aboutsummaryrefslogtreecommitdiffstats
path: root/config/orionids-dev/patches
diff options
context:
space:
mode:
Diffstat (limited to 'config/orionids-dev/patches')
-rw-r--r--config/orionids-dev/patches/SnortSam/TODAO.txt1
-rw-r--r--config/orionids-dev/patches/SnortSam/snortsam-2.8.6.1.diff3021
-rw-r--r--config/orionids-dev/patches/inlinemode_options_flags.txt0
-rw-r--r--config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.am17
-rw-r--r--config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.in445
-rw-r--r--config/orionids-dev/patches/spoink_patch/2.8.6/plugbase.c1544
-rw-r--r--config/orionids-dev/patches/spoink_patch/2.8.6/util.c3233
-rw-r--r--config/orionids-dev/patches/spoink_patch/spo_pf.c462
-rw-r--r--config/orionids-dev/patches/spoink_patch/spo_pf.h60
9 files changed, 8783 insertions, 0 deletions
diff --git a/config/orionids-dev/patches/SnortSam/TODAO.txt b/config/orionids-dev/patches/SnortSam/TODAO.txt
new file mode 100644
index 00000000..3abf0303
--- /dev/null
+++ b/config/orionids-dev/patches/SnortSam/TODAO.txt
@@ -0,0 +1 @@
+Patch current snort 2.9 \ No newline at end of file
diff --git a/config/orionids-dev/patches/SnortSam/snortsam-2.8.6.1.diff b/config/orionids-dev/patches/SnortSam/snortsam-2.8.6.1.diff
new file mode 100644
index 00000000..983165e1
--- /dev/null
+++ b/config/orionids-dev/patches/SnortSam/snortsam-2.8.6.1.diff
@@ -0,0 +1,3021 @@
+Index: snort-2.8.6.1/src/twofish.c
+===================================================================
+--- snort-2.8.6.1/src/twofish.c (Revision 0)
++++ snort-2.8.6.1/src/twofish.c (Revision 3)
+@@ -0,0 +1,971 @@
++/* $Id: twofish.c,v 2.1 2008/12/15 20:36:05 fknobbe Exp $
++ *
++ *
++ * Copyright (C) 1997-2000 The Cryptix Foundation Limited.
++ * Copyright (C) 2000 Farm9.
++ * Copyright (C) 2001 Frank Knobbe.
++ * All rights reserved.
++ *
++ * For Cryptix code:
++ * Use, modification, copying and distribution of this software is subject
++ * the terms and conditions of the Cryptix General Licence. You should have
++ * received a copy of the Cryptix General Licence along with this library;
++ * if not, you can download a copy from http://www.cryptix.org/ .
++ *
++ * For Farm9:
++ * --- jojo@farm9.com, August 2000, converted from Java to C++, added CBC mode and
++ * ciphertext stealing technique, added AsciiTwofish class for easy encryption
++ * decryption of text strings
++ *
++ * Frank Knobbe <frank@knobbe.us>:
++ * --- April 2001, converted from C++ to C, prefixed global variables
++ * with TwoFish, substituted some defines, changed functions to make use of
++ * variables supplied in a struct, modified and added routines for modular calls.
++ * Cleaned up the code so that defines are used instead of fixed 16's and 32's.
++ * Created two general purpose crypt routines for one block and multiple block
++ * encryption using Joh's CBC code.
++ * Added crypt routines that use a header (with a magic and data length).
++ * (Basically a major rewrite).
++ *
++ * Note: Routines labeled _TwoFish are private and should not be used
++ * (or with extreme caution).
++ *
++ */
++
++#ifndef __TWOFISH_LIBRARY_SOURCE__
++#define __TWOFISH_LIBRARY_SOURCE__
++
++#include <string.h>
++#include <stdlib.h>
++#include <time.h>
++#include <ctype.h>
++#include <sys/types.h>
++
++#ifdef WIN32
++
++#ifndef u_long
++typedef unsigned long u_long;
++#endif
++#ifndef u_int32_t
++typedef unsigned long u_int32_t;
++#endif
++#ifndef u_word
++typedef unsigned short u_word;
++#endif
++#ifndef u_int16_t
++typedef unsigned short u_int16_t;
++#endif
++#ifndef u_char
++typedef unsigned char u_char;
++#endif
++#ifndef u_int8_t
++typedef unsigned char u_int8_t;
++#endif
++
++#endif /* WIN32 */
++
++#include "twofish.h"
++
++
++bool TwoFish_srand=TRUE; /* if TRUE, first call of TwoFishInit will seed rand(); */
++ /* of TwoFishInit */
++
++/* Fixed 8x8 permutation S-boxes */
++static const u_int8_t TwoFish_P[2][256] =
++{
++ { /* p0 */
++ 0xA9, 0x67, 0xB3, 0xE8, 0x04, 0xFD, 0xA3, 0x76, 0x9A, 0x92, 0x80, 0x78,
++ 0xE4, 0xDD, 0xD1, 0x38, 0x0D, 0xC6, 0x35, 0x98, 0x18, 0xF7, 0xEC, 0x6C,
++ 0x43, 0x75, 0x37, 0x26, 0xFA, 0x13, 0x94, 0x48, 0xF2, 0xD0, 0x8B, 0x30,
++ 0x84, 0x54, 0xDF, 0x23, 0x19, 0x5B, 0x3D, 0x59, 0xF3, 0xAE, 0xA2, 0x82,
++ 0x63, 0x01, 0x83, 0x2E, 0xD9, 0x51, 0x9B, 0x7C, 0xA6, 0xEB, 0xA5, 0xBE,
++ 0x16, 0x0C, 0xE3, 0x61, 0xC0, 0x8C, 0x3A, 0xF5, 0x73, 0x2C, 0x25, 0x0B,
++ 0xBB, 0x4E, 0x89, 0x6B, 0x53, 0x6A, 0xB4, 0xF1, 0xE1, 0xE6, 0xBD, 0x45,
++ 0xE2, 0xF4, 0xB6, 0x66, 0xCC, 0x95, 0x03, 0x56, 0xD4, 0x1C, 0x1E, 0xD7,
++ 0xFB, 0xC3, 0x8E, 0xB5, 0xE9, 0xCF, 0xBF, 0xBA, 0xEA, 0x77, 0x39, 0xAF,
++ 0x33, 0xC9, 0x62, 0x71, 0x81, 0x79, 0x09, 0xAD, 0x24, 0xCD, 0xF9, 0xD8,
++ 0xE5, 0xC5, 0xB9, 0x4D, 0x44, 0x08, 0x86, 0xE7, 0xA1, 0x1D, 0xAA, 0xED,
++ 0x06, 0x70, 0xB2, 0xD2, 0x41, 0x7B, 0xA0, 0x11, 0x31, 0xC2, 0x27, 0x90,
++ 0x20, 0xF6, 0x60, 0xFF, 0x96, 0x5C, 0xB1, 0xAB, 0x9E, 0x9C, 0x52, 0x1B,
++ 0x5F, 0x93, 0x0A, 0xEF, 0x91, 0x85, 0x49, 0xEE, 0x2D, 0x4F, 0x8F, 0x3B,
++ 0x47, 0x87, 0x6D, 0x46, 0xD6, 0x3E, 0x69, 0x64, 0x2A, 0xCE, 0xCB, 0x2F,
++ 0xFC, 0x97, 0x05, 0x7A, 0xAC, 0x7F, 0xD5, 0x1A, 0x4B, 0x0E, 0xA7, 0x5A,
++ 0x28, 0x14, 0x3F, 0x29, 0x88, 0x3C, 0x4C, 0x02, 0xB8, 0xDA, 0xB0, 0x17,
++ 0x55, 0x1F, 0x8A, 0x7D, 0x57, 0xC7, 0x8D, 0x74, 0xB7, 0xC4, 0x9F, 0x72,
++ 0x7E, 0x15, 0x22, 0x12, 0x58, 0x07, 0x99, 0x34, 0x6E, 0x50, 0xDE, 0x68,
++ 0x65, 0xBC, 0xDB, 0xF8, 0xC8, 0xA8, 0x2B, 0x40, 0xDC, 0xFE, 0x32, 0xA4,
++ 0xCA, 0x10, 0x21, 0xF0, 0xD3, 0x5D, 0x0F, 0x00, 0x6F, 0x9D, 0x36, 0x42,
++ 0x4A, 0x5E, 0xC1, 0xE0
++ },
++ { /* p1 */
++ 0x75, 0xF3, 0xC6, 0xF4, 0xDB, 0x7B, 0xFB, 0xC8, 0x4A, 0xD3, 0xE6, 0x6B,
++ 0x45, 0x7D, 0xE8, 0x4B, 0xD6, 0x32, 0xD8, 0xFD, 0x37, 0x71, 0xF1, 0xE1,
++ 0x30, 0x0F, 0xF8, 0x1B, 0x87, 0xFA, 0x06, 0x3F, 0x5E, 0xBA, 0xAE, 0x5B,
++ 0x8A, 0x00, 0xBC, 0x9D, 0x6D, 0xC1, 0xB1, 0x0E, 0x80, 0x5D, 0xD2, 0xD5,
++ 0xA0, 0x84, 0x07, 0x14, 0xB5, 0x90, 0x2C, 0xA3, 0xB2, 0x73, 0x4C, 0x54,
++ 0x92, 0x74, 0x36, 0x51, 0x38, 0xB0, 0xBD, 0x5A, 0xFC, 0x60, 0x62, 0x96,
++ 0x6C, 0x42, 0xF7, 0x10, 0x7C, 0x28, 0x27, 0x8C, 0x13, 0x95, 0x9C, 0xC7,
++ 0x24, 0x46, 0x3B, 0x70, 0xCA, 0xE3, 0x85, 0xCB, 0x11, 0xD0, 0x93, 0xB8,
++ 0xA6, 0x83, 0x20, 0xFF, 0x9F, 0x77, 0xC3, 0xCC, 0x03, 0x6F, 0x08, 0xBF,
++ 0x40, 0xE7, 0x2B, 0xE2, 0x79, 0x0C, 0xAA, 0x82, 0x41, 0x3A, 0xEA, 0xB9,
++ 0xE4, 0x9A, 0xA4, 0x97, 0x7E, 0xDA, 0x7A, 0x17, 0x66, 0x94, 0xA1, 0x1D,
++ 0x3D, 0xF0, 0xDE, 0xB3, 0x0B, 0x72, 0xA7, 0x1C, 0xEF, 0xD1, 0x53, 0x3E,
++ 0x8F, 0x33, 0x26, 0x5F, 0xEC, 0x76, 0x2A, 0x49, 0x81, 0x88, 0xEE, 0x21,
++ 0xC4, 0x1A, 0xEB, 0xD9, 0xC5, 0x39, 0x99, 0xCD, 0xAD, 0x31, 0x8B, 0x01,
++ 0x18, 0x23, 0xDD, 0x1F, 0x4E, 0x2D, 0xF9, 0x48, 0x4F, 0xF2, 0x65, 0x8E,
++ 0x78, 0x5C, 0x58, 0x19, 0x8D, 0xE5, 0x98, 0x57, 0x67, 0x7F, 0x05, 0x64,
++ 0xAF, 0x63, 0xB6, 0xFE, 0xF5, 0xB7, 0x3C, 0xA5, 0xCE, 0xE9, 0x68, 0x44,
++ 0xE0, 0x4D, 0x43, 0x69, 0x29, 0x2E, 0xAC, 0x15, 0x59, 0xA8, 0x0A, 0x9E,
++ 0x6E, 0x47, 0xDF, 0x34, 0x35, 0x6A, 0xCF, 0xDC, 0x22, 0xC9, 0xC0, 0x9B,
++ 0x89, 0xD4, 0xED, 0xAB, 0x12, 0xA2, 0x0D, 0x52, 0xBB, 0x02, 0x2F, 0xA9,
++ 0xD7, 0x61, 0x1E, 0xB4, 0x50, 0x04, 0xF6, 0xC2, 0x16, 0x25, 0x86, 0x56,
++ 0x55, 0x09, 0xBE, 0x91
++ }
++};
++
++static bool TwoFish_MDSready=FALSE;
++static u_int32_t TwoFish_MDS[4][256]; /* TwoFish_MDS matrix */
++
++
++#define TwoFish_LFSR1(x) (((x)>>1)^(((x)&0x01)?TwoFish_MDS_GF_FDBK/2:0))
++#define TwoFish_LFSR2(x) (((x)>>2)^(((x)&0x02)?TwoFish_MDS_GF_FDBK/2:0)^(((x)&0x01)?TwoFish_MDS_GF_FDBK/4:0))
++
++#define TwoFish_Mx_1(x) ((u_int32_t)(x)) /* force result to dword so << will work */
++#define TwoFish_Mx_X(x) ((u_int32_t)((x)^TwoFish_LFSR2(x))) /* 5B */
++#define TwoFish_Mx_Y(x) ((u_int32_t)((x)^TwoFish_LFSR1(x)^TwoFish_LFSR2(x))) /* EF */
++#define TwoFish_RS_rem(x) { u_int8_t b=(u_int8_t)(x>>24); u_int32_t g2=((b<<1)^((b&0x80)?TwoFish_RS_GF_FDBK:0))&0xFF; u_int32_t g3=((b>>1)&0x7F)^((b&1)?TwoFish_RS_GF_FDBK>>1:0)^g2; x=(x<<8)^(g3<<24)^(g2<<16)^(g3<<8)^b; }
++
++/*#define TwoFish__b(x,N) (((u_int8_t *)&x)[((N)&3)^TwoFish_ADDR_XOR])*/ /* pick bytes out of a dword */
++
++#define TwoFish_b0(x) TwoFish__b(x,0) /* extract LSB of u_int32_t */
++#define TwoFish_b1(x) TwoFish__b(x,1)
++#define TwoFish_b2(x) TwoFish__b(x,2)
++#define TwoFish_b3(x) TwoFish__b(x,3) /* extract MSB of u_int32_t */
++
++u_int8_t TwoFish__b(u_int32_t x,int n)
++{ n&=3;
++ while(n-->0)
++ x>>=8;
++ return (u_int8_t)x;
++}
++
++
++/* TwoFish Initialization
++ *
++ * This routine generates a global data structure for use with TwoFish,
++ * initializes important values (such as subkeys, sBoxes), generates subkeys
++ * and precomputes the MDS matrix if not already done.
++ *
++ * Input: User supplied password (will be appended by default password of 'SnortHas2FishEncryptionRoutines!')
++ *
++ * Output: Pointer to TWOFISH structure. This data structure contains key dependent data.
++ * This pointer is used with all other crypt functions.
++ */
++
++TWOFISH *TwoFishInit(char *userkey)
++{ TWOFISH *tfdata;
++ int i,x,m;
++ char tkey[TwoFish_KEY_LENGTH+40];
++
++ tfdata=malloc(sizeof(TWOFISH)); /* allocate the TwoFish structure */
++ if(tfdata!=NULL)
++ { if(*userkey)
++ { strncpy(tkey,userkey,TwoFish_KEY_LENGTH); /* use first 32 chars of user supplied password */
++ tkey[TwoFish_KEY_LENGTH]=0; /* make sure it wasn't more */
++ }
++ else
++ strcpy(tkey,TwoFish_DEFAULT_PW); /* if no key defined, use default password */
++ for(i=0,x=0,m=strlen(tkey);i<TwoFish_KEY_LENGTH;i++) /* copy into data structure */
++ { tfdata->key[i]=tkey[x++]; /* fill the whole keyspace with repeating key. */
++ if(x==m)
++ x=0;
++ }
++
++ if(!TwoFish_MDSready)
++ _TwoFish_PrecomputeMDSmatrix(); /* "Wake Up, Neo" */
++ _TwoFish_MakeSubKeys(tfdata); /* generate subkeys */
++ _TwoFish_ResetCBC(tfdata); /* reset the CBC */
++ tfdata->output=NULL; /* nothing to output yet */
++ tfdata->dontflush=FALSE; /* reset decrypt skip block flag */
++ if(TwoFish_srand)
++ { TwoFish_srand=FALSE;
++ srand(time(NULL));
++ }
++ }
++ return tfdata; /* return the data pointer */
++}
++
++
++void TwoFishDestroy(TWOFISH *tfdata)
++{ if(tfdata!=NULL)
++ free(tfdata);
++}
++
++
++/* en/decryption with CBC mode */
++unsigned long _TwoFish_CryptRawCBC(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata)
++{ unsigned long rl;
++
++ rl=len; /* remember how much data to crypt. */
++ while(len>TwoFish_BLOCK_SIZE) /* and now we process block by block. */
++ { _TwoFish_BlockCrypt(in,out,TwoFish_BLOCK_SIZE,decrypt,tfdata); /* de/encrypt it. */
++ in+=TwoFish_BLOCK_SIZE; /* adjust pointers. */
++ out+=TwoFish_BLOCK_SIZE;
++ len-=TwoFish_BLOCK_SIZE;
++ }
++ if(len>0) /* if we have less than a block left... */
++ _TwoFish_BlockCrypt(in,out,len,decrypt,tfdata); /* ...then we de/encrypt that too. */
++ if(tfdata->qBlockDefined && !tfdata->dontflush) /* in case len was exactly one block... */
++ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata); /* ...we need to write the... */
++ /* ...remaining bytes of the buffer */
++ return rl;
++}
++
++/* en/decryption on one block only */
++unsigned long _TwoFish_CryptRaw16(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata)
++{ /* qBlockPlain already zero'ed through ResetCBC */
++ memcpy(tfdata->qBlockPlain,in,len); /* toss the data into it. */
++ _TwoFish_BlockCrypt16(tfdata->qBlockPlain,tfdata->qBlockCrypt,decrypt,tfdata); /* encrypt just that block without CBC. */
++ memcpy(out,tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE); /* and return what we got */
++ return TwoFish_BLOCK_SIZE;
++}
++
++/* en/decryption without reset of CBC and output assignment */
++unsigned long _TwoFish_CryptRaw(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata)
++{
++ if(in!=NULL && out!=NULL && len>0 && tfdata!=NULL) /* if we have valid data, then... */
++ { if(len>TwoFish_BLOCK_SIZE) /* ...check if we have more than one block. */
++ return _TwoFish_CryptRawCBC(in,out,len,decrypt,tfdata); /* if so, use the CBC routines... */
++ else
++ return _TwoFish_CryptRaw16(in,out,len,decrypt,tfdata); /* ...otherwise just do one block. */
++ }
++ return 0;
++}
++
++
++/* TwoFish Raw Encryption
++ *
++ * Does not use header, but does use CBC (if more than one block has to be encrypted).
++ *
++ * Input: Pointer to the buffer of the plaintext to be encrypted.
++ * Pointer to the buffer receiving the ciphertext.
++ * The length of the plaintext buffer.
++ * The TwoFish structure.
++ *
++ * Output: The amount of bytes encrypted if successful, otherwise 0.
++ */
++
++unsigned long TwoFishEncryptRaw(char *in,
++ char *out,
++ unsigned long len,
++ TWOFISH *tfdata)
++{ _TwoFish_ResetCBC(tfdata); /* reset CBC flag. */
++ tfdata->output=out; /* output straight into output buffer. */
++ return _TwoFish_CryptRaw(in,out,len,FALSE,tfdata); /* and go for it. */
++}
++
++/* TwoFish Raw Decryption
++ *
++ * Does not use header, but does use CBC (if more than one block has to be decrypted).
++ *
++ * Input: Pointer to the buffer of the ciphertext to be decrypted.
++ * Pointer to the buffer receiving the plaintext.
++ * The length of the ciphertext buffer (at least one cipher block).
++ * The TwoFish structure.
++ *
++ * Output: The amount of bytes decrypted if successful, otherwise 0.
++ */
++
++unsigned long TwoFishDecryptRaw(char *in,
++ char *out,
++ unsigned long len,
++ TWOFISH *tfdata)
++{ _TwoFish_ResetCBC(tfdata); /* reset CBC flag. */
++ tfdata->output=out; /* output straight into output buffer. */
++ return _TwoFish_CryptRaw(in,out,len,TRUE,tfdata); /* and go for it. */
++}
++
++/* TwoFish Free
++ *
++ * Free's the allocated buffer.
++ *
++ * Input: Pointer to the TwoFish structure
++ *
++ * Output: (none)
++ */
++
++void TwoFishFree(TWOFISH *tfdata)
++{ if(tfdata->output!=NULL) /* if a valid buffer is present... */
++ { free(tfdata->output); /* ...then we free it for you... */
++ tfdata->output=NULL; /* ...and mark as such. */
++ }
++}
++
++/* TwoFish Set Output
++ *
++ * If you want to allocate the output buffer yourself,
++ * then you can set it with this function.
++ *
++ * Input: Pointer to your output buffer
++ * Pointer to the TwoFish structure
++ *
++ * Output: (none)
++ */
++
++void TwoFishSetOutput(char *outp,TWOFISH *tfdata)
++{ tfdata->output=outp; /* (do we really need a function for this?) */
++}
++
++/* TwoFish Alloc
++ *
++ * Allocates enough memory for the output buffer that would be required
++ *
++ * Input: Length of the plaintext.
++ * Boolean flag for BinHex Output.
++ * Pointer to the TwoFish structure.
++ *
++ * Output: Returns a pointer to the memory allocated.
++ */
++
++void *TwoFishAlloc(unsigned long len,bool binhex,bool decrypt,TWOFISH *tfdata)
++{
++/* TwoFishFree(tfdata); */ /* (don't for now) discard whatever was allocated earlier. */
++ if(decrypt) /* if decrypting... */
++ { if(binhex) /* ...and input is binhex encoded... */
++ len/=2; /* ...use half as much for output. */
++ len-=TwoFish_BLOCK_SIZE; /* Also, subtract the size of the header. */
++ }
++ else
++ { len+=TwoFish_BLOCK_SIZE; /* the size is just increased by the header... */
++ if(binhex)
++ len*=2; /* ...and doubled if output is to be binhexed. */
++ }
++ tfdata->output=malloc(len+TwoFish_BLOCK_SIZE);/* grab some memory...plus some extra (it's running over somewhere, crashes without extra padding) */
++
++ return tfdata->output; /* ...and return to caller. */
++}
++
++/* bin2hex and hex2bin conversion */
++void _TwoFish_BinHex(u_int8_t *buf,unsigned long len,bool bintohex)
++{ u_int8_t *pi,*po,c;
++
++ if(bintohex)
++ { for(pi=buf+len-1,po=buf+(2*len)-1;len>0;pi--,po--,len--) /* let's start from the end of the bin block. */
++ { c=*pi; /* grab value. */
++ c&=15; /* use lower 4 bits. */
++ if(c>9) /* convert to ascii. */
++ c+=('a'-10);
++ else
++ c+='0';
++ *po--=c; /* set the lower nibble. */
++ c=*pi; /* grab value again. */
++ c>>=4; /* right shift 4 bits. */
++ c&=15; /* make sure we only have 4 bits. */
++ if(c>9) /* convert to ascii. */
++ c+=('a'-10);
++ else
++ c+='0';
++ *po=c; /* set the higher nibble. */
++ } /* and keep going. */
++ }
++ else
++ { for(pi=buf,po=buf;len>0;pi++,po++,len-=2) /* let's start from the beginning of the hex block. */
++ { c=tolower(*pi++)-'0'; /* grab higher nibble. */
++ if(c>9) /* convert to value. */
++ c-=('0'-9);
++ *po=c<<4; /* left shit 4 bits. */
++ c=tolower(*pi)-'0'; /* grab lower nibble. */
++ if(c>9) /* convert to value. */
++ c-=('0'-9);
++ *po|=c; /* and add to value. */
++ }
++ }
++}
++
++
++/* TwoFish Encryption
++ *
++ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc,
++ * this routine will alloc the memory. In addition, it will include a small 'header'
++ * containing the magic and some salt. That way the decrypt routine can check if the
++ * packet got decrypted successfully, and return 0 instead of garbage.
