") exec_program( "@CMAKE_COMMAND@" ARGS "-E remove \"$ENV{DESTDIR}${file}\"" OUTPUT_VARIABLE rm_out RETURN_VALUE rm_retval ) if(NOT "${rm_retval}" STREQUAL 0) message(FATAL_ERROR "Problem when removing $ENV{DESTDIR}${file}") endif(NOT "${rm_retval}" STREQUAL 0) else(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}") message(STATUS "File $ENV{DESTDIR}${file} does not exist.") endif(IS_SYMLINK "$ENV{DESTDIR}${file}" OR EXISTS "$ENV{DESTDIR}${file}") endforeach(file)snort3-3.1.82.0/config.cmake.h.in000066400000000000000000000110741457433257500163170ustar00rootroot00000000000000#ifndef __CONFIG_H__ #define __CONFIG_H__ /*****************************************************************************/ /** **/ /** If you want to change any of these options, go to your build directory, **/ /** and type `ccmake ${PATH_TO_SOURCE}`". Change your options in the GUI. **/ /** Make sure to compile and regenerate the Makefiles when you are done by **/ /** either exiting the GUI by typing `c` following by `g`, or by typing **/ /** `cmake ${PATH_TO_SOURCE}` from your build directory. **/ /** **/ /*****************************************************************************/ /* General Snort++ Information */ /* Name of package */ #define PACKAGE @PROJECT_NAME@ /* Version number of package */ #define VERSION "@VERSION@" /* Build number for this build */ #cmakedefine BUILD "@BUILD@" /* see configure.ac for the purpose of API_OPTIONS */ /* there is no cmake magic yet to configure this */ /* but luckily it is not yet needed */ #define API_OPTIONS "" /* User-configured options */ /* enable debug messages */ #cmakedefine DEBUG_MSGS 1 /* enable profiling */ #cmakedefine PROFILE 1 /* do not generate a core file on segfault etc */ #cmakedefine NOCOREFILE 1 /* enable command shell */ #cmakedefine SHELL 1 /* include internal decoders in binary */ #cmakedefine STATIC_CODECS 1 /* include internal inspectors in binary */ #cmakedefine STATIC_INSPECTORS 1 /* include internal ips actions in binary */ #cmakedefine STATIC_IPS_ACTIONS 1 /* include internal ips options in binary */ #cmakedefine STATIC_IPS_OPTIONS 1 /* include internal loggers in binary */ #cmakedefine STATIC_LOGGERS 1 /* include internal inspectors in binary */ #cmakedefine STATIC_SEARCH_ENGINES 1 /* enable unit tests */ #cmakedefine UNIT_TEST 1 /* enable stdlog */ #cmakedefine USE_STDLOG 1 /* enable tsc clock */ #cmakedefine USE_TSC_CLOCK 1 /* disable snort profiler */ #cmakedefine NO_PROFILER 1 /* enable memory profiler */ #cmakedefine ENABLE_MEMORY_PROFILER 1 /* enable rule profiler */ #cmakedefine ENABLE_RULE_PROFILER 1 /* enable deep profiling */ #cmakedefine DEEP_PROFILING 1 /* enable new and delete overloads for profiling */ #cmakedefine ENABLE_MEMORY_OVERLOADS 1 /* signal to dump stats */ #cmakedefine SIGNAL_SNORT_DUMP_STATS @SIGNAL_SNORT_DUMP_STATS@ /* signal to reload attribute table */ #cmakedefine SIGNAL_SNORT_READ_ATTR_TBL @SIGNAL_SNORT_READ_ATTR_TBL@ /* signal to reload configuration */ #cmakedefine SIGNAL_SNORT_RELOAD @SIGNAL_SNORT_RELOAD@ /* signal to reload stats */ #cmakedefine SIGNAL_SNORT_ROTATE_STATS @SIGNAL_SNORT_ROTATE_STATS@ /* large pcap options */ #cmakedefine _LARGEFILE_SOURCE 1 #cmakedefine _FILE_OFFSET_BITS @_FILE_OFFSET_BITS@ /* System types and their sizes */ /* The size of `long int', as computed by sizeof. */ #cmakedefine SIZEOF_LONG_INT @SIZEOF_LONG_INT@ /* The size of `unsigned long int', as computed by sizeof. */ #cmakedefine SIZEOF_UNSIGNED_LONG_INT @SIZEOF_UNSIGNED_LONG_INT@ /* Define if words are big endian */ #cmakedefine WORDS_BIGENDIAN 1 /* Header file definitions */ /* Define to 1 if you have the header file. */ #cmakedefine HAVE_DUMBNET_H 1 /* Available libraries */ /* hyperscan available */ #cmakedefine HAVE_HYPERSCAN 1 #cmakedefine HAVE_HS_COMPILE_LIT 1 /* iconv available */ #cmakedefine HAVE_ICONV 1 /* libunwind available */ #cmakedefine HAVE_LIBUNWIND 1 /* lzma available */ #cmakedefine HAVE_LZMA 1 /* safec available */ #cmakedefine HAVE_SAFEC 1 /* jemalloc available */ #cmakedefine HAVE_JEMALLOC 1 /* uuid available */ #cmakedefine HAVE_UUID 1 /* tirpc should be used for RPC database lookups */ #cmakedefine USE_TIRPC 1 /* numa available */ #cmakedefine HAVE_NUMA 1 /* libml available */ #cmakedefine HAVE_LIBML 1 /* Availability of specific library functions */ /* Define to 1 if you have the `malloc_trim' function. */ #cmakedefine HAVE_MALLOC_TRIM 1 /* Define to 1 if you have the `memrchr' function. */ #cmakedefine HAVE_MEMRCHR 1 /* Define to 1 if you have the `sigaction' function. */ #cmakedefine HAVE_SIGACTION 1 /* Define to 1 if you have the GNU form of the `strerror_r' function. */ #cmakedefine HAVE_GNU_STRERROR_R 1 /* Define 1 if you have basename_r function for freebsd < 12.0.0 */ #cmakedefine HAVE_BASENAME_R 1 /* Available compiler options */ /* Define if the compiler supports visibility declarations. */ #cmakedefine HAVE_VISIBILITY 1 /* Define if `thread_local` keyword should be used */ #cmakedefine USE_THREAD_LOCAL 1 #endif snort3-3.1.82.0/configure_cmake.sh000077500000000000000000000501031457433257500166710ustar00rootroot00000000000000#!/bin/sh # Convenience wrapper for easily viewing/setting options that # the project's CMake scripts will recognize set -e command="$0 $*" # check for `cmake` command type cmake > /dev/null 2>&1 || { echo "\ This package requires CMake, please install it first, then you may use this configure script to access CMake equivalent functionality.\ " >&2; exit 1; } usage="\ Usage: $0 [OPTION]... [VAR=VALUE]... --builddir= The build directory --generator= run cmake --help for a list of generators --prefix= Snort++ installation prefix Optional Features: --build-type=[Debug|Release|RelWithDebInfo|MinSizeRel] set cmake build type (defaults to RelWithDebInfo if neither CFLAGS nor CXXFLAGS are set) --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] --enable-code-coverage Whether to enable code coverage support --enable-hardened-build Detect and use compile-time hardening options --enable-pie Attempt to produce a position-independent executable --disable-safec do not use libsafec bounds checking even if available --disable-static-ips-actions do not include ips actions in binary --disable-static-inspectors do not include inspectors in binary --disable-static-loggers do not include loggers in binary --disable-static-ips-options do not include ips options in binary --disable-static-search-engines do not include search engines in binary --disable-static-codecs do not include codecs in binary --enable-shell enable command line shell support --enable-large-pcap enable support for pcaps larger than 2 GB --enable-stdlog use file descriptor 3 instead of stdout for alerts --enable-tsc-clock use timestamp counter register clock (x86 and arm only) --enable-debug-msgs enable debug printing options (bugreports and developers only) --enable-debug enable debugging options (bugreports and developers only) --disable-gdb disable gdb debugging information --enable-gprof-profile enable gprof profiling options (developers only) --disable-snort-profiler disable snort performance profiling (cpu and memory) (developers only) --enable-memory-profiler enable memory profiler --enable-rule-profiler enable rule keyword profiler (developers only) --enable-deep-profiling enable deep (multi-level) profiling (developers only) --disable-corefiles prevent Snort from generating core files --enable-address-sanitizer enable address sanitizer support --enable-thread-sanitizer enable thread sanitizer support --enable-ub-sanitizer enable undefined behavior sanitizer support --enable-tcmalloc enable using tcmalloc for dynamic memory management --enable-jemalloc enable using jemalloc for dynamic memory management --enable-jemalloc-static same as --enable-jemalloc but linked statically --enable-luajit-static enable luajit linked statically --enable-appid-third-party enable third party appid --enable-unit-tests build unit tests --enable-ccache enable ccache support --disable-static-daq link static DAQ modules --disable-html-docs don't create the HTML documentation --disable-pdf-docs don't create the PDF documentation --disable-text-docs don't create the TEXT documentation --disable-docs don't create documentation Optional Packages: --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --with-pcap-includes=DIR libpcap include directory --with-pcap-libraries=DIR libpcap library directory --with-luajit-includes=DIR luajit include directory --with-luajit-libraries=DIR luajit library directory --with-pcre-includes=DIR libpcre include directory --with-pcre-libraries=DIR libpcre library directory --with-dnet-includes=DIR libdnet include directory --with-dnet-libraries=DIR libdnet library directory --with-daq-includes=DIR DAQ include directory --with-daq-libraries=DIR DAQ library directory --with-openssl=DIR openssl installation root directory --with-hyperscan-includes=DIR libhs include directory --with-hyperscan-libraries=DIR libhs library directory --with-atomic-libraries=DIR atomic library directory --with-flex-prefix=DIR flex prefix directory --with-flex-includes=DIR flex include directory --with-iconv-includes=DIR libiconv include directory --with-iconv-libraries=DIR libiconv library directory --with-uuid-includes=DIR libuuid include directory --with-uuid-libraries=DIR libuuid library directory --with-libml-includes=DIR libml include directory --with-libml-libraries=DIR libml library directory --without-libml build Snort ML with mock of LibML Some influential variable definitions: SIGNAL_SNORT_RELOAD= override the signal used to reload configuration (default: SIGHUP) SIGNAL_SNORT_DUMP_STATS= override the signal used to dump run-time statistics (default: SIGUSR1) SIGNAL_SNORT_ROTATE_STATS= override the signal used to force rotation of stats files (default: SIGUSR2) SIGNAL_SNORT_READ_ATTR_TBL= override the signal used to reload the host attributes table (default: SIGURG) SNORT_BUILD_NUMBER= define a build number for this build of Snort " sourcedir="$( cd "$( dirname "$0" )" && pwd )" # Function to append a CMake cache entry definition to the # CMakeCacheEntries variable # $1 is the cache entry variable name # $2 is the cache entry variable type # $3 is the cache entry variable value append_cache_entry () { CMakeCacheEntries="$CMakeCacheEntries -D $1:$2=$3" } # set defaults builddir=build prefix=/usr/local/snort CMakeCacheEntries="" append_cache_entry CMAKE_INSTALL_PREFIX PATH $prefix build_type="" [ -z "$CFLAGS" ] && [ -z "$CXXFLAGS" ] && build_type="RelWithDebInfo" # parse arguments while [ $# -ne 0 ]; do case "$1" in *=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;; *) optarg= ;; esac case "$1" in --help|-h) echo "${usage}" 1>&2 exit 1 ;; --builddir=*) builddir=$optarg ;; --define=*) CMakeCacheEntries="$CMakeCacheEntries -D$optarg" ;; --generator=*) CMakeGenerator="$optarg" ;; --prefix=*) prefix=$optarg append_cache_entry CMAKE_INSTALL_PREFIX PATH $optarg ;; --enable-code-coverage) append_cache_entry ENABLE_CODE_COVERAGE BOOL true ;; --disable-code-coverage) append_cache_entry ENABLE_CODE_COVERAGE BOOL false ;; --enable-hardened-build) append_cache_entry ENABLE_HARDENED_BUILD BOOL true ;; --disable-hardened-build) append_cache_entry ENABLE_HARDENED_BUILD BOOL false ;; --enable-pie) append_cache_entry ENABLE_PIE BOOL true ;; --disable-pie) append_cache_entry ENABLE_PIE BOOL false ;; --disable-safec) append_cache_entry ENABLE_SAFEC BOOL false ;; --enable-safec) append_cache_entry ENABLE_SAFEC BOOL true ;; --disable-static-ips-actions) append_cache_entry STATIC_IPS_ACTIONS BOOL false ;; --enable-static-ips-actions) append_cache_entry STATIC_IPS_ACTIONS BOOL true ;; --disable-static-inspectors) append_cache_entry STATIC_INSPECTORS BOOL false ;; --enable-static-inspectors) append_cache_entry STATIC_INSPECTORS BOOL true ;; --disable-static-loggers) append_cache_entry STATIC_LOGGERS BOOL false ;; --enable-static-loggers) append_cache_entry STATIC_LOGGERS BOOL true ;; --disable-static-ips-options) append_cache_entry STATIC_IPS_OPTIONS BOOL false ;; --enable-static-ips-options) append_cache_entry STATIC_IPS_OPTIONS BOOL true ;; --disable-static-search-engines) append_cache_entry STATIC_SEARCH_ENGINES BOOL false ;; --enable-static-search-engines) append_cache_entry STATIC_SEARCH_ENGINES BOOL true ;; --disable-static-codecs) append_cache_entry STATIC_CODECS BOOL false ;; --enable-static-codecs) append_cache_entry STATIC_CODECS BOOL true ;; --enable-shell) append_cache_entry ENABLE_SHELL BOOL true ;; --disable-shell) append_cache_entry ENABLE_SHELL BOOL false ;; --enable-large-pcap) append_cache_entry ENABLE_LARGE_PCAP BOOL true ;; --enable-stdlog) append_cache_entry ENABLE_STDLOG BOOL true ;; --enable-tsc-clock) append_cache_entry ENABLE_TSC_CLOCK BOOL true ;; --disable-snort-profiler) append_cache_entry DISABLE_SNORT_PROFILER BOOL false ;; --enable-memory-profiler) append_cache_entry ENABLE_MEMORY_PROFILER BOOL true ;; --enable-rule-profiler) append_cache_entry ENABLE_RULE_PROFILER BOOL true ;; --enable-deep-profiling) append_cache_entry DEEP_PROFILING BOOL true ;; --disable-large-pcap) append_cache_entry ENABLE_LARGE_PCAP BOOL false ;; --enable-debug-msgs) append_cache_entry ENABLE_DEBUG_MSGS BOOL true ;; --disable-debug-msgs) append_cache_entry ENABLE_DEBUG_MSGS BOOL false ;; --enable-debug) append_cache_entry ENABLE_DEBUG BOOL true ;; --disable-debug) append_cache_entry ENABLE_DEBUG BOOL false ;; --enable-gdb) append_cache_entry ENABLE_GDB BOOL true ;; --disable-gdb) append_cache_entry ENABLE_GDB BOOL false ;; --enable-gprof-profile) append_cache_entry ENABLE_PROFILE BOOL true ;; --disable-gprof-profile) append_cache_entry ENABLE_PROFILE BOOL false ;; --disable-corefiles) append_cache_entry ENABLE_COREFILES BOOL false ;; --enable-corefiles) append_cache_entry ENABLE_COREFILES BOOL true ;; --enable-address-sanitizer) append_cache_entry ENABLE_ADDRESS_SANITIZER BOOL true ;; --disable-address-sanitizer) append_cache_entry ENABLE_ADDRESS_SANITIZER BOOL false ;; --enable-thread-sanitizer) append_cache_entry ENABLE_THREAD_SANITIZER BOOL true ;; --disable-thread-sanitizer) append_cache_entry ENABLE_THREAD_SANITIZER BOOL false ;; --enable-ub-sanitizer) append_cache_entry ENABLE_UB_SANITIZER BOOL true ;; --disable-ub-sanitizer) append_cache_entry ENABLE_UB_SANITIZER BOOL false ;; --enable-tcmalloc) append_cache_entry ENABLE_TCMALLOC BOOL true tcm=1 ;; --disable-tcmalloc) append_cache_entry ENABLE_TCMALLOC BOOL false ;; --enable-jemalloc) append_cache_entry ENABLE_JEMALLOC BOOL true append_cache_entry STATIC_JEMALLOC BOOL false jem=1 ;; --disable-jemalloc) append_cache_entry ENABLE_JEMALLOC BOOL false ;; --enable-jemalloc-static) append_cache_entry ENABLE_JEMALLOC BOOL true append_cache_entry STATIC_JEMALLOC BOOL true ;; --enable-luajit-static) append_cache_entry STATIC_LUAJIT BOOL true ;; --disable-jemalloc-static) append_cache_entry ENABLE_JEMALLOC BOOL false ;; --enable-appid-third-party) ;; --enable-unit-tests) append_cache_entry ENABLE_UNIT_TESTS BOOL true ;; --disable-unit-tests) append_cache_entry ENABLE_UNIT_TESTS BOOL false ;; --enable-benchmark-tests) append_cache_entry ENABLE_BENCHMARK_TESTS BOOL true ;; --disable-benchmark-tests) append_cache_entry ENABLE_BENCHMARK_TESTS BOOL false ;; --enable-ccache) append_cache_entry CMAKE_CXX_COMPILER_LAUNCHER STRING ccache append_cache_entry CMAKE_C_COMPILER_LAUNCHER STRING ccache ;; --disable-static-daq) append_cache_entry ENABLE_STATIC_DAQ BOOL false ;; --enable-static-daq) append_cache_entry ENABLE_STATIC_DAQ BOOL true ;; --disable-html-docs) append_cache_entry MAKE_HTML_DOC BOOL false ;; --enable-html-docs) append_cache_entry MAKE_HTML_DOC BOOL true ;; --disable-pdf-docs) append_cache_entry MAKE_PDF_DOC BOOL false ;; --enable-pdf-docs) append_cache_entry MAKE_PDF_DOC BOOL true ;; --disable-text-docs) append_cache_entry MAKE_TEXT_DOC BOOL false ;; --enable-text-docs) append_cache_entry MAKE_TEXT_DOC BOOL true ;; --disable-docs) append_cache_entry MAKE_DOC BOOL false ;; --enable-docs) append_cache_entry MAKE_DOC BOOL true ;; --build-type=*) if [ $optarg = "Debug" ] || [ $optarg = "Release" ] || [ $optarg = "RelWithDebInfo" ] || [ $optarg = "MinSizeRel" ]; then build_type=$optarg else echo "Invalid build type '$optarg'. Try $0 --help to see available build types." exit 1 fi ;; --with-pcap-includes=*) append_cache_entry PCAP_INCLUDE_DIR_HINT PATH $optarg ;; --with-pcap-libraries=*) append_cache_entry PCAP_LIBRARIES_DIR_HINT PATH $optarg ;; --with-luajit-includes=*) append_cache_entry LUAJIT_INCLUDE_DIR_HINT PATH $optarg ;; --with-luajit-libraries=*) append_cache_entry LUAJIT_LIBRARIES_DIR_HINT PATH $optarg ;; --with-pcre-includes=*) append_cache_entry PCRE_INCLUDE_DIR_HINT PATH $optarg ;; --with-pcre-libraries=*) append_cache_entry PCRE_LIBRARIES_DIR_HINT PATH $optarg ;; --with-dnet-includes=*) append_cache_entry DNET_INCLUDE_DIR_HINT PATH $optarg ;; --with-dnet-libraries=*) append_cache_entry DNET_LIBRARIES_DIR_HINT PATH $optarg ;; --with-daq-includes=*) append_cache_entry DAQ_INCLUDE_DIR_HINT PATH $optarg ;; --with-daq-libraries=*) append_cache_entry DAQ_LIBRARIES_DIR_HINT PATH $optarg ;; --with-openssl=*) append_cache_entry OPENSSL_ROOT_DIR PATH $optarg ;; --with-hyperscan-includes=*) append_cache_entry HS_INCLUDE_DIR PATH $optarg ;; --with-hyperscan-libraries=*) append_cache_entry HS_LIBRARIES_DIR PATH $optarg ;; --with-atomic-libraries=*) append_cache_entry ATOMIC_LIBRARIES_DIR_HINT PATH $optarg ;; --with-flex-prefix=*) append_cache_entry CMAKE_PREFIX_PATH PATH $optarg ;; --with-flex-includes=*) append_cache_entry FLEX_INCLUDE_DIR_HINT PATH $optarg ;; --with-iconv-includes=*) append_cache_entry ICONV_INCLUDE_DIR_HINT PATH $optarg ;; --with-iconv-libraries=*) append_cache_entry ICONV_LIBRARIES_DIR_HINT PATH $optarg ;; --with-uuid-includes=*) append_cache_entry UUID_INCLUDE_DIR_HINT PATH $optarg ;; --with-uuid-libraries=*) append_cache_entry UUID_LIBRARIES_DIR_HINT PATH $optarg ;; --with-toolchain=*) append_cache_entry CMAKE_TOOLCHAIN_FILE PATH $optarg ;; --with-libml-includes=*) append_cache_entry ML_INCLUDE_DIR_HINT PATH $optarg ;; --with-libml-libraries=*) append_cache_entry ML_LIBRARIES_DIR_HINT PATH $optarg ;; --without-libml) append_cache_entry ENABLE_KAIZEN_MOCK BOOL true ;; SIGNAL_SNORT_RELOAD=*) append_cache_entry SIGNAL_SNORT_RELOAD STRING $optarg ;; SIGNAL_SNORT_DUMP_STATS=*) append_cache_entry SIGNAL_SNORT_DUMP_STATS STRING $optarg ;; SIGNAL_SNORT_ROTATE_STATS=*) append_cache_entry SIGNAL_SNORT_ROTATE_STATS STRING $optarg ;; SIGNAL_SNORT_READ_ATTR_TBL=*) append_cache_entry SIGNAL_SNORT_READ_ATTR_TBL STRING $optarg ;; SNORT_BUILD_NUMBER=*) append_cache_entry VERSION_BUILD STRING $optarg ;; *) echo "Invalid option '$1'. Try $0 --help to see available options." exit 1 ;; esac shift done if [ "$tcm" -eq 1 -a "$jem" -eq 1 ] ; then echo "--enable-jemalloc and --enable-tcmalloc are mutually exclusive; enable at most one" exit 2 fi if [ -d $builddir ]; then # If build directory exists, check if it has a CMake cache if [ -f $builddir/CMakeCache.txt ]; then # If the CMake cache exists, delete it so that this configuration # is not tainted by a previous one rm -f $builddir/CMakeCache.txt fi else # Create build directory mkdir -p $builddir fi echo "Build Directory : $builddir" echo "Source Directory: $sourcedir" cd $builddir [ "$CMakeGenerator" ] && gen="-G $CMakeGenerator" cmake "$gen" \ -DCMAKE_CXX_FLAGS:STRING="$CXXFLAGS $CPPFLAGS" \ -DCMAKE_C_FLAGS:STRING="$CFLAGS $CPPFLAGS" \ -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \ -DCMAKE_BUILD_TYPE:STRING=$build_type \ $CMakeCacheEntries $sourcedir echo "# This is the command used to configure this build" > config.status echo $command >> config.status chmod u+x config.status snort3-3.1.82.0/crusty.cfg000066400000000000000000002124571457433257500152370ustar00rootroot00000000000000# Uncrustify 0.60 # # General options # # The type of line endings newlines = lf # auto/lf/crlf/cr # The original size of tabs in the input input_tab_size = 4 # number # The size of tabs in the output (only used if align_with_tabs=true) output_tab_size = 4 # number # The ASCII value of the string escape char, usually 92 (\) or 94 (^). (Pawn) string_escape_char = 92 # number # Alternate string escape char for Pawn. Only works right before the quote char. string_escape_char2 = 0 # number # Allow interpreting '>=' and '>>=' as part of a template in 'void f(list>=val);'. # If true (default), 'assert(x<0 && y>=3)' will be broken. # Improvements to template detection may make this option obsolete. tok_split_gte = false # false/true # Control what to do with the UTF-8 BOM (recommend 'remove') utf8_bom = remove # ignore/add/remove/force # If the file contains bytes with values between 128 and 255, but is not UTF-8, then output as UTF-8 utf8_byte = false # false/true # Force the output encoding to UTF-8 utf8_force = false # false/true # # Indenting # # The number of columns to indent per level. # Usually 2, 3, 4, or 8. indent_columns = 4 # number # The continuation indent. If non-zero, this overrides the indent of '(' and '=' continuation indents. # For FreeBSD, this is set to 4. Negative value is absolute and not increased for each ( level indent_continue = 4 # number # How to use tabs when indenting code # 0=spaces only # 1=indent with tabs to brace level, align with spaces # 2=indent and align with tabs, using spaces when not on a tabstop indent_with_tabs = 0 # number # Comments that are not a brace level are indented with tabs on a tabstop. # Requires indent_with_tabs=2. If false, will use spaces. indent_cmt_with_tabs = false # false/true # Whether to indent strings broken by '\' so that they line up indent_align_string = false # false/true # The number of spaces to indent multi-line XML strings. # Requires indent_align_string=True indent_xml_string = 0 # number # Spaces to indent '{' from level indent_brace = 0 # number # Whether braces are indented to the body level indent_braces = false # false/true # Disabled indenting function braces if indent_braces is true indent_braces_no_func = true # false/true # Disabled indenting class braces if indent_braces is true indent_braces_no_class = true # false/true # Disabled indenting struct braces if indent_braces is true indent_braces_no_struct = true # false/true # Indent based on the size of the brace parent, i.e. 