++ *
++ * Input: Pointer to the buffer of the plaintext to be encrypted.
++ * Pointer to the pointer to the buffer receiving the ciphertext.
++ * The pointer either points to user allocated output buffer space, or to NULL, in which case
++ * this routine will set the pointer to the buffer allocated through the struct.
++ * The length of the plaintext buffer.
++ * Can be -1 if the input is a null terminated string, in which case we'll count for you.
++ * Boolean flag for BinHex Output (if used, output will be twice as large as input).
++ * Note: BinHex conversion overwrites (converts) input buffer!
++ * The TwoFish structure.
++ *
++ * Output: The amount of bytes encrypted if successful, otherwise 0.
++ */
++
++unsigned long TwoFishEncrypt(char *in,
++ char **out,
++ signed long len,
++ bool binhex,
++ TWOFISH *tfdata)
++{ unsigned long ilen,olen;
++
++
++ if(len== -1) /* if we got -1 for len, we'll assume IN is a... */
++ ilen=strlen(in); /* ...\0 terminated string and figure len out ourselves... */
++ else
++ ilen=len; /* ...otherwise we trust you supply a correct length. */
++
++ if(in!=NULL && out!=NULL && ilen>0 && tfdata!=NULL) /* if we got usable stuff, we'll do it. */
++ { if(*out==NULL) /* if OUT points to a NULL pointer... */
++ *out=TwoFishAlloc(ilen,binhex,FALSE,tfdata); /* ...we'll (re-)allocate buffer space. */
++ if(*out!=NULL)
++ { tfdata->output=*out; /* set output buffer. */
++ tfdata->header.salt=rand()*65536+rand(); /* toss in some salt. */
++ tfdata->header.length[0]= (u_int8_t)(ilen);
++ tfdata->header.length[1]= (u_int8_t)(ilen>>8);
++ tfdata->header.length[2]= (u_int8_t)(ilen>>16);
++ tfdata->header.length[3]= (u_int8_t)(ilen>>24);
++ memcpy(tfdata->header.magic,TwoFish_MAGIC,TwoFish_MAGIC_LEN); /* set the magic. */
++ olen=TwoFish_BLOCK_SIZE; /* set output counter. */
++ _TwoFish_ResetCBC(tfdata); /* reset the CBC flag */
++ _TwoFish_BlockCrypt((u_int8_t *)&(tfdata->header),*out,olen,FALSE,tfdata); /* encrypt first block (without flush on 16 byte boundary). */
++ olen+=_TwoFish_CryptRawCBC(in,*out+TwoFish_BLOCK_SIZE,ilen,FALSE,tfdata); /* and encrypt the rest (we do not reset the CBC flag). */
++ if(binhex) /* if binhex... */
++ { _TwoFish_BinHex(*out,olen,TRUE); /* ...convert output to binhex... */
++ olen*=2; /* ...and size twice as large. */
++ }
++ tfdata->output=*out;
++ return olen;
++ }
++ }
++ return 0;
++}
++
++/* TwoFish Decryption
++ *
++ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc,
++ * this routine will alloc the memory. In addition, it will check the small 'header'
++ * containing the magic. If magic does not match we return 0. Otherwise we return the
++ * amount of bytes decrypted (should be the same as the length in the header).
++ *
++ * Input: Pointer to the buffer of the ciphertext to be decrypted.
++ * Pointer to the pointer to the buffer receiving the plaintext.
++ * The pointer either points to user allocated output buffer space, or to NULL, in which case
++ * this routine will set the pointer to the buffer allocated through the struct.
++ * The length of the ciphertext buffer.
++ * Can be -1 if the input is a null terminated binhex string, in which case we'll count for you.
++ * Boolean flag for BinHex Input (if used, plaintext will be half as large as input).
++ * Note: BinHex conversion overwrites (converts) input buffer!
++ * The TwoFish structure.
++ *
++ * Output: The amount of bytes decrypted if successful, otherwise 0.
++ */
++
++unsigned long TwoFishDecrypt(char *in,
++ char **out,
++ signed long len,
++ bool binhex,
++ TWOFISH *tfdata)
++{ unsigned long ilen,elen,olen;
++ const u_int8_t cmagic[TwoFish_MAGIC_LEN]=TwoFish_MAGIC;
++ u_int8_t *tbuf;
++
++
++
++ if(len== -1) /* if we got -1 for len, we'll assume IN is... */
++ ilen=strlen(in); /* ...\0 terminated binhex and figure len out ourselves... */
++ else
++ ilen=len; /* ...otherwise we trust you supply a correct length. */
++
++ if(in!=NULL && out!=NULL && ilen>0 && tfdata!=NULL) /* if we got usable stuff, we'll do it. */
++ { if(*out==NULL) /* if OUT points to a NULL pointer... */
++ *out=TwoFishAlloc(ilen,binhex,TRUE,tfdata); /* ...we'll (re-)allocate buffer space. */
++ if(*out!=NULL)
++ { if(binhex) /* if binhex... */
++ { _TwoFish_BinHex(in,ilen,FALSE); /* ...convert input to values... */
++ ilen/=2; /* ...and size half as much. */
++ }
++ _TwoFish_ResetCBC(tfdata); /* reset the CBC flag. */
++
++ tbuf=(u_int8_t *)malloc(ilen+TwoFish_BLOCK_SIZE); /* get memory for data and header. */
++ if(tbuf==NULL)
++ return 0;
++ tfdata->output=tbuf; /* set output to temp buffer. */
++
++ olen=_TwoFish_CryptRawCBC(in,tbuf,ilen,TRUE,tfdata)-TwoFish_BLOCK_SIZE; /* decrypt the whole thing. */
++ memcpy(&(tfdata->header),tbuf,TwoFish_BLOCK_SIZE); /* copy first block into header. */
++ tfdata->output=*out;
++ for(elen=0;elen<TwoFish_MAGIC_LEN;elen++) /* compare magic. */
++ if(tfdata->header.magic[elen]!=cmagic[elen])
++ break;
++ if(elen==TwoFish_MAGIC_LEN) /* if magic matches then... */
++ { elen=(tfdata->header.length[0]) |
++ (tfdata->header.length[1])<<8 |
++ (tfdata->header.length[2])<<16 |
++ (tfdata->header.length[3])<<24; /* .. we know how much to expect. */
++ if(elen>olen) /* adjust if necessary. */
++ elen=olen;
++ memcpy(*out,tbuf+TwoFish_BLOCK_SIZE,elen); /* copy data into intended output. */
++ free(tbuf);
++ return elen;
++ }
++ free(tbuf);
++ }
++ }
++ return 0;
++}
++
++void _TwoFish_PrecomputeMDSmatrix(void) /* precompute the TwoFish_MDS matrix */
++{ u_int32_t m1[2];
++ u_int32_t mX[2];
++ u_int32_t mY[2];
++ u_int32_t i, j;
++
++ for (i = 0; i < 256; i++)
++ { j = TwoFish_P[0][i] & 0xFF; /* compute all the matrix elements */
++ m1[0] = j;
++ mX[0] = TwoFish_Mx_X( j ) & 0xFF;
++ mY[0] = TwoFish_Mx_Y( j ) & 0xFF;
++
++ j = TwoFish_P[1][i] & 0xFF;
++ m1[1] = j;
++ mX[1] = TwoFish_Mx_X( j ) & 0xFF;
++ mY[1] = TwoFish_Mx_Y( j ) & 0xFF;
++
++ TwoFish_MDS[0][i] = m1[TwoFish_P_00] | /* fill matrix w/ above elements */
++ mX[TwoFish_P_00] << 8 |
++ mY[TwoFish_P_00] << 16 |
++ mY[TwoFish_P_00] << 24;
++ TwoFish_MDS[1][i] = mY[TwoFish_P_10] |
++ mY[TwoFish_P_10] << 8 |
++ mX[TwoFish_P_10] << 16 |
++ m1[TwoFish_P_10] << 24;
++ TwoFish_MDS[2][i] = mX[TwoFish_P_20] |
++ mY[TwoFish_P_20] << 8 |
++ m1[TwoFish_P_20] << 16 |
++ mY[TwoFish_P_20] << 24;
++ TwoFish_MDS[3][i] = mX[TwoFish_P_30] |
++ m1[TwoFish_P_30] << 8 |
++ mY[TwoFish_P_30] << 16 |
++ mX[TwoFish_P_30] << 24;
++ }
++ TwoFish_MDSready=TRUE;
++}
++
++
++void _TwoFish_MakeSubKeys(TWOFISH *tfdata) /* Expand a user-supplied key material into a session key. */
++{ u_int32_t k64Cnt = TwoFish_KEY_LENGTH / 8;
++ u_int32_t k32e[4]; /* even 32-bit entities */
++ u_int32_t k32o[4]; /* odd 32-bit entities */
++ u_int32_t sBoxKey[4];
++ u_int32_t offset,i,j;
++ u_int32_t A, B, q=0;
++ u_int32_t k0,k1,k2,k3;
++ u_int32_t b0,b1,b2,b3;
++
++ /* split user key material into even and odd 32-bit entities and */
++ /* compute S-box keys using (12, 8) Reed-Solomon code over GF(256) */
++
++
++ for (offset=0,i=0,j=k64Cnt-1;i<4 && offset<TwoFish_KEY_LENGTH;i++,j--)
++ { k32e[i] = tfdata->key[offset++];
++ k32e[i]|= tfdata->key[offset++]<<8;
++ k32e[i]|= tfdata->key[offset++]<<16;
++ k32e[i]|= tfdata->key[offset++]<<24;
++ k32o[i] = tfdata->key[offset++];
++ k32o[i]|= tfdata->key[offset++]<<8;
++ k32o[i]|= tfdata->key[offset++]<<16;
++ k32o[i]|= tfdata->key[offset++]<<24;
++ sBoxKey[j] = _TwoFish_RS_MDS_Encode( k32e[i], k32o[i] ); /* reverse order */
++ }
++
++ /* compute the round decryption subkeys for PHT. these same subkeys */
++ /* will be used in encryption but will be applied in reverse order. */
++ i=0;
++ while(i < TwoFish_TOTAL_SUBKEYS)
++ { A = _TwoFish_F32( k64Cnt, q, k32e ); /* A uses even key entities */
++ q += TwoFish_SK_BUMP;
++
++ B = _TwoFish_F32( k64Cnt, q, k32o ); /* B uses odd key entities */
++ q += TwoFish_SK_BUMP;
++
++ B = B << 8 | B >> 24;
++
++ A += B;
++ tfdata->subKeys[i++] = A; /* combine with a PHT */
++
++ A += B;
++ tfdata->subKeys[i++] = A << TwoFish_SK_ROTL | A >> (32-TwoFish_SK_ROTL);
++ }
++
++ /* fully expand the table for speed */
++ k0 = sBoxKey[0];
++ k1 = sBoxKey[1];
++ k2 = sBoxKey[2];
++ k3 = sBoxKey[3];
++
++ for (i = 0; i < 256; i++)
++ { b0 = b1 = b2 = b3 = i;
++ switch (k64Cnt & 3)
++ { case 1: /* 64-bit keys */
++ tfdata->sBox[ 2*i ] = TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][b0]) ^ TwoFish_b0(k0)];
++ tfdata->sBox[ 2*i+1] = TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][b1]) ^ TwoFish_b1(k0)];
++ tfdata->sBox[0x200+2*i ] = TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][b2]) ^ TwoFish_b2(k0)];
++ tfdata->sBox[0x200+2*i+1] = TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][b3]) ^ TwoFish_b3(k0)];
++ break;
++ case 0: /* 256-bit keys (same as 4) */
++ b0 = (TwoFish_P[TwoFish_P_04][b0]) ^ TwoFish_b0(k3);
++ b1 = (TwoFish_P[TwoFish_P_14][b1]) ^ TwoFish_b1(k3);
++ b2 = (TwoFish_P[TwoFish_P_24][b2]) ^ TwoFish_b2(k3);
++ b3 = (TwoFish_P[TwoFish_P_34][b3]) ^ TwoFish_b3(k3);
++ case 3: /* 192-bit keys */
++ b0 = (TwoFish_P[TwoFish_P_03][b0]) ^ TwoFish_b0(k2);
++ b1 = (TwoFish_P[TwoFish_P_13][b1]) ^ TwoFish_b1(k2);
++ b2 = (TwoFish_P[TwoFish_P_23][b2]) ^ TwoFish_b2(k2);
++ b3 = (TwoFish_P[TwoFish_P_33][b3]) ^ TwoFish_b3(k2);
++ case 2: /* 128-bit keys */
++ tfdata->sBox[ 2*i ]=
++ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][(TwoFish_P[TwoFish_P_02][b0]) ^
++ TwoFish_b0(k1)]) ^ TwoFish_b0(k0)];
++
++ tfdata->sBox[ 2*i+1]=
++ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][(TwoFish_P[TwoFish_P_12][b1]) ^
++ TwoFish_b1(k1)]) ^ TwoFish_b1(k0)];
++
++ tfdata->sBox[0x200+2*i ]=
++ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][(TwoFish_P[TwoFish_P_22][b2]) ^
++ TwoFish_b2(k1)]) ^ TwoFish_b2(k0)];
++
++ tfdata->sBox[0x200+2*i+1]=
++ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][(TwoFish_P[TwoFish_P_32][b3]) ^
++ TwoFish_b3(k1)]) ^ TwoFish_b3(k0)];
++ }
++ }
++}
++
++
++/**
++ * Encrypt or decrypt exactly one block of plaintext in CBC mode.
++ * Use "ciphertext stealing" technique described on pg. 196
++ * of "Applied Cryptography" to encrypt the final partial
++ * (i.e. <16 byte) block if necessary.
++ *
++ * jojo: the "ciphertext stealing" requires we read ahead and have
++ * special handling for the last two blocks. Because of this, the
++ * output from the TwoFish algorithm is handled internally here.
++ * It would be better to have a higher level handle this as well as
++ * CBC mode. Unfortunately, I've mixed the two together, which is
++ * pretty crappy... The Java version separates these out correctly.
++ *
++ * fknobbe: I have reduced the CBC mode to work on memory buffer only.
++ * Higher routines should use an intermediate buffer and handle
++ * their output seperately (mainly so the data can be flushed
++ * in one chunk, not seperate 16 byte blocks...)
++ *
++ * @param in The plaintext.
++ * @param out The ciphertext
++ * @param size how much to encrypt
++ * @param tfdata: Pointer to the global data structure containing session keys.
++ * @return none
++ */
++void _TwoFish_BlockCrypt(u_int8_t *in,u_int8_t *out,unsigned long size,int decrypt,TWOFISH *tfdata)
++{ u_int8_t PnMinusOne[TwoFish_BLOCK_SIZE];
++ u_int8_t CnMinusOne[TwoFish_BLOCK_SIZE];
++ u_int8_t CBCplusCprime[TwoFish_BLOCK_SIZE];
++ u_int8_t Pn[TwoFish_BLOCK_SIZE];
++ u_int8_t *p,*pout;
++ unsigned long i;
++
++ /* here is where we implement CBC mode and cipher block stealing */
++ if(size==TwoFish_BLOCK_SIZE)
++ { /* if we are encrypting, CBC means we XOR the plain text block with the */
++ /* previous cipher text block before encrypting */
++ if(!decrypt && tfdata->qBlockDefined)
++ { for(p=in,i=0;i<TwoFish_BLOCK_SIZE;i++,p++)
++ Pn[i]=*p ^ tfdata->qBlockCrypt[i]; /* FK: I'm copying the xor'ed input into Pn... */
++ }
++ else
++ memcpy(Pn,in,TwoFish_BLOCK_SIZE); /* FK: same here. we work of Pn all the time. */
++
++ /* TwoFish block level encryption or decryption */
++ _TwoFish_BlockCrypt16(Pn,out,decrypt,tfdata);
++
++ /* if we are decrypting, CBC means we XOR the result of the decryption */
++ /* with the previous cipher text block to get the resulting plain text */
++ if(decrypt && tfdata->qBlockDefined)
++ { for (p=out,i=0;i<TwoFish_BLOCK_SIZE;i++,p++)
++ *p^=tfdata->qBlockPlain[i];
++ }
++
++ /* save the input and output blocks, since CBC needs these for XOR */
++ /* operations */
++ _TwoFish_qBlockPush(Pn,out,tfdata);
++ }
++ else
++ { /* cipher block stealing, we are at Pn, */
++ /* but since Cn-1 must now be replaced with CnC' */
++ /* we pop it off, and recalculate Cn-1 */
++
++ if(decrypt)
++ { /* We are on an odd block, and had to do cipher block stealing, */
++ /* so the PnMinusOne has to be derived differently. */
++
++ /* First we decrypt it into CBC and C' */
++ _TwoFish_qBlockPop(CnMinusOne,PnMinusOne,tfdata);
++ _TwoFish_BlockCrypt16(CnMinusOne,CBCplusCprime,decrypt,tfdata);
++
++ /* we then xor the first few bytes with the "in" bytes (Cn) */
++ /* to recover Pn, which we put in out */
++ for(p=in,pout=out,i=0;i<size;i++,p++,pout++)
++ *pout=*p ^ CBCplusCprime[i];
++
++ /* We now recover the original CnMinusOne, which consists of */
++ /* the first "size" bytes of "in" data, followed by the */
++ /* "Cprime" portion of CBCplusCprime */
++ for(p=in,i=0;i<size;i++,p++)
++ CnMinusOne[i]=*p;
++ for(;i<TwoFish_BLOCK_SIZE;i++)
++ CnMinusOne[i]=CBCplusCprime[i];
++
++ /* we now decrypt CnMinusOne to get PnMinusOne xored with Cn-2 */
++ _TwoFish_BlockCrypt16(CnMinusOne,PnMinusOne,decrypt,tfdata);
++
++ for(i=0;i<TwoFish_BLOCK_SIZE;i++)
++ PnMinusOne[i]=PnMinusOne[i] ^ tfdata->prevCipher[i];
++
++ /* So at this point, out has PnMinusOne */
++ _TwoFish_qBlockPush(CnMinusOne,PnMinusOne,tfdata);
++ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata);
++ _TwoFish_FlushOutput(out,size,tfdata);
++ }
++ else
++ { _TwoFish_qBlockPop(PnMinusOne,CnMinusOne,tfdata);
++ memset(Pn,0,TwoFish_BLOCK_SIZE);
++ memcpy(Pn,in,size);
++ for(i=0;i<TwoFish_BLOCK_SIZE;i++)
++ Pn[i]^=CnMinusOne[i];
++ _TwoFish_BlockCrypt16(Pn,out,decrypt,tfdata);
++ _TwoFish_qBlockPush(Pn,out,tfdata); /* now we officially have Cn-1 */
++ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata);
++ _TwoFish_FlushOutput(CnMinusOne,size,tfdata); /* old Cn-1 becomes new partial Cn */
++ }
++ tfdata->qBlockDefined=FALSE;
++ }
++}
++
++void _TwoFish_qBlockPush(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata)
++{ if(tfdata->qBlockDefined)
++ _TwoFish_FlushOutput(tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE,tfdata);
++ memcpy(tfdata->prevCipher,tfdata->qBlockPlain,TwoFish_BLOCK_SIZE);
++ memcpy(tfdata->qBlockPlain,p,TwoFish_BLOCK_SIZE);
++ memcpy(tfdata->qBlockCrypt,c,TwoFish_BLOCK_SIZE);
++ tfdata->qBlockDefined=TRUE;
++}
++
++void _TwoFish_qBlockPop(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata)
++{ memcpy(p,tfdata->qBlockPlain,TwoFish_BLOCK_SIZE );
++ memcpy(c,tfdata->qBlockCrypt,TwoFish_BLOCK_SIZE );
++ tfdata->qBlockDefined=FALSE;
++}
++
++/* Reset's the CBC flag and zero's PrevCipher (through qBlockPlain) (important) */
++void _TwoFish_ResetCBC(TWOFISH *tfdata)
++{ tfdata->qBlockDefined=FALSE;
++ memset(tfdata->qBlockPlain,0,TwoFish_BLOCK_SIZE);
++}
++
++void _TwoFish_FlushOutput(u_int8_t *b,unsigned long len,TWOFISH *tfdata)
++{ unsigned long i;
++
++ for(i=0;i<len && !tfdata->dontflush;i++)
++ *tfdata->output++ = *b++;
++ tfdata->dontflush=FALSE;
++}
++
++void _TwoFish_BlockCrypt16(u_int8_t *in,u_int8_t *out,bool decrypt,TWOFISH *tfdata)
++{ u_int32_t x0,x1,x2,x3;
++ u_int32_t k,t0,t1,R;
++
++
++ x0=*in++;
++ x0|=(*in++ << 8 );
++ x0|=(*in++ << 16);
++ x0|=(*in++ << 24);
++ x1=*in++;
++ x1|=(*in++ << 8 );
++ x1|=(*in++ << 16);
++ x1|=(*in++ << 24);
++ x2=*in++;
++ x2|=(*in++ << 8 );
++ x2|=(*in++ << 16);
++ x2|=(*in++ << 24);
++ x3=*in++;
++ x3|=(*in++ << 8 );
++ x3|=(*in++ << 16);
++ x3|=(*in++ << 24);
++
++ if(decrypt)
++ { x0 ^= tfdata->subKeys[4]; /* swap input and output whitening keys when decrypting */
++ x1 ^= tfdata->subKeys[5];
++ x2 ^= tfdata->subKeys[6];
++ x3 ^= tfdata->subKeys[7];
++
++ k = 7+(TwoFish_ROUNDS*2);
++ for (R = 0; R < TwoFish_ROUNDS; R += 2)
++ { t0 = _TwoFish_Fe320( tfdata->sBox, x0);
++ t1 = _TwoFish_Fe323( tfdata->sBox, x1);
++ x3 ^= t0 + (t1<<1) + tfdata->subKeys[k--];
++ x3 = x3 >> 1 | x3 << 31;
++ x2 = x2 << 1 | x2 >> 31;
++ x2 ^= t0 + t1 + tfdata->subKeys[k--];
++
++ t0 = _TwoFish_Fe320( tfdata->sBox, x2);
++ t1 = _TwoFish_Fe323( tfdata->sBox, x3);
++ x1 ^= t0 + (t1<<1) + tfdata->subKeys[k--];
++ x1 = x1 >> 1 | x1 << 31;
++ x0 = x0 << 1 | x0 >> 31;
++ x0 ^= t0 + t1 + tfdata->subKeys[k--];
++ }
++
++ x2 ^= tfdata->subKeys[0];
++ x3 ^= tfdata->subKeys[1];
++ x0 ^= tfdata->subKeys[2];
++ x1 ^= tfdata->subKeys[3];
++ }
++ else
++ { x0 ^= tfdata->subKeys[0];
++ x1 ^= tfdata->subKeys[1];
++ x2 ^= tfdata->subKeys[2];
++ x3 ^= tfdata->subKeys[3];
++
++ k = 8;
++ for (R = 0; R < TwoFish_ROUNDS; R += 2)
++ { t0 = _TwoFish_Fe320( tfdata->sBox, x0);
++ t1 = _TwoFish_Fe323( tfdata->sBox, x1);
++ x2 ^= t0 + t1 + tfdata->subKeys[k++];
++ x2 = x2 >> 1 | x2 << 31;
++ x3 = x3 << 1 | x3 >> 31;
++ x3 ^= t0 + (t1<<1) + tfdata->subKeys[k++];
++
++ t0 = _TwoFish_Fe320( tfdata->sBox, x2);
++ t1 = _TwoFish_Fe323( tfdata->sBox, x3);
++ x0 ^= t0 + t1 + tfdata->subKeys[k++];
++ x0 = x0 >> 1 | x0 << 31;
++ x1 = x1 << 1 | x1 >> 31;
++ x1 ^= t0 + (t1<<1) + tfdata->subKeys[k++];
++ }
++
++ x2 ^= tfdata->subKeys[4];
++ x3 ^= tfdata->subKeys[5];
++ x0 ^= tfdata->subKeys[6];
++ x1 ^= tfdata->subKeys[7];
++ }
++
++ *out++ = (u_int8_t)(x2 );
++ *out++ = (u_int8_t)(x2 >> 8);
++ *out++ = (u_int8_t)(x2 >> 16);
++ *out++ = (u_int8_t)(x2 >> 24);
++
++ *out++ = (u_int8_t)(x3 );
++ *out++ = (u_int8_t)(x3 >> 8);
++ *out++ = (u_int8_t)(x3 >> 16);
++ *out++ = (u_int8_t)(x3 >> 24);
++
++ *out++ = (u_int8_t)(x0 );
++ *out++ = (u_int8_t)(x0 >> 8);
++ *out++ = (u_int8_t)(x0 >> 16);
++ *out++ = (u_int8_t)(x0 >> 24);
++
++ *out++ = (u_int8_t)(x1 );
++ *out++ = (u_int8_t)(x1 >> 8);
++ *out++ = (u_int8_t)(x1 >> 16);
++ *out++ = (u_int8_t)(x1 >> 24);
++}
++
++/**
++ * Use (12, 8) Reed-Solomon code over GF(256) to produce a key S-box
++ * 32-bit entity from two key material 32-bit entities.
++ *
++ * @param k0 1st 32-bit entity.
++ * @param k1 2nd 32-bit entity.
++ * @return Remainder polynomial generated using RS code
++ */
++u_int32_t _TwoFish_RS_MDS_Encode(u_int32_t k0,u_int32_t k1)
++{ u_int32_t i,r;
++
++ for(r=k1,i=0;i<4;i++) /* shift 1 byte at a time */
++ TwoFish_RS_rem(r);
++ r ^= k0;
++ for(i=0;i<4;i++)
++ TwoFish_RS_rem(r);
++
++ return r;
++}
++
++u_int32_t _TwoFish_F32(u_int32_t k64Cnt,u_int32_t x,u_int32_t *k32)
++{ u_int8_t b0,b1,b2,b3;
++ u_int32_t k0,k1,k2,k3,result = 0;
++
++ b0=TwoFish_b0(x);
++ b1=TwoFish_b1(x);
++ b2=TwoFish_b2(x);
++ b3=TwoFish_b3(x);
++ k0=k32[0];
++ k1=k32[1];
++ k2=k32[2];
++ k3=k32[3];
++
++ switch (k64Cnt & 3)
++ { case 1: /* 64-bit keys */
++ result =
++ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][b0] & 0xFF) ^ TwoFish_b0(k0)] ^
++ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][b1] & 0xFF) ^ TwoFish_b1(k0)] ^
++ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][b2] & 0xFF) ^ TwoFish_b2(k0)] ^
++ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][b3] & 0xFF) ^ TwoFish_b3(k0)];
++ break;
++ case 0: /* 256-bit keys (same as 4) */
++ b0 = (TwoFish_P[TwoFish_P_04][b0] & 0xFF) ^ TwoFish_b0(k3);
++ b1 = (TwoFish_P[TwoFish_P_14][b1] & 0xFF) ^ TwoFish_b1(k3);
++ b2 = (TwoFish_P[TwoFish_P_24][b2] & 0xFF) ^ TwoFish_b2(k3);
++ b3 = (TwoFish_P[TwoFish_P_34][b3] & 0xFF) ^ TwoFish_b3(k3);
++
++ case 3: /* 192-bit keys */
++ b0 = (TwoFish_P[TwoFish_P_03][b0] & 0xFF) ^ TwoFish_b0(k2);
++ b1 = (TwoFish_P[TwoFish_P_13][b1] & 0xFF) ^ TwoFish_b1(k2);
++ b2 = (TwoFish_P[TwoFish_P_23][b2] & 0xFF) ^ TwoFish_b2(k2);
++ b3 = (TwoFish_P[TwoFish_P_33][b3] & 0xFF) ^ TwoFish_b3(k2);
++ case 2: /* 128-bit keys (optimize for this case) */
++ result =
++ TwoFish_MDS[0][(TwoFish_P[TwoFish_P_01][(TwoFish_P[TwoFish_P_02][b0] & 0xFF) ^ TwoFish_b0(k1)] & 0xFF) ^ TwoFish_b0(k0)] ^
++ TwoFish_MDS[1][(TwoFish_P[TwoFish_P_11][(TwoFish_P[TwoFish_P_12][b1] & 0xFF) ^ TwoFish_b1(k1)] & 0xFF) ^ TwoFish_b1(k0)] ^
++ TwoFish_MDS[2][(TwoFish_P[TwoFish_P_21][(TwoFish_P[TwoFish_P_22][b2] & 0xFF) ^ TwoFish_b2(k1)] & 0xFF) ^ TwoFish_b2(k0)] ^
++ TwoFish_MDS[3][(TwoFish_P[TwoFish_P_31][(TwoFish_P[TwoFish_P_32][b3] & 0xFF) ^ TwoFish_b3(k1)] & 0xFF) ^ TwoFish_b3(k0)];
++ break;
++ }
++ return result;
++}
++
++u_int32_t _TwoFish_Fe320(u_int32_t *lsBox,u_int32_t x)
++{ return lsBox[ TwoFish_b0(x)<<1 ]^
++ lsBox[ ((TwoFish_b1(x)<<1)|1)]^
++ lsBox[0x200+ (TwoFish_b2(x)<<1) ]^
++ lsBox[0x200+((TwoFish_b3(x)<<1)|1)];
++}
++
++u_int32_t _TwoFish_Fe323(u_int32_t *lsBox,u_int32_t x)
++{ return lsBox[ (TwoFish_b3(x)<<1) ]^
++ lsBox[ ((TwoFish_b0(x)<<1)|1)]^
++ lsBox[0x200+ (TwoFish_b1(x)<<1) ]^
++ lsBox[0x200+((TwoFish_b2(x)<<1)|1)];
++}
++
++u_int32_t _TwoFish_Fe32(u_int32_t *lsBox,u_int32_t x,u_int32_t R)
++{ return lsBox[ 2*TwoFish__b(x,R ) ]^
++ lsBox[ 2*TwoFish__b(x,R+1)+1]^
++ lsBox[0x200+2*TwoFish__b(x,R+2) ]^
++ lsBox[0x200+2*TwoFish__b(x,R+3)+1];
++}
++
++
++#endif
+
+Index: snort-2.8.6.1/src/twofish.h
+===================================================================
+--- snort-2.8.6.1/src/twofish.h (Revision 0)
++++ snort-2.8.6.1/src/twofish.h (Revision 3)
+@@ -0,0 +1,276 @@
++/* $Id: twofish.h,v 2.1 2008/12/15 20:36:05 fknobbe Exp $
++ *
++ *
++ * Copyright (C) 1997-2000 The Cryptix Foundation Limited.
++ * Copyright (C) 2000 Farm9.
++ * Copyright (C) 2001 Frank Knobbe.
++ * All rights reserved.
++ *
++ * For Cryptix code:
++ * Use, modification, copying and distribution of this software is subject
++ * the terms and conditions of the Cryptix General Licence. You should have
++ * received a copy of the Cryptix General Licence along with this library;
++ * if not, you can download a copy from http://www.cryptix.org/ .
++ *
++ * For Farm9:
++ * --- jojo@farm9.com, August 2000, converted from Java to C++, added CBC mode and
++ * ciphertext stealing technique, added AsciiTwofish class for easy encryption
++ * decryption of text strings
++ *
++ * Frank Knobbe <frank@knobbe.us>:
++ * --- April 2001, converted from C++ to C, prefixed global variables
++ * with TwoFish, substituted some defines, changed functions to make use of
++ * variables supplied in a struct, modified and added routines for modular calls.
++ * Cleaned up the code so that defines are used instead of fixed 16's and 32's.
++ * Created two general purpose crypt routines for one block and multiple block
++ * encryption using Joh's CBC code.
++ * Added crypt routines that use a header (with a magic and data length).
++ * (Basically a major rewrite).
++ *
++ * Note: Routines labeled _TwoFish are private and should not be used
++ * (or with extreme caution).
++ *
++ */
++
++#ifndef __TWOFISH_LIBRARY_HEADER__
++#define __TWOFISH_LIBRARY_HEADER__
++
++#ifndef FALSE
++#define FALSE 0
++#endif
++#ifndef TRUE
++#define TRUE !FALSE
++#endif
++#ifndef bool
++#define bool int
++#endif
++
++
++/* Constants */
++
++#define TwoFish_DEFAULT_PW "SnortHas2FishEncryptionRoutines!" /* default password (not more than 32 chars) */
++#define TwoFish_MAGIC "TwoFish" /* to indentify a successful decryption */
++
++enum
++{ TwoFish_KEY_SIZE = 256, /* Valid values: 64, 128, 192, 256 */
++ /* User 256, other key sizes have not been tested. */
++ /* (But should work. I substituted as much as */
++ /* I could with this define.) */
++ TwoFish_ROUNDS = 16,
++ TwoFish_BLOCK_SIZE = 16, /* bytes in a data-block */
++ TwoFish_KEY_LENGTH = TwoFish_KEY_SIZE/8, /* 32= 256-bit key */
++ TwoFish_TOTAL_SUBKEYS = 4+4+2*TwoFish_ROUNDS,
++ TwoFish_MAGIC_LEN = TwoFish_BLOCK_SIZE-8,
++ TwoFish_SK_BUMP = 0x01010101,
++ TwoFish_SK_ROTL = 9,
++ TwoFish_P_00 = 1,
++ TwoFish_P_01 = 0,
++ TwoFish_P_02 = 0,
++ TwoFish_P_03 = TwoFish_P_01 ^ 1,
++ TwoFish_P_04 = 1,
++ TwoFish_P_10 = 0,
++ TwoFish_P_11 = 0,
++ TwoFish_P_12 = 1,
++ TwoFish_P_13 = TwoFish_P_11 ^ 1,
++ TwoFish_P_14 = 0,
++ TwoFish_P_20 = 1,
++ TwoFish_P_21 = 1,
++ TwoFish_P_22 = 0,
++ TwoFish_P_23 = TwoFish_P_21 ^ 1,
++ TwoFish_P_24 = 0,
++ TwoFish_P_30 = 0,
++ TwoFish_P_31 = 1,
++ TwoFish_P_32 = 1,
++ TwoFish_P_33 = TwoFish_P_31 ^ 1,
++ TwoFish_P_34 = 1,
++ TwoFish_GF256_FDBK = 0x169,
++ TwoFish_GF256_FDBK_2 = 0x169 / 2,
++ TwoFish_GF256_FDBK_4 = 0x169 / 4,
++ TwoFish_RS_GF_FDBK = 0x14D, /* field generator */
++ TwoFish_MDS_GF_FDBK = 0x169 /* primitive polynomial for GF(256) */
++};
++
++
++/* Global data structure for callers */
++
++typedef struct
++{ u_int32_t sBox[4 * 256]; /* Key dependent S-box */
++ u_int32_t subKeys[TwoFish_TOTAL_SUBKEYS]; /* Subkeys */
++ u_int8_t key[TwoFish_KEY_LENGTH]; /* Encryption Key */
++ u_int8_t *output; /* Pointer to output buffer */
++ u_int8_t qBlockPlain[TwoFish_BLOCK_SIZE]; /* Used by CBC */
++ u_int8_t qBlockCrypt[TwoFish_BLOCK_SIZE];
++ u_int8_t prevCipher[TwoFish_BLOCK_SIZE];
++ struct /* Header for crypt functions. Has to be at least one block long. */
++ { u_int32_t salt; /* Random salt in first block (will salt the rest through CBC) */
++ u_int8_t length[4]; /* The amount of data following the header */
++ u_int8_t magic[TwoFish_MAGIC_LEN]; /* Magic to identify successful decryption */
++ } header;
++ bool qBlockDefined;
++ bool dontflush;
++} TWOFISH;
++
++#ifndef __TWOFISH_LIBRARY_SOURCE__
++
++extern bool TwoFish_srand; /* if set to TRUE (default), first call of TwoFishInit will seed rand(); */
++ /* call of TwoFishInit */
++#endif
++
++
++/**** Public Functions ****/
++
++/* TwoFish Initialization
++ *
++ * This routine generates a global data structure for use with TwoFish,
++ * initializes important values (such as subkeys, sBoxes), generates subkeys
++ * and precomputes the MDS matrix if not already done.
++ *
++ * Input: User supplied password (will be appended by default password of 'SnortHas2FishEncryptionRoutines!')
++ *
++ * Output: Pointer to TWOFISH structure. This data structure contains key dependent data.
++ * This pointer is used with all other crypt functions.
++ */
++TWOFISH *TwoFishInit(char *userkey);
++
++
++/* TwoFish Destroy
++ *
++ * Nothing else but a free...
++ *
++ * Input: Pointer to the TwoFish structure.
++ *
++ */
++void TwoFishDestroy(TWOFISH *tfdata);
++
++
++/* TwoFish Alloc
++ *
++ * Allocates enough memory for the output buffer as required.
++ *
++ * Input: Length of the plaintext.
++ * Boolean flag for BinHex Output.
++ * Pointer to the TwoFish structure.
++ *
++ * Output: Returns a pointer to the memory allocated.
++ */
++void *TwoFishAlloc(unsigned long len,bool binhex,bool decrypt,TWOFISH *tfdata);
++
++
++/* TwoFish Free
++ *
++ * Free's the allocated buffer.
++ *
++ * Input: Pointer to the TwoFish structure
++ *
++ * Output: (none)
++ */
++void TwoFishFree(TWOFISH *tfdata);
++
++
++/* TwoFish Set Output
++ *
++ * If you want to allocate the output buffer yourself,
++ * then you can set it with this function.
++ *
++ * Input: Pointer to your output buffer
++ * Pointer to the TwoFish structure
++ *
++ * Output: (none)
++ */
++void TwoFishSetOutput(char *outp,TWOFISH *tfdata);
++
++
++/* TwoFish Raw Encryption
++ *
++ * Does not use header, but does use CBC (if more than one block has to be encrypted).
++ *
++ * Input: Pointer to the buffer of the plaintext to be encrypted.
++ * Pointer to the buffer receiving the ciphertext.
++ * The length of the plaintext buffer.
++ * The TwoFish structure.
++ *
++ * Output: The amount of bytes encrypted if successful, otherwise 0.
++ */
++unsigned long TwoFishEncryptRaw(char *in,char *out,unsigned long len,TWOFISH *tfdata);
++
++/* TwoFish Raw Decryption
++ *
++ * Does not use header, but does use CBC (if more than one block has to be decrypted).
++ *
++ * Input: Pointer to the buffer of the ciphertext to be decrypted.
++ * Pointer to the buffer receiving the plaintext.
++ * The length of the ciphertext buffer (at least one cipher block).
++ * The TwoFish structure.
++ *
++ * Output: The amount of bytes decrypted if successful, otherwise 0.
++ */
++unsigned long TwoFishDecryptRaw(char *in,char *out,unsigned long len,TWOFISH *tfdata);
++
++
++/* TwoFish Encryption
++ *
++ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc,
++ * this routine will alloc the memory. In addition, it will include a small 'header'
++ * containing the magic and some salt. That way the decrypt routine can check if the
++ * packet got decrypted successfully, and return 0 instead of garbage.
++ *
++ * Input: Pointer to the buffer of the plaintext to be encrypted.
++ * Pointer to the pointer to the buffer receiving the ciphertext.
++ * The pointer either points to user allocated output buffer space, or to NULL, in which case
++ * this routine will set the pointer to the buffer allocated through the struct.
++ * The length of the plaintext buffer.
++ * Can be -1 if the input is a null terminated string, in which case we'll count for you.
++ * Boolean flag for BinHex Output (if used, output will be twice as large as input).
++ * Note: BinHex conversion overwrites (converts) input buffer!
++ * The TwoFish structure.
++ *
++ * Output: The amount of bytes encrypted if successful, otherwise 0.
++ */
++unsigned long TwoFishEncrypt(char *in,char **out,signed long len,bool binhex,TWOFISH *tfdata);
++
++
++/* TwoFish Decryption
++ *
++ * Uses header and CBC. If the output area has not been intialized with TwoFishAlloc,
++ * this routine will alloc the memory. In addition, it will check the small 'header'
++ * containing the magic. If magic does not match we return 0. Otherwise we return the
++ * amount of bytes decrypted (should be the same as the length in the header).
++ *
++ * Input: Pointer to the buffer of the ciphertext to be decrypted.
++ * Pointer to the pointer to the buffer receiving the plaintext.
++ * The pointer either points to user allocated output buffer space, or to NULL, in which case
++ * this routine will set the pointer to the buffer allocated through the struct.
++ * The length of the ciphertext buffer.
++ * Can be -1 if the input is a null terminated binhex string, in which case we'll count for you.
++ * Boolean flag for BinHex Input (if used, plaintext will be half as large as input).
++ * Note: BinHex conversion overwrites (converts) input buffer!
++ * The TwoFish structure.
++ *
++ * Output: The amount of bytes decrypted if successful, otherwise 0.
++ */
++unsigned long TwoFishDecrypt(char *in,char **out,signed long len,bool binhex,TWOFISH *tfdata);
++
++
++/**** Private Functions ****/
++
++u_int8_t TwoFish__b(u_int32_t x,int n);
++void _TwoFish_BinHex(u_int8_t *buf,unsigned long len,bool bintohex);
++unsigned long _TwoFish_CryptRawCBC(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata);
++unsigned long _TwoFish_CryptRaw16(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata);
++unsigned long _TwoFish_CryptRaw(char *in,char *out,unsigned long len,bool decrypt,TWOFISH *tfdata);
++void _TwoFish_PrecomputeMDSmatrix(void);
++void _TwoFish_MakeSubKeys(TWOFISH *tfdata);
++void _TwoFish_qBlockPush(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata);
++void _TwoFish_qBlockPop(u_int8_t *p,u_int8_t *c,TWOFISH *tfdata);
++void _TwoFish_ResetCBC(TWOFISH *tfdata);
++void _TwoFish_FlushOutput(u_int8_t *b,unsigned long len,TWOFISH *tfdata);
++void _TwoFish_BlockCrypt(u_int8_t *in,u_int8_t *out,unsigned long size,int decrypt,TWOFISH *tfdata);
++void _TwoFish_BlockCrypt16(u_int8_t *in,u_int8_t *out,bool decrypt,TWOFISH *tfdata);
++u_int32_t _TwoFish_RS_MDS_Encode(u_int32_t k0,u_int32_t k1);
++u_int32_t _TwoFish_F32(u_int32_t k64Cnt,u_int32_t x,u_int32_t *k32);
++u_int32_t _TwoFish_Fe320(u_int32_t *lsBox,u_int32_t x);
++u_int32_t _TwoFish_Fe323(u_int32_t *lsBox,u_int32_t x);
++u_int32_t _TwoFish_Fe32(u_int32_t *lsBox,u_int32_t x,u_int32_t R);
++
++
++#endif
+
+Index: snort-2.8.6.1/src/plugin_enum.h
+===================================================================
+--- snort-2.8.6.1/src/plugin_enum.h (Revision 1)
++++ snort-2.8.6.1/src/plugin_enum.h (Revision 3)
+@@ -60,6 +60,7 @@
+ PLUGIN_URILEN_CHECK,
+ PLUGIN_DYNAMIC,
+ PLUGIN_FLOWBIT,
++ PLUGIN_FWSAM,
+ PLUGIN_MAX /* sentinel value */
+ };
+
+Index: snort-2.8.6.1/src/fatal.h
+===================================================================
+--- snort-2.8.6.1/src/fatal.h (Revision 0)
++++ snort-2.8.6.1/src/fatal.h (Revision 3)
+@@ -0,0 +1,40 @@
++/* $Id$ */
++/*
++** Copyright (C) 2002-2008 Sourcefire, Inc.
++** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
++**
++** This program is free software; you can redistribute it and/or modify
++** it under the terms of the GNU General Public License Version 2 as
++** published by the Free Software Foundation. You may not use, modify or
++** distribute this program under any other version of the GNU General
++** Public License.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++** GNU General Public License for more details.
++**
++** You should have received a copy of the GNU General Public License
++** along with this program; if not, write to the Free Software
++** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
++*/
++
++#ifndef __FATAL_H__
++#define __FATAL_H__
++
++
++/*
++ * in debugging mode print out the filename and the line number where the
++ * failure have occured
++ */
++
++
++#ifdef DEBUG
++ #define FATAL(msg) { printf("%s:%d: ", __FILE__, __LINE__); FatalError( (char *) msg); }
++#else
++ #define FATAL(msg) FatalError( (char *) msg)
++#endif
++
++
++
++#endif /* __FATAL_H__ */
+
+Index: snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c
+===================================================================
+--- snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c (Revision 0)
++++ snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.c (Revision 3)
+@@ -0,0 +1,1380 @@
++/* $id: snortpatchb,v 1.2 2002/10/26 03:32:35 fknobbe Exp $
++**
++** spo_alert_fwsam.c
++**
++** Copyright (c) 2001-2004 Frank Knobbe <frank@knobbe.us>
++**
++** This program is free software; you can redistribute it and/or modify
++** it under the terms of the GNU General Public License as published by
++** the Free Software Foundation; either version 2 of the License, or
++** (at your option) any later version.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++** GNU General Public License for more details.
++**
++** You should have received a copy of the GNU General Public License
++** along with this program; if not, write to the Free Software
++** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
++*/
++
++/*
++ * Purpose:
++ *
++ * This module sends alerts to a remote service on a host running SnortSam
++ * (the agent) which will block the intruding IP address on a variety of
++ * host and network firewalls.
++ *
++ * SnortSam also performs checks against a white-list of never-to-be-blocked IP addresses,
++ * can override block durations (for example for known proxies), and can detect attack conditions
++ * where too many blocks are received within a defined interval. If an attack is detected
++ * it will unblock the last x blocks and wait for the attack to end.
++ *
++ * See the SnortSam documentation for more information.
++ *
++ *
++ * Output Plugin Parameters:
++ ***************************
++ *
++ * output alert_fwsam: <SnortSam Station>:<port>/<key>
++ *
++ * <FW Mgmt Station>: The IP address or host name of the host running SnortSam.
++ * <port>: The port the remote SnortSam service listens on (default 898).
++ * <key>: The key used for authentication (encryption really)
++ * of the communication to the remote service.
++ *
++ * Examples:
++ *
++ * output alert_fwsam: snortsambox/idspassword
++ * output alert_fwsam: fw1.domain.tld:898/mykey
++ * output alert_fwsam: 192.168.0.1/borderfw 192.168.1.254/wanfw
++ *
++ *
++ * Rule Options:
++ ***************
++ *
++ * fwsam: who[how],time;
++ *
++ * who: src, source, dst, dest, destination
++ * IP address to be blocked according to snort rule (some rules
++ * are reversed, i.e. homenet -> any [and you want to block any]).
++ * src denotes IP to the left of -> and dst denotes IP to the right
++ *
++ * how: Optional. In, out, src, dest, either, both, this, conn, connection
++ * Tells FW-1 to block packets INcoming from host, OUTgoing to host,
++ * EITHERway, or only THIS connection (IP/Service pair).
++ * See 'fw sam' for more information. May be ignored by other plugins.
++ *
++ * time: Duration of block in seconds. (Accepts 'days', 'months', 'weeks',
++ * 'years', 'minutes', 'seconds', 'hours'. Alternatively, a value of
++ * 0, or the keyword PERManent, INFinite, or ALWAYS, will block the
++ * host permanently. Be careful with this!
++ * Tells FW-1 (and others) how long to inhibit packets from the host.