'if' => 3 spaces, 'for' => 4 spaces, etc. indent_brace_parent = false # false/true # Whether the 'namespace' body is indented indent_namespace = false # false/true # The number of spaces to indent a namespace block indent_namespace_level = 4 # number # If the body of the namespace is longer than this number, it won't be indented. # Requires indent_namespace=true. Default=0 (no limit) indent_namespace_limit = 0 # number # Whether the 'extern "C"' body is indented indent_extern = true # false/true # Whether the 'class' body is indented indent_class = true # false/true # Whether to indent the stuff after a leading class colon indent_class_colon = false # false/true # Virtual indent from the ':' for member initializers. Default is 2 indent_ctor_init_leading = 4 # number # Additional indenting for constructor initializer list indent_ctor_init = 0 # number # False=treat 'else\nif' as 'else if' for indenting purposes # True=indent the 'if' one level indent_else_if = false # false/true # Amount to indent variable declarations after a open brace. neg=relative, pos=absolute indent_var_def_blk = 0 # number # Indent continued variable declarations instead of aligning. indent_var_def_cont = true # false/true # True: force indentation of function definition to start in column 1 # False: use the default behavior indent_func_def_force_col1 = false # false/true # True: indent continued function call parameters one indent level # False: align parameters under the open paren indent_func_call_param = true # false/true # Same as indent_func_call_param, but for function defs indent_func_def_param = true # false/true # Same as indent_func_call_param, but for function protos indent_func_proto_param = true # false/true # Same as indent_func_call_param, but for class declarations indent_func_class_param = true # false/true # Same as indent_func_call_param, but for class variable constructors indent_func_ctor_var_param = true # false/true # Same as indent_func_call_param, but for templates indent_template_param = true # false/true # Double the indent for indent_func_xxx_param options indent_func_param_double = false # false/true # Indentation column for standalone 'const' function decl/proto qualifier indent_func_const = 4 # number # Indentation column for standalone 'throw' function decl/proto qualifier indent_func_throw = 0 # number # The number of spaces to indent a continued '->' or '.' # Usually set to 0, 1, or indent_columns. indent_member = 0 # number # Spaces to indent single line ('//') comments on lines before code indent_sing_line_comments = 0 # number # If set, will indent trailing single line ('//') comments relative # to the code instead of trying to keep the same absolute column indent_relative_single_line_comments = false # false/true # Spaces to indent 'case' from 'switch' # Usually 0 or indent_columns. indent_switch_case = 0 # number # Spaces to shift the 'case' line, without affecting any other lines # Usually 0. indent_case_shift = 0 # number # Spaces to indent '{' from 'case'. # By default, the brace will appear under the 'c' in case. # Usually set to 0 or indent_columns. indent_case_brace = 0 # number # Whether to indent comments found in first column indent_col1_comment = false # false/true # How to indent goto labels # >0 : absolute column where 1 is the leftmost column # <=0 : subtract from brace indent indent_label = 1 # number # Same as indent_label, but for access specifiers that are followed by a colon indent_access_spec = 1 # number # Indent the code after an access specifier by one level. # If set, this option forces 'indent_access_spec=0' indent_access_spec_body = false # false/true # If an open paren is followed by a newline, indent the next line so that it lines up after the open paren (not recommended) indent_paren_nl = false # false/true # Controls the indent of a close paren after a newline. # 0: Indent to body level # 1: Align under the open paren # 2: Indent to the brace level indent_paren_close = 0 # number # Controls the indent of a comma when inside a paren.If TRUE, aligns under the open paren indent_comma_paren = false # false/true # Controls the indent of a BOOL operator when inside a paren.If TRUE, aligns under the open paren indent_bool_paren = false # false/true # If 'indent_bool_paren' is true, controls the indent of the first expression. If TRUE, aligns the first expression to the following ones indent_first_bool_expr = false # false/true # If an open square is followed by a newline, indent the next line so that it lines up after the open square (not recommended) indent_square_nl = false # false/true # Don't change the relative indent of ESQL/C 'EXEC SQL' bodies indent_preserve_sql = false # false/true # Align continued statements at the '='. Default=True # If FALSE or the '=' is followed by a newline, the next line is indent one tab. indent_align_assign = true # false/true # Indent OC blocks at brace level instead of usual rules. indent_oc_block = false # false/true # Indent OC blocks in a message relative to the parameter name. # 0=use indent_oc_block rules, 1+=spaces to indent indent_oc_block_msg = 0 # number # Minimum indent for subsequent parameters indent_oc_msg_colon = 0 # number # # Spacing options # # Add or remove space around arithmetic operator '+', '-', '/', '*', etc sp_arith = ignore # ignore/add/remove/force # Add or remove space around assignment operator '=', '+=', etc sp_assign = ignore # ignore/add/remove/force # Add or remove space around '=' in C++11 lambda capture specifications. Overrides sp_assign sp_cpp_lambda_assign = ignore # ignore/add/remove/force # Add or remove space after the capture specification in C++11 lambda. sp_cpp_lambda_paren = ignore # ignore/add/remove/force # Add or remove space around assignment operator '=' in a prototype sp_assign_default = ignore # ignore/add/remove/force # Add or remove space before assignment operator '=', '+=', etc. Overrides sp_assign. sp_before_assign = ignore # ignore/add/remove/force # Add or remove space after assignment operator '=', '+=', etc. Overrides sp_assign. sp_after_assign = ignore # ignore/add/remove/force # Add or remove space around assignment '=' in enum sp_enum_assign = ignore # ignore/add/remove/force # Add or remove space before assignment '=' in enum. Overrides sp_enum_assign. sp_enum_before_assign = ignore # ignore/add/remove/force # Add or remove space after assignment '=' in enum. Overrides sp_enum_assign. sp_enum_after_assign = ignore # ignore/add/remove/force # Add or remove space around preprocessor '##' concatenation operator. Default=Add sp_pp_concat = add # ignore/add/remove/force # Add or remove space after preprocessor '#' stringify operator. Also affects the '#@' charizing operator. sp_pp_stringify = ignore # ignore/add/remove/force # Add or remove space before preprocessor '#' stringify operator as in '#define x(y) L#y'. sp_before_pp_stringify = ignore # ignore/add/remove/force # Add or remove space around boolean operators '&&' and '||' sp_bool = ignore # ignore/add/remove/force # Add or remove space around compare operator '<', '>', '==', etc sp_compare = ignore # ignore/add/remove/force # Add or remove space inside '(' and ')' sp_inside_paren = ignore # ignore/add/remove/force # Add or remove space between nested parens sp_paren_paren = ignore # ignore/add/remove/force # Whether to balance spaces inside nested parens sp_balance_nested_parens = false # false/true # Add or remove space between ')' and '{' sp_paren_brace = force # ignore/add/remove/force # Add or remove space before pointer star '*' sp_before_ptr_star = remove # ignore/add/remove/force # Add or remove space before pointer star '*' that isn't followed by a variable name # If set to 'ignore', sp_before_ptr_star is used instead. sp_before_unnamed_ptr_star = remove # ignore/add/remove/force # Add or remove space between pointer stars '*' sp_between_ptr_star = remove # ignore/add/remove/force # Add or remove space after pointer star '*', if followed by a word. sp_after_ptr_star = force # ignore/add/remove/force # Add or remove space after a pointer star '*', if followed by a func proto/def. sp_after_ptr_star_func = ignore # ignore/add/remove/force # Add or remove space after a pointer star '*', if followed by an open paren (function types). sp_ptr_star_paren = ignore # ignore/add/remove/force # Add or remove space before a pointer star '*', if followed by a func proto/def. sp_before_ptr_star_func = ignore # ignore/add/remove/force # Add or remove space before a reference sign '&' sp_before_byref = remove # ignore/add/remove/force # Add or remove space before a reference sign '&' that isn't followed by a variable name # If set to 'ignore', sp_before_byref is used instead. sp_before_unnamed_byref = ignore # ignore/add/remove/force # Add or remove space after reference sign '&', if followed by a word. sp_after_byref = force # ignore/add/remove/force # Add or remove space after a reference sign '&', if followed by a func proto/def. sp_after_byref_func = ignore # ignore/add/remove/force # Add or remove space before a reference sign '&', if followed by a func proto/def. sp_before_byref_func = ignore # ignore/add/remove/force # Add or remove space between type and word. Default=Force sp_after_type = force # ignore/add/remove/force # Add or remove space before the paren in the D constructs 'template Foo(' and 'class Foo('. sp_before_template_paren = ignore # ignore/add/remove/force # Add or remove space in 'template <' vs 'template<'. # If set to ignore, sp_before_angle is used. sp_template_angle = ignore # ignore/add/remove/force # Add or remove space before '<>' sp_before_angle = ignore # ignore/add/remove/force # Add or remove space inside '<' and '>' sp_inside_angle = ignore # ignore/add/remove/force # Add or remove space after '<>' sp_after_angle = ignore # ignore/add/remove/force # Add or remove space between '<>' and '(' as found in 'new List();' sp_angle_paren = ignore # ignore/add/remove/force # Add or remove space between '<>' and a word as in 'List m;' sp_angle_word = ignore # ignore/add/remove/force # Add or remove space between '>' and '>' in '>>' (template stuff C++/C# only). Default=Add sp_angle_shift = add # ignore/add/remove/force # Permit removal of the space between '>>' in 'foo >' (C++11 only). Default=False # sp_angle_shift cannot remove the space without this option. sp_permit_cpp11_shift = false # false/true # Add or remove space before '(' of 'if', 'for', 'switch', and 'while' sp_before_sparen = force # ignore/add/remove/force # Add or remove space inside if-condition '(' and ')' sp_inside_sparen = ignore # ignore/add/remove/force # Add or remove space before if-condition ')'. Overrides sp_inside_sparen. sp_inside_sparen_close = ignore # ignore/add/remove/force # Add or remove space before if-condition '('. Overrides sp_inside_sparen. sp_inside_sparen_open = ignore # ignore/add/remove/force # Add or remove space after ')' of 'if', 'for', 'switch', and 'while' sp_after_sparen = ignore # ignore/add/remove/force # Add or remove space between ')' and '{' of 'if', 'for', 'switch', and 'while' sp_sparen_brace = force # ignore/add/remove/force # Add or remove space between 'invariant' and '(' in the D language. sp_invariant_paren = ignore # ignore/add/remove/force # Add or remove space after the ')' in 'invariant (C) c' in the D language. sp_after_invariant_paren = ignore # ignore/add/remove/force # Add or remove space before empty statement ';' on 'if', 'for' and 'while' sp_special_semi = ignore # ignore/add/remove/force # Add or remove space before ';'. Default=Remove sp_before_semi = remove # ignore/add/remove/force # Add or remove space before ';' in non-empty 'for' statements sp_before_semi_for = ignore # ignore/add/remove/force # Add or remove space before a semicolon of an empty part of a for statement. sp_before_semi_for_empty = ignore # ignore/add/remove/force # Add or remove space after ';', except when followed by a comment. Default=Add sp_after_semi = add # ignore/add/remove/force # Add or remove space after ';' in non-empty 'for' statements. Default=Force sp_after_semi_for = force # ignore/add/remove/force # Add or remove space after the final semicolon of an empty part of a for statement: for ( ; ; ). sp_after_semi_for_empty = ignore # ignore/add/remove/force # Add or remove space before '[' (except '[]') sp_before_square = ignore # ignore/add/remove/force # Add or remove space before '[]' sp_before_squares = ignore # ignore/add/remove/force # Add or remove space inside a non-empty '[' and ']' sp_inside_square = ignore # ignore/add/remove/force # Add or remove space after ',' sp_after_comma = ignore # ignore/add/remove/force # Add or remove space before ',' sp_before_comma = remove # ignore/add/remove/force # Add or remove space between an open paren and comma: '(,' vs '( ,' sp_paren_comma = force # ignore/add/remove/force # Add or remove space before the variadic '...' when preceded by a non-punctuator sp_before_ellipsis = ignore # ignore/add/remove/force # Add or remove space after class ':' sp_after_class_colon = ignore # ignore/add/remove/force # Add or remove space before class ':' sp_before_class_colon = ignore # ignore/add/remove/force # Add or remove space before case ':'. Default=Remove sp_before_case_colon = remove # ignore/add/remove/force # Add or remove space between 'operator' and operator sign sp_after_operator = ignore # ignore/add/remove/force # Add or remove space between the operator symbol and the open paren, as in 'operator ++(' sp_after_operator_sym = ignore # ignore/add/remove/force # Add or remove space after C/D cast, i.e. 'cast(int)a' vs 'cast(int) a' or '(int)a' vs '(int) a' sp_after_cast = remove # ignore/add/remove/force # Add or remove spaces inside cast parens sp_inside_paren_cast = ignore # ignore/add/remove/force # Add or remove space between the type and open paren in a C++ cast, i.e. 'int(exp)' vs 'int (exp)' sp_cpp_cast_paren = ignore # ignore/add/remove/force # Add or remove space between 'sizeof' and '(' sp_sizeof_paren = ignore # ignore/add/remove/force # Add or remove space after the tag keyword (Pawn) sp_after_tag = ignore # ignore/add/remove/force # Add or remove space inside enum '{' and '}' sp_inside_braces_enum = force # ignore/add/remove/force # Add or remove space inside struct/union '{' and '}' sp_inside_braces_struct = force # ignore/add/remove/force # Add or remove space inside '{' and '}' sp_inside_braces = force # ignore/add/remove/force # Add or remove space inside '{}' sp_inside_braces_empty = force # ignore/add/remove/force # Add or remove space between return type and function name # A minimum of 1 is forced except for pointer return types. sp_type_func = force # ignore/add/remove/force # Add or remove space between function name and '(' on function declaration sp_func_proto_paren = remove # ignore/add/remove/force # Add or remove space between function name and '(' on function definition sp_func_def_paren = remove # ignore/add/remove/force # Add or remove space inside empty function '()' sp_inside_fparens = ignore # ignore/add/remove/force # Add or remove space inside function '(' and ')' sp_inside_fparen = remove # ignore/add/remove/force # Add or remove space inside the first parens in the function type: 'void (*x)(...)' sp_inside_tparen = ignore # ignore/add/remove/force # Add or remove between the parens in the function type: 'void (*x)(...)' sp_after_tparen_close = ignore # ignore/add/remove/force # Add or remove space between ']' and '(' when part of a function call. sp_square_fparen = ignore # ignore/add/remove/force # Add or remove space between ')' and '{' of function sp_fparen_brace = force # ignore/add/remove/force # Add or remove space between function name and '(' on function calls sp_func_call_paren = ignore # ignore/add/remove/force # Add or remove space between function name and '()' on function calls without parameters. # If set to 'ignore' (the default), sp_func_call_paren is used. sp_func_call_paren_empty = ignore # ignore/add/remove/force # Add or remove space between the user function name and '(' on function calls # You need to set a keyword to be a user function, like this: 'set func_call_user _' in the config file. sp_func_call_user_paren = ignore # ignore/add/remove/force # Add or remove space between a constructor/destructor and the open paren sp_func_class_paren = ignore # ignore/add/remove/force # Add or remove space between 'return' and '(' sp_return_paren = ignore # ignore/add/remove/force # Add or remove space between '__attribute__' and '(' sp_attribute_paren = ignore # ignore/add/remove/force # Add or remove space between 'defined' and '(' in '#if defined (FOO)' sp_defined_paren = ignore # ignore/add/remove/force # Add or remove space between 'throw' and '(' in 'throw (something)' sp_throw_paren = ignore # ignore/add/remove/force # Add or remove space between 'throw' and anything other than '(' as in '@throw [...];' sp_after_throw = ignore # ignore/add/remove/force # Add or remove space between 'catch' and '(' in 'catch (something) { }' # If set to ignore, sp_before_sparen is used. sp_catch_paren = ignore # ignore/add/remove/force # Add or remove space between 'version' and '(' in 'version (something) { }' (D language) # If set to ignore, sp_before_sparen is used. sp_version_paren = ignore # ignore/add/remove/force # Add or remove space between 'scope' and '(' in 'scope (something) { }' (D language) # If set to ignore, sp_before_sparen is used. sp_scope_paren = ignore # ignore/add/remove/force # Add or remove space between macro and value sp_macro = ignore # ignore/add/remove/force # Add or remove space between macro function ')' and value sp_macro_func = ignore # ignore/add/remove/force # Add or remove space between 'else' and '{' if on the same line sp_else_brace = ignore # ignore/add/remove/force # Add or remove space between '}' and 'else' if on the same line sp_brace_else = ignore # ignore/add/remove/force # Add or remove space between '}' and the name of a typedef on the same line sp_brace_typedef = ignore # ignore/add/remove/force # Add or remove space between 'catch' and '{' if on the same line sp_catch_brace = ignore # ignore/add/remove/force # Add or remove space between '}' and 'catch' if on the same line sp_brace_catch = ignore # ignore/add/remove/force # Add or remove space between 'finally' and '{' if on the same line sp_finally_brace = ignore # ignore/add/remove/force # Add or remove space between '}' and 'finally' if on the same line sp_brace_finally = ignore # ignore/add/remove/force # Add or remove space between 'try' and '{' if on the same line sp_try_brace = ignore # ignore/add/remove/force # Add or remove space between get/set and '{' if on the same line sp_getset_brace = ignore # ignore/add/remove/force # Add or remove space before the '::' operator sp_before_dc = ignore # ignore/add/remove/force # Add or remove space after the '::' operator sp_after_dc = ignore # ignore/add/remove/force # Add or remove around the D named array initializer ':' operator sp_d_array_colon = ignore # ignore/add/remove/force # Add or remove space after the '!' (not) operator. Default=Remove sp_not = remove # ignore/add/remove/force # Add or remove space after the '~' (invert) operator. Default=Remove sp_inv = remove # ignore/add/remove/force # Add or remove space after the '&' (address-of) operator. Default=Remove # This does not affect the spacing after a '&' that is part of a type. sp_addr = remove # ignore/add/remove/force # Add or remove space around the '.' or '->' operators. Default=Remove sp_member = remove # ignore/add/remove/force # Add or remove space after the '*' (dereference) operator. Default=Remove # This does not affect the spacing after a '*' that is part of a type. sp_deref = remove # ignore/add/remove/force # Add or remove space after '+' or '-', as in 'x = -5' or 'y = +7'. Default=Remove sp_sign = remove # ignore/add/remove/force # Add or remove space before or after '++' and '--', as in '(--x)' or 'y++;'. Default=Remove sp_incdec = remove # ignore/add/remove/force # Add or remove space before a backslash-newline at the end of a line. Default=Add sp_before_nl_cont = add # ignore/add/remove/force # Add or remove space after the scope '+' or '-', as in '-(void) foo;' or '+(int) bar;' sp_after_oc_scope = ignore # ignore/add/remove/force # Add or remove space after the colon in message specs # '-(int) f:(int) x;' vs '-(int) f: (int) x;' sp_after_oc_colon = ignore # ignore/add/remove/force # Add or remove space before the colon in message specs # '-(int) f: (int) x;' vs '-(int) f : (int) x;' sp_before_oc_colon = ignore # ignore/add/remove/force # Add or remove space after the colon in immutable dictionary expression # 'NSDictionary *test = @{@"foo" :@"bar"};' sp_after_oc_dict_colon = ignore # ignore/add/remove/force # Add or remove space before the colon in immutable dictionary expression # 'NSDictionary *test = @{@"foo" :@"bar"};' sp_before_oc_dict_colon = ignore # ignore/add/remove/force # Add or remove space after the colon in message specs # '[object setValue:1];' vs '[object setValue: 1];' sp_after_send_oc_colon = ignore # ignore/add/remove/force # Add or remove space before the colon in message specs # '[object setValue:1];' vs '[object setValue :1];' sp_before_send_oc_colon = ignore # ignore/add/remove/force # Add or remove space after the (type) in message specs # '-(int)f: (int) x;' vs '-(int)f: (int)x;' sp_after_oc_type = ignore # ignore/add/remove/force # Add or remove space after the first (type) in message specs # '-(int) f:(int)x;' vs '-(int)f:(int)x;' sp_after_oc_return_type = ignore # ignore/add/remove/force # Add or remove space between '@selector' and '(' # '@selector(msgName)' vs '@selector (msgName)' # Also applies to @protocol() constructs sp_after_oc_at_sel = ignore # ignore/add/remove/force # Add or remove space between '@selector(x)' and the following word # '@selector(foo) a:' vs '@selector(foo)a:' sp_after_oc_at_sel_parens = ignore # ignore/add/remove/force # Add or remove space inside '@selector' parens # '@selector(foo)' vs '@selector( foo )' # Also applies to @protocol() constructs sp_inside_oc_at_sel_parens = ignore # ignore/add/remove/force # Add or remove space before a block pointer caret # '^int (int arg){...}' vs. ' ^int (int arg){...}' sp_before_oc_block_caret = ignore # ignore/add/remove/force # Add or remove space after a block pointer caret # '^int (int arg){...}' vs. '^ int (int arg){...