++ *
++ * Examples:
++ *
++ * fwsam: src[either],15min;
++ * or dst[in], 2 days 4 hours
++ * or src, 1 hour
++ *
++ * (default: src[either],5min)
++ *
++ *
++ * Effect:
++ *
++ * Alerts are sent to the remote SnortSam services on Firewall-1 Management Stations
++ * or other hosts running SnortSam (as required for Cisco Routers and PIX).
++ * The remote services will invoke the SAM configuration via the fw sam
++ * command line, or by sending a packet to the SAM port 18183, or by using the official
++ * OPSEC API calls, or by telnetting into Cisco routers or PIX firewalls.
++ * The communication over the network is encrypted using two-fish.
++ * (Implementation ripped from CryptCat by Farm9 with permission.)
++ *
++ * Future Plans:
++ *
++ * - Custom alert trigger per rule (x alerts in y secs) --> Seems to exist in Snort 1.9 now.
++ * - Enable/Allow tagged fwsam: arguments to provide different values to
++ * different stations. --> Seems to be accomplished with custom rule-types
++ *
++ *
++ * Comments:
++ *
++ * It seem that above wishes can be implemented with todays setup. Feedback concerning
++ * these is greatly appreciated.
++ *
++*/
++
++
++#include "spo_alert_fwsam.h"
++#include "twofish.h"
++/* external globals from rules.c */
++extern char *file_name;
++extern int file_line;
++extern OptTreeNode *otn_tmp;
++extern char *snort_conf_dir; /* extern PV pv; */
++
++
++/* my globals */
++
++FWsamList *FWsamStationList=NULL; /* Global (for all alert-types) list of snortsam stations */
++FWsamOptions *FWsamOptionField=NULL;
++unsigned long FWsamMaxOptions=0;
++
++
++/*
++ * Function: AlertFWsamSetup()
++ *
++ * Purpose: Registers the output plugin keyword and initialization
++ * function into the output plugin list. This is the function that
++ * gets called from InitOutputPlugins() in plugbase.c.
++ * It also registers itself as a plugin in order to parse every rule
++ * and to set the appropiate flags from fwsam: option.
++ *
++ * Arguments: None.
++ *
++ * Returns: void function
++ *
++*/
++void AlertFWsamSetup(void)
++{
++ /* link the preprocessor keyword to the init function in
++ the preproc list */
++ RegisterOutputPlugin("alert_fwsam", OUTPUT_TYPE_FLAG__ALERT, AlertFWsamInit);
++ RegisterRuleOption("fwsam", AlertFWsamOptionInit, NULL, OPT_TYPE_ACTION, NULL);
++
++#ifdef FWSAMDEBUG /* This allows debugging of fwsam only */
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamSetup) Output plugin is plugged in...\n");
++#endif
++}
++
++
++/* This function checks if a given snortsam station is already in
++ * a given list.
++*/
++int FWsamStationExists(FWsamStation *who,FWsamList *list)
++{
++ while(list)
++ {
++ if(list->station) {
++// if( who->stationip.s_addr==list->station->stationip.s_addr &&
++ if(IP_EQUALITY(&who->stationip, &list->station->stationip) &&
++ who->stationport==list->station->stationport)
++ return TRUE;
++ }
++ list=list->next;
++ }
++ return FALSE;
++}
++
++/*
++ * Function: AlertFWsamInit(char *args)
++ *
++ * Purpose: Calls the argument parsing function, performs final setup on data
++ * structs, links the preproc function into the function list.
++ *
++ * Arguments: args => ptr to argument string
++ *
++ * Returns: void function
++ *
++*/
++void AlertFWsamInit(char *args)
++{ char *ap;
++ unsigned long statip,cnt,again,i;
++ char *stathost,*statport,*statpass;
++ FWsamStation *station;
++ FWsamList *fwsamlist=NULL; /* alert-type dependent list of snortsam stations */
++ FWsamList *listp,*newlistp;
++ struct hostent *hoste;
++ char buf[1024]="";
++ FILE *fp;
++ FWsamOptions tempopt;
++
++#ifdef FWSAMDEBUG
++ unsigned long hostcnt=0;
++
++
++
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Output plugin initializing...\n");
++#endif
++
++ /* pv.alert_plugin_active = 1; */
++
++ /* parse the argument list from the rules file */
++
++ if(args == NULL)
++ FatalError("ERROR %s (%d) => [Alert_FWsam](AlertFWsamInit) No arguments to alert_fwsam preprocessor!\n", file_name, file_line);
++
++ if(!FWsamOptionField && !FWsamMaxOptions)
++ { strncpy(buf,snort_conf_dir,sizeof(buf)-1);
++ strncpy(buf+strlen(buf),SID_MAPFILE,sizeof(buf)-strlen(buf)-1);
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamSetup) Using file: %s\n",buf);
++#endif
++ fp=fopen(buf,"rt");
++ if(!fp)
++ { strncpy(buf,snort_conf_dir,sizeof(buf)-1);
++ strncpy(buf+strlen(buf),SID_ALT_MAPFILE,sizeof(buf)-strlen(buf)-1);
++ fp=fopen(buf,"rt");
++ }
++ if(fp) /* Check for presence of map file and read those in, sorted. */
++ { LogMessage("INFO => [Alert_FWsam](AlertFWsamSetup) Using sid-map file: %s\n",buf);
++
++ while(FWsamReadLine(buf,sizeof(buf),fp))
++ if(*buf)
++ FWsamMaxOptions++;
++ if(FWsamMaxOptions)
++ { if((FWsamOptionField=(FWsamOptions *)malloc(sizeof(FWsamOptions)*FWsamMaxOptions))==NULL)
++ FatalError("ERROR => [Alert_FWsam](AlertFWsamSetup) malloc failed for OptionField!\n");
++ fseek(fp,0,SEEK_SET);
++ for(cnt=0;cnt<FWsamMaxOptions;)
++ { FWsamReadLine(buf,sizeof(buf),fp);
++ if(*buf)
++ FWsamParseLine(&(FWsamOptionField[cnt++]),buf);
++ }
++ if(FWsamMaxOptions>1)
++ { for(again=TRUE,cnt=FWsamMaxOptions-1;cnt>=1 && again;cnt--)
++ { for(again=FALSE,i=0;i<cnt;i++)
++ { if(FWsamOptionField[i].sid>FWsamOptionField[i+1].sid)
++ { memcpy(&tempopt,&(FWsamOptionField[i]),sizeof(FWsamOptions));
++ memcpy(&(FWsamOptionField[i]),&(FWsamOptionField[i+1]),sizeof(FWsamOptions));
++ memcpy(&(FWsamOptionField[i+1]),&tempopt,sizeof(FWsamOptions));
++ again=TRUE;
++ }
++ }
++ }
++ }
++ }
++ else
++ FWsamMaxOptions=1;
++ fclose(fp);
++ }
++ else
++ FWsamMaxOptions=1;
++ }
++
++
++ ap=args; /* start at the beginning of the argument */
++ while(*ap && isspace(*ap)) ap++;
++ while(*ap)
++ { stathost=ap; /* first argument should be host */
++ statport=NULL;
++ statpass=NULL;
++ while(*ap && *ap!=':' && *ap!='/' && !isspace(*ap)) ap++; /* find token */
++ switch(*ap)
++ { case ':': *ap++=0; /* grab the port */
++ statport=ap;
++ while(*ap && *ap!='/' && !isspace(*ap)) ap++;
++ if(*ap!='/')
++ break;
++ case '/': *ap++=0; /* grab the key */
++ statpass=ap;
++ while(*ap && !isspace(*ap)) ap++;
++ default: break;
++ }
++ if(*ap)
++ { *ap++=0;
++ while(isspace(*ap)) ap++;
++ }
++ /* now we have the first host with port and password (key) */
++ /* next we check for valid/blank password/port */
++ if(statpass!=NULL)
++ if(!*statpass)
++ statpass=NULL;
++ if(statport!=NULL)
++ if(!*statport)
++ statport=NULL;
++ statip=0;
++ /* now we check if a valid host was specified */
++ if(inet_addr(stathost)==INADDR_NONE)
++ { hoste=gethostbyname(stathost);
++ if (!hoste)
++ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWsamInit) Unable to resolve host '%s'!\n",file_name,file_line,stathost);
++ else
++ statip=*(unsigned long *)hoste->h_addr;
++ }
++ else
++ { statip=inet_addr(stathost);
++ if(!statip)
++ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWsamInit) Invalid host address '%s'!\n",file_name,file_line,stathost);
++ }
++ if(statip)
++ { /* groovie, a valid host. Let's alloc and assemble the structure for it. */
++ if((station=(FWsamStation *)malloc(sizeof(FWsamStation)))==NULL)
++ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for station!\n");
++
++// station->stationip.s_addr=statip; /* the IP address */
++ station->stationip.ip32[0] = statip; /* the IP address */
++ if(statport!=NULL && atoi(statport)>0) /* if the user specified one */
++ station->stationport=atoi(statport); /* use users setting */
++ else
++ station->stationport=FWSAM_DEFAULTPORT; /* set the default port */
++
++ if(statpass!=NULL) /* if specified by user */
++ strncpy(station->stationkey,statpass,TwoFish_KEY_LENGTH); /* use defined key */
++ else
++ station->stationkey[0]=0;
++ station->stationkey[TwoFish_KEY_LENGTH]=0; /* make sure it's terminated. (damn strncpy...) */
++
++ strcpy(station->initialkey,station->stationkey);
++ station->stationfish=TwoFishInit(station->stationkey);
++
++ station->localsocketaddr.sin_port=htons(0); /* let's use dynamic ports for now */
++ station->localsocketaddr.sin_addr.s_addr=0;
++ station->localsocketaddr.sin_family=AF_INET;
++ station->stationsocketaddr.sin_port=htons(station->stationport);
++ //station->stationsocketaddr.sin_addr=station->stationip;
++ station->stationsocketaddr.sin_addr.s_addr=station->stationip.ip32[0];
++ station->stationsocketaddr.sin_family=AF_INET; /* load all socket crap and keep for later */
++
++ do
++ station->myseqno=rand(); /* the seqno this host will use */
++ while(station->myseqno<20 || station->myseqno>65500);
++ station->mykeymod[0]=rand();
++ station->mykeymod[1]=rand();
++ station->mykeymod[2]=rand();
++ station->mykeymod[3]=rand();
++ station->stationseqno=0; /* peer hasn't answered yet. */
++
++
++ if(!FWsamStationExists(station,FWsamStationList)) /* If we don't have the station already in global list....*/
++ { if(FWsamCheckIn(station)) /* ...and we can talk to the agent... */
++ { if((newlistp=(FWsamList *)malloc(sizeof(FWsamList)))==NULL)
++ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for global newlistp!\n");
++ newlistp->station=station;
++ newlistp->next=NULL;
++
++ if(!FWsamStationList) /* ... add it to the global list/ */
++ FWsamStationList=newlistp;
++ else
++ { listp=FWsamStationList;
++ while(listp->next)
++ listp=listp->next;
++ listp->next=newlistp;
++ }
++ }
++ else
++ { TwoFishDestroy(station->stationfish); /* if not, we trash it. */
++ free(station);
++ station=NULL;
++ }
++ }
++#ifdef FWSAMDEBUG
++ else
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Host %s:%i already in global list, skipping CheckIn.\n", sfip_ntoa(&station->stationip),station->stationport);
++#endif
++
++ if(station)
++ { if(!FWsamStationExists(station,fwsamlist)) /* If we don't have the station already in local list....*/
++ { if((newlistp=(FWsamList *)malloc(sizeof(FWsamList)))==NULL)
++ FatalError("ERROR => [Alert_FWsam](AlertFWsamInit) malloc failed for local newlistp!\n");
++ newlistp->station=station;
++ newlistp->next=NULL;
++
++ if(!fwsamlist) /* ... add it to the local list/ */
++ fwsamlist=newlistp;
++ else
++ { listp=fwsamlist;
++ while(listp->next)
++ listp=listp->next;
++ listp->next=newlistp;
++ }
++ }
++
++#ifdef FWSAMDEBUG
++ else
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Host %s:%i already in local list, skipping.\n",sfip_ntoa(&station->stationip),station->stationport);
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) #%i: Host %s [%s] port %i password %s\n",++hostcnt,stathost,sfip_ntoa(&station->stationip),station->stationport,station->stationkey);
++#endif
++ }
++
++ }
++ } /* next one */
++
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamInit) Linking fwsam alert function to call list...\n");
++#endif
++
++ /* Set the preprocessor function into the function list */
++ AddFuncToOutputList(AlertFWsam, OUTPUT_TYPE_FLAG__ALERT, fwsamlist);
++ AddFuncToCleanExitList(AlertFWsamCleanExitFunc, fwsamlist);
++ AddFuncToRestartList(AlertFWsamRestartFunc, fwsamlist);
++}
++
++
++/* This routine reads in a str from a file, snips white-spaces
++ * off the front and back, removes comments, and pretties the
++ * string. Returns true or false if a line was read or not.
++*/
++int FWsamReadLine(char *buf,unsigned long bufsize,FILE *fp)
++{ char *p;
++
++ if(fgets(buf,bufsize-1,fp))
++ { buf[bufsize-1]=0;
++
++#ifdef FWSAMDEBUG_off
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamReadLine) Line: %s\n",buf);
++#endif
++
++ p=buf;
++ while(isspace(*p))
++ p++;
++ if(p>buf);
++ strcpy(buf,p);
++ if(*buf)
++ { p=buf+strlen(buf)-1; /* remove leading and trailing spaces */
++ while(isspace(*p))
++ *p-- =0;
++ }
++ p=buf;
++ if(*p=='#' || *p==';')
++ *p=0;
++ else
++ p++;
++ while(*p) /* remove inline comments (except escaped #'s and ;'s) */
++ { if(*p=='#' || *p==';')
++ { if(*(p-1)=='\\')
++ strcpy(p-1,p);
++ else
++ *p=0;
++ }
++ else
++ p++;
++ }
++ return TRUE;
++ }
++ return FALSE;
++}
++
++
++/* Parses the duration of the argument, recognizing minutes, hours, etc..
++*/
++unsigned long FWsamParseDuration(char *p)
++{ unsigned long dur=0,tdu;
++ char *tok,c1,c2;
++
++ while(*p)
++ { tok=p;
++ while(*p && isdigit(*p))
++ p++;
++ if(*p)
++ { c1=tolower(*p);
++ *p=0;
++ p++;
++ if(*p && !isdigit(*p))
++ { c2=tolower(*p++);
++ while(*p && !isdigit(*p))
++ p++;
++ }
++ else
++ c2=0;
++ tdu=atol(tok);
++ switch(c1)
++ { case 'm': if(c2=='o') /* month */
++ tdu*=(60*60*24*30); /* use 30 days */
++ else
++ tdu*=60; /* minutes */
++ case 's': break; /* seconds */
++ case 'h': tdu*=(60*60); /* hours */
++ break;
++ case 'd': tdu*=(60*60*24); /* days */
++ break;
++ case 'w': tdu*=(60*60*24*7); /* week */
++ break;
++ case 'y': tdu*=(60*60*24*365); /* year */
++ break;
++ }
++ dur+=tdu;
++ }
++ else
++ dur+=atol(tok);
++ }
++
++ return dur;
++}
++
++
++/* This routine parses an option line. It is called by FWsamParseLine,
++ * which parses the sid-block.map file, and also by AlertFWsamOptionInit,
++ * which is called by Snort when processing fwsam: options in rules.
++ * It returns TRUE it there is a possible option problem, otherwise FALSE.
++*/
++int FWsamParseOption(FWsamOptions *optp,char *ap)
++{ int possprob=FALSE;
++
++ /* set defaults */
++
++ optp->duration=300; /* default of 5 minute block */
++ optp->how=FWSAM_HOW_INOUT; /* inbound and outbound block */
++ optp->who=FWSAM_WHO_SRC; /* the source */
++ optp->loglevel=FWSAM_LOG_LONGALERT; /* the log level default */
++ /* parse the fwsam keywords */
++
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWamOptionInit) Parse Options Args: %s\n",ap);
++#endif
++
++ if(*ap) /* should be dst/src (the WHO) or duration */
++ { if(isdigit(*ap))
++ optp->duration=FWsamParseDuration(ap);
++ else
++ { switch(*ap) /* yeah, we're lazy and check only the first character */
++ { case 'p': ; /* permanent, perm */
++ case 'f': ; /* forever */
++ case 'i': optp->duration=0; /* infinite, inf */
++ break;
++ case 'd': optp->who=FWSAM_WHO_DST; /* destination, dest, dst */
++ break;
++ case 's': optp->who=FWSAM_WHO_SRC; /* source, src */
++ break;
++ default: possprob=TRUE;
++ }
++ while(*ap && *ap!=',' && *ap!='[')
++ ap++;
++ if(*ap=='[')
++ { ap++; /* now we have the HOW */
++ switch(*ap)
++ { case 'i': ; /* in */
++ case 's': optp->how=FWSAM_HOW_IN; /* source, src */
++ break;
++ case 'o': ; /* out */
++ case 'd': optp->how=FWSAM_HOW_OUT; /* destination, dest, dst */
++ break;
++ case 'b': ; /* both */
++ case 'e': optp->how=FWSAM_HOW_INOUT; /* either */
++ break;
++ case 't': ; /* this */
++ case 'c': optp->how=FWSAM_HOW_THIS; /* connection, conn */
++ break;
++ default: possprob=TRUE;
++ }
++ while(*ap && *ap!=',')
++ ap++;
++ }
++ if(*ap==',')
++ { ap++;
++ if(isdigit(*ap)) /* and figure out how long to block */
++ optp->duration=FWsamParseDuration(ap);
++ else if(*ap=='p' || *ap=='f' || *ap=='i')
++ optp->duration=0;
++ else
++ possprob=TRUE;
++ }
++ else if(!*ap)
++ possprob=TRUE;
++ }
++ }
++ else
++ possprob=TRUE;
++
++ return possprob;
++}
++
++
++/* This goes through the lines of sid-block.map and sets the
++ * options for fwsam if the file is being used.
++*/
++void FWsamParseLine(FWsamOptions *optp,char *buf)
++{ char *ap;
++
++ ap=buf; /* start at the beginning of the argument */
++
++ while(*ap)
++ { if(isspace(*ap)) /* normalize spaces (tabs into space, etc) */
++ *ap=' ';
++ if(isupper(*ap)) /* and set to lower case */
++ *ap=tolower(*ap);
++ ap++;
++ }
++ while((ap=strrchr(buf,' '))!=NULL) /* remove spaces */
++ strcpy(ap,ap+1);
++
++ ap=buf;
++ if(*ap)
++ { while(*ap && *ap!=':' && *ap!='|')
++ ap++;
++ *ap++ =0;
++ while(*ap && (*ap==':' || *ap=='|'))
++ ap++;
++
++ optp->sid=(unsigned long)atol(buf);
++
++ if(FWsamParseOption(optp,ap))
++ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWamOptionInit) Possible option problem. Using %s[%s],%lu.\n",file_name,file_line,(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration);
++ }
++ else
++ optp->sid=0;
++}
++
++
++
++/*
++ * Function: AlertFWsamOptionInit(char *data, OptTreeNode *otn, int protocol)
++ *
++ * Purpose: Parses each rule and sets the option flags in the tree.
++ *
++ * Arguments: args => ptr to argument string
++ *
++ * Returns: void function
++ *
++*/
++void AlertFWsamOptionInit(char *args,OptTreeNode *otn,int protocol)
++{
++ FWsamOptions *optp;
++ char *ap;
++
++
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWamOptionInit) FWsamOptionInit is parsing...\n");
++#endif
++
++ if((optp=(FWsamOptions *)malloc(sizeof(FWsamOptions)))==NULL)
++ FatalError("ERROR => [Alert_FWsam](AlertFWamOptionInit) malloc failed for opt!\n");
++
++
++ ap=args; /* start at the beginning of the argument */
++
++ while(*ap)
++ { if(isspace(*ap)) /* normalize spaces (tabs into space, etc) */
++ *ap=' ';
++ if(isupper(*ap)) /* and set to lower case */
++ *ap=tolower(*ap);
++ ap++;
++ }
++ while((ap=strrchr(args,' '))!=NULL) /* remove spaces */
++ strcpy(ap,ap+1);
++
++
++ if(FWsamParseOption(optp,args))
++ LogMessage("WARNING %s (%d) => [Alert_FWsam](AlertFWamOptionInit) Possible option problem. Using %s[%s],%lu.\n",file_name,file_line,(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration);
++
++ otn->ds_list[PLUGIN_FWSAM]=(FWsamOptions *)optp;
++}
++
++
++/* Generates a new encryption key for TwoFish based on seq numbers and a random that
++ * the SnortSam agents send on checkin (in protocol)
++*/
++void FWsamNewStationKey(FWsamStation *station,FWsamPacket *packet)
++{
++ //unsigned char newkey[TwoFish_KEY_LENGTH+2];
++ char newkey[TwoFish_KEY_LENGTH+2];
++ int i;
++
++ newkey[0]=packet->snortseqno[0]; /* current snort seq # (which both know) */
++ newkey[1]=packet->snortseqno[1];
++ newkey[2]=packet->fwseqno[0]; /* current SnortSam seq # (which both know) */
++ newkey[3]=packet->fwseqno[1];
++ newkey[4]=packet->protocol[0]; /* the random SnortSam chose */
++ newkey[5]=packet->protocol[1];
++
++ strncpy(newkey+6,station->stationkey,TwoFish_KEY_LENGTH-6); /* append old key */
++ newkey[TwoFish_KEY_LENGTH]=0;
++
++ newkey[0]^=station->mykeymod[0]; /* modify key with key modifiers which were */
++ newkey[1]^=station->mykeymod[1]; /* exchanged during the check-in handshake. */
++ newkey[2]^=station->mykeymod[2];
++ newkey[3]^=station->mykeymod[3];
++ newkey[4]^=station->fwkeymod[0];
++ newkey[5]^=station->fwkeymod[1];
++ newkey[6]^=station->fwkeymod[2];
++ newkey[7]^=station->fwkeymod[3];
++
++ for(i=0;i<=7;i++)
++ if(newkey[i]==0)
++ newkey[i]++;
++
++ strcpy(station->stationkey,newkey);
++ TwoFishDestroy(station->stationfish);
++ station->stationfish=TwoFishInit(newkey);
++}
++
++
++/* This routine will search the option list as defined
++ * by the sid-block.map file and return a pointer
++ * to the matching record.
++*/
++FWsamOptions *FWsamGetOption(unsigned long sid)
++{ signed long i,step,diff,o,o2;
++
++#ifdef FWSAM_FANCYFETCH /* Fancy-fetch jumps in decreasing n/2 steps and takes much less lookups */
++ o=o2= -1;
++ i=step=FWsamMaxOptions>>1;
++ while(i>=0 && i<FWsamMaxOptions && i!=o2)
++ { diff=sid-FWsamOptionField[i].sid;
++ if(!diff)
++ return &(FWsamOptionField[i]);
++ if(step>1)
++ step=step>>1;
++ o2=o;
++ o=i;
++ if(diff>0)
++ i+=step;
++ else
++ i-=step;
++ }
++#else /* This is just a sequential list lookup */
++ for(i=0;i<FWsamMaxOptions;i++)
++ if(FWsamOptionField[i].sid==sid)
++ return &(FWsamOptionField[i]);
++#endif
++ return NULL;
++}
++
++
++/****************************************************************************
++ *
++ * Function: AlertFWsam(Packet *, char *)
++ *
++ * Purpose: Send the current alert to a remote module on a FW-1 mgmt station
++ *
++ * Arguments: p => pointer to the packet data struct
++ * msg => the message to print in the alert
++ *
++ * Returns: void function
++ *
++ ***************************************************************************/
++void AlertFWsam(Packet *p, char *msg, void *arg, Event *event)
++{ FWsamOptions *optp;
++ FWsamPacket sampacket;
++ FWsamStation *station=NULL;
++ FWsamList *fwsamlist;
++ SOCKET stationsocket;
++ int i,len,deletestation,stationtry=0;
++ //unsigned char *encbuf,*decbuf;
++ char *encbuf,*decbuf;
++ static unsigned long lastbsip[FWSAM_REPET_BLOCKS],lastbdip[FWSAM_REPET_BLOCKS],
++ lastbduration[FWSAM_REPET_BLOCKS],lastbtime[FWSAM_REPET_BLOCKS];
++ static unsigned short lastbsp[FWSAM_REPET_BLOCKS],lastbdp[FWSAM_REPET_BLOCKS],
++ lastbproto[FWSAM_REPET_BLOCKS],lastbpointer;
++ static unsigned char lastbmode[FWSAM_REPET_BLOCKS];
++ static unsigned long btime=0;
++
++
++ if(otn_tmp==NULL)
++ {
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] NULL otn_tmp!\n");
++#endif
++ return;
++ }
++ if(p == NULL)
++ {
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] NULL packet!\n");
++#endif
++ return;
++ }
++ if(arg == NULL)
++ {
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] NULL arg!\n");
++#endif
++ return;
++ }
++
++ /* SnortSam does no IPv6 */
++ if (!IS_IP4(p)) {
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] not acting on non-IP4 packet!\n");
++#endif
++ return;
++ }
++
++ optp=NULL;
++
++ if(FWsamOptionField) /* If using the file (field present), let's use that */
++ optp=FWsamGetOption(event->sig_id);
++
++ if(!optp) /* If file not present, check if an fwsam option was defined on the triggering rule */
++ optp=otn_tmp->ds_list[PLUGIN_FWSAM];
++
++ if(optp) /* if options specified for this rule */
++ { if(!btime) /* if this is the first time this function is */
++ { for(i=0;i<FWSAM_REPET_BLOCKS;i++) /* called, reset the time and protocol to 0. */
++ { lastbproto[i]=0;
++ lastbtime[i]=0;
++ }
++ }
++
++ fwsamlist=(FWsamList *)arg;
++
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] Alert -> Msg=\"%s\"\n",msg);
++
++ LogMessage("DEBUG => [Alert_FWsam] Alert -> Option: %s[%s],%lu.\n",(optp->who==FWSAM_WHO_SRC)?"src":"dst",(optp->how==FWSAM_HOW_IN)?"in":((optp->how==FWSAM_HOW_OUT)?"out":"either"),optp->duration);
++#endif
++
++ len=TRUE;
++ btime=(unsigned long)time(NULL); /* get current time */
++ /* This is a cheap check to see if the blocking request matches any of the previous requests. */
++ for(i=0;i<FWSAM_REPET_BLOCKS && len;i++)
++ { if( ((optp->how==FWSAM_HOW_THIS)? /* if blocking mode SERVICE, check for src and dst */
++ ( lastbsip[i]==p->iph->ip_src.s_addr && lastbdip[i]==p->iph->ip_dst.s_addr &&lastbproto[i]==p->iph->ip_proto &&
++ ((p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP)? /* check port only of TCP or UDP */
++/* ((optp->who==FWSAM_WHO_SRC)?(lastbsp[i]==p->sp):(lastbdp[i]==p->dp)):TRUE) ): */
++ lastbdp[i]==p->dp:TRUE) ):
++ ((optp->who==FWSAM_WHO_SRC)?(lastbsip[i]==p->iph->ip_src.s_addr):(lastbdip[i]==p->iph->ip_dst.s_addr))) && /* otherwise if we block source, only compare source. Same for dest. */
++ lastbduration[i]==optp->duration &&
++ (lastbmode[i]&(FWSAM_HOW|FWSAM_WHO))==(optp->how|optp->who) &&
++ (btime-lastbtime[i]<((optp->duration>FWSAM_REPET_TIME)?FWSAM_REPET_TIME:optp->duration)))
++ { len=FALSE; /* If so, we don't need to block again. */
++ }
++ }
++ if(len)
++ { if(++lastbpointer>=FWSAM_REPET_BLOCKS) /* increase repetitive check pointer */
++ lastbpointer=0;
++ lastbsip[lastbpointer]=p->iph->ip_src.s_addr; /* and note packet details */
++ lastbdip[lastbpointer]=p->iph->ip_dst.s_addr;
++ lastbduration[lastbpointer]=optp->duration;
++ lastbmode[lastbpointer]=optp->how|optp->who|optp->loglevel;
++ lastbproto[lastbpointer]=p->iph->ip_proto;
++ if(p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP)
++ { lastbsp[lastbpointer]=p->sp; /* set ports if TCP or UDP */
++ lastbdp[lastbpointer]=p->dp;
++ }
++ lastbtime[lastbpointer]=btime;
++
++
++ while(fwsamlist!=NULL)
++ { station=fwsamlist->station;
++ //if(station->stationip.s_addr)
++ if(station->stationip.ip32[0])
++ { deletestation=FALSE;
++ stationtry++; /* first try */
++ /* create a socket for the station */
++ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP);
++ if(stationsocket==INVALID_SOCKET)
++ FatalError("ERROR => [Alert_FWsam] Funky socket error (socket)!\n");
++ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr)))
++ FatalError("ERROR => [Alert_FWsam] Could not bind socket!\n");
++
++ /* let's connect to the agent */
++ if(connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr)))
++ {
++ LogMessage("WARNING => [Alert_FWsam] Could not send block to host %s. Will try later.\n",sfip_ntoa(&station->stationip));
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++ stationtry=0;
++ }
++ else
++ {
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] Connected to host %s.\n",sfip_ntoa(&station->stationip));
++#endif
++ /* now build the packet */
++ station->myseqno+=station->stationseqno; /* increase my seqno by adding agent seq no */
++ sampacket.endiancheck=1; /* This is an endian indicator for Snortsam */
++ sampacket.snortseqno[0]=(char)station->myseqno;
++ sampacket.snortseqno[1]=(char)(station->myseqno>>8);
++ sampacket.fwseqno[0]=(char)station->stationseqno;/* fill station seqno */
++ sampacket.fwseqno[1]=(char)(station->stationseqno>>8);
++ sampacket.status=FWSAM_STATUS_BLOCK; /* set block mode */
++ sampacket.version=FWSAM_PACKETVERSION; /* set packet version */
++ sampacket.duration[0]=(char)optp->duration; /* set duration */
++ sampacket.duration[1]=(char)(optp->duration>>8);
++ sampacket.duration[2]=(char)(optp->duration>>16);
++ sampacket.duration[3]=(char)(optp->duration>>24);
++ sampacket.fwmode=optp->how|optp->who|optp->loglevel; /* set the mode */
++ sampacket.dstip[0]=(char)p->iph->ip_dst.s_addr; /* destination IP */
++ sampacket.dstip[1]=(char)(p->iph->ip_dst.s_addr>>8);
++ sampacket.dstip[2]=(char)(p->iph->ip_dst.s_addr>>16);
++ sampacket.dstip[3]=(char)(p->iph->ip_dst.s_addr>>24);
++ sampacket.srcip[0]=(char)p->iph->ip_src.s_addr; /* source IP */
++ sampacket.srcip[1]=(char)(p->iph->ip_src.s_addr>>8);
++ sampacket.srcip[2]=(char)(p->iph->ip_src.s_addr>>16);
++ sampacket.srcip[3]=(char)(p->iph->ip_src.s_addr>>24);
++ sampacket.protocol[0]=(char)p->iph->ip_proto; /* protocol */
++ sampacket.protocol[1]=(char)(p->iph->ip_proto>>8);/* protocol */
++
++ if(p->iph->ip_proto==IPPROTO_TCP || p->iph->ip_proto==IPPROTO_UDP)
++ { sampacket.srcport[0]=(char)p->sp; /* set ports */
++ sampacket.srcport[1]=(char)(p->sp>>8);
++ sampacket.dstport[0]=(char)p->dp;
++ sampacket.dstport[1]=(char)(p->dp>>8);
++ }
++ else
++ sampacket.srcport[0]=sampacket.srcport[1]=sampacket.dstport[0]=sampacket.dstport[1]=0;
++
++ sampacket.sig_id[0]=(char)event->sig_id; /* set signature ID */
++ sampacket.sig_id[1]=(char)(event->sig_id>>8);
++ sampacket.sig_id[2]=(char)(event->sig_id>>16);
++ sampacket.sig_id[3]=(char)(event->sig_id>>24);
++
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] Sending BLOCK\n");
++ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",station->myseqno);
++ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno);
++ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",FWSAM_STATUS_BLOCK);
++ LogMessage("DEBUG => [Alert_FWsam] Mode : %i\n",optp->how|optp->who|optp->loglevel);
++ LogMessage("DEBUG => [Alert_FWsam] Duration : %li\n",optp->duration);
++ LogMessage("DEBUG => [Alert_FWsam] Protocol : %i\n",GET_IPH_PROTO(p));
++#ifdef SUP_IP6
++ LogMessage("DEBUG => [Alert_FWsam] Src IP : %s\n",sfip_ntoa(GET_SRC_IP(p)));
++ LogMessage("DEBUG => [Alert_FWsam] Dest IP : %s\n",sfip_ntoa(GET_DST_IP(p)));
++#else
++ LogMessage("DEBUG => [Alert_FWsam] Src IP : %s\n",inet_ntoa(p->iph->ip_src));
++ LogMessage("DEBUG => [Alert_FWsam] Dest IP : %s\n",inet_ntoa(p->iph->ip_dst));
++#endif
++ LogMessage("DEBUG => [Alert_FWsam] Src Port : %i\n",p->sp);
++ LogMessage("DEBUG => [Alert_FWsam] Dest Port : %i\n",p->dp);
++ LogMessage("DEBUG => [Alert_FWsam] Sig_ID : %lu\n",event->sig_id);
++
++#endif
++
++ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get the encryption buffer */
++ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt the packet with current key */
++
++ if(send(stationsocket,encbuf,len,0)!=len) /* weird...could not send */
++ { LogMessage("WARNING => [Alert_FWsam] Could not send to host %s. Will try again later.\n",sfip_ntoa(&station->stationip));
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++ stationtry=0;
++ }
++ else
++ { i=FWSAM_NETWAIT;
++#ifdef WIN32
++ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */
++#else
++ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */
++#endif
++ while(i-- >1) /* the response packet */
++ { waitms(10); /* wait for response (default maximum 3 secs */
++ if(recv(stationsocket,encbuf,len,0)==len)
++ i=0; /* if we received packet we set the counter to 0. */
++ /* by the time we check with if, it's already dec'ed to -1 */
++ }
++ if(!i) /* id we timed out (i was one, then dec'ed)... */
++ { LogMessage("WARNING => [Alert_FWsam] Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip));
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++ stationtry=0;
++ }
++ else /* got a packet */
++ { decbuf=(char *)&sampacket; /* get the pointer to the packet struct */
++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt the packet with current key */
++
++ if(len!=sizeof(FWsamPacket)) /* invalid decryption */
++ { strcpy(station->stationkey,station->initialkey); /* try the intial key */
++ TwoFishDestroy(station->stationfish);
++ station->stationfish=TwoFishInit(station->stationkey); /* re-initialize the TwoFish with the intial key */
++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try again to decrypt */
++ LogMessage("INFO => [Alert_FWsam] Had to use initial key!\n");
++ }
++ if(len==sizeof(FWsamPacket)) /* valid decryption */
++ { if(sampacket.version==FWSAM_PACKETVERSION)/* master speaks my language */
++ { if(sampacket.status==FWSAM_STATUS_OK || sampacket.status==FWSAM_STATUS_NEWKEY
++ || sampacket.status==FWSAM_STATUS_RESYNC || sampacket.status==FWSAM_STATUS_HOLD)
++ { station->stationseqno=sampacket.fwseqno[0] | (sampacket.fwseqno[1]<<8); /* get stations seqno */
++ station->lastcontact=(unsigned long)time(NULL); /* set the last contact time (not used yet) */
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK":
++ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY":
++ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC":
++ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR");
++ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8));
++ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno);
++ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",sampacket.status);
++ LogMessage("DEBUG => [Alert_FWsam] Version : %i\n",sampacket.version);
++#endif
++ if(sampacket.status==FWSAM_STATUS_HOLD)
++ { i=FWSAM_NETHOLD; /* Stay on hold for a maximum of 60 secs (default) */
++ while(i-- >1) /* the response packet */
++ { waitms(10); /* wait for response */
++ if(recv(stationsocket,encbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,0)==sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE)
++ i=0; /* if we received packet we set the counter to 0. */
++ }
++ if(!i) /* id we timed out (i was one, then dec'ed)... */
++ { LogMessage("WARNING => [Alert_FWsam] Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip));
++ stationtry=0;
++ sampacket.status=FWSAM_STATUS_ERROR;
++ }
++ else /* got a packet */
++ { decbuf=(char *)&sampacket; /* get the pointer to the packet struct */
++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt the packet with current key */
++
++ if(len!=sizeof(FWsamPacket)) /* invalid decryption */
++ { strcpy(station->stationkey,station->initialkey); /* try the intial key */
++ TwoFishDestroy(station->stationfish);
++ station->stationfish=TwoFishInit(station->stationkey); /* re-initialize the TwoFish with the intial key */
++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try again to decrypt */
++ LogMessage("INFO => [Alert_FWsam] Had to use initial key again!\n");
++ }
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK":
++ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY":
++ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC":
++ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR");
++ LogMessage("DEBUG => [Alert_FWsam] Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8));
++ LogMessage("DEBUG => [Alert_FWsam] Mgmt SeqNo : %x\n",station->stationseqno);
++ LogMessage("DEBUG => [Alert_FWsam] Status : %i\n",sampacket.status);
++ LogMessage("DEBUG => [Alert_FWsam] Version : %i\n",sampacket.version);
++#endif
++ if(len!=sizeof(FWsamPacket)) /* invalid decryption */
++ { ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++ deletestation=TRUE;
++ sampacket.status=FWSAM_STATUS_ERROR;
++ }
++ else if(sampacket.version!=FWSAM_PACKETVERSION) /* invalid protocol version */
++ { ErrorMessage("ERROR => [Alert_FWsam] Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++ deletestation=TRUE;
++ sampacket.status=FWSAM_STATUS_ERROR;
++ }
++ else if(sampacket.status!=FWSAM_STATUS_OK && sampacket.status!=FWSAM_STATUS_NEWKEY && sampacket.status!=FWSAM_STATUS_RESYNC)
++ { ErrorMessage("ERROR => [Alert_FWsam] Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++ deletestation=TRUE;
++ sampacket.status=FWSAM_STATUS_ERROR;
++ }
++ }
++ }
++ if(sampacket.status==FWSAM_STATUS_RESYNC) /* if station want's to resync... */
++ { strcpy(station->stationkey,station->initialkey); /* ...we use the intial key... */
++ memcpy(station->fwkeymod,sampacket.duration,4); /* and note the random key modifier */
++ }
++ if(sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC)
++ {
++ FWsamNewStationKey(station,&sampacket); /* generate new TwoFish keys */
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] Generated new encryption key...\n");
++#endif
++ }
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++ stationtry=0;
++ }
++ else if(sampacket.status==FWSAM_STATUS_ERROR) /* if SnortSam reports an error on second try, */
++ {
++#ifdef WIN32
++ closesocket(stationsocket); /* something is messed up and ... */
++#else
++ close(stationsocket);
++#endif
++ if(stationtry>1) /* we ignore that station. */
++ { deletestation=TRUE; /* flag for deletion */
++ ErrorMessage("ERROR => [Alert_FWsam] Could not renegotiate key! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++ }
++ else /* if we get an error on the first try, */
++ { if(!FWsamCheckIn(station)) /* we first try to check in again. */
++ { deletestation=TRUE;
++ ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++ }
++ }
++ }
++ else /* an unknown status means trouble... */
++ { ErrorMessage("ERROR => [Alert_FWsam] Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++ deletestation=TRUE;
++ }
++ }
++ else /* if the SnortSam agent uses a different packet version, we have no choice but to ignore it. */
++ { ErrorMessage("ERROR => [Alert_FWsam] Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++ deletestation=TRUE;
++ }
++ }
++ else /* if the intial key failed to decrypt as well, the keys are not configured the same, and we ignore that SnortSam station. */
++ { ErrorMessage("ERROR => [Alert_FWsam] Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++ deletestation=TRUE;
++ }
++ }
++ }
++ free(encbuf); /* release of the TwoFishAlloc'ed encryption buffer */
++ }
++ if(stationtry==0 || deletestation) /* if everything went real well, or real bad... */
++ { if(deletestation){ /* If it went bad, we remove the station from the list by marking the IP */
++// station->stationip.s_addr=0;
++ station->stationip.ip32[0]=0;
++ }
++ fwsamlist=fwsamlist->next;
++ }
++ }
++ else
++ fwsamlist=fwsamlist->next;
++ }
++ }
++ else
++ {
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam] Skipping repetitive block.\n");
++#endif
++ }
++ }
++}
++
++/* FWsamCheckOut will be called when Snort exists. It de-registeres this snort sensor
++ * from the list of sensor that the SnortSam agent keeps.
++ */
++void FWsamCheckOut(FWsamStation *station)
++{ FWsamPacket sampacket;
++ SOCKET stationsocket;
++ int i,len;
++ char *encbuf,*decbuf;
++ //unsigned char *encbuf,*decbuf;
++
++
++ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP);
++ if(stationsocket==INVALID_SOCKET)
++ FatalError("ERROR => [Alert_FWsam](FWsamCheckOut) Funky socket error (socket)!\n");
++ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr)))
++ FatalError("ERROR => [Alert_FWsam](FWsamCheckOut) Could not bind socket!\n");
++
++ /* let's connect to the agent */
++ if(!connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr)))
++ { LogMessage("INFO => [Alert_FWsam](FWsamCheckOut) Disconnecting from host %s.\n",sfip_ntoa(&station->stationip));
++ /* now build the packet */
++ station->myseqno+=station->stationseqno; /* increase my seqno */
++ sampacket.endiancheck=1;
++ sampacket.snortseqno[0]=(char)station->myseqno;
++ sampacket.snortseqno[1]=(char)(station->myseqno>>8);
++ sampacket.fwseqno[0]=(char)station->stationseqno; /* fill station seqno */
++ sampacket.fwseqno[1]=(char)(station->stationseqno>>8);
++ sampacket.status=FWSAM_STATUS_CHECKOUT; /* checking out... */
++ sampacket.version=FWSAM_PACKETVERSION;
++
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Sending CHECKOUT\n");
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Snort SeqNo: %x\n",station->myseqno);
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Mgmt SeqNo : %x\n",station->stationseqno);
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckOut) Status : %i\n",sampacket.status);
++
++#endif
++
++ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get encryption buffer */
++ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt packet with current key */
++
++ if(send(stationsocket,encbuf,len,0)==len)
++ { i=FWSAM_NETWAIT;
++#ifdef WIN32
++ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */
++#else
++ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */
++#endif
++ while(i-- >1)
++ { waitms(10); /* ...wait a maximum of 3 secs for response... */
++ if(recv(stationsocket,encbuf,len,0)==len) /* ... for the status packet */
++ i=0;
++ }
++ if(i) /* if we got the packet */
++ { decbuf=(char *)&sampacket;
++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish);
++
++ if(len!=sizeof(FWsamPacket)) /* invalid decryption */
++ { strcpy(station->stationkey,station->initialkey); /* try initial key */
++ TwoFishDestroy(station->stationfish); /* toss this fish */
++ station->stationfish=TwoFishInit(station->stationkey); /* re-initialze TwoFish with initial key */
++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* and try to decrypt again */
++ LogMessage("INFO => [Alert_FWsam](FWsamCheckOut) Had to use initial key!\n");
++ }
++ if(len==sizeof(FWsamPacket)) /* valid decryption */
++ { if(sampacket.version!=FWSAM_PACKETVERSION) /* but don't really care since we are on the way out */
++ ErrorMessage("WARNING => [Alert_FWsam](FWsamCheckOut) Protocol version error! What the hell, we're quitting anyway! :)\n");
++ }
++ else
++ ErrorMessage("WARNING => [Alert_FWsam](FWsamCheckOut) Password mismatch! What the hell, we're quitting anyway! :)\n");
++ }
++ }
++ free(encbuf); /* release TwoFishAlloc'ed buffer */
++ }
++ else
++ LogMessage("WARNING => [Alert_FWsam] Could not connect to host %s for CheckOut. What the hell, we're quitting anyway! :)\n",sfip_ntoa(&station->stationip));
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++}
++
++
++/* FWSamFree: Disconnects all FW-1 management stations,
++ * closes sockets, and frees the structures.
++ */
++void FWsamFree(FWsamList *list)
++{
++ FWsamList *next;
++
++ while(list) /* Free pointer list for rule type */
++ {
++ next=list->next;
++ free(list);
++ list=next;
++ }
++ list=FWsamStationList;
++
++ while(list) /* Free global pointer list and stations */
++ {
++ next=list->next;
++ if (list->station)
++ {
++ if(list->station->stationip.ip32[0])
++ //if(list->station->stationip.s_addr)
++ FWsamCheckOut(list->station); /* Send a Check-Out to SnortSam, */
++
++ TwoFishDestroy(list->station->stationfish); /* toss the fish, */
++ free(list->station); /* free station, */
++ }
++ free(list); /* free pointer, */
++ list=next; /* and move to next. */
++ }
++ FWsamStationList=NULL;
++ if(FWsamOptionField)
++ free(FWsamOptionField);
++}
++
++void AlertFWsamCleanExitFunc(int signal, void *arg)
++{ FWsamList *fwsamlist;
++
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamCleanExitFunc) Exiting...\n");
++#endif
++
++ fwsamlist=(FWsamList *)arg;
++ FWsamFree(fwsamlist); /* Free all elements */
++}
++
++void AlertFWsamRestartFunc(int signal, void *arg)
++{ FWsamList *fwsamlist;
++
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](AlertFWsamRestartFunc) Restarting...\n");
++#endif
++
++ fwsamlist=(FWsamList *)arg;
++ FWsamFree(fwsamlist); /* Free all elements */
++}
++
++/* This routine registers this Snort sensor with SnortSam.
++ * It will also change the encryption key based on some variables.