}' sp_after_oc_block_caret = ignore # ignore/add/remove/force # Add or remove space between the receiver and selector in a message. # '[receiver selector ...]' sp_after_oc_msg_receiver = ignore # ignore/add/remove/force # Add or remove space after @property. sp_after_oc_property = ignore # ignore/add/remove/force # Add or remove space around the ':' in 'b ? t : f' sp_cond_colon = ignore # ignore/add/remove/force # Add or remove space around the '?' in 'b ? t : f' sp_cond_question = ignore # ignore/add/remove/force # Fix the spacing between 'case' and the label. Only 'ignore' and 'force' make sense here. sp_case_label = ignore # ignore/add/remove/force # Control the space around the D '..' operator. sp_range = ignore # ignore/add/remove/force # Control the spacing after ':' in 'for (TYPE VAR : EXPR)' (Java) sp_after_for_colon = ignore # ignore/add/remove/force # Control the spacing before ':' in 'for (TYPE VAR : EXPR)' (Java) sp_before_for_colon = ignore # ignore/add/remove/force # Control the spacing in 'extern (C)' (D) sp_extern_paren = ignore # ignore/add/remove/force # Control the space after the opening of a C++ comment '// A' vs '//A' sp_cmt_cpp_start = ignore # ignore/add/remove/force # Controls the spaces between #else or #endif and a trailing comment sp_endif_cmt = ignore # ignore/add/remove/force # Controls the spaces after 'new', 'delete', and 'delete[]' sp_after_new = ignore # ignore/add/remove/force # Controls the spaces before a trailing or embedded comment sp_before_tr_emb_cmt = ignore # ignore/add/remove/force # Number of spaces before a trailing or embedded comment sp_num_before_tr_emb_cmt = 0 # number # Control space between a Java annotation and the open paren. sp_annotation_paren = ignore # ignore/add/remove/force # # Code alignment (not left column spaces/tabs) # # Whether to keep non-indenting tabs align_keep_tabs = false # false/true # Whether to use tabs for aligning align_with_tabs = false # false/true # Whether to bump out to the next tab when aligning align_on_tabstop = false # false/true # Whether to left-align numbers align_number_left = false # false/true # Align variable definitions in prototypes and functions align_func_params = false # false/true # Align parameters in single-line functions that have the same name. # The function names must already be aligned with each other. align_same_func_call_params = false # false/true # The span for aligning variable definitions (0=don't align) align_var_def_span = 0 # number # How to align the star in variable definitions. # 0=Part of the type 'void * foo;' # 1=Part of the variable 'void *foo;' # 2=Dangling 'void *foo;' align_var_def_star_style = 0 # number # How to align the '&' in variable definitions. # 0=Part of the type # 1=Part of the variable # 2=Dangling align_var_def_amp_style = 0 # number # The threshold for aligning variable definitions (0=no limit) align_var_def_thresh = 0 # number # The gap for aligning variable definitions align_var_def_gap = 0 # number # Whether to align the colon in struct bit fields align_var_def_colon = false # false/true # Whether to align any attribute after the variable name align_var_def_attribute = false # false/true # Whether to align inline struct/enum/union variable definitions align_var_def_inline = false # false/true # The span for aligning on '=' in assignments (0=don't align) align_assign_span = 0 # number # The threshold for aligning on '=' in assignments (0=no limit) align_assign_thresh = 0 # number # The span for aligning on '=' in enums (0=don't align) align_enum_equ_span = 0 # number # The threshold for aligning on '=' in enums (0=no limit) align_enum_equ_thresh = 0 # number # The span for aligning struct/union (0=don't align) align_var_struct_span = 0 # number # The threshold for aligning struct/union member definitions (0=no limit) align_var_struct_thresh = 0 # number # The gap for aligning struct/union member definitions align_var_struct_gap = 0 # number # The span for aligning struct initializer values (0=don't align) align_struct_init_span = 0 # number # The minimum space between the type and the synonym of a typedef align_typedef_gap = 0 # number # The span for aligning single-line typedefs (0=don't align) align_typedef_span = 0 # number # How to align typedef'd functions with other typedefs # 0: Don't mix them at all # 1: align the open paren with the types # 2: align the function type name with the other type names align_typedef_func = 0 # number # Controls the positioning of the '*' in typedefs. Just try it. # 0: Align on typedef type, ignore '*' # 1: The '*' is part of type name: typedef int *pint; # 2: The '*' is part of the type, but dangling: typedef int *pint; align_typedef_star_style = 0 # number # Controls the positioning of the '&' in typedefs. Just try it. # 0: Align on typedef type, ignore '&' # 1: The '&' is part of type name: typedef int &pint; # 2: The '&' is part of the type, but dangling: typedef int &pint; align_typedef_amp_style = 0 # number # The span for aligning comments that end lines (0=don't align) align_right_cmt_span = 0 # number # If aligning comments, mix with comments after '}' and #endif with less than 3 spaces before the comment align_right_cmt_mix = false # false/true # If a trailing comment is more than this number of columns away from the text it follows, # it will qualify for being aligned. This has to be > 0 to do anything. align_right_cmt_gap = 0 # number # Align trailing comment at or beyond column N; 'pulls in' comments as a bonus side effect (0=ignore) align_right_cmt_at_col = 0 # number # The span for aligning function prototypes (0=don't align) align_func_proto_span = 0 # number # Minimum gap between the return type and the function name. align_func_proto_gap = 0 # number # Align function protos on the 'operator' keyword instead of what follows align_on_operator = false # false/true # Whether to mix aligning prototype and variable declarations. # If true, align_var_def_XXX options are used instead of align_func_proto_XXX options. align_mix_var_proto = false # false/true # Align single-line functions with function prototypes, uses align_func_proto_span align_single_line_func = false # false/true # Aligning the open brace of single-line functions. # Requires align_single_line_func=true, uses align_func_proto_span align_single_line_brace = false # false/true # Gap for align_single_line_brace. align_single_line_brace_gap = 0 # number # The span for aligning ObjC msg spec (0=don't align) align_oc_msg_spec_span = 0 # number # Whether to align macros wrapped with a backslash and a newline. # This will not work right if the macro contains a multi-line comment. align_nl_cont = false # false/true # # Align macro functions and variables together align_pp_define_together = false # false/true # The minimum space between label and value of a preprocessor define align_pp_define_gap = 0 # number # The span for aligning on '#define' bodies (0=don't align) align_pp_define_span = 0 # number # Align lines that start with '<<' with previous '<<'. Default=true align_left_shift = true # false/true # Span for aligning parameters in an Obj-C message call on the ':' (0=don't align) align_oc_msg_colon_span = 0 # number # If true, always align with the first parameter, even if it is too short. align_oc_msg_colon_first = false # false/true # Aligning parameters in an Obj-C '+' or '-' declaration on the ':' align_oc_decl_colon = false # false/true # # Newline adding and removing options # # Whether to collapse empty blocks between '{' and '}' nl_collapse_empty_body = false # false/true # Don't split one-line braced assignments - 'foo_t f = { 1, 2 };' nl_assign_leave_one_liners = true # false/true # Don't split one-line braced statements inside a class xx { } body nl_class_leave_one_liners = true # false/true # Don't split one-line enums: 'enum foo { BAR = 15 };' nl_enum_leave_one_liners = true # false/true # Don't split one-line get or set functions nl_getset_leave_one_liners = true # false/true # Don't split one-line function definitions - 'int foo() { return 0; }' nl_func_leave_one_liners = true # false/true # Don't split one-line if/else statements - 'if(a) b++;' nl_if_leave_one_liners = false # false/true # Don't split one-line OC messages nl_oc_msg_leave_one_liner = false # false/true # Add or remove newlines at the start of the file nl_start_of_file = remove # ignore/add/remove/force # The number of newlines at the start of the file (only used if nl_start_of_file is 'add' or 'force' nl_start_of_file_min = 0 # number # Add or remove newline at the end of the file nl_end_of_file = force # ignore/add/remove/force # The number of newlines at the end of the file (only used if nl_end_of_file is 'add' or 'force') nl_end_of_file_min = 2 # number # Add or remove newline between '=' and '{' nl_assign_brace = force # ignore/add/remove/force # Add or remove newline between '=' and '[' (D only) nl_assign_square = ignore # ignore/add/remove/force # Add or remove newline after '= [' (D only). Will also affect the newline before the ']' nl_after_square_assign = ignore # ignore/add/remove/force # The number of blank lines after a block of variable definitions at the top of a function body # 0 = No change (default) nl_func_var_def_blk = 0 # number # The number of newlines before a block of typedefs # 0 = No change (default) nl_typedef_blk_start = 0 # number # The number of newlines after a block of typedefs # 0 = No change (default) nl_typedef_blk_end = 0 # number # The maximum consecutive newlines within a block of typedefs # 0 = No change (default) nl_typedef_blk_in = 0 # number # The number of newlines before a block of variable definitions not at the top of a function body # 0 = No change (default) nl_var_def_blk_start = 0 # number # The number of newlines after a block of variable definitions not at the top of a function body # 0 = No change (default) nl_var_def_blk_end = 0 # number # The maximum consecutive newlines within a block of variable definitions # 0 = No change (default) nl_var_def_blk_in = 0 # number # Add or remove newline between a function call's ')' and '{', as in: # list_for_each(item, &list) { } nl_fcall_brace = force # ignore/add/remove/force # Add or remove newline between 'enum' and '{' nl_enum_brace = force # ignore/add/remove/force # Add or remove newline between 'struct and '{' nl_struct_brace = force # ignore/add/remove/force # Add or remove newline between 'union' and '{' nl_union_brace = force # ignore/add/remove/force # Add or remove newline between 'if' and '{' nl_if_brace = force # ignore/add/remove/force # Add or remove newline between '}' and 'else' nl_brace_else = force # ignore/add/remove/force # Add or remove newline between 'else if' and '{' # If set to ignore, nl_if_brace is used instead nl_elseif_brace = force # ignore/add/remove/force # Add or remove newline between 'else' and '{' nl_else_brace = force # ignore/add/remove/force # Add or remove newline between 'else' and 'if' nl_else_if = remove # ignore/add/remove/force # Add or remove newline between '}' and 'finally' nl_brace_finally = ignore # ignore/add/remove/force # Add or remove newline between 'finally' and '{' nl_finally_brace = ignore # ignore/add/remove/force # Add or remove newline between 'try' and '{' nl_try_brace = force # ignore/add/remove/force # Add or remove newline between get/set and '{' nl_getset_brace = force # ignore/add/remove/force # Add or remove newline between 'for' and '{' nl_for_brace = force # ignore/add/remove/force # Add or remove newline between 'catch' and '{' nl_catch_brace = force # ignore/add/remove/force # Add or remove newline between '}' and 'catch' nl_brace_catch = force # ignore/add/remove/force # Add or remove newline between 'while' and '{' nl_while_brace = force # ignore/add/remove/force # Add or remove newline between 'scope (x)' and '{' (D) nl_scope_brace = force # ignore/add/remove/force # Add or remove newline between 'unittest' and '{' (D) nl_unittest_brace = force # ignore/add/remove/force # Add or remove newline between 'version (x)' and '{' (D) nl_version_brace = force # ignore/add/remove/force # Add or remove newline between 'using' and '{' nl_using_brace = force # ignore/add/remove/force # Add or remove newline between two open or close braces. # Due to general newline/brace handling, REMOVE may not work. nl_brace_brace = force # ignore/add/remove/force # Add or remove newline between 'do' and '{' nl_do_brace = force # ignore/add/remove/force # Add or remove newline between '}' and 'while' of 'do' statement nl_brace_while = force # ignore/add/remove/force # Add or remove newline between 'switch' and '{' nl_switch_brace = force # ignore/add/remove/force # Add a newline between ')' and '{' if the ')' is on a different line than the if/for/etc. # Overrides nl_for_brace, nl_if_brace, nl_switch_brace, nl_while_switch, and nl_catch_brace. nl_multi_line_cond = false # false/true # Force a newline in a define after the macro name for multi-line defines. nl_multi_line_define = true # false/true # Whether to put a newline before 'case' statement nl_before_case = false # false/true # Add or remove newline between ')' and 'throw' nl_before_throw = ignore # ignore/add/remove/force # Whether to put a newline after 'case' statement nl_after_case = false # false/true # Add or remove a newline between a case ':' and '{'. Overrides nl_after_case. nl_case_colon_brace = force # ignore/add/remove/force # Newline between namespace and { nl_namespace_brace = force # ignore/add/remove/force # Add or remove newline between 'template<>' and whatever follows. nl_template_class = ignore # ignore/add/remove/force # Add or remove newline between 'class' and '{' nl_class_brace = force # ignore/add/remove/force # Add or remove newline after each ',' in the constructor member initialization nl_class_init_args = ignore # ignore/add/remove/force # Add or remove newline between return type and function name in a function definition nl_func_type_name = remove # ignore/add/remove/force # Add or remove newline between return type and function name inside a class {} # Uses nl_func_type_name or nl_func_proto_type_name if set to ignore. nl_func_type_name_class = remove # ignore/add/remove/force # Add or remove newline between function scope and name in a definition # Controls the newline after '::' in 'void A::f() { }' nl_func_scope_name = remove # ignore/add/remove/force # Add or remove newline between return type and function name in a prototype nl_func_proto_type_name = remove # ignore/add/remove/force # Add or remove newline between a function name and the opening '(' nl_func_paren = ignore # ignore/add/remove/force # Add or remove newline between a function name and the opening '(' in the definition nl_func_def_paren = ignore # ignore/add/remove/force # Add or remove newline after '(' in a function declaration nl_func_decl_start = ignore # ignore/add/remove/force # Add or remove newline after '(' in a function definition nl_func_def_start = ignore # ignore/add/remove/force # Overrides nl_func_decl_start when there is only one parameter. nl_func_decl_start_single = ignore # ignore/add/remove/force # Overrides nl_func_def_start when there is only one parameter. nl_func_def_start_single = ignore # ignore/add/remove/force # Add or remove newline after each ',' in a function declaration nl_func_decl_args = ignore # ignore/add/remove/force # Add or remove newline after each ',' in a function definition nl_func_def_args = ignore # ignore/add/remove/force # Add or remove newline before the ')' in a function declaration nl_func_decl_end = ignore # ignore/add/remove/force # Add or remove newline before the ')' in a function definition nl_func_def_end = ignore # ignore/add/remove/force # Overrides nl_func_decl_end when there is only one parameter. nl_func_decl_end_single = ignore # ignore/add/remove/force # Overrides nl_func_def_end when there is only one parameter. nl_func_def_end_single = ignore # ignore/add/remove/force # Add or remove newline between '()' in a function declaration. nl_func_decl_empty = ignore # ignore/add/remove/force # Add or remove newline between '()' in a function definition. nl_func_def_empty = ignore # ignore/add/remove/force # Whether to put each OC message parameter on a separate line # See nl_oc_msg_leave_one_liner nl_oc_msg_args = false # false/true # Add or remove newline between function signature and '{' nl_fdef_brace = force # ignore/add/remove/force # Add or remove a newline between the return keyword and return expression. nl_return_expr = ignore # ignore/add/remove/force # Whether to put a newline after semicolons, except in 'for' statements nl_after_semicolon = false # false/true # Whether to put a newline after brace open. # This also adds a newline before the matching brace close. nl_after_brace_open = false # false/true # If nl_after_brace_open and nl_after_brace_open_cmt are true, a newline is # placed between the open brace and a trailing single-line comment. nl_after_brace_open_cmt = false # false/true # Whether to put a newline after a virtual brace open with a non-empty body. # These occur in un-braced if/while/do/for statement bodies. nl_after_vbrace_open = false # false/true # Whether to put a newline after a virtual brace open with an empty body. # These occur in un-braced if/while/do/for statement bodies. nl_after_vbrace_open_empty = false # false/true # Whether to put a newline after a brace close. # Does not apply if followed by a necessary ';'. nl_after_brace_close = false # false/true # Whether to put a newline after a virtual brace close. # Would add a newline before return in: 'if (foo) a++; return;' nl_after_vbrace_close = false # false/true # Control the newline between the close brace and 'b' in: 'struct { int a; } b;' # Affects enums, unions, and structures. If set to ignore, uses nl_after_brace_close nl_brace_struct_var = ignore # ignore/add/remove/force # Whether to alter newlines in '#define' macros nl_define_macro = false # false/true # Whether to not put blanks after '#ifxx', '#elxx', or before '#endif' nl_squeeze_ifdef = false # false/true # Add or remove blank line before 'if' nl_before_if = ignore # ignore/add/remove/force # Add or remove blank line after 'if' statement nl_after_if = ignore # ignore/add/remove/force # Add or remove blank line before 'for' nl_before_for = ignore # ignore/add/remove/force # Add or remove blank line after 'for' statement nl_after_for = ignore # ignore/add/remove/force # Add or remove blank line before 'while' nl_before_while = ignore # ignore/add/remove/force # Add or remove blank line after 'while' statement nl_after_while = ignore # ignore/add/remove/force # Add or remove blank line before 'switch' nl_before_switch = ignore # ignore/add/remove/force # Add or remove blank line after 'switch' statement nl_after_switch = ignore # ignore/add/remove/force # Add or remove blank line before 'do' nl_before_do = ignore # ignore/add/remove/force # Add or remove blank line after 'do/while' statement nl_after_do = ignore # ignore/add/remove/force # Whether to double-space commented-entries in struct/enum nl_ds_struct_enum_cmt = false # false/true # Whether to double-space before the close brace of a struct/union/enum # (lower priority than 'eat_blanks_before_close_brace') nl_ds_struct_enum_close_brace = false # false/true # Add or remove a newline around a class colon. # Related to pos_class_colon, nl_class_init_args, and pos_comma. nl_class_colon = ignore # ignore/add/remove/force # Change simple unbraced if statements into a one-liner # 'if(b)\n i++;' => 'if(b) i++;' nl_create_if_one_liner = false # false/true # Change simple unbraced for statements into a one-liner # 'for (i=0;i<5;i++)\n foo(i);' => 'for (i=0;i<5;i++) foo(i);' nl_create_for_one_liner = false # false/true # Change simple unbraced while statements into a one-liner # 'while (i<5)\n foo(i++);' => 'while (i<5) foo(i++);' nl_create_while_one_liner = false # false/true # # Positioning options # # The position of arithmetic operators in wrapped expressions pos_arith = ignore # ignore/join/lead/lead_break/lead_force/trail/trail_break/trail_force # The position of assignment in wrapped expressions. # Do not affect '=' followed by '{' pos_assign = ignore # ignore/join/lead/lead_break/lead_force/trail/trail_break/trail_force # The position of boolean operators in wrapped expressions pos_bool = ignore # ignore/join/lead/lead_break/lead_force/trail/trail_break/trail_force # The position of comparison operators in wrapped expressions pos_compare = ignore # ignore/join/lead/lead_break/lead_force/trail/trail_break/trail_force # The position of conditional (b ? t : f) operators in wrapped expressions pos_conditional = ignore # ignore/join/lead/lead_break/lead_force/trail/trail_break/trail_force # The position of the comma in wrapped expressions pos_comma = ignore # ignore/join/lead/lead_break/lead_force/trail/trail_break/trail_force # The position of the comma in the constructor initialization list pos_class_comma = ignore # ignore/join/lead/lead_break/lead_force/trail/trail_break/trail_force # The position of colons between constructor and member initialization pos_class_colon = ignore # ignore/join/lead/lead_break/lead_force/trail/trail_break/trail_force # # Line Splitting options # # Try to limit code width to N number of columns code_width = 119 # number # Whether to fully split long 'for' statements at semi-colons ls_for_split_full = false # false/true # Whether to fully split long function protos/calls at commas ls_func_split_full = false # false/true # Whether to split lines as close to code_width as possible and ignore some groupings ls_code_width = true # false/true # # Blank line options # # The maximum consecutive newlines nl_max = 2 # number # The number of newlines after a function prototype, if followed by another function prototype nl_after_func_proto = 0 # number # The number of newlines after a function prototype, if not followed by another function prototype nl_after_func_proto_group = 0 # number # The number of newlines after '}' of a multi-line function body nl_after_func_body = 2 # number # The number of newlines after '}' of a multi-line function body in a class declaration nl_after_func_body_class = 0 # number # The number of newlines after '}' of a single line function body nl_after_func_body_one_liner = 0 # number # The minimum number of newlines before a multi-line comment. # Doesn't apply if after a brace open or another multi-line comment. nl_before_block_comment = 0 # number # The minimum number of newlines before a single-line C comment. # Doesn't apply if after a brace open or other single-line C comments. nl_before_c_comment = 0 # number # The minimum number of newlines before a CPP comment. # Doesn't apply if after a brace open or other CPP comments. nl_before_cpp_comment = 0 # number # Whether to force a newline after a multi-line comment. nl_after_multiline_comment = false # false/true # The number of newlines after '}' or ';' of a struct/enum/union definition nl_after_struct = 0 # number # The number of newlines after '}' or ';' of a class definition nl_after_class = 0 # number # The number of newlines before a 'private:', 'public:', 'protected:', 'signals:', or 'slots:' label. # Will not change the newline count if after a brace open. # 0 = No change. nl_before_access_spec = 2 # number # The number of newlines after a 'private:', 'public:', 'protected:', 'signals:', or 'slots:' label. # 0 = No change. nl_after_access_spec = 0 # number # The number of newlines between a function def and the function comment. # 0 = No change. nl_comment_func_def = 0 # number # The number of newlines after a try-catch-finally block that isn't followed by a brace close. # 0 = No change. nl_after_try_catch_finally = 0 # number # The number of newlines before and after a property, indexer or event decl. # 0 = No change. nl_around_cs_property = 0 # number # The number of newlines between the get/set/add/remove handlers in C#. # 0 = No change. nl_between_get_set = 0 # number # Add or remove newline between C# property and the '{' nl_property_brace = ignore # ignore/add/remove/force # Whether to remove blank lines after '{' eat_blanks_after_open_brace = true # false/true # Whether to remove blank lines before '}' eat_blanks_before_close_brace = true # false/true # How aggressively to remove extra newlines not in preproc. # 0: No change # 1: Remove most newlines not handled by other config # 2: Remove all newlines and reformat completely by config nl_remove_extra_newlines = 0 # number # Whether to put a blank line before 'return' statements, unless after an open brace. nl_before_return = false # false/true # Whether to put a blank line after 'return' statements, unless followed by a close brace. nl_after_return = false # false/true # Whether to put a newline after a Java annotation statement. # Only affects annotations that are after a newline. nl_after_annotation = ignore # ignore/add/remove/force # Controls the newline between two annotations. nl_between_annotation = ignore # ignore/add/remove/force # # Code modifying options (non-whitespace) # # Add or remove braces on single-line 'do' statement mod_full_brace_do = ignore # ignore/add/remove/force # Add or remove braces on single-line 'for' statement mod_full_brace_for = ignore # ignore/add/remove/force # Add or remove braces on single-line function definitions. (Pawn) mod_full_brace_function = ignore # ignore/add/remove/force # Add or remove braces on single-line 'if' statement. Will not remove the braces if they