++ */
++int FWsamCheckIn(FWsamStation *station)
++{ int i,len,stationok=TRUE;
++ FWsamPacket sampacket;
++ char *encbuf,*decbuf;
++ //unsigned char *encbuf,*decbuf;
++ SOCKET stationsocket;
++
++
++ /* create a socket for the station */
++ stationsocket=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP);
++ if(stationsocket==INVALID_SOCKET)
++ FatalError("ERROR => [Alert_FWsam](FWsamCheckIn) Funky socket error (socket)!\n");
++ if(bind(stationsocket,(struct sockaddr *)&(station->localsocketaddr),sizeof(struct sockaddr)))
++ FatalError("ERROR => [Alert_FWsam](FWsamCheckIn) Could not bind socket!\n");
++
++ i=TRUE;
++ /* let's connect to the agent */
++ if(connect(stationsocket,(struct sockaddr *)&station->stationsocketaddr,sizeof(struct sockaddr)))
++ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Could not connect to host %s. Will try later.\n",sfip_ntoa(&station->stationip));
++ else
++ { LogMessage("INFO => [Alert_FWsam](FWsamCheckIn) Connected to host %s.\n",sfip_ntoa(&station->stationip));
++ /* now build the packet */
++ sampacket.endiancheck=1;
++ sampacket.snortseqno[0]=(char)station->myseqno; /* fill my sequence number number */
++ sampacket.snortseqno[1]=(char)(station->myseqno>>8); /* fill my sequence number number */
++ sampacket.status=FWSAM_STATUS_CHECKIN; /* let's check in */
++ sampacket.version=FWSAM_PACKETVERSION; /* set the packet version */
++ memcpy(sampacket.duration,station->mykeymod,4); /* we'll send SnortSam our key modifier in the duration slot */
++ /* (the checkin packet is just the plain initial key) */
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Sending CheckIn\n");
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Snort SeqNo: %x\n",station->myseqno);
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Mode : %i\n",sampacket.status);
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Version : %i\n",sampacket.version);
++#endif
++ encbuf=TwoFishAlloc(sizeof(FWsamPacket),FALSE,FALSE,station->stationfish); /* get buffer for encryption */
++ len=TwoFishEncrypt((char *)&sampacket,&encbuf,sizeof(FWsamPacket),FALSE,station->stationfish); /* encrypt with initial key */
++ if(send(stationsocket,encbuf,len,0)!=len) /* weird...could not send */
++ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Could not send to host %s. Will try again later.\n",sfip_ntoa(&station->stationip));
++ else
++ { i=FWSAM_NETWAIT;
++#ifdef WIN32
++ ioctlsocket(stationsocket,FIONBIO,&i); /* set non blocking and wait for */
++#else
++ ioctl(stationsocket,FIONBIO,&i); /* set non blocking and wait for */
++#endif
++ while(i-- >1)
++ { waitms(10); /* wait a maximum of 3 secs for response */
++ if(recv(stationsocket,encbuf,len,0)==len)
++ i=0;
++ }
++ if(!i) /* time up? */
++ LogMessage("WARNING => [Alert_FWsam](FWsamCheckIn) Did not receive response from host %s. Will try again later.\n",sfip_ntoa(&station->stationip));
++ else
++ { decbuf=(char *)&sampacket; /* got status packet */
++ len=TwoFishDecrypt(encbuf,&decbuf,sizeof(FWsamPacket)+TwoFish_BLOCK_SIZE,FALSE,station->stationfish); /* try to decrypt with initial key */
++ if(len==sizeof(FWsamPacket)) /* valid decryption */
++ {
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Received %s\n",sampacket.status==FWSAM_STATUS_OK?"OK":
++ sampacket.status==FWSAM_STATUS_NEWKEY?"NEWKEY":
++ sampacket.status==FWSAM_STATUS_RESYNC?"RESYNC":
++ sampacket.status==FWSAM_STATUS_HOLD?"HOLD":"ERROR");
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Snort SeqNo: %x\n",sampacket.snortseqno[0]|(sampacket.snortseqno[1]<<8));
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Mgmt SeqNo : %x\n",sampacket.fwseqno[0]|(sampacket.fwseqno[1]<<8));
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Status : %i\n",sampacket.status);
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Version : %i\n",sampacket.version);
++#endif
++ if(sampacket.version==FWSAM_PACKETVERSION) /* master speaks my language */
++ { if(sampacket.status==FWSAM_STATUS_OK || sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC)
++ { station->stationseqno=sampacket.fwseqno[0]|(sampacket.fwseqno[1]<<8); /* get stations seqno */
++ station->lastcontact=(unsigned long)time(NULL);
++
++ if(sampacket.status==FWSAM_STATUS_NEWKEY || sampacket.status==FWSAM_STATUS_RESYNC) /* generate new keys */
++ { memcpy(station->fwkeymod,sampacket.duration,4); /* note the key modifier */
++ FWsamNewStationKey(station,&sampacket); /* and generate new TwoFish keys (with key modifiers) */
++#ifdef FWSAMDEBUG
++ LogMessage("DEBUG => [Alert_FWsam](FWsamCheckIn) Generated new encryption key...\n");
++#endif
++ }
++ }
++ else /* weird, got a strange status back */
++ { ErrorMessage("ERROR => [Alert_FWsam](FWsamCheckIn) Funky handshake error! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++ stationok=FALSE;
++ }
++ }
++ else /* packet version does not match */
++ { ErrorMessage("ERROR =>[Alert_FWsam](FWsamCheckIn) Protocol version error! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++ stationok=FALSE;
++ }
++ }
++ else /* key does not match */
++ { ErrorMessage("ERROR => [Alert_FWsam](FWsamCheckIn) Password mismatch! Ignoring host %s.\n",sfip_ntoa(&station->stationip));
++ stationok=FALSE;
++ }
++ }
++ }
++ free(encbuf); /* release TwoFishAlloc'ed buffer */
++ }
++#ifdef WIN32
++ closesocket(stationsocket);
++#else
++ close(stationsocket);
++#endif
++ return stationok;
++}
++#undef FWSAMDEBUG
++
+
+Index: snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h
+===================================================================
+--- snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h (Revision 0)
++++ snort-2.8.6.1/src/output-plugins/spo_alert_fwsam.h (Revision 3)
+@@ -0,0 +1,216 @@
++/* $Id: snortpatchb,v 1.5 2005/10/06 08:50:39 fknobbe Exp $
++**
++** spo_alert_fwsam.h
++**
++** Copyright (c) 2001-2004 Frank Knobbe <frank@knobbe.us>
++**
++** This program is free software; you can redistribute it and/or modify
++** it under the terms of the GNU General Public License as published by
++** the Free Software Foundation; either version 2 of the License, or
++** (at your option) any later version.
++**
++** This program is distributed in the hope that it will be useful,
++** but WITHOUT ANY WARRANTY; without even the implied warranty of
++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++** GNU General Public License for more details.
++**
++** You should have received a copy of the GNU General Public License
++** along with this program; if not, write to the Free Software
++** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
++*/
++
++/* This file gets included in plugbase.c when it is integrated into the rest
++ * of the program.
++ *
++ * For more info, see the beginning of spo_alert_fwsam.c
++ *
++ */
++
++#ifndef __SPO_FWSAM_H__
++#define __SPO_FWSAM_H__
++
++#include "snort.h"
++#include "rules.h"
++#include "plugbase.h"
++#include "plugin_enum.h"
++#include "fatal.h"
++#include "util.h"
++#include "twofish.h"
++
++#include <stdlib.h>
++#include <stdio.h>
++#include <time.h>
++#include <string.h>
++#include <ctype.h>
++#include <unistd.h>
++
++
++/* just some compatibility stuff */
++#ifdef WIN32
++#if !defined(_WINSOCKAPI_) && !defined(_WINSOCK2API_)
++#include <winsock.h>
++#endif
++#define waitms(x) Sleep(x)
++
++#else
++
++#include <sys/socket.h>
++#include <netinet/in.h>
++#include <arpa/inet.h>
++#include <sys/ioctl.h>
++#include <netdb.h>
++
++#ifdef SOLARIS
++#include <sys/filio.h>
++#endif
++
++typedef int SOCKET;
++
++#ifndef INVALID_SOCKET
++#define INVALID_SOCKET -1
++#endif
++
++#define waitms(x) usleep((x)*1000)
++
++#endif
++
++#ifndef FALSE
++#define FALSE 0
++#endif
++#ifndef TRUE
++#define TRUE !FALSE
++#endif
++#ifndef bool
++#define bool int
++#endif
++
++
++#if defined(_DEBUG) || defined(DEBUG)
++#ifndef FWSAMDEBUG
++#define FWSAMDEBUG
++#endif
++#else
++#endif
++
++
++/* Official Snort PlugIn Number has been moved into plugin_enum.h */
++
++
++/* fixed defines */
++
++#define FWSAM_DEFAULTPORT 898 /* Default port if user does not specify one in snort.conf */
++ /* (Was unused last time I checked...) */
++#define FWSAM_PACKETVERSION 14 /* version of the packet. Will increase with enhancements. */
++
++#define FWSAM_STATUS_CHECKIN 1 /* snort to fw */
++#define FWSAM_STATUS_CHECKOUT 2
++#define FWSAM_STATUS_BLOCK 3
++#define FWSAM_STATUS_UNBLOCK 9
++
++#define FWSAM_STATUS_OK 4 /* fw to snort */
++#define FWSAM_STATUS_ERROR 5
++#define FWSAM_STATUS_NEWKEY 6
++#define FWSAM_STATUS_RESYNC 7
++#define FWSAM_STATUS_HOLD 8
++
++#define FWSAM_LOG_NONE 0
++#define FWSAM_LOG_SHORTLOG 1
++#define FWSAM_LOG_SHORTALERT 2
++#define FWSAM_LOG_LONGLOG 3
++#define FWSAM_LOG_LONGALERT 4
++#define FWSAM_LOG (FWSAM_LOG_SHORTLOG|FWSAM_LOG_SHORTALERT|FWSAM_LOG_LONGLOG|FWSAM_LOG_LONGALERT)
++#define FWSAM_WHO_DST 8
++#define FWSAM_WHO_SRC 16
++#define FWSAM_WHO (FWSAM_WHO_DST|FWSAM_WHO_SRC)
++#define FWSAM_HOW_IN 32
++#define FWSAM_HOW_OUT 64
++#define FWSAM_HOW_INOUT (FWSAM_HOW_IN|FWSAM_HOW_OUT)
++#define FWSAM_HOW_THIS 128
++#define FWSAM_HOW (FWSAM_HOW_IN|FWSAM_HOW_OUT|FWSAM_HOW_THIS)
++
++
++/* user adjustable defines */
++
++#define FWSAM_REPET_BLOCKS 10 /* Snort remembers this amount of last blocks and... */
++#define FWSAM_REPET_TIME 20 /* ...checks if they fall within this time. If so,... */
++ /* ...the blocking request is not send. */
++
++#define FWSAM_NETWAIT 300 /* 100th of a second. 3 sec timeout for network connections */
++#define FWSAM_NETHOLD 6000 /* 100th of a second. 60 sec timeout for holding */
++
++#define SID_MAPFILE "sid-block.map"
++#define SID_ALT_MAPFILE "sid-fwsam.map"
++
++#define FWSAM_FANCYFETCH /* This will invoke a fast sid lookup routine */
++
++
++/* vars */
++
++typedef struct _FWsamstation /* structure of a mgmt station */
++{ unsigned short myseqno;
++ unsigned short stationseqno;
++ unsigned char mykeymod[4];
++ unsigned char fwkeymod[4];
++ unsigned short stationport;
++ //struct in_addr stationip;
++ sfip_t stationip;
++ struct sockaddr_in localsocketaddr;
++ struct sockaddr_in stationsocketaddr;
++ TWOFISH *stationfish;
++ char initialkey[TwoFish_KEY_LENGTH+2];
++ char stationkey[TwoFish_KEY_LENGTH+2];
++ time_t lastcontact;
++/* time_t sleepstart; */
++} FWsamStation;
++
++typedef struct _FWsampacket /* 2 blocks (3rd block is header from TwoFish) */
++{ unsigned short endiancheck; /* 0 */
++ unsigned char srcip[4]; /* 2 */
++ unsigned char dstip[4]; /* 6 */
++ unsigned char duration[4]; /* 10 */
++ unsigned char snortseqno[2]; /* 14 */
++ unsigned char fwseqno[2]; /* 16 */
++ unsigned char srcport[2]; /* 18 */
++ unsigned char dstport[2]; /* 20 */
++ unsigned char protocol[2]; /* 22 */
++ unsigned char fwmode; /* 24 */
++ unsigned char version; /* 25 */
++ unsigned char status; /* 26 */
++ unsigned char sig_id[4]; /* 27 */
++ unsigned char fluff; /* 31 */
++} FWsamPacket; /* 32 bytes in size */
++
++typedef struct _FWsamoptions /* snort rule options */
++{ unsigned long sid;
++ unsigned long duration;
++ unsigned char who;
++ unsigned char how;
++ unsigned char loglevel;
++} FWsamOptions;
++
++typedef struct _FWsamlistpointer
++{ FWsamStation *station;
++ struct _FWsamlistpointer *next;
++} FWsamList;
++
++
++/* functions */
++void AlertFWsamSetup(void);
++void AlertFWsamInit(char *args);
++void AlertFWsamOptionInit(char *args,OptTreeNode *otn,int protocol);
++void AlertFWsamCleanExitFunc(int signal, void *arg);
++void AlertFWsamRestartFunc(int signal, void *arg);
++void AlertFWsam(Packet *p, char *msg, void *arg, Event *event);
++int FWsamCheckIn(FWsamStation *station);
++void FWsamCheckOut(FWsamStation *station);
++void FWsamNewStationKey(FWsamStation *station,FWsamPacket *packet);
++void FWsamFixPacketEndian(FWsamPacket *p);
++unsigned long FWsamParseDuration(char *p);
++void FWsamFree(FWsamList *fwsamlist);
++int FWsamStationExists(FWsamStation *who,FWsamList *list);
++int FWsamReadLine(char *,unsigned long,FILE *);
++void FWsamParseLine(FWsamOptions *,char *);
++FWsamOptions *FWsamGetOption(unsigned long);
++int FWsamParseOption(FWsamOptions *,char *);
++
++#endif /* __SPO_FWSAM_H__ */
+
+Index: snort-2.8.6.1/src/output-plugins/Makefile.am
+===================================================================
+--- snort-2.8.6.1/src/output-plugins/Makefile.am (Revision 1)
++++ snort-2.8.6.1/src/output-plugins/Makefile.am (Revision 3)
+@@ -11,6 +11,7 @@
+ spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \
+ spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \
+ spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \
++spo_alert_fwsam.c spo_alert_fwsam.h \
+ spo_alert_test.c spo_alert_test.h
+
+ INCLUDES = @INCLUDES@
+Index: snort-2.8.6.1/src/plugbase.c
+===================================================================
+--- snort-2.8.6.1/src/plugbase.c (Revision 1)
++++ snort-2.8.6.1/src/plugbase.c (Revision 3)
+@@ -125,6 +125,7 @@
+ #endif
+
+ #include "output-plugins/spo_alert_test.h"
++#include "output-plugins/spo_alert_fwsam.h"
+
+ extern ListHead *head_tmp;
+ extern PreprocConfigFuncNode *preproc_config_funcs;
+@@ -1240,6 +1241,7 @@
+ #endif
+
+ AlertTestSetup();
++ AlertFWsamSetup();
+ }
+
+ /****************************************************************************
+Index: snort-2.8.6.1/src/Makefile.am
+===================================================================
+--- snort-2.8.6.1/src/Makefile.am (Revision 1)
++++ snort-2.8.6.1/src/Makefile.am (Revision 3)
+@@ -52,7 +52,8 @@
+ detection_filter.c detection_filter.h \
+ rate_filter.c rate_filter.h \
+ obfuscation.c obfuscation.h \
+-rule_option_types.h
++rule_option_types.h \
++twofish.c twofish.h
+
+ snort_LDADD = output-plugins/libspo.a \
+ detection-plugins/libspd.a \
+Index: snort-2.8.6.1/autojunk.sh
+===================================================================
+--- snort-2.8.6.1/autojunk.sh (Revision 0)
++++ snort-2.8.6.1/autojunk.sh (Revision 3)
+@@ -0,0 +1,7 @@
++#!/bin/sh
++# the list of commands that need to run before we do a compile
++libtoolize --automake --copy
++aclocal -I m4
++autoheader
++automake --add-missing --copy
++autoconf
+
+Index: snort-2.8.6.1/etc/snort.conf
+===================================================================
+--- snort-2.8.6.1/etc/snort.conf (Revision 1)
++++ snort-2.8.6.1/etc/snort.conf (Revision 3)
+@@ -277,6 +277,32 @@
+ # prelude
+ # output alert_prelude
+
++# snortsam
++# In order to cause Snort to send a blocking request to the SnortSam agent,
++# that agent has to be listed, including the port it listens on,
++# and the encryption key it is using. The statement for that is:
++#
++# output alert_fwsam: {SnortSam Station}:{port}/{password}
++#
++# {SnortSam Station}: IP address or host name of the host where SnortSam is running.
++# {port}: The port the remote SnortSam agent listens on.
++# {password}: The password, or key, used for encryption of the
++# communication to the remote agent.
++#
++# At the very least, the IP address or host name of the host running SnortSam
++# needs to be specified. If the port is omitted, it defaults to TCP port 898.
++# If the password is omitted, it defaults to a preset password.
++# (In which case it needs to be omitted on the SnortSam agent as well)
++#
++# More than one host can be specified, but has to be done on the same line.
++# Just separate them with one or more spaces.
++#
++# Examples:
++#
++# output alert_fwsam: firewall/idspassword
++# output alert_fwsam: fw1.domain.tld:898/mykey
++# output alert_fwsam: 192.168.0.1/borderfw 192.168.1.254/wanfw
++
+ # metadata reference data. do not modify these lines
+ include classification.config
+ include reference.config
diff --git a/config/orionids-dev/patches/inlinemode_options_flags.txt b/config/orionids-dev/patches/inlinemode_options_flags.txt
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/config/orionids-dev/patches/inlinemode_options_flags.txt
diff --git a/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.am b/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.am
new file mode 100644
index 00000000..0879c6e3
--- /dev/null
+++ b/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.am
@@ -0,0 +1,17 @@
+## $Id
+AUTOMAKE_OPTIONS=foreign no-dependencies
+
+noinst_LIBRARIES = libspo.a
+
+libspo_a_SOURCES = spo_alert_fast.c spo_alert_fast.h \
+spo_alert_full.c spo_alert_full.h \
+spo_alert_syslog.c spo_alert_syslog.h spo_alert_unixsock.c \
+spo_alert_unixsock.h spo_csv.c spo_csv.h spo_database.c spo_database.h \
+spo_log_null.c spo_log_null.h spo_log_tcpdump.c \
+spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \
+spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \
+spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \
+spo_alert_test.c spo_alert_test.h \
+spo_pf.h spo_pf.c
+
+INCLUDES = @INCLUDES@
diff --git a/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.in b/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.in
new file mode 100644
index 00000000..3f06cc31
--- /dev/null
+++ b/config/orionids-dev/patches/spoink_patch/2.8.6/Makefile.in
@@ -0,0 +1,445 @@
+# Makefile.in generated by automake 1.9.6 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
+# 2003, 2004, 2005 Free Software Foundation, Inc.
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+srcdir = @srcdir@
+top_srcdir = @top_srcdir@
+VPATH = @srcdir@
+pkgdatadir = $(datadir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+top_builddir = ../..
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+INSTALL = @INSTALL@
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = src/output-plugins
+DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/libprelude.m4 \
+ $(top_srcdir)/configure.in
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+ $(ACLOCAL_M4)
+mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+LIBRARIES = $(noinst_LIBRARIES)
+ARFLAGS = cru
+libspo_a_AR = $(AR) $(ARFLAGS)
+libspo_a_LIBADD =
+am_libspo_a_OBJECTS = spo_alert_fast.$(OBJEXT) \
+ spo_alert_full.$(OBJEXT) spo_alert_syslog.$(OBJEXT) \
+ spo_alert_unixsock.$(OBJEXT) spo_csv.$(OBJEXT) \
+ spo_database.$(OBJEXT) spo_log_null.$(OBJEXT) \
+ spo_log_tcpdump.$(OBJEXT) spo_unified.$(OBJEXT) \
+ spo_unified2.$(OBJEXT) spo_log_ascii.$(OBJEXT) \
+ spo_alert_sf_socket.$(OBJEXT) spo_alert_prelude.$(OBJEXT) \
+ spo_alert_arubaaction.$(OBJEXT) spo_alert_test.$(OBJEXT) \
+ spo_pf.$(OBJEXT)
+libspo_a_OBJECTS = $(am_libspo_a_OBJECTS)
+DEFAULT_INCLUDES = -I. -I$(srcdir) -I$(top_builddir)
+depcomp =
+am__depfiles_maybe =
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) --tag=CC --mode=compile $(CC) $(DEFS) \
+ $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+ $(AM_CFLAGS) $(CFLAGS)
+CCLD = $(CC)
+LINK = $(LIBTOOL) --tag=CC --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+ $(AM_LDFLAGS) $(LDFLAGS) -o $@
+SOURCES = $(libspo_a_SOURCES)
+DIST_SOURCES = $(libspo_a_SOURCES)
+ETAGS = etags
+CTAGS = ctags
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMDEP_FALSE = @AMDEP_FALSE@
+AMDEP_TRUE = @AMDEP_TRUE@
+AMTAR = @AMTAR@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+BUILD_DYNAMIC_EXAMPLES_FALSE = @BUILD_DYNAMIC_EXAMPLES_FALSE@
+BUILD_DYNAMIC_EXAMPLES_TRUE = @BUILD_DYNAMIC_EXAMPLES_TRUE@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CXX = @CXX@
+CXXCPP = @CXXCPP@
+CXXDEPMODE = @CXXDEPMODE@
+CXXFLAGS = @CXXFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+ECHO = @ECHO@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+F77 = @F77@
+FFLAGS = @FFLAGS@
+HAVE_DYNAMIC_PLUGINS_FALSE = @HAVE_DYNAMIC_PLUGINS_FALSE@
+HAVE_DYNAMIC_PLUGINS_TRUE = @HAVE_DYNAMIC_PLUGINS_TRUE@
+HAVE_SUP_IP6_FALSE = @HAVE_SUP_IP6_FALSE@
+HAVE_SUP_IP6_TRUE = @HAVE_SUP_IP6_TRUE@
+HAVE_TARGET_BASED_FALSE = @HAVE_TARGET_BASED_FALSE@
+HAVE_TARGET_BASED_TRUE = @HAVE_TARGET_BASED_TRUE@
+HAVE_ZLIB_FALSE = @HAVE_ZLIB_FALSE@
+HAVE_ZLIB_TRUE = @HAVE_ZLIB_TRUE@
+INCLUDES = @INCLUDES@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LDFLAGS = @LDFLAGS@
+LEX = @LEX@
+LIBOBJS = @LIBOBJS@
+LIBPRELUDE_CFLAGS = @LIBPRELUDE_CFLAGS@
+LIBPRELUDE_CONFIG = @LIBPRELUDE_CONFIG@
+LIBPRELUDE_CONFIG_PREFIX = @LIBPRELUDE_CONFIG_PREFIX@
+LIBPRELUDE_LDFLAGS = @LIBPRELUDE_LDFLAGS@
+LIBPRELUDE_LIBS = @LIBPRELUDE_LIBS@
+LIBPRELUDE_PREFIX = @LIBPRELUDE_PREFIX@
+LIBPRELUDE_PTHREAD_CFLAGS = @LIBPRELUDE_PTHREAD_CFLAGS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+MAINT = @MAINT@
+MAINTAINER_MODE_FALSE = @MAINTAINER_MODE_FALSE@
+MAINTAINER_MODE_TRUE = @MAINTAINER_MODE_TRUE@
+MAKEINFO = @MAKEINFO@
+OBJEXT = @OBJEXT@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+RANLIB = @RANLIB@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+STRIP = @STRIP@
+VERSION = @VERSION@
+YACC = @YACC@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_CXX = @ac_ct_CXX@
+ac_ct_F77 = @ac_ct_F77@
+ac_ct_RANLIB = @ac_ct_RANLIB@
+ac_ct_STRIP = @ac_ct_STRIP@
+am__fastdepCC_FALSE = @am__fastdepCC_FALSE@
+am__fastdepCC_TRUE = @am__fastdepCC_TRUE@
+am__fastdepCXX_FALSE = @am__fastdepCXX_FALSE@
+am__fastdepCXX_TRUE = @am__fastdepCXX_TRUE@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+datadir = @datadir@
+exec_prefix = @exec_prefix@
+extra_incl = @extra_incl@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+AUTOMAKE_OPTIONS = foreign no-dependencies
+noinst_LIBRARIES = libspo.a
+libspo_a_SOURCES = spo_alert_fast.c spo_alert_fast.h \
+spo_alert_full.c spo_alert_full.h \
+spo_alert_syslog.c spo_alert_syslog.h spo_alert_unixsock.c \
+spo_alert_unixsock.h spo_csv.c spo_csv.h spo_database.c spo_database.h \
+spo_log_null.c spo_log_null.h spo_log_tcpdump.c \
+spo_log_tcpdump.h spo_unified.c spo_unified2.c spo_unified.h spo_unified2.h \
+spo_log_ascii.c spo_log_ascii.h spo_alert_sf_socket.h spo_alert_sf_socket.c \
+spo_alert_prelude.c spo_alert_prelude.h spo_alert_arubaaction.c spo_alert_arubaaction.h \
+spo_alert_test.c spo_alert_test.h \
+spo_pf.h spo_pf.c
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in: @MAINTAINER_MODE_TRUE@ $(srcdir)/Makefile.am $(am__configure_deps)
+ @for dep in $?; do \
+ case '$(am__configure_deps)' in \
+ *$$dep*) \
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
+ && exit 0; \
+ exit 1;; \
+ esac; \
+ done; \
+ echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/output-plugins/Makefile'; \
+ cd $(top_srcdir) && \
+ $(AUTOMAKE) --foreign src/output-plugins/Makefile
+.PRECIOUS: Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+ @case '$?' in \
+ *config.status*) \
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+ *) \
+ echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
+ cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
+ esac;
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure: @MAINTAINER_MODE_TRUE@ $(am__configure_deps)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4): @MAINTAINER_MODE_TRUE@ $(am__aclocal_m4_deps)
+ cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+clean-noinstLIBRARIES:
+ -test -z "$(noinst_LIBRARIES)" || rm -f $(noinst_LIBRARIES)
+libspo.a: $(libspo_a_OBJECTS) $(libspo_a_DEPENDENCIES)
+ -rm -f libspo.a
+ $(libspo_a_AR) libspo.a $(libspo_a_OBJECTS) $(libspo_a_LIBADD)
+ $(RANLIB) libspo.a
+
+mostlyclean-compile:
+ -rm -f *.$(OBJEXT)
+
+distclean-compile:
+ -rm -f *.tab.c
+
+.c.o:
+ $(COMPILE) -c $<
+
+.c.obj:
+ $(COMPILE) -c `$(CYGPATH_W) '$<'`
+
+.c.lo:
+ $(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+ -rm -f *.lo
+
+clean-libtool:
+ -rm -rf .libs _libs
+
+distclean-libtool:
+ -rm -f libtool
+uninstall-info-am:
+
+ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) ' { files[$$0] = 1; } \
+ END { for (i in files) print i; }'`; \
+ mkid -fID $$unique
+tags: TAGS
+
+TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
+ $(TAGS_FILES) $(LISP)
+ tags=; \
+ here=`pwd`; \
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) ' { files[$$0] = 1; } \
+ END { for (i in files) print i; }'`; \
+ if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+ test -n "$$unique" || unique=$$empty_fix; \
+ $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+ $$tags $$unique; \
+ fi
+ctags: CTAGS
+CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
+ $(TAGS_FILES) $(LISP)
+ tags=; \
+ here=`pwd`; \
+ list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
+ unique=`for i in $$list; do \
+ if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+ done | \
+ $(AWK) ' { files[$$0] = 1; } \
+ END { for (i in files) print i; }'`; \
+ test -z "$(CTAGS_ARGS)$$tags$$unique" \
+ || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+ $$tags $$unique
+
+GTAGS:
+ here=`$(am__cd) $(top_builddir) && pwd` \
+ && cd $(top_srcdir) \
+ && gtags -i $(GTAGS_ARGS) $$here
+
+distclean-tags:
+ -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(DISTFILES)
+ @srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; \
+ topsrcdirstrip=`echo "$(top_srcdir)" | sed 's|.|.|g'`; \
+ list='$(DISTFILES)'; for file in $$list; do \
+ case $$file in \
+ $(srcdir)/*) file=`echo "$$file" | sed "s|^$$srcdirstrip/||"`;; \
+ $(top_srcdir)/*) file=`echo "$$file" | sed "s|^$$topsrcdirstrip/|$(top_builddir)/|"`;; \
+ esac; \
+ if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+ dir=`echo "$$file" | sed -e 's,/[^/]*$$,,'`; \
+ if test "$$dir" != "$$file" && test "$$dir" != "."; then \
+ dir="/$$dir"; \
+ $(mkdir_p) "$(distdir)$$dir"; \
+ else \
+ dir=''; \
+ fi; \
+ if test -d $$d/$$file; then \
+ if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+ cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+ fi; \
+ cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+ else \
+ test -f $(distdir)/$$file \
+ || cp -p $$d/$$file $(distdir)/$$file \
+ || exit 1; \
+ fi; \
+ done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LIBRARIES)
+installdirs:
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+ @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+ $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+ install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+ `test -z '$(STRIP)' || \
+ echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+ -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+
+maintainer-clean-generic:
+ @echo "This command is intended for maintainers to use"
+ @echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libtool clean-noinstLIBRARIES \
+ mostlyclean-am
+
+distclean: distclean-am
+ -rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+ distclean-libtool distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+info: info-am
+
+info-am:
+
+install-data-am:
+
+install-exec-am:
+
+install-info: install-info-am
+
+install-man:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+ -rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+ mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-info-am
+
+.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
+ clean-libtool clean-noinstLIBRARIES ctags distclean \
+ distclean-compile distclean-generic distclean-libtool \
+ distclean-tags distdir dvi dvi-am html html-am info info-am \
+ install install-am install-data install-data-am install-exec \
+ install-exec-am install-info install-info-am install-man \
+ install-strip installcheck installcheck-am installdirs \
+ maintainer-clean maintainer-clean-generic mostlyclean \
+ mostlyclean-compile mostlyclean-generic mostlyclean-libtool \
+ pdf pdf-am ps ps-am tags uninstall uninstall-am \
+ uninstall-info-am
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:
diff --git a/config/orionids-dev/patches/spoink_patch/2.8.6/plugbase.c b/config/orionids-dev/patches/spoink_patch/2.8.6/plugbase.c
new file mode 100644
index 00000000..31f381a8
--- /dev/null
+++ b/config/orionids-dev/patches/spoink_patch/2.8.6/plugbase.c
@@ -0,0 +1,1544 @@
+/* $Id$ */
+/*
+** Copyright (C) 2002-2010 Sourcefire, Inc.