contain an 'else'. mod_full_brace_if = ignore # ignore/add/remove/force # Make all if/elseif/else statements in a chain be braced or not. Overrides mod_full_brace_if. # If any must be braced, they are all braced. If all can be unbraced, then the braces are removed. mod_full_brace_if_chain = false # false/true # Don't remove braces around statements that span N newlines mod_full_brace_nl = 0 # number # Add or remove braces on single-line 'while' statement mod_full_brace_while = ignore # ignore/add/remove/force # Add or remove braces on single-line 'using ()' statement mod_full_brace_using = ignore # ignore/add/remove/force # Add or remove unnecessary paren on 'return' statement mod_paren_on_return = ignore # ignore/add/remove/force # Whether to change optional semicolons to real semicolons mod_pawn_semicolon = false # false/true # Add parens on 'while' and 'if' statement around bools mod_full_paren_if_bool = false # false/true # Whether to remove superfluous semicolons mod_remove_extra_semicolon = true # false/true # If a function body exceeds the specified number of newlines and doesn't have a comment after # the close brace, a comment will be added. mod_add_long_function_closebrace_comment = 0 # number # If a switch body exceeds the specified number of newlines and doesn't have a comment after # the close brace, a comment will be added. mod_add_long_switch_closebrace_comment = 0 # number # If an #ifdef body exceeds the specified number of newlines and doesn't have a comment after # the #endif, a comment will be added. mod_add_long_ifdef_endif_comment = 0 # number # If an #ifdef or #else body exceeds the specified number of newlines and doesn't have a comment after # the #else, a comment will be added. mod_add_long_ifdef_else_comment = 0 # number # If TRUE, will sort consecutive single-line 'import' statements [Java, D] mod_sort_import = false # false/true # If TRUE, will sort consecutive single-line 'using' statements [C#] mod_sort_using = false # false/true # If TRUE, will sort consecutive single-line '#include' statements [C/C++] and '#import' statements [Obj-C] # This is generally a bad idea, as it may break your code. mod_sort_include = false # false/true # If TRUE, it will move a 'break' that appears after a fully braced 'case' before the close brace. mod_move_case_break = false # false/true # Will add or remove the braces around a fully braced case statement. # Will only remove the braces if there are no variable declarations in the block. mod_case_brace = ignore # ignore/add/remove/force # If TRUE, it will remove a void 'return;' that appears as the last statement in a function. mod_remove_empty_return = true # false/true # # Comment modifications # # Try to wrap comments at cmt_width columns cmt_width = 99 # number # Set the comment reflow mode (default: 0) # 0: no reflowing (apart from the line wrapping due to cmt_width) # 1: no touching at all # 2: full reflow cmt_reflow_mode = 2 # number # If false, disable all multi-line comment changes, including cmt_width. keyword substitution, and leading chars. # Default is true. cmt_indent_multi = false # false/true # Whether to group c-comments that look like they are in a block cmt_c_group = true # false/true # Whether to put an empty '/*' on the first line of the combined c-comment cmt_c_nl_start = false # false/true # Whether to put a newline before the closing '*/' of the combined c-comment cmt_c_nl_end = false # false/true # Whether to group cpp-comments that look like they are in a block cmt_cpp_group = true # false/true # Whether to put an empty '/*' on the first line of the combined cpp-comment cmt_cpp_nl_start = false # false/true # Whether to put a newline before the closing '*/' of the combined cpp-comment cmt_cpp_nl_end = false # false/true # Whether to change cpp-comments into c-comments cmt_cpp_to_c = false # false/true # Whether to put a star on subsequent comment lines cmt_star_cont = false # false/true # The number of spaces to insert at the start of subsequent comment lines cmt_sp_before_star_cont = 0 # number # The number of spaces to insert after the star on subsequent comment lines cmt_sp_after_star_cont = 1 # number # For multi-line comments with a '*' lead, remove leading spaces if the first and last lines of # the comment are the same length. Default=True cmt_multi_check_last = true # false/true # The filename that contains text to insert at the head of a file if the file doesn't start with a C/C++ comment. # Will substitute $(filename) with the current file's name. cmt_insert_file_header = "" # string # The filename that contains text to insert at the end of a file if the file doesn't end with a C/C++ comment. # Will substitute $(filename) with the current file's name. cmt_insert_file_footer = "" # string # The filename that contains text to insert before a function implementation if the function isn't preceded with a C/C++ comment. # Will substitute $(function) with the function name and $(javaparam) with the javadoc @param and @return stuff. # Will also substitute $(fclass) with the class name: void CFoo::Bar() { ... } cmt_insert_func_header = "" # string # The filename that contains text to insert before a class if the class isn't preceded with a C/C++ comment. # Will substitute $(class) with the class name. cmt_insert_class_header = "" # string # The filename that contains text to insert before a Obj-C message specification if the method isn't preceeded with a C/C++ comment. # Will substitute $(message) with the function name and $(javaparam) with the javadoc @param and @return stuff. cmt_insert_oc_msg_header = "" # string # If a preprocessor is encountered when stepping backwards from a function name, then # this option decides whether the comment should be inserted. # Affects cmt_insert_oc_msg_header, cmt_insert_func_header and cmt_insert_class_header. cmt_insert_before_preproc = false # false/true # # Preprocessor options # # Control indent of preprocessors inside #if blocks at brace level 0 pp_indent = ignore # ignore/add/remove/force # Whether to indent #if/#else/#endif at the brace level (true) or from column 1 (false) pp_indent_at_level = false # false/true # If pp_indent_at_level=false, specifies the number of columns to indent per level. Default=1. pp_indent_count = 1 # number # Add or remove space after # based on pp_level of #if blocks pp_space = ignore # ignore/add/remove/force # Sets the number of spaces added with pp_space pp_space_count = 0 # number # The indent for #region and #endregion in C# and '#pragma region' in C/C++ pp_indent_region = 0 # number # Whether to indent the code between #region and #endregion pp_region_indent_code = false # false/true # If pp_indent_at_level=true, sets the indent for #if, #else, and #endif when not at file-level pp_indent_if = 0 # number # Control whether to indent the code between #if, #else and #endif when not at file-level pp_if_indent_code = false # false/true # Whether to indent '#define' at the brace level (true) or from column 1 (false) pp_define_at_level = false # false/true # You can force a token to be a type with the 'type' option. # Example: # type myfoo1 myfoo2 # # You can create custom macro-based indentation using macro-open, # macro-else and macro-close. # Example: # macro-open BEGIN_TEMPLATE_MESSAGE_MAP # macro-open BEGIN_MESSAGE_MAP # macro-close END_MESSAGE_MAP # # You can assign any keyword to any type with the set option. # set func_call_user _ N_ # # The full syntax description of all custom definition config entries # is shown below: # # define custom tokens as: # - embed whitespace in token using '' escape character, or # put token in quotes # - these: ' " and ` are recognized as quote delimiters # # type token1 token2 token3 ... # ^ optionally specify multiple tokens on a single line # define def_token output_token # ^ output_token is optional, then NULL is assumed # macro-open token # macro-close token # macro-else token # set id token1 token2 ... # ^ optionally specify multiple tokens on a single line # ^ id is one of the names in token_enum.h sans the CT_ prefix, # e.g. PP_PRAGMA # # all tokens are separated by any mix of ',' commas, '=' equal signs # and whitespace (space, tab) # snort3-3.1.82.0/daqs/000077500000000000000000000000001457433257500141425ustar00rootroot00000000000000snort3-3.1.82.0/daqs/CMakeLists.txt000066400000000000000000000007071457433257500167060ustar00rootroot00000000000000macro ( add_daq_module libname ) add_dynamic_daq_module ( ${libname} ${ARGN} ) endmacro ( add_daq_module ) set ( DAQS_HEADERS daq_user.h ) set( EXTERNAL_INCLUDES ${DAQ_INCLUDE_DIR} ${PCAP_INCLUDE_DIR} ${DNET_INCLUDE_DIR} ) include_directories ( AFTER ${EXTERNAL_INCLUDES} ) add_daq_module ( daq_file daq_file.c ) add_daq_module ( daq_hext daq_hext.c ) install (FILES ${DAQS_HEADERS} DESTINATION "${INCLUDE_INSTALL_PATH}/daq" ) snort3-3.1.82.0/daqs/daq_file.c000066400000000000000000000326701457433257500160620ustar00rootroot00000000000000/*-------------------------------------------------------------------------- // Copyright (C) 2015-2024 Cisco and/or its affiliates. All rights reserved. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published // by the Free Software Foundation. You may not use, modify or distribute // this program under any other version of the GNU General Public License. // // This program is distributed in the hope that it will be useful, but // WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU // General Public License for more details. // // You should have received a copy of the GNU General Public License along // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- */ /* daq_file.c author Russ Combs */ #ifdef HAVE_CONFIG_H #include "config.h" #endif #include "daq_user.h" #include #include #include #include #include #include #include #include #include #include #define DAQ_MOD_VERSION 0 #define DAQ_NAME "file" #define DAQ_TYPE (DAQ_TYPE_FILE_CAPABLE|DAQ_TYPE_INTF_CAPABLE|DAQ_TYPE_MULTI_INSTANCE) #define FILE_DEFAULT_POOL_SIZE 16 #define FILE_BUF_SZ 16384 #define SET_ERROR(modinst, ...) daq_base_api.set_errbuf(modinst, __VA_ARGS__) typedef struct _file_msg_desc { DAQ_Msg_t msg; DAQ_PktHdr_t pkthdr; DAQ_UsrHdr_t pci; uint8_t* data; struct _file_msg_desc* next; } FileMsgDesc; typedef struct { FileMsgDesc* pool; FileMsgDesc* freelist; DAQ_MsgPoolInfo_t info; } FileMsgPool; typedef struct { /* Configuration */ char* filename; unsigned snaplen; /* State */ DAQ_ModuleInstance_h modinst; FileMsgPool pool; int fid; volatile bool interrupted; bool sof; bool eof; DAQ_UsrHdr_t pci; DAQ_Stats_t stats; } FileContext; static DAQ_BaseAPI_t daq_base_api; //------------------------------------------------------------------------- // utility functions //------------------------------------------------------------------------- static void destroy_message_pool(FileContext* fc) { FileMsgPool* pool = &fc->pool; if (pool->pool) { while (pool->info.size > 0) free(pool->pool[--pool->info.size].data); free(pool->pool); pool->pool = NULL; } pool->freelist = NULL; pool->info.available = 0; pool->info.mem_size = 0; } static int create_message_pool(FileContext* fc, unsigned size) { FileMsgPool* pool = &fc->pool; pool->pool = calloc(sizeof(FileMsgDesc), size); if (!pool->pool) { SET_ERROR(fc->modinst, "%s: Could not allocate %zu bytes for a packet descriptor pool!", __func__, sizeof(FileMsgDesc) * size); return DAQ_ERROR_NOMEM; } pool->info.mem_size = sizeof(FileMsgDesc) * size; while (pool->info.size < size) { /* Allocate packet data and set up descriptor */ FileMsgDesc *desc = &pool->pool[pool->info.size]; desc->data = malloc(fc->snaplen); if (!desc->data) { SET_ERROR(fc->modinst, "%s: Could not allocate %d bytes for a packet descriptor message buffer!", __func__, fc->snaplen); return DAQ_ERROR_NOMEM; } pool->info.mem_size += fc->snaplen; /* Initialize non-zero invariant packet header fields. */ DAQ_PktHdr_t *pkthdr = &desc->pkthdr; pkthdr->ingress_index = DAQ_PKTHDR_UNKNOWN; pkthdr->ingress_group = DAQ_PKTHDR_UNKNOWN; pkthdr->egress_index = DAQ_PKTHDR_UNKNOWN; pkthdr->egress_group = DAQ_PKTHDR_UNKNOWN; /* Initialize non-zero invariant message header fields. */ DAQ_Msg_t *msg = &desc->msg; msg->owner = fc->modinst; msg->priv = desc; /* Place it on the free list */ desc->next = pool->freelist; pool->freelist = desc; pool->info.size++; } pool->info.available = pool->info.size; return DAQ_SUCCESS; } //------------------------------------------------------------------------- // file functions //------------------------------------------------------------------------- static int file_setup(FileContext* fc) { if ( !strcmp(fc->filename, "tty") ) { fc->fid = STDIN_FILENO; } else if ( (fc->fid = open(fc->filename, O_RDONLY|O_NONBLOCK)) < 0 ) { char error_msg[1024] = {0}; if (strerror_r(errno, error_msg, sizeof(error_msg)) == 0) SET_ERROR(fc->modinst, "%s: can't open file (%s)", DAQ_NAME, error_msg); else SET_ERROR(fc->modinst, "%s: can't open file: %d", DAQ_NAME, errno); return -1; } fc->sof = true; fc->eof = false; return 0; } static void file_cleanup(FileContext* fc) { if ( fc->fid > STDIN_FILENO ) close(fc->fid); fc->fid = -1; } //------------------------------------------------------------------------- // daq utilities //------------------------------------------------------------------------- static void init_packet_message(FileContext* fc, FileMsgDesc* desc) { DAQ_PktHdr_t *pkthdr = &desc->pkthdr; desc->msg.type = DAQ_MSG_TYPE_PACKET; desc->msg.hdr_len = sizeof(*pkthdr); desc->msg.hdr = pkthdr; desc->msg.data_len = 0; desc->msg.data = desc->data; struct timeval t; gettimeofday(&t, NULL); pkthdr->ts.tv_sec = t.tv_sec; pkthdr->ts.tv_usec = t.tv_usec; desc->pci = fc->pci; if (fc->sof) { desc->pci.flags |= DAQ_USR_FLAG_START_FLOW; fc->sof = false; } } static DAQ_RecvStatus file_read_message(FileContext* fc, FileMsgDesc* desc) { desc->msg.data = NULL; int n = read(fc->fid, desc->data, fc->snaplen); if ( n ) { init_packet_message(fc, desc); desc->msg.data_len = n; } else { // create an empty packet message to convey the End of Flow if (!fc->eof) { init_packet_message(fc, desc); desc->pci.flags |= DAQ_USR_FLAG_END_FLOW; fc->eof = true; return DAQ_RSTAT_EOF; } } if ( n < 0 ) { if (errno != EINTR) { char error_msg[1024] = {0}; if (strerror_r(errno, error_msg, sizeof(error_msg)) == 0) SET_ERROR(fc->modinst, "%s: can't read from file (%s)", DAQ_NAME, error_msg); else SET_ERROR(fc->modinst, "%s: can't read from file: %d", DAQ_NAME, errno); return DAQ_RSTAT_ERROR; } } return DAQ_RSTAT_OK; } //------------------------------------------------------------------------- // daq //------------------------------------------------------------------------- static int file_daq_module_load(const DAQ_BaseAPI_t* base_api) { if (base_api->api_version != DAQ_BASE_API_VERSION || base_api->api_size != sizeof(DAQ_BaseAPI_t)) return DAQ_ERROR; daq_base_api = *base_api; return DAQ_SUCCESS; } static int file_daq_instantiate(const DAQ_ModuleConfig_h modcfg, DAQ_ModuleInstance_h modinst, void** ctxt_ptr) { FileContext* fc; int rval = DAQ_ERROR; fc = calloc(1, sizeof(*fc)); if (!fc) { SET_ERROR(modinst, "%s: Couldn't allocate memory for the new File context!", DAQ_NAME); rval = DAQ_ERROR_NOMEM; goto err; } fc->modinst = modinst; fc->snaplen = daq_base_api.config_get_snaplen(modcfg) ? daq_base_api.config_get_snaplen(modcfg) : FILE_BUF_SZ; fc->fid = -1; const char* filename = daq_base_api.config_get_input(modcfg); if (filename) { if (!(fc->filename = strdup(filename))) { SET_ERROR(modinst, "%s: Couldn't allocate memory for the filename!", DAQ_NAME); rval = DAQ_ERROR_NOMEM; goto err; } } uint32_t pool_size = daq_base_api.config_get_msg_pool_size(modcfg); rval = create_message_pool(fc, pool_size ? pool_size : FILE_DEFAULT_POOL_SIZE); if (rval != DAQ_SUCCESS) goto err; *ctxt_ptr = fc; return DAQ_SUCCESS; err: if (fc) { if (fc->filename) free(fc->filename); destroy_message_pool(fc); free(fc); } return rval; } static void file_daq_destroy(void* handle) { FileContext* fc = (FileContext*) handle; if (fc->filename) free(fc->filename); destroy_message_pool(fc); free(fc); } static int file_daq_start(void* handle) { FileContext* fc = (FileContext*) handle; if (file_setup(fc)) return DAQ_ERROR; return DAQ_SUCCESS; } static int file_daq_interrupt(void* handle) { FileContext* fc = (FileContext*) handle; fc->interrupted = true; return DAQ_SUCCESS; } static int file_daq_stop (void* handle) { FileContext* fc = (FileContext*) handle; file_cleanup(fc); return DAQ_SUCCESS; } static int file_daq_ioctl(void* handle, DAQ_IoctlCmd cmd, void* arg, size_t arglen) { (void) handle; if (cmd == DIOCTL_QUERY_USR_PCI) { if (arglen != sizeof(DIOCTL_QueryUsrPCI)) return DAQ_ERROR_INVAL; DIOCTL_QueryUsrPCI* qup = (DIOCTL_QueryUsrPCI*) arg; if (!qup->msg) return DAQ_ERROR_INVAL; FileMsgDesc* desc = (FileMsgDesc*) qup->msg->priv; qup->pci = &desc->pci; return DAQ_SUCCESS; } return DAQ_ERROR_NOTSUP; } static int file_daq_get_stats(void* handle, DAQ_Stats_t* stats) { FileContext* fc = (FileContext*) handle; memcpy(stats, &fc->stats, sizeof(DAQ_Stats_t)); return DAQ_SUCCESS; } static void file_daq_reset_stats(void* handle) { FileContext* fc = (FileContext*) handle; memset(&fc->stats, 0, sizeof(fc->stats)); } static int file_daq_get_snaplen (void* handle) { FileContext* fc = (FileContext*) handle; return fc->snaplen; } static uint32_t file_daq_get_capabilities(void* handle) { (void) handle; return DAQ_CAPA_BLOCK | DAQ_CAPA_REPLACE | DAQ_CAPA_INJECT | DAQ_CAPA_INJECT_RAW | DAQ_CAPA_INTERRUPT | DAQ_CAPA_UNPRIV_START; } static int file_daq_get_datalink_type(void *handle) { (void)handle; return DLT_USER; } static unsigned file_daq_msg_receive(void* handle, const unsigned max_recv, const DAQ_Msg_t* msgs[], DAQ_RecvStatus* rstat) { FileContext* fc = (FileContext*) handle; DAQ_RecvStatus status = DAQ_RSTAT_OK; unsigned idx = 0; while (idx < max_recv) { /* Check to see if the receive has been canceled. If so, reset it and return appropriately. */ if (fc->interrupted) { fc->interrupted = false; status = DAQ_RSTAT_INTERRUPTED; break; } /* Make sure that we have a message descriptor available to populate. */ FileMsgDesc* desc = fc->pool.freelist; if (!desc) { status = DAQ_RSTAT_NOBUF; break; } /* Attempt to read a message into the descriptor. */ status = file_read_message(fc, desc); if (status != DAQ_RSTAT_OK) break; /* Last, but not least, extract this descriptor from the free list and place the message in the return vector. */ fc->pool.freelist = desc->next; desc->next = NULL; fc->pool.info.available--; msgs[idx] = &desc->msg; idx++; } *rstat = status; return idx; } static int file_daq_msg_finalize(void* handle, const DAQ_Msg_t* msg, DAQ_Verdict verdict) { FileContext* fc = (FileContext*) handle; FileMsgDesc* desc = (FileMsgDesc *) msg->priv; if (verdict >= MAX_DAQ_VERDICT) verdict = DAQ_VERDICT_PASS; fc->stats.verdicts[verdict]++; /* Toss the descriptor back on the free list for reuse. */ desc->next = fc->pool.freelist; fc->pool.freelist = desc; fc->pool.info.available++; return DAQ_SUCCESS; } static int file_daq_get_msg_pool_info(void* handle, DAQ_MsgPoolInfo_t* info) { FileContext* fc = (FileContext*) handle; *info = fc->pool.info; return DAQ_SUCCESS; } //------------------------------------------------------------------------- #ifdef BUILDING_SO DAQ_SO_PUBLIC const DAQ_ModuleAPI_t DAQ_MODULE_DATA = #else const DAQ_ModuleAPI_t file_daq_module_data = #endif { /* .api_version = */ DAQ_MODULE_API_VERSION, /* .api_size = */ sizeof(DAQ_ModuleAPI_t), /* .module_version = */ DAQ_MOD_VERSION, /* .name = */ DAQ_NAME, /* .type = */ DAQ_TYPE, /* .load = */ file_daq_module_load, /* .unload = */ NULL, /* .get_variable_descs = */ NULL, /* .instantiate = */ file_daq_instantiate, /* .destroy = */ file_daq_destroy, /* .set_filter = */ NULL, /* .start = */ file_daq_start, /* .inject = */ NULL, /* .inject_relative = */ NULL, /* .interrupt = */ file_daq_interrupt, /* .stop = */ file_daq_stop, /* .ioctl = */ file_daq_ioctl, /* .get_stats = */ file_daq_get_stats, /* .reset_stats = */ file_daq_reset_stats, /* .get_snaplen = */ file_daq_get_snaplen, /* .get_capabilities = */ file_daq_get_capabilities, /* .get_datalink_type = */ file_daq_get_datalink_type, /* .config_load = */ NULL, /* .config_swap = */ NULL, /* .config_free = */ NULL, /* .msg_receive = */ file_daq_msg_receive, /* .msg_finalize = */ file_daq_msg_finalize, /* .get_msg_pool_info = */ file_daq_get_msg_pool_info, }; snort3-3.1.82.0/daqs/daq_hext.c000066400000000000000000000547251457433257500161200ustar00rootroot00000000000000/*-------------------------------------------------------------------------- // Copyright (C) 2015-2024 Cisco and/or its affiliates. All rights reserved. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published // by the Free Software Foundation. You may not use, modify or distribute // this program under any other version of the GNU General Public License. // // This program is distributed in the hope that it will be useful, but // WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU // General Public License for more details. // // You should have received a copy of the GNU General Public License along // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- */ /* daq_hext.c author Russ Combs */ #ifdef HAVE_CONFIG_H #include "config.h" #endif #include "daq_user.