+** Copyright (C) 1998-2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+*/
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <assert.h>
+
+#ifdef HAVE_STRINGS_H
+#include <strings.h>
+#endif
+
+#ifndef WIN32
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#endif /* !WIN32 */
+#include <time.h>
+#include <errno.h>
+
+#include "sf_types.h"
+#include "plugbase.h"
+#include "spo_plugbase.h"
+#include "snort.h"
+#include "debug.h"
+#include "util.h"
+#include "log.h"
+#include "detect.h"
+
+/* built-in preprocessors */
+#include "preprocessors/spp_rpc_decode.h"
+#include "preprocessors/spp_bo.h"
+#include "preprocessors/spp_stream5.h"
+#include "preprocessors/spp_arpspoof.h"
+#include "preprocessors/spp_perfmonitor.h"
+#include "preprocessors/spp_httpinspect.h"
+#include "preprocessors/spp_sfportscan.h"
+#include "preprocessors/spp_frag3.h"
+
+/* built-in detection plugins */
+#include "detection-plugins/sp_pattern_match.h"
+#include "detection-plugins/sp_tcp_flag_check.h"
+#include "detection-plugins/sp_icmp_type_check.h"
+#include "detection-plugins/sp_icmp_code_check.h"
+#include "detection-plugins/sp_ttl_check.h"
+#include "detection-plugins/sp_ip_id_check.h"
+#include "detection-plugins/sp_tcp_ack_check.h"
+#include "detection-plugins/sp_tcp_seq_check.h"
+#include "detection-plugins/sp_dsize_check.h"
+#include "detection-plugins/sp_ipoption_check.h"
+#include "detection-plugins/sp_rpc_check.h"
+#include "detection-plugins/sp_icmp_id_check.h"
+#include "detection-plugins/sp_icmp_seq_check.h"
+#include "detection-plugins/sp_session.h"
+#include "detection-plugins/sp_ip_tos_check.h"
+#include "detection-plugins/sp_ip_fragbits.h"
+#include "detection-plugins/sp_tcp_win_check.h"
+#include "detection-plugins/sp_ip_same_check.h"
+#include "detection-plugins/sp_ip_proto.h"
+#include "detection-plugins/sp_ip_same_check.h"
+#include "detection-plugins/sp_clientserver.h"
+#include "detection-plugins/sp_byte_check.h"
+#include "detection-plugins/sp_byte_jump.h"
+#include "detection-plugins/sp_isdataat.h"
+#include "detection-plugins/sp_pcre.h"
+#include "detection-plugins/sp_flowbits.h"
+#include "detection-plugins/sp_file_data.h"
+#include "detection-plugins/sp_asn1.h"
+#ifdef ENABLE_REACT
+#include "detection-plugins/sp_react.h"
+#endif
+#ifdef ENABLE_RESPOND
+#include "detection-plugins/sp_respond.h"
+#endif
+#include "detection-plugins/sp_ftpbounce.h"
+#include "detection-plugins/sp_urilen_check.h"
+#include "detection-plugins/sp_cvs.h"
+
+/* built-in output plugins */
+#include "output-plugins/spo_alert_syslog.h"
+#include "output-plugins/spo_log_tcpdump.h"
+#include "output-plugins/spo_database.h"
+#include "output-plugins/spo_alert_fast.h"
+#include "output-plugins/spo_alert_full.h"
+#include "output-plugins/spo_alert_unixsock.h"
+#include "output-plugins/spo_csv.h"
+#include "output-plugins/spo_unified.h"
+#include "output-plugins/spo_log_null.h"
+#include "output-plugins/spo_log_ascii.h"
+#include "output-plugins/spo_unified2.h"
+#include "output-plugins/spo_pf.h"
+
+#ifdef ARUBA
+#include "output-plugins/spo_alert_arubaaction.h"
+#endif
+
+#ifdef HAVE_LIBPRELUDE
+#include "output-plugins/spo_alert_prelude.h"
+#endif
+
+#ifdef LINUX
+#include "output-plugins/spo_alert_sf_socket.h"
+#endif
+
+#include "output-plugins/spo_alert_test.h"
+
+extern ListHead *head_tmp;
+extern PreprocConfigFuncNode *preproc_config_funcs;
+extern OutputConfigFuncNode *output_config_funcs;
+extern RuleOptConfigFuncNode *rule_opt_config_funcs;
+extern RuleOptOverrideInitFuncNode *rule_opt_override_init_funcs;
+extern RuleOptParseCleanupNode *rule_opt_parse_cleanup_list;
+extern PreprocSignalFuncNode *preproc_restart_funcs;
+extern PreprocSignalFuncNode *preproc_clean_exit_funcs;
+extern PreprocSignalFuncNode *preproc_shutdown_funcs;
+extern PreprocSignalFuncNode *preproc_reset_funcs;
+extern PreprocSignalFuncNode *preproc_reset_stats_funcs;
+extern PreprocStatsFuncNode *preproc_stats_funcs;
+extern PluginSignalFuncNode *plugin_shutdown_funcs;
+extern PluginSignalFuncNode *plugin_clean_exit_funcs;
+extern PluginSignalFuncNode *plugin_restart_funcs;
+extern OutputFuncNode *AlertList;
+extern OutputFuncNode *LogList;
+
+
+/**************************** Detection Plugin API ****************************/
+/* For translation from enum to char* */
+#ifdef DEBUG
+static const char *optTypeMap[OPT_TYPE_MAX] =
+{
+ "action",
+ "logging",
+ "detection"
+};
+
+#define ENUM2STR(num, map) \
+ ((num < sizeof(map)/sizeof(map[0])) ? map[num] : "undefined")
+#endif
+
+
+void RegisterRuleOptions(void)
+{
+ LogMessage("Initializing Plug-ins!\n");
+
+ SetupPatternMatch();
+ SetupTCPFlagCheck();
+ SetupIcmpTypeCheck();
+ SetupIcmpCodeCheck();
+ SetupTtlCheck();
+ SetupIpIdCheck();
+ SetupTcpAckCheck();
+ SetupTcpSeqCheck();
+ SetupDsizeCheck();
+ SetupIpOptionCheck();
+ SetupRpcCheck();
+ SetupIcmpIdCheck();
+ SetupIcmpSeqCheck();
+ SetupSession();
+ SetupIpTosCheck();
+ SetupFragBits();
+ SetupFragOffset();
+ SetupTcpWinCheck();
+ SetupIpProto();
+ SetupIpSameCheck();
+ SetupClientServer();
+ SetupByteTest();
+ SetupByteJump();
+ SetupIsDataAt();
+ SetupFileData();
+ SetupPcre();
+ SetupFlowBits();
+ SetupAsn1();
+#ifdef ENABLE_REACT
+ SetupReact();
+#endif
+#ifdef ENABLE_RESPOND
+ SetupRespond();
+#endif
+ SetupFTPBounce();
+ SetupUriLenCheck();
+ SetupCvs();
+}
+
+/****************************************************************************
+ *
+ * Function: RegisterRuleOption(char *, void (*func)(), enum OptionType)
+ *
+ * Purpose: Associates a rule option keyword with an option setup/linking
+ * function.
+ *
+ * Arguments: keyword => The option keyword to associate with the option
+ * handler
+ * *func => function pointer to the handler
+ * type => used to determine where keyword is allowed
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+void RegisterRuleOption(char *opt_name, RuleOptConfigFunc config_func,
+ RuleOptOverrideInitFunc override_init_func,
+ RuleOptType opt_type,
+ RuleOptOtnHandler otn_handler)
+{
+ RuleOptConfigFuncNode *node;
+
+ DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN, "Registering keyword:func => %s/%s:%p\n",
+ ENUM2STR(opt_type, optTypeMap), opt_name, config_func););
+
+ node = (RuleOptConfigFuncNode *)SnortAlloc(sizeof(RuleOptConfigFuncNode));
+
+ if (rule_opt_config_funcs == NULL)
+ {
+ rule_opt_config_funcs = node;
+ }
+ else
+ {
+ RuleOptConfigFuncNode *tmp = rule_opt_config_funcs;
+ RuleOptConfigFuncNode *last;
+
+ do
+ {
+ if (strcasecmp(tmp->keyword, opt_name) == 0)
+ {
+ free(node);
+ FatalError("Duplicate detection plugin keyword: %s.\n",
+ file_line, opt_name);
+ }
+
+ last = tmp;
+ tmp = tmp->next;
+
+ } while (tmp != NULL);
+
+ last->next = node;
+ }
+
+ node->keyword = SnortStrdup(opt_name);
+ node->type = opt_type;
+ node->func = config_func;
+ node->otn_handler = otn_handler;
+
+ if (override_init_func != NULL)
+ {
+ RuleOptOverrideInitFuncNode *node_override =
+ (RuleOptOverrideInitFuncNode *)SnortAlloc(sizeof(RuleOptOverrideInitFuncNode));
+
+ if (rule_opt_override_init_funcs == NULL)
+ {
+ rule_opt_override_init_funcs = node_override;
+ }
+ else
+ {
+ RuleOptOverrideInitFuncNode *tmp = rule_opt_override_init_funcs;
+ RuleOptOverrideInitFuncNode *last;
+
+ do
+ {
+ if (strcasecmp(tmp->keyword, opt_name) == 0)
+ {
+ free(node_override);
+ FatalError("RegisterRuleOption: Duplicate detection plugin keyword:"
+ " (%s) (%s)!\n", tmp->keyword, opt_name);
+ }
+
+ last = tmp;
+ tmp = tmp->next;
+
+ } while (tmp != NULL);
+
+ last->next = node_override;
+ }
+
+ node_override->keyword = SnortStrdup(opt_name);
+ node_override->type = opt_type;
+ node_override->func = override_init_func;
+ node_override->otn_handler = otn_handler;
+ }
+}
+
+void RegisterOverrideKeyword(char *keyword, char *option, RuleOptOverrideFunc func)
+{
+ RuleOptOverrideInitFuncNode *node = rule_opt_override_init_funcs;
+
+ while (node != NULL)
+ {
+ if (strcasecmp(node->keyword, keyword) == 0)
+ {
+ node->func(keyword, option, func);
+ break;
+ }
+
+ node = node->next;
+ }
+}
+
+/****************************************************************************
+ *
+ * Function: DumpPlugIns()
+ *
+ * Purpose: Prints the keyword->function list
+ *
+ * Arguments: None.
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+void DumpRuleOptions(void)
+{
+ RuleOptConfigFuncNode *node;
+
+ node = rule_opt_config_funcs;
+
+ LogMessage("-------------------------------------------------\n");
+ LogMessage(" Keyword | Plugin Registered @\n");
+ LogMessage("-------------------------------------------------\n");
+
+ while (node != NULL)
+ {
+ LogMessage("%-13s: %p\n", node->keyword, node->func);
+ node = node->next;
+ }
+
+ LogMessage("-------------------------------------------------\n");
+ LogMessage("\n");
+}
+
+
+/****************************************************************************
+ *
+ * Function: AddOptFuncToList(int (*func)(), OptTreeNode *)
+ *
+ * Purpose: Links the option detection module to the OTN
+ *
+ * Arguments: (*func)() => function pointer to the detection module
+ * otn => pointer to the current OptTreeNode
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+OptFpList * AddOptFuncToList(RuleOptEvalFunc func, OptTreeNode *otn)
+{
+ OptFpList *ofp = (OptFpList *)SnortAlloc(sizeof(OptFpList));
+
+ DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding new rule to list\n"););
+
+ /* if there are no nodes on the function list... */
+ if (otn->opt_func == NULL)
+ {
+ otn->opt_func = ofp;
+ }
+ else
+ {
+ OptFpList *tmp = otn->opt_func;
+
+ /* walk to the end of the list */
+ while (tmp->next != NULL)
+ tmp = tmp->next;
+
+ tmp->next = ofp;
+ }
+
+ DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Set OptTestFunc to %p\n", func););
+
+ ofp->OptTestFunc = func;
+
+ return ofp;
+}
+
+/****************************************************************************
+ *
+ * Function: AddRspFuncToList(int (*func)(), OptTreeNode *)
+ *
+ * Purpose: Adds Response function to OTN
+ *
+ * Arguments: (*func)() => function pointer to the response module
+ * otn => pointer to the current OptTreeNode
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+void AddRspFuncToList(ResponseFunc func, OptTreeNode *otn, void *params)
+{
+ RspFpList *rsp = (RspFpList *)SnortAlloc(sizeof(RspFpList));
+
+ DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Adding response to list\n"););
+
+ /* if there are no nodes on the function list... */
+ if (otn->rsp_func == NULL)
+ {
+ otn->rsp_func = rsp;
+ }
+ else
+ {
+ RspFpList *tmp = otn->rsp_func;
+
+ /* walk to the end of the list */
+ while (tmp->next != NULL)
+ tmp = tmp->next;
+
+ tmp->next = rsp;
+ }
+
+ DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,"Set ResponseFunc to %p\n", func););
+
+ rsp->func = func;
+ rsp->params = params;
+}
+
+void PostConfigInitPlugins(PluginSignalFuncNode *post_config_funcs)
+{
+ while (post_config_funcs != NULL)
+ {
+ post_config_funcs->func(0, post_config_funcs->arg);
+ post_config_funcs = post_config_funcs->next;
+ }
+}
+
+void FreeRuleOptConfigFuncs(RuleOptConfigFuncNode *head)
+{
+
+ while (head != NULL)
+ {
+ RuleOptConfigFuncNode *tmp = head;
+
+ head = head->next;
+
+ if (tmp->keyword != NULL)
+ free(tmp->keyword);
+
+ free(tmp);
+ }
+}
+
+void FreeRuleOptOverrideInitFuncs(RuleOptOverrideInitFuncNode *head)
+{
+
+ while (head != NULL)
+ {
+ RuleOptOverrideInitFuncNode *tmp = head;
+
+ head = head->next;
+
+ if (tmp->keyword != NULL)
+ free(tmp->keyword);
+
+ free(tmp);
+ }
+}
+
+void FreePluginSigFuncs(PluginSignalFuncNode *head)
+{
+ while (head != NULL)
+ {
+ PluginSignalFuncNode *tmp = head;
+
+ head = head->next;
+
+ /* don't free sig->arg, that's free'd by the CleanExit/Restart func */
+ free(tmp);
+ }
+}
+
+
+/************************** Preprocessor Plugin API ***************************/
+static void AddFuncToPreprocSignalList(PreprocSignalFunc, void *,
+ PreprocSignalFuncNode **, uint16_t, uint32_t);
+
+
+void RegisterPreprocessors(void)
+{
+ LogMessage("Initializing Preprocessors!\n");
+
+ SetupARPspoof();
+ SetupFrag3();
+ SetupStream5();
+ SetupRpcDecode();
+ SetupBo();
+ SetupHttpInspect();
+ SetupPerfMonitor();
+ SetupSfPortscan();
+}
+
+/****************************************************************************
+ *
+ * Function: RegisterPreprocessor(char *, void (*)(char *))
+ *
+ * Purpose: Associates a preprocessor statement with its function.
+ *
+ * Arguments: keyword => The option keyword to associate with the
+ * preprocessor
+ * *func => function pointer to the handler
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+#ifndef SNORT_RELOAD
+void RegisterPreprocessor(char *keyword, PreprocConfigFunc func)
+#else
+void RegisterPreprocessor(char *keyword, PreprocConfigFunc func,
+ PreprocReloadFunc rfunc, PreprocReloadSwapFunc sfunc,
+ PreprocReloadSwapFreeFunc ffunc)
+#endif
+{
+ PreprocConfigFuncNode *node =
+ (PreprocConfigFuncNode *)SnortAlloc(sizeof(PreprocConfigFuncNode));
+
+ DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering keyword:preproc => %s:%p\n", keyword, func););
+
+ if (preproc_config_funcs == NULL)
+ {
+ preproc_config_funcs = node;
+ }
+ else
+ {
+ PreprocConfigFuncNode *tmp = preproc_config_funcs;
+ PreprocConfigFuncNode *last;
+
+ do
+ {
+ if (strcasecmp(tmp->keyword, keyword) == 0)
+ {
+ free(node);
+ FatalError("Duplicate preprocessor keyword: %s.\n", keyword);
+ }
+
+ last = tmp;
+ tmp = tmp->next;
+
+ } while (tmp != NULL);
+
+ last->next = node;
+ }
+
+ node->keyword = SnortStrdup(keyword);
+ node->config_func = func;
+
+#ifdef SNORT_RELOAD
+ node->reload_func = rfunc;
+ node->reload_swap_func = sfunc;
+ node->reload_swap_free_func = ffunc;
+#endif
+}
+
+PreprocConfigFuncNode * GetPreprocConfig(char *keyword)
+{
+ PreprocConfigFuncNode *head = preproc_config_funcs;
+
+ if (keyword == NULL)
+ return NULL;
+
+ while (head != NULL)
+ {
+ if (strcasecmp(head->keyword, keyword) == 0)
+ return head;
+
+ head = head->next;
+ }
+
+ return NULL;
+}
+
+PreprocConfigFunc GetPreprocConfigFunc(char *keyword)
+{
+ PreprocConfigFuncNode *head = preproc_config_funcs;
+
+ if (keyword == NULL)
+ return NULL;
+
+ while (head != NULL)
+ {
+ if (strcasecmp(head->keyword, keyword) == 0)
+ return head->config_func;
+
+ head = head->next;
+ }
+
+ return NULL;
+}
+
+/****************************************************************************
+ *
+ * Function: RegisterPreprocStats(char *keyword, void (*func)(int))
+ *
+ * Purpose: Registers a function for printing preprocessor final stats
+ * (or other if it has a use for printing final stats)
+ *
+ * Arguments: keyword => keyword (preprocessor) whose stats will print
+ * func => function pointer to the handler
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+void RegisterPreprocStats(char *keyword, PreprocStatsFunc func)
+{
+ PreprocStatsFuncNode *node;
+
+ DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering final stats function: "
+ "preproc => %s:%p\n", keyword, func););
+
+ node = (PreprocStatsFuncNode *)SnortAlloc(sizeof(PreprocStatsFuncNode));
+
+ if (preproc_stats_funcs == NULL)
+ {
+ preproc_stats_funcs = node;
+ }
+ else
+ {
+ PreprocStatsFuncNode *tmp = preproc_stats_funcs;
+ PreprocStatsFuncNode *last;
+
+ do
+ {
+ if (strcasecmp(tmp->keyword, keyword) == 0)
+ {
+ free(node);
+ FatalError("Duplicate preprocessor keyword: %s.\n", keyword);
+ }
+
+ last = tmp;
+ tmp = tmp->next;
+
+ } while (tmp != NULL);
+
+ last->next = node;
+ }
+
+ node->keyword = SnortStrdup(keyword);
+ node->func = func;
+}
+
+/****************************************************************************
+ *
+ * Function: DumpPreprocessors()
+ *
+ * Purpose: Prints the keyword->preprocess list
+ *
+ * Arguments: None.