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #define DAQ_MOD_VERSION 1 #define DAQ_NAME "hext" #define DAQ_TYPE (DAQ_TYPE_FILE_CAPABLE|DAQ_TYPE_INTF_CAPABLE|DAQ_TYPE_MULTI_INSTANCE) #define HEXT_DEFAULT_POOL_SIZE 16 #define DEF_BUF_SZ 16384 #define MAX_LINE_SZ 128 #define SET_ERROR(modinst, ...) daq_base_api.set_errbuf(modinst, __VA_ARGS__) typedef struct _hext_msg_desc { DAQ_Msg_t msg; DAQ_PktHdr_t pkthdr; DAQ_FlowStats_t flowstats; DAQ_UsrHdr_t pci; uint8_t* data; struct _hext_msg_desc* next; } HextMsgDesc; typedef struct { HextMsgDesc* pool; HextMsgDesc* freelist; DAQ_MsgPoolInfo_t info; } HextMsgPool; typedef struct { /* Configuration */ char* filename; unsigned snaplen; int dlt; /* State */ DAQ_ModuleInstance_h modinst; HextMsgPool pool; FILE* fp; volatile bool interrupted; bool sof; bool eof; DAQ_UsrHdr_t pci; DAQ_UsrHdr_t cfg; DAQ_Stats_t stats; } HextContext; static DAQ_VariableDesc_t hext_variable_descriptions[] = { { "dlt", "Data link type to report to the application instead of DLT_USER (integer)", DAQ_VAR_DESC_REQUIRES_ARGUMENT }, }; static DAQ_BaseAPI_t daq_base_api; //------------------------------------------------------------------------- // utility functions //------------------------------------------------------------------------- static void destroy_message_pool(HextContext* hc) { HextMsgPool* pool = &hc->pool; if (pool->pool) { while (pool->info.size > 0) free(pool->pool[--pool->info.size].data); free(pool->pool); pool->pool = NULL; } pool->freelist = NULL; pool->info.available = 0; pool->info.mem_size = 0; } static int create_message_pool(HextContext* hc, unsigned size) { HextMsgPool* pool = &hc->pool; pool->pool = calloc(sizeof(HextMsgDesc), size); if (!pool->pool) { SET_ERROR(hc->modinst, "%s: Could not allocate %zu bytes for a packet descriptor pool!", __func__, sizeof(HextMsgDesc) * size); return DAQ_ERROR_NOMEM; } pool->info.mem_size = sizeof(HextMsgDesc) * size; while (pool->info.size < size) { /* Allocate packet data and set up descriptor */ HextMsgDesc *desc = &pool->pool[pool->info.size]; desc->data = malloc(hc->snaplen); if (!desc->data) { SET_ERROR(hc->modinst, "%s: Could not allocate %d bytes for a packet descriptor message buffer!", __func__, hc->snaplen); return DAQ_ERROR_NOMEM; } pool->info.mem_size += hc->snaplen; /* Initialize non-zero invariant packet header fields. */ DAQ_PktHdr_t *pkthdr = &desc->pkthdr; pkthdr->ingress_index = DAQ_PKTHDR_UNKNOWN; pkthdr->ingress_group = DAQ_PKTHDR_UNKNOWN; pkthdr->egress_index = DAQ_PKTHDR_UNKNOWN; pkthdr->egress_group = DAQ_PKTHDR_UNKNOWN; /* Initialize non-zero invariant message header fields. */ DAQ_Msg_t *msg = &desc->msg; msg->owner = hc->modinst; msg->priv = desc; /* Place it on the free list */ desc->next = pool->freelist; pool->freelist = desc; pool->info.size++; } pool->info.available = pool->info.size; return DAQ_SUCCESS; } static void set_c2s(HextContext* hc, int c2s) { if (c2s) { hc->pci = hc->cfg; } else { hc->pci.src_addr = hc->cfg.dst_addr; hc->pci.dst_addr = hc->cfg.src_addr; hc->pci.src_port = hc->cfg.dst_port; hc->pci.dst_port = hc->cfg.src_port; hc->pci.flags &= ~DAQ_USR_FLAG_TO_SERVER; } } static void parse_host(const char* s, uint32_t* addr, uint16_t* port) { char buf[32]; // oversize so pton() errors out if too long unsigned c = 0; while (isspace(*s)) s++; while (*s && !isspace(*s) && c < sizeof(buf)) buf[c++] = *s++; if (c == sizeof(buf)) --c; buf[c] = '\0'; inet_pton(AF_INET, buf, addr); *port = atoi(s); } static void parse_pci(HextContext* hc, const char* s) { parse_host(s, &hc->pci.src_addr, &hc->pci.src_port); s = strstr(s, "->"); if (!s) return; parse_host(s+2, &hc->pci.dst_addr, &hc->pci.dst_port); // hack until client / server is resolved: if (hc->pci.src_port >= hc->pci.dst_port) hc->pci.flags |= DAQ_USR_FLAG_TO_SERVER; else hc->pci.flags &= ~DAQ_USR_FLAG_TO_SERVER; } static bool is_ipv4(char const* src) { struct in6_addr temp; if (inet_pton(AF_INET, src, &temp) == 1) return true; else if (inet_pton(AF_INET6, src, &temp) == 1) return false; return false; } static void IpAddr(uint32_t* addr, char const* ip) { if (is_ipv4(ip)) { addr[0] = 0; addr[1] = 0; addr[2] = htonl(0xffff); inet_pton(AF_INET, ip, &addr[3]); } else inet_pton(AF_INET6, ip, addr); } static bool parse_flowstats(DAQ_MsgType type, const char* line, HextMsgDesc *desc) { #define FLOWSTATS_FORMAT \ "%" SCNi16 " " /* ingress_group */ \ "%" SCNi16 " " /* egress_group */ \ "%" SCNi32 " " /* ingress_intf */ \ "%" SCNi32 " " /* egress_intf */ \ "%s " /* srcAddr */ \ "%" SCNu16 " " /* initiator_port */ \ "%s " /* dstAddr */ \ "%" SCNu16 " " /* responder_port */ \ "%" SCNu32 " " /* opaque */ \ "%" SCNu64 " " /* initiator_pkts */ \ "%" SCNu64 " " /* responder_pkts */ \ "%" SCNu64 " " /* initiator_pkts_dropped */ \ "%" SCNu64 " " /* responder_pkts_dropped */ \ "%" SCNu64 " " /* initiator_bytes_dropped */ \ "%" SCNu64 " " /* responder_bytes_dropped */ \ "%" SCNu8 " " /* is_qos_applied_on_src_intf */ \ "%" SCNu32 " " /* sof_timestamp.tv_sec */ \ "%" SCNu32 " " /* eof_timestamp.tv_sec */ \ "%" SCNu32 " " /* address_space_id */ \ "%" SCNu32 " " /* tenant_id */ \ "%" SCNu16 " " /* vlan_tag */ \ "%" SCNu8 " " /* protocol */ \ "%" SCNu8 /* flags */ #define FLOWSTATS_ITEMS 23 DAQ_FlowStats_t* f = &desc->flowstats; char srcaddr[INET6_ADDRSTRLEN], dstaddr[INET6_ADDRSTRLEN]; uint32_t sof_sec, eof_sec; int rval = sscanf(line, FLOWSTATS_FORMAT, &f->ingress_group, &f->egress_group, &f->ingress_intf, &f->egress_intf, srcaddr, &f->initiator_port, dstaddr, &f->responder_port, &f->opaque, &f->initiator_pkts, &f->responder_pkts, &f->initiator_pkts_dropped, &f->responder_pkts_dropped, &f->initiator_bytes_dropped, &f->responder_bytes_dropped, &f->is_qos_applied_on_src_intf, &sof_sec, &eof_sec, &f->address_space_id, &f->tenant_id, &f->vlan_tag, &f->protocol, &f->flags); if (rval != FLOWSTATS_ITEMS) return false; f->sof_timestamp.tv_sec = sof_sec; f->eof_timestamp.tv_sec = eof_sec; desc->msg.type = type; desc->msg.hdr_len = sizeof(desc->flowstats); desc->msg.hdr = &desc->flowstats; desc->msg.data_len = 0; desc->msg.data = NULL; IpAddr((uint32_t*)&f->initiator_ip, srcaddr); f->initiator_port = htons(f->initiator_port); IpAddr((uint32_t*)&f->responder_ip, dstaddr); f->responder_port = htons(f->responder_port); f->sof_timestamp.tv_usec = 0; f->eof_timestamp.tv_usec = 0; if (f->vlan_tag == 0) f->vlan_tag = 0xfff; return true; } static uint8_t xlat(char c) { switch (c) { case 'r': return '\r'; case 'n': return '\n'; case 't': return '\t'; case '\\': return '\\'; } return c; } static int unescape(char c, char* u) { static int esc = 0; if (!esc && c == '\\') { esc = 1; return 0; } else if (esc) { esc = 0; *u = xlat(c); } else *u = c; return 1; } //------------------------------------------------------------------------- // parsing functions //------------------------------------------------------------------------- // all commands start with $ // $packet -> // $packet -> client // $packet -> server // $client // $server static bool parse_command(HextContext* hc, const char* s, HextMsgDesc *desc) { bool msg = false; if (!strncmp(s, "packet -> client", 16)) set_c2s(hc, 0); else if (!strncmp(s, "packet -> server", 16)) set_c2s(hc, 1); else if (!strncmp(s, "packet ", 7)) parse_pci(hc, s+7); else if (!strncmp(s, "client ", 7)) parse_host(s+7, &hc->cfg.src_addr, &hc->cfg.src_port); else if (!strncmp(s, "server ", 7)) parse_host(s+7, &hc->cfg.dst_addr, &hc->cfg.dst_port); else if (!strncmp(s, "sof ", 4)) msg = parse_flowstats(DAQ_MSG_TYPE_SOF, s+4, desc); else if (!strncmp(s, "eof ", 4)) msg = parse_flowstats(DAQ_MSG_TYPE_EOF, s+4, desc); return msg; } // load quoted string data into buffer up to snaplen static void parse_string(HextContext* hc, char* s, HextMsgDesc *desc) { char t; while (*s && *s != '"' && desc->msg.data_len < hc->snaplen) { if (unescape(*s++, &t)) desc->data[desc->msg.data_len++] = t; } desc->pkthdr.pktlen = desc->msg.data_len; } // load hex data into buffer up to snaplen static void parse_hex(HextContext* hc, char* s, HextMsgDesc *desc) { char* t = s; long x = strtol(t, &s, 16); while (*s && s != t && desc->msg.data_len < hc->snaplen) { desc->data[desc->msg.data_len++] = (uint8_t) x; x = strtol(t=s, &s, 16); } desc->pkthdr.pktlen = desc->msg.data_len; } static void init_packet_message(HextContext* hc, HextMsgDesc* desc) { DAQ_PktHdr_t *pkthdr = &desc->pkthdr; desc->msg.type = DAQ_MSG_TYPE_PACKET; desc->msg.hdr_len = sizeof(*pkthdr); desc->msg.hdr = pkthdr; desc->msg.data_len = 0; desc->msg.data = desc->data; struct timeval t; gettimeofday(&t, NULL); pkthdr->ts.tv_sec = t.tv_sec; pkthdr->ts.tv_usec = t.tv_usec; desc->pci = hc->pci; if (hc->sof) { desc->pci.flags |= DAQ_USR_FLAG_START_FLOW; hc->sof = false; } } static bool parse(HextContext* hc, char* line, HextMsgDesc* desc) { char* s = line; bool got_msg = false; while (isspace(*s)) s++; // Force a flush of the current packet message if we hit a blank line or command switch (*s) { case '\0': if (desc->msg.data) got_msg = true; break; case '#': break; case '$': // Do not reset the line buffer so that we can parse the command the next time through if (desc->msg.data) return true; got_msg = parse_command(hc, s+1, desc); break; case '"': if (!desc->msg.data) init_packet_message(hc, desc); parse_string(hc, s+1, desc); break; case 'x': if (!desc->msg.data) init_packet_message(hc, desc); parse_hex(hc, s+1, desc); break; } line[0] = '\0'; return got_msg; } static DAQ_RecvStatus hext_read_message(HextContext* hc, HextMsgDesc* desc) { char line[MAX_LINE_SZ]; char* s = NULL; desc->msg.data = NULL; line[0] = '\0'; while (line[0] != '\0' || (s = fgets(line, sizeof(line), hc->fp)) != NULL) { // FIXIT-L Currently no error checking, just ignores bad lines if (parse(hc, line, desc)) break; } if (!s) { if (feof(hc->fp)) { // If there is still pending data in a packet message, mark it as End of Flow and flush it // Otherwise, create an empty packet message to convey the End of Flow // FIXIT-M - Make this actually the case, for now Snort can't handle data on packets marked EoF /* if (!hc->eof) { if (!desc->msg.data) init_packet_message(hc, desc); desc->pci.flags |= DAQ_USR_FLAG_END_FLOW; hc->eof = true; return DAQ_RSTAT_OK; } */ if (desc->msg.data) return DAQ_RSTAT_OK; if (!hc->eof) { init_packet_message(hc, desc); desc->pci.flags |= DAQ_USR_FLAG_END_FLOW; hc->eof = true; return DAQ_RSTAT_OK; } return DAQ_RSTAT_EOF; } if (ferror(hc->fp)) { char error_msg[1024] = {0}; if (strerror_r(errno, error_msg, sizeof(error_msg)) == 0) SET_ERROR(hc->modinst, "%s: can't read from file (%s)\n", DAQ_NAME, error_msg); else SET_ERROR(hc->modinst, "%s: can't read from file: %d\n", DAQ_NAME, errno); return DAQ_RSTAT_ERROR; } } return DAQ_RSTAT_OK; } //------------------------------------------------------------------------- // file functions //------------------------------------------------------------------------- static int hext_setup(HextContext* hc) { if (!strcmp(hc->filename, "-")) { hc->fp = stdin; } else if (!(hc->fp = fopen(hc->filename, "r"))) { char error_msg[1024] = {0}; if (strerror_r(errno, error_msg, sizeof(error_msg)) == 0) SET_ERROR(hc->modinst, "%s: can't open file (%s)\n", DAQ_NAME, error_msg); else SET_ERROR(hc->modinst, "%s: can't open file: %d\n", DAQ_NAME, errno); return -1; } parse_host("192.168.1.2 12345", &hc->cfg.src_addr, &hc->cfg.src_port); parse_host("10.1.2.3 80", &hc->cfg.dst_addr, &hc->cfg.dst_port); hc->cfg.ip_proto = hc->pci.ip_proto = IPPROTO_TCP; hc->cfg.flags = hc->pci.flags = DAQ_USR_FLAG_TO_SERVER; hc->sof = true; hc->eof = false; return 0; } //------------------------------------------------------------------------- // daq //------------------------------------------------------------------------- static int hext_daq_module_load(const DAQ_BaseAPI_t* base_api) { if (base_api->api_version != DAQ_BASE_API_VERSION || base_api->api_size != sizeof(DAQ_BaseAPI_t)) return DAQ_ERROR; daq_base_api = *base_api; return DAQ_SUCCESS; } static int hext_daq_get_variable_descs(const DAQ_VariableDesc_t** var_desc_table) { *var_desc_table = hext_variable_descriptions; return sizeof(hext_variable_descriptions) / sizeof(DAQ_VariableDesc_t); } static int hext_daq_instantiate(const DAQ_ModuleConfig_h modcfg, DAQ_ModuleInstance_h modinst, void** ctxt_ptr) { HextContext* hc; int rval = DAQ_ERROR; hc = calloc(1, sizeof(*hc)); if (!hc) { SET_ERROR(modinst, "%s: Couldn't allocate memory for the new Hext context!", DAQ_NAME); rval = DAQ_ERROR_NOMEM; goto err; } hc->modinst = modinst; hc->snaplen = daq_base_api.config_get_snaplen(modcfg) ? daq_base_api.config_get_snaplen(modcfg) : DEF_BUF_SZ; hc->dlt = DLT_USER; const char* varKey, * varValue; daq_base_api.config_first_variable(modcfg, &varKey, &varValue); while (varKey) { /* Retrieve the requested buffer size (default = 0) */ if (!strcmp(varKey, "dlt")) hc->dlt = strtol(varValue, NULL, 10); else { SET_ERROR(modinst, "%s: Unknown variable name: '%s'", DAQ_NAME, varKey); rval = DAQ_ERROR_INVAL; goto err; } daq_base_api.config_next_variable(modcfg, &varKey, &varValue); } const char* filename = daq_base_api.config_get_input(modcfg); if (filename) { if (!(hc->filename = strdup(filename))) { SET_ERROR(modinst, "%s: Couldn't allocate memory for the filename!", DAQ_NAME); rval = DAQ_ERROR_NOMEM; goto err; } } uint32_t pool_size = daq_base_api.config_get_msg_pool_size(modcfg); rval = create_message_pool(hc, pool_size ? pool_size : HEXT_DEFAULT_POOL_SIZE); if (rval != DAQ_SUCCESS) goto err; *ctxt_ptr = hc; return DAQ_SUCCESS; err: if (hc) { if (hc->filename) free(hc->filename); destroy_message_pool(hc); free(hc); } return rval; } static void hext_daq_destroy(void* handle) { HextContext* hc = (HextContext*) handle; if (hc->filename) free(hc->filename); destroy_message_pool(hc); free(hc); } static int hext_daq_start(void* handle) { HextContext* hc = (HextContext*) handle; if (hext_setup(hc)) return DAQ_ERROR; return DAQ_SUCCESS; } static int hext_daq_interrupt(void* handle) { HextContext* hc = (HextContext*) handle; hc->interrupted = true; return DAQ_SUCCESS; } static int hext_daq_stop(void* handle) { HextContext* hc = (HextContext*) handle; if (hc->fp != stdin) fclose(hc->fp); hc->fp = NULL; return DAQ_SUCCESS; } static int hext_daq_ioctl(void* handle, DAQ_IoctlCmd cmd, void* arg, size_t arglen) { (void) handle; if (cmd == DIOCTL_QUERY_USR_PCI) { if (arglen != sizeof(DIOCTL_QueryUsrPCI)) return DAQ_ERROR_INVAL; DIOCTL_QueryUsrPCI* qup = (DIOCTL_QueryUsrPCI*) arg; if (!qup->msg) return DAQ_ERROR_INVAL; HextMsgDesc* desc = (HextMsgDesc*) qup->msg->priv; qup->pci = &desc->pci; return DAQ_SUCCESS; } return DAQ_ERROR_NOTSUP; } static int hext_daq_get_stats(void* handle, DAQ_Stats_t* stats) { HextContext* hc = (HextContext*) handle; memcpy(stats, &hc->stats, sizeof(DAQ_Stats_t)); return DAQ_SUCCESS; } static void hext_daq_reset_stats(void* handle) { HextContext* hc = (HextContext*) handle; memset(&hc->stats, 0, sizeof(hc->stats)); } static int hext_daq_get_snaplen (void* handle) { HextContext* hc = (HextContext*) handle; return hc->snaplen; } static uint32_t hext_daq_get_capabilities(void* handle) { (void) handle; return DAQ_CAPA_BLOCK | DAQ_CAPA_REPLACE | DAQ_CAPA_INJECT | DAQ_CAPA_INJECT_RAW | DAQ_CAPA_INTERRUPT | DAQ_CAPA_UNPRIV_START; } static int hext_daq_get_datalink_type(void* handle) { HextContext* hc = (HextContext*) handle; return hc->dlt; } static unsigned hext_daq_msg_receive(void* handle, const unsigned max_recv, const DAQ_Msg_t* msgs[], DAQ_RecvStatus* rstat) { HextContext* hc = (HextContext*) handle; DAQ_RecvStatus status = DAQ_RSTAT_OK; unsigned idx = 0; while (idx < max_recv) { /* Check to see if the receive has been canceled. If so, reset it and return appropriately. */ if (hc->interrupted) { hc->interrupted = false; status = DAQ_RSTAT_INTERRUPTED; break; } /* Make sure that we have a message descriptor available to populate. */ HextMsgDesc* desc = hc->pool.freelist; if (!desc) { status = DAQ_RSTAT_NOBUF; break; } /* Attempt to read a message into the descriptor. */ status = hext_read_message(hc, desc); if (status != DAQ_RSTAT_OK) break; /* Last, but not least, extract this descriptor from the free list and place the message in the return vector. */ hc->pool.freelist = desc->next; desc->next = NULL; hc->pool.info.available--; msgs[idx] = &desc->msg; idx++; } *rstat = status; return idx; } static int hext_daq_msg_finalize(void* handle, const DAQ_Msg_t* msg, DAQ_Verdict verdict) { HextContext* hc = (HextContext*) handle; HextMsgDesc* desc = (HextMsgDesc *) msg->priv; if (verdict >= MAX_DAQ_VERDICT) verdict = DAQ_VERDICT_PASS; hc->stats.verdicts[verdict]++; /* Toss the descriptor back on the free list for reuse. */ desc->next = hc->pool.freelist; hc->pool.freelist = desc; hc->pool.info.available++; return DAQ_SUCCESS; } static int hext_daq_get_msg_pool_info(void* handle, DAQ_MsgPoolInfo_t* info) { HextContext* hc = (HextContext*) handle; *info = hc->pool.info; return DAQ_SUCCESS; } //------------------------------------------------------------------------- #ifdef BUILDING_SO DAQ_SO_PUBLIC const DAQ_ModuleAPI_t DAQ_MODULE_DATA = #else const DAQ_ModuleAPI_t hext_daq_module_data = #endif { /* .api_version = */ DAQ_MODULE_API_VERSION, /* .api_size = */ sizeof(DAQ_ModuleAPI_t), /* .module_version = */ DAQ_MOD_VERSION, /* .name = */ DAQ_NAME, /* .type = */ DAQ_TYPE, /* .load = */ hext_daq_module_load, /* .unload = */ NULL, /* .get_variable_descs = */ hext_daq_get_variable_descs, /* .instantiate = */ hext_daq_instantiate, /* .destroy = */ hext_daq_destroy, /* .set_filter = */ NULL, /* .start = */ hext_daq_start, /* .inject = */ NULL, /* .inject_relative = */ NULL, /* .interrupt = */ hext_daq_interrupt, /* .stop = */ hext_daq_stop, /* .ioctl = */ hext_daq_ioctl, /* .get_stats = */ hext_daq_get_stats, /* .reset_stats = */ hext_daq_reset_stats, /* .get_snaplen = */ hext_daq_get_snaplen, /* .get_capabilities = */ hext_daq_get_capabilities, /* .get_datalink_type = */ hext_daq_get_datalink_type, /* .config_load = */ NULL, /* .config_swap = */ NULL, /* .config_free = */ NULL, /* .msg_receive = */ hext_daq_msg_receive, /* .msg_finalize = */ hext_daq_msg_finalize, /* .get_msg_pool_info = */ hext_daq_get_msg_pool_info, }; snort3-3.1.82.0/daqs/daq_user.h000066400000000000000000000032131457433257500161150ustar00rootroot00000000000000/*-------------------------------------------------------------------------- // Copyright (C) 2015-2024 Cisco and/or its affiliates. All rights reserved. // // This program is free software; you can redistribute it and/or modify it // under the terms of the GNU General Public License Version 2 as published // by the Free Software Foundation. You may not use, modify or distribute // this program under any other version of the GNU General Public License. // // This program is distributed in the hope that it will be useful, but // WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU // General Public License for more details. // // You should have received a copy of the GNU General Public License along // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- */ /* daq_user.h author Russ Combs */ /* this is a C include, not C++ */ #ifndef DAQ_USER_H #define DAQ_USER_H #include #include /* for raw payload only */ #define DLT_USER 230 /* DAQ_UsrHdr_t.flags */ #define DAQ_USR_FLAG_TO_SERVER 0x01 #define DAQ_USR_FLAG_START_FLOW 0x02 #define DAQ_USR_FLAG_END_FLOW 0x04 typedef struct { uint32_t src_addr; uint32_t dst_addr; uint16_t src_port; uint16_t dst_port; uint8_t ip_proto; uint8_t flags; } DAQ_UsrHdr_t; #define DIOCTL_QUERY_USR_PCI (DAQ_IoctlCmd) 2048 typedef struct { DAQ_Msg_h msg; DAQ_UsrHdr_t* pci; } DIOCTL_QueryUsrPCI; #endif snort3-3.1.82.0/doc/000077500000000000000000000000001457433257500137575ustar00rootroot00000000000000snort3-3.1.82.0/doc/CMakeLists.txt000066400000000000000000000020551457433257500165210ustar00rootroot00000000000000 add_subdirectory (user) add_subdirectory (reference) add_subdirectory (upgrade) add_subdirectory (devel) add_custom_target ( docs-html DEPENDS docs-user-html docs-reference-html docs-upgrade-html ) add_custom_target ( docs-pdf DEPENDS docs-user-pdf docs-reference-pdf docs-upgrade-pdf ) add_custom_target ( docs-text DEPENDS docs-user-text docs-reference-text docs-upgrade-text ) add_custom_target ( docs-user DEPENDS docs-user-html docs-user-pdf docs-user-text ) add_custom_target ( docs-reference DEPENDS docs-reference-html docs-reference-pdf docs-reference-text ) add_custom_target ( docs-upgrade DEPENDS docs-upgrade-html docs-upgrade-pdf docs-upgrade-text ) add_custom_target ( docs-devel DEPENDS docs-devel-html ) add_custom_target ( docs DEPENDS docs-user docs-reference docs-upgrade ) add_custom_target ( docs-all DEPENDS docs-user docs-reference docs-upgrade docs-devel ) snort3-3.1.82.0/doc/devel/000077500000000000000000000000001457433257500150565ustar00rootroot00000000000000snort3-3.1.82.0/doc/devel/CMakeLists.txt000066400000000000000000000037331457433257500176240ustar00rootroot00000000000000 set ( UNBUILT_SOURCES snort_devel.txt extending.txt style.txt ) foreach ( file_name ${UNBUILT_SOURCES} ) list ( APPEND LIST_DIR_SOURCES "${CMAKE_CURRENT_LIST_DIR}/${file_name}" ) endforeach ( file_name ) set ( BUILT_DIST ${BINARY_DIR_BUILT_SOURCES} ${BINARY_DIR_UNBUILT_SOURCES} ) add_custom_command ( OUTPUT version.txt COMMAND $ -V 2>&1 | grep -o "Version.*$" > version.txt COMMAND sed -i -e "s/Version/:revnumber:/" version.txt COMMAND echo ":revdate: {localdate} {localtime}" >> version.txt DEPENDS snort COMMENT "Documents: building version.txt" ) list ( APPEND BUILT_SOURCES version.txt ) add_custom_target ( dev_built_sources DEPENDS ${BUILT_SOURCES} ) if ( MAKE_HTML_DOC ) set ( HTML_DOC_TMP "${CMAKE_CURRENT_BINARY_DIR}/html/" ) add_custom_command ( OUTPUT "${HTML_DOC_TMP}/" COMMAND mkdir -p ${HTML_DOC_TMP} ) add_custom_command ( OUTPUT snort_devel.html COMMAND mv ../${BUILT_SOURCES} ./ COMMAND cp ${LIST_DIR_SOURCES} ${BINARY_DIR_BUILT_SOURCES} ./ COMMAND ${CMAKE_CURRENT_LIST_DIR}/snort_devel.sh ${CMAKE_SOURCE_DIR} COMMAND mv snort_devel.html ../ DEPENDS dev_built_sources "${HTML_DOC_TMP}/" WORKING_DIRECTORY ${HTML_DOC_TMP} COMMENT "Documents: building dev guide" ) add_custom_target ( docs-devel-html DEPENDS snort_devel.html ) endif ( MAKE_HTML_DOC ) install ( FILES ${BUILT_DIST} ${UNBUILT_SOURCES} DESTINATION ${CMAKE_INSTALL_DOCDIR} ) set ( EXTRA_CLEAN ${EXTRA_CLEAN} ${BINARY_DIR_BUILT_SOURCES} ) if ( NOT CMAKE_CURRENT_LIST_DIR STREQUAL CMAKE_CURRENT_BINARY_DIR ) list ( APPEND EXTRA_CLEAN ${BINARY_DIR_UNBUILT_SOURCES} ) endif () if ( EXTRA_CLEAN ) set_property ( DIRECTORY PROPERTY ADDITIONAL_MAKE_CLEAN_FILES ${EXTRA_CLEAN} ) endif ( EXTRA_CLEAN ) snort3-3.1.82.0/doc/devel/extending.txt000066400000000000000000000272051457433257500176120ustar00rootroot00000000000000=== Plugins Plugins have an associated API defined for each type, all of which share a common 'header', called the BaseApi. A dynamic library makes its plugins available by exporting the snort_plugins symbol, which is a null terminated array of BaseApi pointers. The BaseApi includes type, name, API version, plugin version, and function pointers for constructing and destructing a Module. The specific API add various other data and functions for their given roles. === Modules If we are defining a new Inspector called, say, gadget, it might be configured in snort.lua like this: gadget = { brain = true, claw = 3 } When the gadget table is processed, Snort will look for a module called gadget. If that Module has an associated API, it will be used to configure a new instance of the plugin. In this case, a GadgetModule would be instantiated, brain and claw would be set, and the Module instance would be passed to the GadgetInspector constructor. Module has three key virtual methods: * *begin()* - called when Snort starts processing the associated Lua table. This is a good place to allocate any required data and set defaults. * *set()* - called to set each parameter after validation. * *end()* - called when Snort finishes processing the associated Lua table. This is where additional integrity checks of related parameters should be done. The configured Module is passed to the plugin constructor which pulls the configuration data from the Module. For non-trivial configurations, the working paradigm is that Module hands a pointer to the configured data to the plugin instance which takes ownership. Note that there is at most one instance of a given Module, even if multiple plugin instances are created which use that Module. (Multiple instances require Snort binding configuration.) A module's usage determines how it may be configured: * Global: configured at most once, outside any policy. * Context: configured at most once in a network policy, eg event_queue. * Inspect: configured in an inspection policy aka network analysis policy (NAP); stream and service inspectors like stream_tcp and smtp are multitons, ie they may be configured more than once in a policy, while others like binder are singletons and can be configured at most once per policy. * Detect: configured at most once in an IPS policy, eg ips. === Inspectors There are several types of inspector, which determines which inspectors are executed when: * IT_CONTROL - process all packets before detection * IT_FIRST - analyze 1st pkt of new flow and 1st pkt after reload of ongoing flow (eg reputation) * IT_NETWORK - processes packets w/o service (e.g. arp_spoof, back_orifice) * IT_PACKET - used to process raw packets only (e.g. normalizer) * IT_PASSIVE - for configuration only or for handling inspection events (eg ftp_client and binder) * IT_PROBE - process all packets after all the detection (e.g. perf_monitor, port_scan) * IT_SERVICE - for analyzing PDUs eg http_inspect, ftp_server, telnet, etc. * IT_STREAM - for flow tracking, ip defrag, and TCP reassembly; also for processing files directly or TCP payload-only streams * IT_WIZARD - determines which service inspector to use if none explicitly bound by matching start-of-flow patterns === Codecs The Snort Codecs decipher raw packets. These Codecs are now completely pluggable; almost every Snort Codec can be built dynamically and replaced with an alternative, customized Codec. The pluggable nature has also made it easier to build new Codecs for protocols without having to touch the Snort code base. The first step in creating a Codec is defining its class and protocol. Every Codec must inherit from the Snort Codec class defined in "framework/codec.h". The following is an example Codec named "example" and has an associated struct that is 14 bytes long. #include #include #include “framework/codec.h†#include "main/snort_types.h" #define EX_NAME “example†#define EX_HELP “example codec help string†struct Example { uint8_t dst[6]; uint8_t src[6]; uint16_t ethertype; static inline uint8_t size() { return 14; } } class ExCodec : public Codec { public: ExCodec() : Codec(EX_NAME) { } ~ExCodec() { } bool decode(const RawData&, CodecData&, DecodeData&) override; void get_protocol_ids(std::vector&) override; }; After defining ExCodec, the next step is adding the Codec's decode functionality. The function below does this by implementing a valid decode function. The first parameter, which is the RawData struct, provides both a pointer to the raw data that has come from a wire and the length of that raw data. The function takes this information and validates that there are enough bytes for this protocol. If the raw data's length is less than 14 bytes, the function returns false and Snort discards the packet; the packet is neither inspected nor processed. If the length is greater than 14 bytes, the function populates two fields in the CodecData struct, next_prot_id and lyr_len. The lyr_len field tells Snort the number of bytes that this layer contains. The next_prot_id field provides Snort the value of the next EtherType or IP protocol number. bool ExCodec::decode(const RawData& raw, CodecData& codec, DecodeData&) { if ( raw.len < Example::size() ) return false; const Example* const ex = reinterpret_cast(raw.data); codec.next_prot_id = ntohs(ex->ethertype); codec.lyr_len = ex->size(); return true; } For instance, assume this decode function receives the following raw data with a validated length of 32 bytes: 00 11 22 33 44 55 66 77 88 99 aa bb 08 00 45 00 00 38 00 01 00 00 40 06 5c ac 0a 01 02 03 0a 09 The Example struct's EtherType field is the 13 and 14 bytes. Therefore, this function tells Snort that the next protocol has an EtherType of 0x0800. Additionally, since the lyr_len is set to 14, Snort knows that the next protocol begins 14 bytes after the beginning of this protocol. The Codec with EtherType 0x0800, which happens to be the IPv4 Codec, will receive the following data with a validated length of 18 ( == 32 – 14): 45 00 00 38 00 01 00 00 40 06 5c ac 0a 01 02 03 0a 09 How does Snort know that the IPv4 Codec has an EtherType of 0x0800? The Codec class has a second virtual function named get_protocol_ids(). When implementing the function, a Codec can register for any number of values between 0x0000 - 0xFFFF. Then, if the next_proto_id is set to a value for which this Codec has registered, this Codec's decode function will be called. As a general note, the protocol ids between [0, 0x00FF] are IP protocol numbers, [0x0100, 0x05FF] are custom types, and [0x0600, 0xFFFF] are EtherTypes. For example, in the get_protocol_ids function below, the ExCodec registers for the protocols numbers 17, 787, and 2054. 17 happens to be the protocol number for UDP while 2054 is ARP's EtherType. Therefore, this Codec will now attempt to decode UDP and ARP data. Additionally, if any Codec sets the next_protocol_id to 787, ExCodec's decode function will be called. Some custom protocols are already defined in the file "protocols/protocol_ids.h" void ExCodec::get_protocol_ids(std::vector&v) { v.push_back(0x0011); // == 17 == UDP v.push_back(0x1313); // == 787 == custom v.push_back(0x0806); // == 2054 == ARP } To register a Codec for Data Link Type's rather than protocols, the function get_data_link_type() can be similarly implemented. The final step to creating a pluggable Codec is the snort_plugins array. This array is important because when Snort loads a dynamic library, the program only find plugins that are inside the snort_plugins array. In other words, if a plugin has not been added to the snort_plugins array, that plugin will not be loaded into Snort. Although the details will not be covered in this post, the following code snippet is a basic CodecApi that Snort can load. This snippet can be copied and used with only three minor changes. First, in the function ctor, ExCodec should be replaced with the name of the Codec that is being built. Second, EX_NAME must match the Codec's name or Snort will be unable to load this Codec. Third, EX_HELP should be replaced with the general description of this Codec. Once this code snippet has been added, ExCodec is ready to be compiled and plugged into Snort. static Codec* ctor(Module*) { return new ExCodec; } static void dtor(Codec *cd) { delete cd; } static const CodecApi ex_api = { { PT_CODEC, EX_NAME, EX_HELP, CDAPI_PLUGIN_V0, 0, nullptr, nullptr, }, nullptr, // pointer to a function called during Snort's startup. nullptr, // pointer to a function called during Snort's exit. nullptr, // pointer to a function called during thread's startup. nullptr, // pointer to a function called during thread's destruction. ctor, // pointer to the codec constructor. dtor, // pointer to the codec destructor. }; SO_PUBLIC const BaseApi* snort_plugins[] = { &ex_api.base, nullptr }; Two example Codecs are available in the extra directory on git and the extra tarball on the Snort page. One of those examples is the Token Ring Codec while the other example is the PIM Codec. As a final note, there are four more virtual functions that a Codec should implement: encode, format, update, and log. If the functions are not implemented Snort will not throw any errors. However, Snort may also be unable to accomplish some of its basic functionality. * encode is called whenever Snort actively responds and needs to builds a packet, i.e. whenever a rule using an IPS ACTION like react, reject, or rewrite is triggered. This function is used to build the response packet protocol by protocol. * format is called when Snort is rebuilding a packet. For instance, every time Snort reassembles a TCP stream or IP fragment, format is called. Generally, this function either swaps any source and destination fields in the protocol or does nothing. * update is similar to format in that it is called when Snort is reassembling a packet. Unlike format, this function only sets length fields. * log is called when either the log_codecs logger or a custom logger that calls PacketManager::log_protocols is used when running Snort. === IPS Actions Action plugins specify a builtin action in the API which is used to determine verdict. (Conversely, builtin actions don't have an associated plugin function.) === Trace Loggers The Trace Loggers print trace messages. They can be implemented as inspector plugins. The first step is creating a custom logger by inheriting from the Snort TraceLogger class. The following is an example TraceLogger. class FooLogger : public TraceLogger { public: void log(const char*, const char*, uint8_t, const char*, const Packet*) override { printf("%s%s\n", "Foo", "Bar"); } }; To instantiate logger objects it's needed to create a logger factory derived from the Snort TraceLoggerFactory class. class FooFactory : public TraceLoggerFactory { public: TraceLogger* instantiate() override { return new FooLogger(); } }; Once the Factory is created, Inspector and appropriate Module are needed. *Inspector::configure()* must initialize the logger factory. bool FooInspector::configure(SnortConfig* sc) override { return TraceApi::override_logger_factory(sc, new FooFactory()); } snort3-3.1.82.0/doc/devel/snort_devel.sh000077500000000000000000000057171457433257500177530ustar00rootroot00000000000000#!/usr/bin/env bash # run from top of source tree (where configure.ac lives) # or supply top_srcdir as argument # use ./snort_devel.html to browse the source notes and headers # # FIXIT: # -- make sidebar width draggable # -- remove header guards? (outermost #ifndef, #define, #endif) # -- use css source instead of the sed fixups? usage() { echo "usage: $0 []" exit -1 } pushd . work=`pwd` if [ "$1" ] ; then cd $1 || usage echo "cd $1" fi [ -d src ] || usage out=snort_devel.txt data=dev_data.txt html=snort_devel.html notes=dev_notes.txt more_notes=dev_notes_*.txt src_dirs=`find src -type d -name "[^.]?*" | sort` # copy headers to temp working dir using same tree structure # but strip out repetitive copyright blocks for d in $src_dirs ; do mkdir -p $work/$d ls $d/*.h &> /dev/null || continue for f in $d/*.h ; do n=`grep -m 1 -n -o "#ifndef" $f` n=${n/:*} [ "$n" ] || continue n=$((n-1)) sed -e "1,${n}d" $f > $work/$f done done echo "generating doc source from headers and dev notes" for d in $src_dirs ; do # section heading if [ ${#d} -eq 3 ] ; then echo -e "=== $d/\n" else echo -e "=== ${d:4}/\n" fi # section notes if [ -e "$d/$notes" ] ; then cp $d/$notes $work/$d/ cp $d/$more_notes $work/$d/ echo -e "include::$d/$notes[]\n" fi ls $d/*.h &> /dev/null || continue # now emit subsection for all headers for h in $d/*.h ; do [ -e "$work/$h" ] || continue cat <> $work/$data echo "generating the dev guide" popd asc_args="-b xhtml11 -a toc2" asciidoc $asc_args $out # fix up some stuff # this is quick and dirty and but not future proof echo "fixing up the html" sed -i.sed \ -e "s/color: fuchsia/color: green/" \ -e "s/margin-left: 16em/margin-left: 20em/" \ -e "s/width: 13em/width: 18em/" \ $html # now convert snort includes into links using the existing anchor points # we can't derive the href ids because the toc generator only uses the # file w/o path (eg _rules_h instead of _detection_rules_h) and will add # numeric suffixes if non-unique (foo/rules.h and bar/rules.h would become # _rules_h and _rules_h_2). # this function generates sed commands like this # s|"detection/rules.h"|"detection/rules.h"| # for each Path added above gen_cmds() { while true ; do read id id=${id/*=\"/} id=${id/\"*/} read path path=${path/*Path = /} path=${path/\<*/} path=\"${path:4}\" echo "s|$path|$path|" if ! read sep ; then break fi done } echo "generating link commands" grep -B 1 "Path = " $html | gen_cmds > sed_cmds.txt echo "translating snort includes into links" sed -i.sed -f sed_cmds.txt $html snort3-3.1.82.0/doc/devel/snort_devel.txt000066400000000000000000000004541457433257500201460ustar00rootroot00000000000000 = Snort++ Developers Guide The Snort Team include::version.txt[] :revdate: {localdate} {localtime} :toc: :toc-placement: manual :toc-title: Contents :toclevels: 4 toc::[] == Extending Snort include::extending.txt[] == Coding Style include::style.txt[] == Source Code include::dev_data.txt[] snort3-3.1.82.0/doc/devel/style.txt000066400000000000000000000322741457433257500167670ustar00rootroot00000000000000All new code should try to follow these style guidelines. These are not yet firm so feedback is welcome to get something we can live with. === General * Generally try to follow https://google.github.io/styleguide/cppguide.html, but there are some differences documented here. * Each source directory should have a dev_notes.txt file summarizing the key points and design decisions for the code in that directory. These are built into the developers guide. * Makefile.am and CMakeLists.txt should have the same files listed in alpha order. This makes it easier to maintain both build systems. * All new code must come with unit tests providing 95% coverage or better. * Generally, Catch is preferred for tests in the source file and CppUTest is preferred for test executables in a test subdirectory. === C++ Specific * Do not use exceptions. Exception-safe code is non-trivial and we have ported legacy code that makes use of exceptions unwise. There are a few exceptions to this rule for the memory manager, shell, etc. Other code should handle errors as errors. * Do not use dynamic_cast or RTTI. Although compilers are getting better all the time, there is a time and space cost to this that is easily avoided. * Use smart pointers judiciously as they aren't free. If you would have to roll your own, then use a smart pointer. If you just need a dtor to delete something, write the dtor. * Prefer 'and' over && and 'or' over || for new source files. * Use nullptr instead of NULL. * Use new, delete, and their [] counterparts instead of malloc and free except where realloc must be used. But try not to use realloc. New and delete can't return nullptr so no need to check. And Snort's memory manager will ensure that we live within our memory budget. * Use references in lieu of pointers wherever possible. * Use the order public, protected, private top to bottom in a class declaration. * Keep inline functions in a class declaration very brief, preferably just one line. If you need a more complex inline function, move the definition below the class declaration. * The goal is to have highly readable class declarations. The user shouldn't have to sift through implementation details to see what is available to the client. * Any using statements in source files should be added only after all includes have been declared. === Naming * Use camel case for namespaces, classes, and types like WhizBangPdfChecker. * Use lower case identifiers with underscore separators, e.g. some_function() and my_var. * Do not start or end variable names with an underscore. This has a good chance of conflicting with macro and/or system definitions. * Use lower case filenames with underscores. === Comments * Write comments sparingly with a mind towards future proofing. Often the comments can be obviated with better code. Clear code is better than a comment. * Heed Tim Ottinger's Rules on Comments (https://disqus.com/by/tim_ottinger/): 1. Comments should only say what the code is incapable of saying. 2. Comments that repeat (or pre-state) what the code is doing must be removed. 3. If the code CAN say what the comment is saying, it must be changed at least until rule #2 is in force. * Function comment blocks are generally just noise that quickly becomes obsolete. If you absolutely must comment on parameters, put each on a separate line along with the comment. That way changing the signature may prompt a change to the comments too. * Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left for a day or even just a minute. That way we can find them easily and won't lose track of them. * Presently using FIXIT-X where X is one of the characters below. Place A and W comments on the exact warning line so we can match up comments and build output. Supporting comments can be added above. * A = known static analysis issue * D = deprecated - code to be removed after users update * E = enhancement - next steps for incomplete features (not a bug) * H = high priority - urgent deficiency * L = low priority - cleanup or similar technical debt (not a bug) * M = medium priority - suspected non-urgent deficiency * P = performance issue (not a bug) * W = warning - known compiler warning * Put the copyright(s) and license in a comment block at the top of each source file (.h and .cc). Don't bother with trivial scripts and make foo. Some interesting Lua code should get a comment block too. Copy and paste exactly from src/main.h (don't reformat). * Put author, description, etc. in separate comment(s) following the license. Do not put such comments in the middle of the license foo. Be sure to put the author line ahead of the header guard to exclude them from the developers guide. Use the following format, and include a mention to the original author if this is derived work: // ips_dnp3_obj.cc author Maya Dagon // based on work by Ryan Jordan * Each header should have a comment immediately after the header guard to give an overview of the file so the reader knows what's going on. * Use the following comment on switch cases that intentionally fall through to the next case to suppress compiler warning on known valid cases: // fallthrough === Logging * Messages intended for the user should not look like debug messages. Eg, the function name should not be included. It is generally unhelpful to include pointers. * Most debug messages should just be deleted. * Don't bang your error messages (no !). The user feels bad enough about the problem already w/o you shouting at him. === Types * Use logical types to make the code clearer and to help the compiler catch problems. typedef uint16_t Port; bool foo(Port) is way better than int foo(int port). * Use forward declarations (e.g. struct SnortConfig;) instead of void*. * Try not to use extern data unless absolutely necessary and then put the extern in an appropriate header. Exceptions for things used in exactly one place like BaseApi pointers. * Use const liberally. In most cases, const char* s = "foo" should be const char* const s = "foo". The former goes in the initialized data section and the latter in read only data section. * But use const char s[] = "foo" instead of const char* s = "foo" when possible. The latter form allocates a pointer variable and the data while the former allocates only the data. * Use static wherever possible to minimize public symbols and eliminate unneeded relocations. * Declare functions virtual only in the parent class introducing the function (not in a derived class that is overriding the function). This makes it clear which class introduces the function. * Declare functions as override if they are intended to override a function. This makes it possible to find derived implementations that didn't get updated and therefore won't get called due a change in the parent signature. * Use bool functions instead of int unless there is truly a need for multiple error returns. The C-style use of zero for success and -1 for error is less readable and often leads to messy code that either ignores the various errors anyway or needlessly and ineffectively tries to do something about them. Generally that code is not updated if new errors are added. === Macros (aka defines) * In many cases, even in C++, use #define name "value" instead of a const char* const name = "value" because it will eliminate a symbol from the binary. * Use inline functions instead of macros where possible (pretty much all cases except where stringification is necessary). Functions offer better typing, avoid re-expansions, and a debugger can break there. * All macros except simple const values should be wrapped in () and all args should be wrapped in () too to avoid surprises upon expansion. Example: #define SEQ_LT(a,b) ((int)((a) - (b)) < 0) * Multiline macros should be blocked (i.e. inside { }) to avoid if-else type surprises. === Formatting * Try to keep all source files under 2500 lines. 3000 is the max allowed. If you need more lines, chances are that the code needs to be refactored. * Indent 4 space chars ... no tabs! * If you need to indent many times, something could be rewritten or restructured to make it clearer. Fewer indents is generally easier to write, easier to read, and overall better code. * Braces go on the line immediately following a new scope (function signature, if, else, loop, switch, etc. * Use consistent spacing and line breaks. Always indent 4 spaces from the breaking line. Keep lines less than 120 chars; it greatly helps readability. No: calling_a_func_with_a_long_name(arg1, arg2, arg3); Yes: calling_a_func_with_a_long_name( arg1, arg2, arg3); * Put function signature on one line, except when breaking for the arg list: No: inline bool foo() { // ... Yes: inline bool foo() { // ... * Put conditional code on the line following the if so it is easy to break on the conditional block: No: if ( test ) foo(); Yes: if ( test ) foo(); === Headers * Don't hesitate to create a new header if it is needed. Don't lump unrelated stuff into an header because it is convenient. * Write header guards like this (leading underscores are reserved for system stuff). In my_header.h: #ifndef MY_HEADER_H #define MY_HEADER_H // ... #endif * Includes from a different directory should specify parent directory. This makes it clear exactly what is included and avoids the primordial soup that results from using -I this -I that -I the_other_thing ... . // given: src/foo/foo.cc src/bar/bar.cc src/bar/baz.cc // in baz.cc #include "bar.h" // in foo.cc #include "bar/bar.h" * Includes within installed headers should specify parent directory. * Just because it is a #define doesn't mean it goes in a header. Everything should be scoped as tightly as possible. Shared implementation declarations should go in a separate header from the interface. And so on. * All .cc files should include config.h with the standard block shown below immediately following the initial comment blocks and before anything else. This presents a consistent view of all included header files as well as access to any other configure-time definitions. To avoid issues, no .h files should include config.h, even if not installed. #ifdef HAVE_CONFIG_H #include "config.h" #endif * A .cc should include its own .h before any others aside from the aforementioned config.h (including system headers). This ensures that the header stands on its own and can be used by clients without include prerequisites and the developer will be the first to find a dependency issue. * Split headers included from the local directory into a final block of headers. For a .cc file, the final order of sets of header includes should look like this: 1. config.h 2. its own .h file 3. system headers (.h/.hpp/.hxx) 4. C++ standard library headers (no file extension) 5. Snort headers external to the local directory (path-prefixed) 6. Snort headers in the local directory * Include required headers, all required headers, and nothing but required headers. Don't just clone a bunch of headers because it is convenient. * Keep includes in alphabetical order. This makes it easier to maintain, avoid duplicates, etc. * Do not put using statements in headers unless they are tightly scoped. === Warnings * With g++, use at least these compiler flags: -Wall -Wextra -pedantic -Wformat -Wformat-security -Wunused-but-set-variable -Wno-deprecated-declarations -fsanitize=address -fno-omit-frame-pointer * With clang, use at least these compiler flags: -Wall -Wextra -pedantic -Wformat -Wformat-security -Wno-deprecated-declarations -fsanitize=address -fno-omit-frame-pointer * Two macros (PADDING_GUARD_BEGIN and PADDING_GUARD_END) are provided by utils/cpp_macros.h. These should be used to surround any structure used as a hash key with a raw comparator or that would otherwise suffer from unintentional padding. A compiler warning will be generated if any structure definition is automatically padded between the macro invocations. * Then Fix All Warnings and Aborts. None Allowed. === Uncrustify Currently using uncrustify from at https://github.com/bengardner/uncrustify to reformat legacy code and anything that happens to need a makeover at some point. The working config is crusty.cfg in the top level directory. It does well but will munge some things. Specially formatted INDENT-OFF comments were added in 2 places to avoid a real mess. You can use uncrustify something like this: uncrustify -c crusty.cfg --replace file.cc === Commit Messages Commit messages should follow some basic guidelines: * Messages should have a subject line followed by an optional body separated by an empty line. * The subject line should be formatted like ": ". * All lines should be 72 characters or less. Subject lines at 50 characters or less are encouraged. snort3-3.1.82.0/doc/reference/000077500000000000000000000000001457433257500157155ustar00rootroot00000000000000snort3-3.1.82.0/doc/reference/CMakeLists.txt000066400000000000000000000134631457433257500204640ustar00rootroot00000000000000 set ( HELP_SOURCES commands.txt config.txt counts.txt modules.txt plugins.txt options.txt signals.txt help.txt ) set ( LIST_SOURCES gids.txt ) set ( MODULE_SOURCES basic.txt codec.txt connector.txt data.txt inspector.txt ips_action.txt ips_option.txt logger.txt ) set ( UNBUILT_SOURCES appendix.txt building.txt builtin_stubs.txt enviro.txt snort_reference.txt ) set ( DEFAULT_MANUALS snort_reference.text ) function ( add_help_command generator_script output_file ) add_custom_command ( OUTPUT ${output_file} COMMAND ${generator_script} $ ${output_file} $ENV{SNORT_PLUGIN_PATH} DEPENDS snort COMMENT "Documents: building ${output_file}" ) endfunction ( add_help_command ) foreach ( output_file ${HELP_SOURCES} ) add_help_command ( "${CMAKE_CURRENT_LIST_DIR}/scripts/generate_help.sh" "${output_file}" ) list ( APPEND BUILT_SOURCES "${output_file}" ) endforeach () foreach ( output_file ${LIST_SOURCES} ) add_help_command ( "${CMAKE_CURRENT_LIST_DIR}/scripts/generate_list.sh" "${output_file}" ) list ( APPEND BUILT_SOURCES "${output_file}" ) endforeach () foreach ( output_file ${MODULE_SOURCES} ) add_help_command ( "${CMAKE_CURRENT_LIST_DIR}/scripts/generate_module.sh" "${output_file}" ) list ( APPEND BUILT_SOURCES "${output_file}" ) endforeach () add_custom_command ( OUTPUT version.txt COMMAND $ -V 2>&1 | grep -o "Version.*$" > version.txt COMMAND sed -i -e "s/Version/:revnumber:/" version.txt DEPENDS snort COMMENT "Documents: building version.txt" ) list ( APPEND BUILT_SOURCES version.txt ) add_custom_command ( OUTPUT builtin.txt COMMAND ${CMAKE_CURRENT_LIST_DIR}/scripts/generate_builtin.sh $ ${CMAKE_CURRENT_LIST_DIR}/builtin_stubs.txt builtin.txt $ENV{SNORT_PLUGIN_PATH} DEPENDS snort COMMENT "Documents: building builtin.txt" ) list ( APPEND BUILT_SOURCES builtin.txt ) foreach ( file_name ${BUILT_SOURCES} ) list ( APPEND BINARY_DIR_BUILT_SOURCES "${CMAKE_CURRENT_BINARY_DIR}/${file_name}" ) endforeach ( file_name ) foreach ( file_name ${UNBUILT_SOURCES} ) list ( APPEND LIST_DIR_SOURCES "${CMAKE_CURRENT_LIST_DIR}/${file_name}" ) endforeach ( file_name ) add_custom_target ( ref_built_sources DEPENDS ${BUILT_SOURCES} ) if ( MAKE_HTML_DOC ) set ( HTML_ASCIIDOC_ARGS -b xhtml11 -a toc2 -a icons -a imagesdir=. ) set ( HTML_A2X_ARGS --format=chunked --attribute=linkcss --attribute=stylesdir --attribute=disable-javascript --xsltproc-opts=\"--stringparam chunk.tocs.and.lots 1\" --attribute=quirks! --attribute=imagesdir=. --resource=. ) set ( HTML_DOC_TMP "${CMAKE_CURRENT_BINARY_DIR}/html/" ) add_custom_command ( OUTPUT "${HTML_DOC_TMP}/" COMMAND mkdir -p ${HTML_DOC_TMP} ) add_custom_command ( OUTPUT snort_reference.html COMMAND cp ${LIST_DIR_SOURCES} ${BINARY_DIR_BUILT_SOURCES} . COMMAND ${ASCIIDOC_EXE} ${HTML_ASCIIDOC_ARGS} snort_reference.txt COMMAND mv snort_reference.html ../ DEPENDS ref_built_sources "${HTML_DOC_TMP}/" WORKING_DIRECTORY ${HTML_DOC_TMP} COMMENT "Documents: building snort_reference.html" ) add_custom_target ( docs-reference-html DEPENDS snort_reference.html ) foreach ( file_name ${UNBUILT_SOURCES} ) list ( APPEND BINARY_DIR_UNBUILT_SOURCES "${CMAKE_CURRENT_BINARY_DIR}/${file_name}" ) endforeach ( file_name ) endif ( MAKE_HTML_DOC ) if ( MAKE_TEXT_DOC ) set ( TEXT_A2X_ARGS --format=text ) set ( TEXT_DOC_TMP "${CMAKE_CURRENT_BINARY_DIR}/text" ) add_custom_command ( OUTPUT "${TEXT_DOC_TMP}/" COMMAND mkdir -p ${TEXT_DOC_TMP} ) add_custom_command ( OUTPUT snort_reference.text COMMAND cp ${LIST_DIR_SOURCES} ${BINARY_DIR_BUILT_SOURCES} . COMMAND ${ASCIIDOC_A2X_EXE} ${TEXT_A2X_ARGS} snort_reference.txt COMMAND mv snort_reference.text ../ DEPENDS ref_built_sources "${TEXT_DOC_TMP}/" WORKING_DIRECTORY ${TEXT_DOC_TMP} COMMENT "Documents: building snort_reference.text" ) add_custom_target ( docs-reference-text DEPENDS snort_reference.text ) endif ( MAKE_TEXT_DOC ) if ( MAKE_PDF_DOC ) set ( PDF_A2X_ARGS --format=pdf --attribute=imagesdir=. ) set ( PDF_DOC_TMP "${CMAKE_CURRENT_BINARY_DIR}/pdf" ) add_custom_command ( OUTPUT "${PDF_DOC_TMP}/" COMMAND mkdir -p ${PDF_DOC_TMP} ) add_custom_command ( OUTPUT snort_reference.pdf COMMAND cp ${LIST_DIR_SOURCES} ${BINARY_DIR_BUILT_SOURCES} . COMMAND ${ASCIIDOC_A2X_EXE} ${PDF_A2X_ARGS} snort_reference.txt COMMAND mv snort_reference.pdf ../ DEPENDS ref_built_sources "${PDF_DOC_TMP}/" WORKING_DIRECTORY ${PDF_DOC_TMP} COMMENT "Documents: building snort_reference.pdf" ) add_custom_target ( docs-reference-pdf DEPENDS snort_reference.pdf ) endif ( MAKE_PDF_DOC ) install ( FILES ${UNBUILT_SOURCES} ${DEFAULT_MANUALS} DESTINATION ${CMAKE_INSTALL_DOCDIR} ) set ( EXTRA_CLEAN ${EXTRA_CLEAN} ${BINARY_DIR_BUILT_SOURCES} ) if ( NOT CMAKE_CURRENT_LIST_DIR STREQUAL CMAKE_CURRENT_BINARY_DIR ) list ( APPEND EXTRA_CLEAN ${BINARY_DIR_UNBUILT_SOURCES} ) endif () if ( EXTRA_CLEAN ) set_property ( DIRECTORY PROPERTY ADDITIONAL_MAKE_CLEAN_FILES ${EXTRA_CLEAN} ) endif ( EXTRA_CLEAN ) snort3-3.1.82.0/doc/reference/appendix.txt000066400000000000000000000011071457433257500202650ustar00rootroot00000000000000 === Build Options include::building.txt[] === Environment Variables include::enviro.txt[] === Command Line Options include::options.txt[] === Configuration include::config.txt[] === Counts include::counts.txt[] === Generators include::gids.txt[] === Builtin Rules include::builtin.txt[] === Command Set include::commands.txt[] === Signals IMPORTANT: Signal numbers are for the system that generated this documentation and are not applicable elsewhere. include::signals.txt[] === Module Listing include::modules.txt[] === Plugin Listing include::plugins.txt[] snort3-3.1.82.0/doc/reference/building.txt000066400000000000000000000024561457433257500202620ustar00rootroot00000000000000The options listed below must be explicitly enabled so they are built into the Snort binary. For a full list of build options, run ./configure --help. * *--enable-shell*: enable building local and remote command line shell support. * *--enable-tsc-clock*: use the TSC register on x86 systems for improved performance of latency and profiler features. These options are built only if the required libraries and headers are present. There is no need to explicitly enable. * *hyperscan* >= 4.4.0: for the regex and sd_pattern rule options and the hyperscan search engine. * *iconv*: for converting UTF16-LE filenames to UTF8 (usually included in glibc) * *libunwind*: for printing a backtrace when a fatal signal is received. * *lzma*: for decompression of SWF and PDF files. * *safec*: for additional runtime error checking of some memory copy operations. If you need to use headers and/or libraries in non-standard locations, you can use these options: * *--with-pkg-includes*: specify the directory containing the package headers. * *--with-pkg-libraries*: specify the directory containing the package libraries. These can be used for pcap, luajit, pcre, dnet, daq, lzma, openssl, iconv, and hyperscan packages. For more information on these libraries see the Getting Started section of the manual. snort3-3.1.82.0/doc/reference/builtin_stubs.txt000066400000000000000000002025611457433257500213520ustar00rootroot000000000000002:1 A tagged packet was logged. 105:1 Back Orifice traffic detected, unknown direction 105:2 Back Orifice client traffic detected 105:3 Back Orifice server traffic detected 105:4 Back Orifice length field >= 1024 bytes 106:1 Detected fragmented RPC records. 106:2 Detected multiple RPC records in the packet. 106:3 Large RPC record fragment. RPC fragment length is greater than packet data size. 106:4 Incomplete RPC segment. Packet data size is less than required RPC fragment length. 106:5 Zero-length RPC fragment. 112:1 ARP request is unicast, not broadcast. 112:2 Mismatch between ethernet source hardware address and ARP source hardware address. 112:3 Mismatch between ethernet destination hardware address and ARP destination hardware address in an ARP reply. 112:4 Attempted ARP cache overwrite attack. The ethernet source hardware address or ARP source hardware address doesn't match the one provided for this IP address in the configured host table. 116:1 The packet is not an IPv4 datagram (based on the ip header's version field). 116:2 The IPv4 header length (based on the header's length field) is less than the ip version 4's minimum header length (20 bytes). 116:3 The total IPv4 datagram length is less than the length calculated using the ipv4 header length field. 116:4 The IPv4 options field has a bad/incorrect length. 116:5 The IPv4 options field is truncated. 116:6 The IPv4 datagram length is greater than the captured packet's length. 116:45 The TCP packet length is smaller than the minimum tcp header length (20 bytes). 116:46 The TCP data offset is less than five 32 bit words (20 bytes) and is invalid. 116:47 The TCP header length exceeds the packet's length. 116:54 The TCP options are invalid and/or have bad lengths. 116:55 The TCP options field is truncated. 116:56 A tcp packet was detected with the CC Echo field set. 116:57 A tcp packet was detected that contained obsolete TCP options. 116:58 A tcp packet was detected that contained experimental TCP options. 116:59 The TCP window scale option found with a length greater than 14. 116:95 A truncated UDP header has been detected. 116:96 An invalid UDP header detected. The header's length is less than 8 bytes. 116:97 The UDP length field is greater than the payload length. 116:98 The UDP length field is less than the payload length. 116:105 An ICMP packet was detected with the header truncated. 116:106 The ICMP packet's timestamp header is truncated. 116:107 The ICMP packet's address header is truncated. 116:109 The packet length is less than ethernet arp's minimum length of 28 bytes. 116:110 (eapol) truncated EAP header 116:111 (eapol) EAP key truncated 116:112 (eapol) EAP header truncated 116:120 A bad PPPOE frame has been detected. The frames length is less than the PPPOE frame minimum (6 bytes). 116:130 A bad VLAN frame was detected due to either the packet being smaller than the minimum VLAN header size or the VLAN ID being invalid (0 or 4095). 116:131 An invalid LLC header has been detected (less than 3 bytes). 116:132 (llc) bad extra LLC info 116:133 (wlan) bad 802.11 LLC header 116:134 (wlan) bad 802.11 extra LLC info 116:140 (token_ring) bad Token Ring header 116:141 (token_ring) bad Token Ring ETHLLC header 116:142 (token_ring) bad Token Ring MRLEN header 116:143 (token_ring) bad Token Ring MR header 116:150 A loopback IP was detected within a packet. 116:151 The same source and destination IP was detected. 116:160 The payload length is greater than the packet length. 116:161 There are multiple encapsulations within the GRE packet. 116:162 The detected GRE version field value is invalid (should be 0 or 1). 116:163 Invalid flag set in GRE header. 116:164 Invalid GRE v.1 PPTP header detected. 116:165 The GRE trans header length is greater than the payload length. 116:170 The MPLS frame is invalid. The MPLS header length is less than the MPLS minimum frame size (4 bytes). 116:171 The MPLS label 0 appears in bottom header when not decoding as an ip4 packet. 116:172 The MPLS label 1 appears in bottom header. 116:173 The MPLS label 2 appears in bottom header when not decoding as an ip6 packet. 116:174 A MPLS label 3 (Implicit NULL Label) appears in header. 116:175 A reserved MPLS label (4, 5 or 15) appears in header. 116:176 There were too many MPLS headers detected. (Use the mpls.max_stack_depth setting to set the max value). 116:180 The packet length is less than the expected GENEVE header length. 116:181 The version number in the GENEVE header is not valid (not equal to zero). 116:182 The packet length is less than the minimum GENEVE header length. 116:183 There are several scenarios for this event. 1) The C flag is clear but critical options are present. 2) The C flag is set but critical options are absent. 3) If the critical header present bit is set the option's length cannot be 0. 116:184 The options length field extends past the end of the GENEVE header. 116:250 The ICMP error message's original IP header is truncated. 116:251 The ICMP error message's original IP packet's version and original IP header versions differ. 116:252 The ICMP error message's original datagram's length is less than the original IP's header length. 116:253 The ICMP error message's original IP packet's payload is less than 64 bits. 116:254 The ICMP error message's original IP packet's payload is greater than the expected max of 576 bytes. 116:255 An ICMP original IP is fragmented and the offset is not 0. 116:270 The IPv6 packet has a TTL value that is below the TTL limit. 116:271 The IPv6 header claims to not be an IPv6 packet. 116:272 The IPv6 packet has a truncated extension header. 116:273 The IPv6 packet has a truncated header. 116:274 The IPv6 datagram length field is less than the header field. 116:275 The IPv6 datagram's length is greater than the captured packet's length. 116:276 An IPv6 packet was detected with a destination address of ::0 116:277 An IPv6 packet with a multicast source address has been detected. 116:278 An IPv6 packet with a reserved multicast destination address has been detected. 116:279 The IPv6 header includes an undefined option type. 116:280 The IPv6 address includes an unassigned multicast scope value. 116:281 The IPv6 header includes an invalid value for the 'next header' field. 116:282 The IPv6 header includes a routing extension header followed by a hop-by-hop header. 116:283 The IPv6 header includes two routing extension headers. 116:285 An ICMPv6 packet of type 2 (message too big) that contains an MTU field of less than 1280 bytes has been detected. 116:286 An ICMPv6 packet of type 1 (destination unreachable) that contains a non-RFC 2463 code has been detected. 116:287 An ICMPv6 router solicitation packet with a code not equal to 0 has been detected. 116:288 An ICMPv6 router advertisement packet with a code not equal to 0 has been detected. 116:289 An ICMPv6 router solicitation packet with the reserved field not equal to 0 has been detected. 116:290 An ICMPv6 router advertisement packet with the reachable time field set to greater than 1 hour was detected. 116:291 An IPV6 tunnel over IPv4 packet was received. The IPv6 header truncated which could possibly be a Linux kernel attack. 116:292 The IPv6 header has destination options followed by a routing header. 116:293 There are two or more IP (v4 and/or v6) encapsulation layers present. 116:294 The encapsulated security payload header was too short (less than 22 bytes). 116:295 The IPv6 header includes an option which is too big for the containing header. 116:296 The IPv6 packet includes out-of-order extension headers. 116:297 There are multiple GTP encapsulation layers present. 116:298 The packet data is smaller than the GTP header length making the packet invalid. 116:400 A XMAS attack detected. 116:401 A NMAP XMAS attack detected. 116:402 (tcp) DOS NAPTHA vulnerability detected. 116:403 A SYN packet was sent to a multicast address. 116:404 IPv4 packet was detected with a zero TTL value. 116:405 The IPv4 packet contains an invalid frag bits combination (both MF and DF are set). 116:406 An invalid IPv6 UDP packet was detected. The checksum value is zero. 116:407 The IPv4 packet's frag offset + the datagram length field exceeds the maximum packet size (65535) 116:408 The IPv4 packet's source address is from the 'current net' (value of zero) 116:409 The IPv4 packet's destination address is to the 'current net' (value of zero) 116:410 The IPv4 packet has a multicast source address. 116:411 The IPv4 packet has a reserved source address. 116:412 The IPv4 packet has a reserved destination address. 116:413 The IPv4 packet has a broadcast source address. 116:414 The IPv4 packet has a broadcast destination address 116:415 ICMP4 packet to multicast destination address 116:416 ICMP4 packet to broadcast destination address 116:418 The ICMP4 packet 'type' is not known. 116:419 The TCP urgent pointer exceeds payload length or has no payload. 116:420 An invalid tcp flag combination was detected (SYN and FIN). 116:421 An invalid tcp flag combination was detected (SYN with RST) 116:422 The TCP packet is missing the acknowledgment flag for an established session. 116:423 The TCP packet is invalid because it doesn't have a SYN, ACK, or RST flag set. 116:424 The packet length is less than the minimum ethernet header size (14 bytes) 116:424 A truncated ethernet header was detected. 116:425 The IPv4 header is truncated. 116:426 The ICMP4 header is truncated. 116:427 The ICMPv6 header is truncated. 116:428 An IPv4 packet was received after the TTL limit. 116:429 An IPv6 packet has a zero hop limit count. 116:430 An invalid IPv4 packet was detected. The DF bit and an offset value are set. 116:431 The ICMPv6 type is unknown and not decoded. 116:432 An ICMPv6 packet to a multicast address was detected. 116:433 A tcp DDOS shaft SYN flood was detected. 116:434 An ICMP ping from NMAP was detected. 116:435 An ICMP icmpenum v1.1.1 packet was received (the payload length is zero and icmp seq number equals 666). 116:436 An ICMP host redirect packet was received. 116:437 An ICMP network redirect packet was received. 116:438 An ICMP packet with trace route ipopts was detected. 116:439 An ICMP packet with the source quench field set was detected. 116:440 Broadscan smurf scanner traffic was detected. 116:441 ICMP destination unreachable traffic was detected (communication administratively prohibited). 116:442 ICMP destination unreachable traffic detected (communication with destination host is administratively prohibited). 116:443 ICMP destination unreachable traffic detected (communication with destination network is administratively prohibited). 116:444 (ipv4) IPv4 option set 116:445 A large UDP packet was received (greater than 4000 bytes). 116:446 TCP port 0 traffic was detected. 116:447 UDP port 0 traffic was detected. 116:448 An IPv4 packet was detected that has the reserved bit set. 116:449 An IP packet has an unassigned/reserved IP protocol number. 116:450 An invalid/bad IP protocol number has been detected. 116:451 An ICMP path MTU denial of service attempt has been detected. 116:452 A Linux ICMP header DOS attempt has been detected. 116:453 (ipv6) ISATAP-addressed IPv6 traffic spoofing attempt 116:454 (pgm) PGM nak list overflow attempt 116:455 An IGMP IP options validation DOS attempt was detected. 116:456 The decoder detected more than the configured amount of IPv6 extension headers. 116:457 An ICMPv6 packet of type 1 (destination unreachable) was received with non-RFC 4443 code. 116:458 An invalid fragmentation packet was detected. Could be a possible BSD attack. 116:459 An ip fragment was received with a zero length payload. 116:460 The ICMPv6 node info query/response packet has a code value greater than 2. 116:461 An IPv6 packet was received with a routing type 0 extension header. 116:462 The ERSpan2 version is not equal to 1 (the value of 1 signals that it's ERSpan2). 116:463 The packet's length is less than the ERSpan2 headers minimum length (8 bytes). 116:464 The packet's length is less than the ERSpan3 header's minimum length (20 bytes). 116:465 The length of the packet received is less than the expected minimum of 16 bytes. 116:466 The authentication header length is greater than the packet data length. 116:467 The packet header length is less than the minimum FabricPath header size of 16 bytes. 116:468 The packet length is less than the Cisco Metadata header length. 116:469 The Cisco Metadata option length value is greater than zero. 116:470 The Cisco metadata option type is not set to 1. 116:471 The Cisco Metadata security group tag value is invalid (0xFFFF). 116:472 The decoder detected that there were too many protocols present. 116:473 An ether type value is below the minimum of 0x0600 (1536) and therefore out of range. 116:474 An ICMPv6 packet was received that was not encapsulated in IPv6. 116:475 The IPv6 mobility header includes an invalid value for the payload protocol field. 116:476 The IPv6 packet has a reserved source address. 116:477 The IPv6 packet has a reserved destination address. 119:1 URI has percent encoding of an unreserved character. The ignore_unreserved option designates specific unreserved characters that are exempted from triggering this alert. 119:2 URI contains double-encoded hexadecimal characters. This alert can only be generated if the iis_double_decode option is configured. 119:3 URI has non-standard %u-style Unicode encoding. This alert can only be generated if the percent_u option is configured. 119:4 URI has Unicode encodings containing bytes that were not percent-encoded as required by the HTTP RFC. This is sometimes called "bare byte" encoding. This alert can only be generated if the utf8_bare_byte option is configured. 119:6 URI has two-byte or three-byte UTF-8 encoding. This alert can only be generated if the utf8 option is configured. 119:7 URI includes a two-byte or three-byte unicode character that normalized through the unicode map to some byte other than 0xFF. This alert can only be generated if the iis_unicode option is configured. 119:8 URI path contains consecutive slash characters which are redundant. This alert can only be generated if the simplify_path option is configured. 119:9 The backslash character appears in the path portion of a URI. This alert can only be generated if the backslash_to_slash option is configured 119:10 URI path contains "/./" pattern repeating the current directory. Alternatively the path may end with "/." repeating the current directory. This alert can only be generated if the simplify_path option is configured. 119:11 URI path contains "/../" pattern moving upward a directory. Alternatively the path may end with "/.." with the same effect. This alert can only be generated if the simplify_path option is configured. 119:12 The HTTP start line has a tab character among the blank space separators. 119:13 HTTP start line or header line terminated by LF without a CR. 119:14 Normalized URI (after percent decoding) contains a forbidden character specified by the bad_characters option. 119:15 URI path contains a segment (directory or file name) that is longer than the oversize_dir_length parameter. 119:16 Chunk length as given in the chunk header exceeds maximum_chunk_length parameter. 119:18 The URI path has used /../ segments to go above the root of the directory tree. For example /foo/../../bar which specifies an object not under the root directory /. This alert can only be generated if the simplify_path option is configured. 119:19 HTTP header line exceeds maximum_header_length option bytes. This does not apply to the start line. Header line length includes both header field name and value. 119:20 HTTP message has more than maximum_headers option header fields. 119:21 HTTP message has more than one Content-Length header value. This may be multiple header lines or comma-separated values on one line. 119:24 Host header field appears more than once or has multiple values. 119:25 Length of HTTP Host header field value exceeds maximum_host_length option. 119:28 HTTP request uses POST or PUT method without delimiting the message body using either the Content-Length header or Transfer-Encoding chunked. 119:31 HTTP request method is not known to Snort. Snort is familiar with all RFC methods and dozens of other methods. 119:32 HTTP request uses primitive HTTP format known as HTTP/0.9. 119:33 HTTP request URI has space character that is not percent-encoded. 119:34 HTTP connection has more than maximum_pipelined_requests simultaneous pipelined requests that have not been answered. 119:102 Invalid status code in HTTP response. Either it is outside the range 100-599 or it is not a number. 119:104 HTTP response has Content-Type charset=utf-16le, utf-16be, utf-32le, or utf-32be, but UTF decoding of the message body failed. 119:105 HTTP response has Content-Type charset=utf-7. 119:109 More than one level of JavaScript obfuscation. This alert can only be generated when normalize_javascript configuration option is true or enhanced JavaScript normalizer is enabled. 119:110 Consecutive whitespaces within a JavaScript exceed max_javascript_whitespaces configuration option. This alert can only be generated when normalize_javascript configuration option is true. 119:111 More than one encoding within JavaScript obfuscated data. This alert can only be generated when normalize_javascript configuration option is true or enhanced JavaScript normalizer is enabled. 119:112 The HTTP message body contains compressed SWF file data with errors that cannot be decompressed. 119:113 The HTTP message body contains compressed LZMA file data with errors that cannot be decompressed. 119:114 The HTTP message body contains compressed PDF file data with errors that cannot be decompressed. 119:115 The HTTP message body contains a compressed PDF file that uses a compression type other than deflate ("FlateDecode" and "Fl"). 119:116 The HTTP message body contains a PDF file with more than one compression applied. 119:117 The HTTP message body contains PDF file data with an error that made the start of the PDF compressed stream unable to be located. 119:201 HTTP inspector is unable to parse this flow. Either the connection is not actually using HTTP or some sort of unrecoverable HTTP protocol error has occurred. This conclusion applies only to one direction of the flow. The opposite direction may be OK. 119:202 Chunk length has five or more leading zeros. 119:203 White space characters before the first HTTP message or inserted between HTTP messages. 119:204 HTTP request message does not include a URI. There is nothing between the method and the version except whitespace. Alternatively the 0.9 equivalent which is GET followed by nothing except whitespace. 119:205 The reason phrase in an HTTP response message contains a control character. 119:206 There is more than one space (or other whitespace) character between two elements of an HTTP request or status line. 119:207 The HTTP version in the start line begins with "HTTP/" but the remainder is not in the expected . format. 119:209 An HTTP header line contains a format error. A well-formed header consists of a field name followed by a colon followed by the field value. 119:210 A chunked transfer-encoded HTTP message body contains chunk extensions. A chunk extension is an optional parameter following the chunk length in the chunk header. 119:211 The HTTP request URI is not well-formatted as one of the four types defined for the HTTP protocol. 119:212 The HTTP URI contains an unrecognized type of percent encoding. 119:213 A chunked transfer-encoded HTTP message body contains a misformatted chunk. The following conditions make a chunk misformatted: there are at least five leading whitespaces before the chunk length in the chunk header, there is an illegal character in the chunk length (expressed as the hex number in ASCII), the chunk length is longer than 32 bits, the chunk header is terminated by lone CR ('\r') without an LF ('\n'), the chunk header does not contain the length, or the chunk data is terminated by a character other than CR or LF 119:214 A chunked transfer-encoded HTTP message body contains a chunk header with white space adjacent to the chunk length. This covers leading and trailing whitespace. 119:215 An HTTP header name contains whitespace. 119:216 A gzip-encoded HTTP message body was found to have an excessive compression ratio during decompression. 119:217 An error was encountered during decompression of a gzip-encoded HTTP message body. 119:218 An HTTP connection contains an HTTP 0.9 request followed by another request. There can only be one 0.9 response per connection because it ends the server-to-client connection. 119:219 An HTTP connection contains an HTTP 0.9 request following a normal request. 119:220 An HTTP message has both Content-Length and Transfer-Encoding headers. These headers conflict since the size of the message body will be determined by either the Content-Length value or by the chunked transfer-encoding formatting. 119:221 An HTTP server sent a response with a status code implying there will be no body but also sent a Transfer-Encoding or nonzero Content-Length header. The status codes that imply no message body are the informational (1XX) codes, 204 No Content and 304 Not Modified. Transfer-Encoding and nonzero Content-Length headers indicate that there will be a message body. 119:222 The HTTP Transfer-Encoding header value does not end with "chunked". The HTTP protocol specifies that when a transfer coding is applied to a message, "chunked" must the last transfer coding applied to the message body so that the length of the message body can be determined by the client. 119:223 An HTTP message includes a Transfer-Encoding header value that specifies other encodings before "chunked." 119:225 The HTTP Content-Encoding header contains a coding other than gzip and deflate decompression. 119:226 The HTTP Content-Encoding header contains an unknown coding. 119:227 The HTTP Content-Encoding header has multiple values, meaning multiple content encodings have been applied. 119:228 An HTTP server response was seen before a corresponding client request. 119:229 The decompressed size of the PDF/SWF/ZIP file contained in the HTTP message body exceeded the configured limit. The decompression limit can be configured with file_id.decompress_buffer_size. 119:230 An HTTP message header field name contains a nonprinting character. 119:231 The HTTP Content-Length header value is not a valid decimal length. 119:232 The HTTP header contains a wrapped header line. This means that the header field value has been folded onto multiple lines, indicated by beginning the continuation line with a space or horizontal tab. 119:233 An HTTP header line is terminated by CR ('\r') without LF ('\n'). The HTTP protocol specifies that header lines should be terminated by CRLF ('\r\n'). 119:234 A chunked transfer-encoded HTTP message body contains a chunk terminated by a nonstandard separator. The separator defined by the protocol that should terminate each chunk is CRLF ('\r\n'). 119:235 A chunked transfer-encoded HTTP message body contains a chunk length that is terminated by LF ('\n') without CR ('\r'). The protocol specifies that chunk lengths should be terminated by CRLF ('\r\n') as the line separator. 119:236 An HTTP server sent more than one response with 100 Continue status code. 119:237 An HTTP server sent a response with a status code other than 100 Continue in response to a request with an Expect header. The Expect header informs the server that the client will send a (presumably large) message body, and requests that the server send an interim 100 Continue response if it can handle the request. 119:238 An HTTP server sent an informational (1XX) response with a status code other than 100 Continue or 101 Switching Protocols. 119:239 An HTTP client sent an Expect header without sending a request message body. The Expect header informs the server that the client will send a (presumably large) message body, and requests that the server send an interim 100 Continue response if it can handle the request. 119:240 An HTTP 1.0 message contains a Transfer-Encoding header, which is disallowed for that version. 119:241 The Content-Transfer-Encoding field is used as an HTTP header. Content-Transfer-Encoding is a MIME header and is not registered as an HTTP header. 119:242 The HTTP trailer contains a header field that is disallowed in chunked message trailers. 119:243 The HTTP Age header field appears twice or has two values. 119:244 An HTTP Content-Encoding header has a value of "chunked", which is not a registered content encoding. 119:245 A partial content (status code 206) response was sent to a request without a Range header, meaning the client did not request the message body be fragmented. 119:246 An HTTP start line contains a version field where the letters in 'HTTP' are not all upper case. 119:247 There is whitespace embedded in the Content-Length header value other than leading and trailing whitespace. 119:248 While decompressing a gzip-encoded message body, the zipped data stream ended before the end of the message body, so there is unexpected non-gzip data following the compressed data. 119:249 There is an HTTP parameter key that is repeated at least 100 times within a request query. 119:250 There is an HTTP/2 Transfer-Encoding header value other than identity. The HTTP/2 protocol specifies that the chunked transfer encoding is not allowed. 119:251 An HTTP/2 message header contained a Content-Length header value, but the actual message body transferred is larger than that value. The Content-Length header is not used to determine the length of the message body for HTTP/2 traffic. 119:252 An HTTP/2 message header contained a Content-Length header value, but the actual message body transferred is smaller than that value. The Content-Length header is not used to determine the length of the message body for HTTP/2 traffic. 119:253 An HTTP client sent a CONNECT request with a request message body. 119:254 There was traffic from an HTTP client after the client sent a CONNECT request but before the CONNECT response from the server was received. 119:255 An HTTP server sent a successful (2XX) CONNECT response with a Content-Length header. 119:256 An HTTP server sent a successful (2XX) CONNECT response with a Transfer-Encoding header. 119:257 An HTTP server sent a CONNECT response with an informational (1XX) status code. 119:258 An HTTP CONNECT response was received before the request message from the client was completed. 119:259 A Content-Disposition HTTP header field contains a malformed filename parameter. 119:260 The TCP connection was closed before the full HTTP message body was transferred. The length of the full message body was determined by the Content-Length HTTP header field. 119:261 The TCP connection was closed before the full HTTP message body was transferred. The message uses the chunked transfer-encoding, so this means there was no well-formed chunk of length zero to terminate the message. 119:262 The scheme portion of an HTTP URI is longer than 10 characters. 119:263 A client sent a request to upgrade an HTTP/1 connection to HTTP/2. 119:264 A server granted a request to upgrade a connection from HTTP/1 to HTTP/2. 119:268 When HTML end-tag is encountered inside a JavaScript comment or literal, which is a syntax error, as the last comment or literal is not closed before script end. This alert is raised by the enhanced JavaScript normalizer. 154:6 JavaScript normalization includes identifier substitution, which brings arbitrary JavaScript identifiers to a common form. Amount of unique identifiers to normalize is limited, for memory considerations, with http_inspect.js_norm_identifier_depth parameter. When this threshold is reached, a corresponding alert is raised. This alert is not expected for typical network traffic and may be an indication that an attacker is trying to exhaust resources. This alert is raised by the enhanced JavaScript normalizer. 154:7 In JavaScript, template literals can have substitutions, that in turn can have nested template literals, which requires a stack to track for proper whitespace normalization. Also, the normalization tracks the current bracket scope, which requires a stack as well. When the depth of nesting exceeds limit set in http_inspect.js_norm_max_tmpl_nest or in http_inspect.js_norm_max_bracket_depth, this alert is raised. This alert is not expected for typical network traffic and may be an indication that an attacker is trying to exhaust resources. This alert is raised by the enhanced JavaScript normalizer. 154:8 This alert is raised for the following situation. During JavaScript normalization some data can be lost and not normalized. Usually it happens when rules have file_data and js_data ips options and fast-pattern (FP) search is applying to file_data. Some data doesn’t match file_data FP search and JavaScript normalization won't be executed for it. The following normalization for inline/external scripts will be stopped for current request within the flow. This alert is raised by the enhanced JavaScript normalizer. 154:9 To resolve variable names in JavaScript, a current stack of variable scopes has to be tracked. When the depth of nesting exceeds the limit set in http_inspect.js_norm_max_scope_depth, this alert is raised. This alert is not expected for typical network traffic and may be an indication that an attacker is trying to exhaust resources. This alert is raised by the enhanced JavaScript normalizer. 175:1 (domain_filter) configured domain detected 256:1 (dpx) too much data sent to port snort3-3.1.82.0/doc/reference/enviro.txt000066400000000000000000000012051457433257500177560ustar00rootroot00000000000000* *HOSTTYPE*: optional string that is output with the version at end of line. * *SNORT_IGNORE*: the list of symbols Snort should ignore when parsing the Lua conf. Unknown symbols not in SNORT_IGNORE will cause warnings with --warn-unknown or fatals with --warn-unknown --pedantic. * *SNORT_PROMPT*: the character sequence that is printed at startup, shutdown, and in the shell. The default is the mini-pig: o")~ . * *SNORT_PLUGIN_PATH*: an optional path where Snort can find supplemental shared libraries. This is only used when Snort is building manuals. Modules in supplemental shared libraries will be added to the manuals. snort3-3.1.82.0/doc/reference/scripts/000077500000000000000000000000001457433257500174045ustar00rootroot00000000000000snort3-3.1.82.0/doc/reference/scripts/generate_builtin.sh000077500000000000000000000006711457433257500232670ustar00rootroot00000000000000#!/usr/bin/env bash SNORT_BINARY="$1" INPUT_FILE="$2" OUTPUT_FILE="$3" PLUGIN_PATH="$4" PLUGIN_ARGS= if [ -n "${PLUGIN_PATH}" ] ; then PLUGIN_ARGS="--plugin-path=${PLUGIN_PATH}" fi cp ${INPUT_FILE} ${OUTPUT_FILE} ${SNORT_BINARY} ${PLUGIN_ARGS} --list-builtin | while read line ; do \ gidsid="${line/ *}"; \ msg="${line#* }"; \ msg="${msg//\//\\/}"; \ sed -i -e "s/^$gidsid\$/\*$gidsid $msg\*/" ${OUTPUT_FILE}; \ done snort3-3.1.82.0/doc/reference/scripts/generate_help.sh000077500000000000000000000012371457433257500225500ustar00rootroot00000000000000#!/usr/bin/env bash SNORT_BINARY="$1" OUTPUT_FILE="$2" PLUGIN_PATH="$3" HELP_ARG="--help" PLUGIN_ARGS= SORT_ARGS= if [ -n "${PLUGIN_PATH}" ] ; then PLUGIN_ARGS="--plugin-path=${PLUGIN_PATH}" fi HELP_TYPE=`basename "${OUTPUT_FILE}" .txt` if [ "${HELP_TYPE}" != "help" ] ; then HELP_ARG="${HELP_ARG}-${HELP_TYPE}" case "${HELP_TYPE}" in config) SORT_ARGS="-k 3" ;; counts) SORT_ARGS="-k 2" ;; esac fi if [ -n "${SORT_ARGS}" ] ; then "${SNORT_BINARY}" ${PLUGIN_ARGS} --markup "${HELP_ARG}" | sort ${SORT_ARGS} \ > "${OUTPUT_FILE}" else "${SNORT_BINARY}" ${PLUGIN_ARGS} --markup "${HELP_ARG}" \ > "${OUTPUT_FILE}" fi snort3-3.1.82.0/doc/reference/scripts/generate_list.sh000077500000000000000000000007401457433257500225710ustar00rootroot00000000000000#!/usr/bin/env bash SNORT_BINARY="$1" OUTPUT_FILE="$2" PLUGIN_PATH="$3" LIST_ARG= PLUGIN_ARGS= SORT_OPTIONS= if [ -n "${PLUGIN_PATH}" ] ; then PLUGIN_ARGS="--plugin-path=${PLUGIN_PATH}" fi LIST_TYPE=`basename ${OUTPUT_FILE} .txt` case "${LIST_TYPE}" in gids) SORT_OPTIONS="-n -k 1.4" ;; builtin) SORT_OPTIONS="-n -t : -k 1.4 -k 2" ;; esac "${SNORT_BINARY}" ${PLUGIN_ARGS} --markup "--list-${LIST_TYPE}" \ | sort ${SORT_OPTIONS} \ > "${OUTPUT_FILE}" snort3-3.1.82.0/doc/reference/scripts/generate_module.sh000077500000000000000000000006761457433257500231130ustar00rootroot00000000000000#!/usr/bin/env bash SNORT_BINARY="$1" OUTPUT_FILE="$2" PLUGIN_PATH="$3" PLUGIN_ARGS= if [ -n "${PLUGIN_PATH}" ] ; then PLUGIN_ARGS="--plugin-path=${PLUGIN_PATH}" fi MODULE_TYPE=`basename "${OUTPUT_FILE}" .txt` rm -f "${OUTPUT_FILE}" "${SNORT_BINARY}" ${PLUGIN_ARGS} --list-modules "${MODULE_TYPE}" \ | while read module_name; do "${SNORT_BINARY}" ${PLUGIN_ARGS} --markup --help-module "${module_name}" \ >> "${OUTPUT_FILE}" done snort3-3.1.82.0/doc/reference/snort_reference.text000066400000000000000000021727621457433257500220270ustar00rootroot00000000000000 --------------------------------------------------------------------- Snort 3 Reference Manual --------------------------------------------------------------------- The Snort Team Revision History Revision 3.1.82.0 2024-03-12 12:50:44 EDT TST --------------------------------------------------------------------- Table of Contents 1. Help 2. Basic Modules 2.1. active 2.2. alerts 2.3. attribute_table 2.4. classifications 2.5. daq 2.6. decode 2.7. detection 2.8. event_filter 2.9. event_queue 2.10. file_policy 2.11. high_availability 2.12. host_cache 2.13. host_tracker 2.14. hosts 2.15. inspection 2.16. ips 2.17. js_norm 2.18. latency 2.19. memory 2.20. network 2.21. output 2.22. packet_tracer 2.23. packets 2.24. payload_injector 2.25. process 2.26. profiler 2.27. rate_filter 2.28. references 2.29. search_engine 2.30. side_channel 2.31. snort 2.32. suppress 2.33. trace 3. Codec Modules 3.1. arp 3.2. auth 3.3. ciscometadata 3.4. eapol 3.5. erspan2 3.6. erspan3 3.7. esp 3.8. eth 3.9. fabricpath 3.10. geneve 3.11. gre 3.12. gtp 3.13. icmp4 3.14. icmp6 3.15. igmp 3.16. ipv4 3.17. ipv6 3.18. llc 3.19. mpls 3.20. pbb 3.21. pgm 3.22. pppoe 3.23. tcp 3.24. token_ring 3.25. udp 3.26. vlan 3.27. wlan 4. Connector Modules 4.1. file_connector 4.2. tcp_connector 5. Inspector Modules 5.1. appid 5.2. appid_listener 5.3. arp_spoof 5.4. back_orifice 5.5. binder 5.6. cip 5.7. cpeos_test 5.8. data_log 5.9. dce_http_proxy 5.10. dce_http_server 5.11. dce_smb 5.12. dce_tcp 5.13. dce_udp 5.14. dnp3 5.15. dns 5.16. domain_filter 5.17. dpx 5.18. file_id 5.19. file_log 5.20. ftp_client 5.21. ftp_data 5.22. ftp_server 5.23. gtp_inspect 5.24. http2_inspect 5.25. http_inspect 5.26. iec104 5.27. imap 5.28. mem_test 5.29. mms 5.30. modbus 5.31. netflow 5.32. normalizer 5.33. null_trace_logger 5.34. packet_capture 5.35. perf_monitor 5.36. pop 5.37. port_scan 5.38. reputation 5.39. rna 5.40. rpc_decode 5.41. s7commplus 5.42. sip 5.43. smtp 5.44. so_proxy 5.45. ssh 5.46. ssl 5.47. stream 5.48. stream_file 5.49. stream_icmp 5.50. stream_ip 5.51. stream_tcp 5.52. stream_udp 5.53. stream_user 5.54. telnet 5.55. wizard 6. IPS Action Modules 6.1. react 6.2. reject 7. IPS Option Modules 7.1. ack 7.2. appids 7.3. base64_decode 7.4. ber_data 7.5. ber_skip 7.6. bufferlen 7.7. byte_extract 7.8. byte_jump 7.9. byte_math 7.10. byte_test 7.11. cip_attribute 7.12. cip_class 7.13. cip_conn_path_class 7.14. cip_instance 7.15. cip_req 7.16. cip_rsp 7.17. cip_service 7.18. cip_status 7.19. classtype 7.20. content 7.21. cvs 7.22. dce_iface 7.23. dce_opnum 7.24. dce_stub_data 7.25. detection_filter 7.26. dnp3_data 7.27. dnp3_func 7.28. dnp3_ind 7.29. dnp3_obj 7.30. dsize 7.31. enable 7.32. enip_command 7.33. enip_req 7.34. enip_rsp 7.35. file_data 7.36. file_meta 7.37. file_type 7.38. flags 7.39. flow 7.40. flowbits 7.41. fragbits 7.42. fragoffset 7.43. gid 7.44. gtp_info 7.45. gtp_type 7.46. gtp_version 7.47. http_client_body 7.48. http_cookie 7.49. http_header 7.50. http_header_test 7.51. http_max_header_line 7.52. http_max_trailer_line 7.53. http_method 7.54. http_num_cookies 7.55. http_num_headers 7.56. http_num_trailers 7.57. http_param 7.58. http_raw_body 7.59. http_raw_cookie 7.60. http_raw_header 7.61. http_raw_request 7.62. http_raw_status 7.63. http_raw_trailer 7.64. http_raw_uri 7.65. http_stat_code 7.66. http_stat_msg 7.67. http_trailer 7.68. http_trailer_test 7.69. http_true_ip 7.70. http_uri 7.71. http_version 7.72. http_version_match 7.73. icmp_id 7.74. icmp_seq 7.75. icode 7.76. id 7.77. iec104_apci_type 7.78. iec104_asdu_func 7.79. ip_proto 7.80. ipopts 7.81. isdataat 7.82. itype 7.83. js_data 7.84. md5 7.85. metadata 7.86. mms_data 7.87. mms_func 7.88. modbus_data 7.89. modbus_func 7.90. modbus_unit 7.91. msg 7.92. mss 7.93. pcre 7.94. pkt_data 7.95. pkt_num 7.96. priority 7.97. raw_data 7.98. reference 7.99. regex 7.100. rem 7.101. replace 7.102. rev 7.103. rpc 7.104. s7commplus_content 7.105. s7commplus_func 7.106. s7commplus_opcode 7.107. sd_pattern 7.108. seq 7.109. service 7.110. sha256 7.111. sha512 7.112. sid 7.113. sip_body 7.114. sip_header 7.115. sip_method 7.116. sip_stat_code 7.117. so 7.118. soid 7.119. ssl_state 7.120. ssl_version 7.121. stream_reassemble 7.122. stream_size 7.123. tag 7.124. target 7.125. tos 7.126. ttl 7.127. urg 7.128. vba_data 7.129. window 7.130. wscale 8. Search Engine Modules 9. SO Rule Modules 10. Logger Modules 10.1. alert_csv 10.2. alert_ex 10.3. alert_fast 10.4. alert_full 10.5. alert_json 10.6. alert_syslog 10.7. alert_talos 10.8. alert_unixsock 10.9. log_codecs 10.10. log_hext 10.11. log_pcap 10.12. unified2 11. Appendix 11.1. Build Options 11.2. Environment Variables 11.3. Command Line Options 11.4. Configuration 11.5. Counts 11.6. Generators 11.7. Builtin Rules 11.8. Command Set 11.9. Signals 11.10. Module Listing 11.11. Plugin Listing --------------------------------------------------------------------- 1. Help --------------------------------------------------------------------- The detail in this reference manual was generated from the various help commands available in Snort. snort --help will output: Snort has several options to get more help: -? list command line options (same as --help) --help this overview of help --help-commands [] output matching commands --help-config [] output matching config options --help-counts [] output matching peg counts --help-limits print the int upper bounds denoted by max* --help-module output description of given module --help-modules list all available modules with brief help --help-modules-json dump description of all available modules in JSON format --help-plugins list all available plugins with brief help --help-options [