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+void DumpPreprocessors(void)
+{
+ PreprocConfigFuncNode *node = preproc_config_funcs;
+
+ LogMessage("-------------------------------------------------\n");
+ LogMessage(" Keyword | Preprocessor @ \n");
+ LogMessage("-------------------------------------------------\n");
+
+ while (node != NULL)
+ {
+ LogMessage("%-13s: %p\n", node->keyword, node->config_func);
+ node = node->next;
+ }
+
+ LogMessage("-------------------------------------------------\n\n");
+}
+
+int IsPreprocEnabled(uint32_t preproc_id)
+{
+ PreprocEvalFuncNode *node;
+ SnortConfig *sc = snort_conf_for_parsing;
+ tSfPolicyId policy_id = getParserPolicy();
+ SnortPolicy *p;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config for parsing is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ p = sc->targeted_policies[policy_id];
+ if (p == NULL)
+ return 0;
+
+ for (node = p->preproc_eval_funcs; node != NULL; node = node->next)
+ {
+ if (node->preproc_id == preproc_id)
+ return 1;
+ }
+
+ return 0;
+}
+
+PreprocEvalFuncNode * AddFuncToPreprocList(PreprocEvalFunc func, uint16_t priority,
+ uint32_t preproc_id, uint32_t proto_mask)
+{
+ PreprocEvalFuncNode *node;
+ SnortConfig *sc = snort_conf_for_parsing;
+ tSfPolicyId policy_id = getParserPolicy();
+ SnortPolicy *p;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config for parsing is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ p = sc->targeted_policies[policy_id];
+ if (p == NULL)
+ return NULL;
+
+ DEBUG_WRAP(DebugMessage(DEBUG_CONFIGRULES,
+ "Adding preprocessor function ID %d/bit %d/pri %d to list\n",
+ preproc_id, p->num_preprocs, priority););
+
+ node = (PreprocEvalFuncNode *)SnortAlloc(sizeof(PreprocEvalFuncNode));
+
+ if (p->preproc_eval_funcs == NULL)
+ {
+ p->preproc_eval_funcs = node;
+ }
+ else
+ {
+ PreprocEvalFuncNode *tmp = p->preproc_eval_funcs;
+ PreprocEvalFuncNode *last = NULL;
+
+ do
+ {
+ if (tmp->preproc_id == preproc_id)
+ {
+ free(node);
+ FatalError("Preprocessor already registered with ID %d\n",
+ preproc_id);
+ }
+
+ /* Insert higher priority preprocessors first. Lower priority
+ * number means higher priority */
+ if (priority < tmp->priority)
+ break;
+
+ last = tmp;
+ tmp = tmp->next;
+
+ } while (tmp != NULL);
+
+ /* Priority higher than first item in list */
+ if (last == NULL)
+ {
+ node->next = tmp;
+ p->preproc_eval_funcs = node;
+ }
+ else
+ {
+ node->next = tmp;
+ last->next = node;
+ }
+ }
+
+ node->func = func;
+ node->priority = priority;
+ node->preproc_id = preproc_id;
+ node->preproc_bit = (1 << preproc_id);
+ node->proto_mask = proto_mask;
+
+ p->num_preprocs++;
+ p->preproc_proto_mask |= proto_mask;
+ p->preproc_bit_mask |= node->preproc_bit;
+
+ return node;
+}
+
+void AddFuncToPreprocPostConfigList(PreprocPostConfigFunc func, void *data)
+{
+ PreprocPostConfigFuncNode *node;
+ SnortConfig *sc = snort_conf_for_parsing;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config for parsing is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ node = (PreprocPostConfigFuncNode *)SnortAlloc(sizeof(PreprocPostConfigFuncNode));
+
+ if (sc->preproc_post_config_funcs == NULL)
+ {
+ sc->preproc_post_config_funcs = node;
+ }
+ else
+ {
+ PreprocPostConfigFuncNode *tmp = sc->preproc_post_config_funcs;
+
+ while (tmp->next != NULL)
+ tmp = tmp->next;
+
+ tmp->next = node;
+ }
+
+ node->data = data;
+ node->func = func;
+}
+
+void PostConfigPreprocessors(SnortConfig *sc)
+{
+ PreprocPostConfigFuncNode *list;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ snort_conf_for_parsing = sc;
+
+ list = sc->preproc_post_config_funcs;
+
+ for (; list != NULL; list = list->next)
+ {
+ if (list->func != NULL)
+ list->func(list->data);
+ }
+
+ snort_conf_for_parsing = NULL;
+}
+
+#ifdef SNORT_RELOAD
+void SwapPreprocConfigurations(void)
+{
+ PreprocConfigFuncNode *node = preproc_config_funcs;
+
+ for (; node != NULL; node = node->next)
+ {
+ if (node->reload_swap_func != NULL)
+ node->swap_free_data = node->reload_swap_func();
+ }
+}
+
+void FreeSwappedPreprocConfigurations(void)
+{
+ PreprocConfigFuncNode *node = preproc_config_funcs;
+
+ for (; node != NULL; node = node->next)
+ {
+ if ((node->reload_swap_free_func != NULL) &&
+ (node->swap_free_data != NULL))
+ {
+ node->reload_swap_free_func(node->swap_free_data);
+ node->swap_free_data = NULL;
+ }
+ }
+}
+
+void AddFuncToPreprocReloadVerifyList(PreprocReloadVerifyFunc func)
+{
+ PreprocReloadVerifyFuncNode *node;
+ SnortConfig *sc = snort_conf_for_parsing;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config for parsing is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ node = (PreprocReloadVerifyFuncNode *)SnortAlloc(sizeof(PreprocReloadVerifyFuncNode));
+
+ if (sc->preproc_reload_verify_funcs == NULL)
+ {
+ sc->preproc_reload_verify_funcs = node;
+ }
+ else
+ {
+ PreprocReloadVerifyFuncNode *tmp = sc->preproc_reload_verify_funcs;
+
+ while (tmp->next != NULL)
+ tmp = tmp->next;
+
+ tmp->next = node;
+ }
+
+ node->func = func;
+}
+
+void FreePreprocReloadVerifyFuncList(PreprocReloadVerifyFuncNode *head)
+{
+ while (head != NULL)
+ {
+ PreprocReloadVerifyFuncNode *tmp = head;
+
+ head = head->next;
+ free(tmp);
+ }
+}
+#endif
+
+void AddFuncToConfigCheckList(PreprocCheckConfigFunc func)
+{
+ PreprocCheckConfigFuncNode *node;
+ SnortConfig *sc = snort_conf_for_parsing;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config for parsing is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ node = (PreprocCheckConfigFuncNode *)SnortAlloc(sizeof(PreprocCheckConfigFuncNode));
+
+ if (sc->preproc_config_check_funcs == NULL)
+ {
+ sc->preproc_config_check_funcs = node;
+ }
+ else
+ {
+ PreprocCheckConfigFuncNode *tmp = sc->preproc_config_check_funcs;
+
+ while (tmp->next != NULL)
+ tmp = tmp->next;
+
+ tmp->next = node;
+ }
+
+ node->func = func;
+}
+
+/* functions to aid in cleaning up after plugins */
+void AddFuncToPreprocRestartList(PreprocSignalFunc func, void *arg,
+ uint16_t priority, uint32_t preproc_id)
+{
+ AddFuncToPreprocSignalList(func, arg, &preproc_restart_funcs, priority, preproc_id);
+}
+
+void AddFuncToPreprocCleanExitList(PreprocSignalFunc func, void *arg,
+ uint16_t priority, uint32_t preproc_id)
+{
+ AddFuncToPreprocSignalList(func, arg, &preproc_clean_exit_funcs, priority, preproc_id);
+}
+
+void AddFuncToPreprocShutdownList(PreprocSignalFunc func, void *arg,
+ uint16_t priority, uint32_t preproc_id)
+{
+ AddFuncToPreprocSignalList(func, arg, &preproc_shutdown_funcs, priority, preproc_id);
+}
+
+void AddFuncToPreprocResetList(PreprocSignalFunc func, void *arg,
+ uint16_t priority, uint32_t preproc_id)
+{
+ AddFuncToPreprocSignalList(func, arg, &preproc_reset_funcs, priority, preproc_id);
+}
+
+void AddFuncToPreprocResetStatsList(PreprocSignalFunc func, void *arg,
+ uint16_t priority, uint32_t preproc_id)
+{
+ AddFuncToPreprocSignalList(func, arg, &preproc_reset_stats_funcs, priority, preproc_id);
+}
+
+static void AddFuncToPreprocSignalList(PreprocSignalFunc func, void *arg,
+ PreprocSignalFuncNode **list,
+ uint16_t priority, uint32_t preproc_id)
+{
+ PreprocSignalFuncNode *node;
+
+ if (list == NULL)
+ return;
+
+ node = (PreprocSignalFuncNode *)SnortAlloc(sizeof(PreprocSignalFuncNode));
+
+ if (*list == NULL)
+ {
+ *list = node;
+ }
+ else
+ {
+ PreprocSignalFuncNode *tmp = *list;
+ PreprocSignalFuncNode *last = NULL;
+
+ do
+ {
+ /* Insert higher priority stuff first. Lower priority
+ * number means higher priority */
+ if (priority < tmp->priority)
+ break;
+
+ last = tmp;
+ tmp = tmp->next;
+
+ } while (tmp != NULL);
+
+ /* Priority higher than first item in list */
+ if (last == NULL)
+ {
+ node->next = tmp;
+ *list = node;
+ }
+ else
+ {
+ node->next = tmp;
+ last->next = node;
+ }
+ }
+
+ node->func = func;
+ node->arg = arg;
+ node->preproc_id = preproc_id;
+ node->priority = priority;
+}
+
+void AddFuncToPreprocReassemblyPktList(PreprocReassemblyPktFunc func, uint32_t preproc_id)
+{
+ PreprocReassemblyPktFuncNode *node;
+ SnortConfig *sc = snort_conf_for_parsing;
+ tSfPolicyId policy_id = getParserPolicy();
+ SnortPolicy *p;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config for parsing is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ p = sc->targeted_policies[policy_id];
+ if (p == NULL)
+ return;
+
+ node = (PreprocReassemblyPktFuncNode *)SnortAlloc(sizeof(PreprocReassemblyPktFuncNode));
+
+ if (p->preproc_reassembly_pkt_funcs == NULL)
+ {
+ p->preproc_reassembly_pkt_funcs = node;
+ }
+ else
+ {
+ PreprocReassemblyPktFuncNode *tmp = p->preproc_reassembly_pkt_funcs;
+
+ /* just insert at front of list */
+ p->preproc_reassembly_pkt_funcs = node;
+ node->next = tmp;
+ }
+
+ node->func = func;
+ node->preproc_id = preproc_id;
+}
+
+void FreePreprocConfigFuncs(void)
+{
+ PreprocConfigFuncNode *head = preproc_config_funcs;
+ PreprocConfigFuncNode *tmp;
+
+ while (head != NULL)
+ {
+ tmp = head->next;
+ if (head->keyword != NULL)
+ free(head->keyword);
+ free(head);
+ head = tmp;
+ }
+}
+
+void FreePreprocCheckConfigFuncs(PreprocCheckConfigFuncNode *head)
+{
+ PreprocCheckConfigFuncNode *tmp;
+
+ while (head != NULL)
+ {
+ tmp = head->next;
+ free(head);
+ head = tmp;
+ }
+}
+
+void FreePreprocPostConfigFuncs(PreprocPostConfigFuncNode *head)
+{
+ PreprocPostConfigFuncNode *tmp;
+
+ while (head != NULL)
+ {
+ tmp = head->next;
+ free(head);
+ head = tmp;
+ }
+}
+
+void FreePreprocStatsFuncs(PreprocStatsFuncNode *head)
+{
+ PreprocStatsFuncNode *tmp;
+
+ while (head != NULL)
+ {
+ tmp = head->next;
+ if (head->keyword != NULL)
+ free(head->keyword);
+ free(head);
+ head = tmp;
+ }
+}
+
+void FreePreprocEvalFuncs(PreprocEvalFuncNode *head)
+{
+ PreprocEvalFuncNode *tmp;
+
+ while (head != NULL)
+ {
+ tmp = head->next;
+ //if (head->context)
+ // free(head->context);
+ free(head);
+ head = tmp;
+ }
+}
+
+void FreePreprocReassemblyPktFuncs(PreprocReassemblyPktFuncNode *head)
+{
+ PreprocReassemblyPktFuncNode *tmp;
+
+ while (head != NULL)
+ {
+ tmp = head->next;
+ free(head);
+ head = tmp;
+ }
+}
+
+void FreePreprocSigFuncs(PreprocSignalFuncNode *head)
+{
+ PreprocSignalFuncNode *tmp;
+
+ while (head != NULL)
+ {
+ tmp = head->next;
+ /* don't free sig->arg, that's free'd by the CleanExit/Restart func */
+ free(head);
+ head = tmp;
+ }
+}
+
+void CheckPreprocessorsConfig(SnortConfig *sc)
+{
+ PreprocCheckConfigFuncNode *idx;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ snort_conf_for_parsing = sc;
+
+ idx = sc->preproc_config_check_funcs;
+
+ LogMessage("Verifying Preprocessor Configurations!\n");
+
+ while(idx != NULL)
+ {
+ idx->func();
+ idx = idx->next;
+ }
+
+ snort_conf_for_parsing = NULL;
+}
+
+#ifdef SNORT_RELOAD
+int VerifyReloadedPreprocessors(SnortConfig *sc)
+{
+ PreprocReloadVerifyFuncNode *node;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ snort_conf_for_parsing = sc;
+
+ node = sc->preproc_reload_verify_funcs;
+ while (node != NULL)
+ {
+ if (node->func != NULL)
+ {
+ if (node->func() == -1)
+ return -1;
+ }
+
+ node = node->next;
+ }
+
+ snort_conf_for_parsing = NULL;
+
+ return 0;
+}
+#endif
+
+
+/***************************** Output Plugin API *****************************/
+extern OutputConfigFuncNode *output_config_funcs;
+
+static void AppendOutputFuncList(OutputFunc, void *, OutputFuncNode **);
+
+void RegisterOutputPlugins(void)
+{
+ LogMessage("Initializing Output Plugins!\n");
+
+ AlertSyslogSetup();
+ LogTcpdumpSetup();
+ DatabaseSetup();
+ AlertFastSetup();
+ AlertFullSetup();
+ AlertPfSetup();
+#ifndef WIN32
+ /* Win32 doesn't support AF_UNIX sockets */
+ AlertUnixSockSetup();
+#endif /* !WIN32 */
+ AlertCSVSetup();
+ LogNullSetup();
+ UnifiedSetup();
+ Unified2Setup();
+ LogAsciiSetup();
+
+#ifdef ARUBA
+ AlertArubaActionSetup();
+#endif
+
+#ifdef LINUX
+ /* This uses linux only capabilities */
+ AlertSFSocket_Setup();
+#endif
+
+#ifdef HAVE_LIBPRELUDE
+ AlertPreludeSetup();
+#endif
+
+ AlertTestSetup();
+}
+
+/****************************************************************************
+ *
+ * Function: RegisterOutputPlugin(char *, void (*func)(Packet *, u_char *))
+ *
+ * Purpose: Associates an output statement with its function.
+ *
+ * Arguments: keyword => The output keyword to associate with the
+ * output processor
+ * type => alert or log types
+ * *func => function pointer to the handler
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+void RegisterOutputPlugin(char *keyword, int type_flags, OutputConfigFunc func)
+{
+ OutputConfigFuncNode *node = (OutputConfigFuncNode *)SnortAlloc(sizeof(OutputConfigFuncNode));
+
+ DEBUG_WRAP(DebugMessage(DEBUG_PLUGIN,"Registering keyword:output => %s:%p\n",
+ keyword, func););
+
+ if (output_config_funcs == NULL)
+ {
+ output_config_funcs = node;
+ }
+ else
+ {
+ OutputConfigFuncNode *tmp = output_config_funcs;
+ OutputConfigFuncNode *last;
+
+ do
+ {
+ if (strcasecmp(tmp->keyword, keyword) == 0)
+ {
+ free(node);
+ FatalError("Duplicate output keyword: %s\n", keyword);
+ }
+
+ last = tmp;
+ tmp = tmp->next;
+
+ } while (tmp != NULL);
+
+ last->next = node;
+ }
+
+ node->keyword = SnortStrdup(keyword);
+ node->func = func;
+ node->output_type_flags = type_flags;
+}
+
+OutputConfigFunc GetOutputConfigFunc(char *keyword)
+{
+ OutputConfigFuncNode *head = output_config_funcs;
+
+ if (keyword == NULL)
+ return NULL;
+
+ while (head != NULL)
+ {
+ if (strcasecmp(head->keyword, keyword) == 0)
+ return head->func;
+
+ head = head->next;
+ }
+
+ return NULL;
+}
+
+int GetOutputTypeFlags(char *keyword)
+{
+ OutputConfigFuncNode *head = output_config_funcs;
+
+ if (keyword == NULL)
+ return 0;
+
+ while (head != NULL)
+ {
+ if (strcasecmp(head->keyword, keyword) == 0)
+ return head->output_type_flags;
+
+ head = head->next;
+ }
+
+ return 0;
+}
+
+void FreeOutputConfigFuncs(void)
+{
+ OutputConfigFuncNode *head = output_config_funcs;
+ OutputConfigFuncNode *tmp;
+
+ while (head != NULL)
+ {
+ tmp = head->next;
+ if (head->keyword != NULL)
+ free(head->keyword);
+ free(head);
+ head = tmp;
+ }
+}
+
+void FreeOutputList(OutputFuncNode *list)
+{
+ while (list != NULL)
+ {
+ OutputFuncNode *tmp = list;
+
+ list = list->next;
+ free(tmp);
+ }
+}
+
+/****************************************************************************
+ *
+ * Function: DumpOutputPlugins()
+ *
+ * Purpose: Prints the keyword->preprocess list
+ *
+ * Arguments: None.
+ *
+ * Returns: void function
+ *
+ ***************************************************************************/
+void DumpOutputPlugins(void)
+{
+ OutputConfigFuncNode *idx = output_config_funcs;
+
+ LogMessage("-------------------------------------------------\n");
+ LogMessage(" Keyword | Output @ \n");
+ LogMessage("-------------------------------------------------\n");
+ while(idx != NULL)
+ {
+ LogMessage("%-13s: %p\n", idx->keyword, idx->func);
+ idx = idx->next;
+ }
+ LogMessage("-------------------------------------------------\n\n");
+}
+
+void AddFuncToOutputList(OutputFunc func, OutputType type, void *arg)
+{
+ switch (type)
+ {
+ case OUTPUT_TYPE__ALERT:
+ if (head_tmp != NULL)
+ AppendOutputFuncList(func, arg, &head_tmp->AlertList);
+ else
+ AppendOutputFuncList(func, arg, &AlertList);
+
+ break;
+
+ case OUTPUT_TYPE__LOG:
+ if (head_tmp != NULL)
+ AppendOutputFuncList(func, arg, &head_tmp->LogList);
+ else
+ AppendOutputFuncList(func, arg, &LogList);
+
+ break;
+
+ default:
+ /* just to be error-prone */
+ FatalError("Unknown output type: %i. Possible bug, please "
+ "report.\n", type);
+ }
+}
+
+void AppendOutputFuncList(OutputFunc func, void *arg, OutputFuncNode **list)
+{
+ OutputFuncNode *node;
+
+ if (list == NULL)
+ return;
+
+ node = (OutputFuncNode *)SnortAlloc(sizeof(OutputFuncNode));
+
+ if (*list == NULL)
+ {
+ *list = node;
+ }
+ else
+ {
+ OutputFuncNode *tmp = *list;
+
+ while (tmp->next != NULL)
+ tmp = tmp->next;
+
+ tmp->next = node;
+ }
+
+ node->func = func;
+ node->arg = arg;
+}
+
+
+/************************** Miscellaneous Functions **************************/
+
+/* functions to aid in cleaning up after plugins
+ * Used for both rule options and output. Preprocessors have their own */
+void AddFuncToRestartList(PluginSignalFunc func, void *arg)
+{
+ AddFuncToSignalList(func, arg, &plugin_restart_funcs);
+}
+
+void AddFuncToCleanExitList(PluginSignalFunc func, void *arg)
+{
+ AddFuncToSignalList(func, arg, &plugin_clean_exit_funcs);
+}
+
+void AddFuncToShutdownList(PluginSignalFunc func, void *arg)
+{
+ AddFuncToSignalList(func, arg, &plugin_shutdown_funcs);
+}
+
+void AddFuncToPostConfigList(PluginSignalFunc func, void *arg)
+{
+ SnortConfig *sc = snort_conf_for_parsing;
+
+ if (sc == NULL)
+ {
+ FatalError("%s(%d) Snort config for parsing is NULL.\n",
+ __FILE__, __LINE__);
+ }
+
+ AddFuncToSignalList(func, arg, &sc->plugin_post_config_funcs);
+}
+
+void AddFuncToSignalList(PluginSignalFunc func, void *arg, PluginSignalFuncNode **list)
+{
+ PluginSignalFuncNode *node;
+
+ if (list == NULL)
+ return;
+
+ node = (PluginSignalFuncNode *)SnortAlloc(sizeof(PluginSignalFuncNode));
+
+ if (*list == NULL)
+ {
+ *list = node;
+ }
+ else
+ {
+ PluginSignalFuncNode *tmp = *list;
+
+ while (tmp->next != NULL)
+ tmp = tmp->next;
+
+ tmp->next = node;
+ }
+
+ node->func = func;
+ node->arg = arg;
+}
+
+void AddFuncToRuleOptParseCleanupList(RuleOptParseCleanupFunc func)
+{
+ RuleOptParseCleanupNode *node =
+ (RuleOptParseCleanupNode *)SnortAlloc(sizeof(RuleOptParseCleanupNode));
+
+ if (rule_opt_parse_cleanup_list == NULL)
+ {
+ rule_opt_parse_cleanup_list = node;
+ }
+ else
+ {
+ RuleOptParseCleanupNode *tmp = rule_opt_parse_cleanup_list;
+
+ while (tmp->next != NULL)
+ tmp = tmp->next;
+
+ tmp->next = node;
+ }
+
+ node->func = func;
+}
+
+void RuleOptParseCleanup(void)
+{
+ RuleOptParseCleanupNode *list = rule_opt_parse_cleanup_list;
+
+ for (; list != NULL; list = list->next)
+ {
+ if (list->func != NULL)
+ list->func();
+ }
+}
+
+void FreeRuleOptParseCleanupList(RuleOptParseCleanupNode *head)
+{
+ while (head != NULL)
+ {
+ RuleOptParseCleanupNode *tmp = head;
+
+ head = head->next;
+ free(tmp);
+ }
+}
+
+
diff --git a/config/orionids-dev/patches/spoink_patch/2.8.6/util.c b/config/orionids-dev/patches/spoink_patch/2.8.6/util.c
new file mode 100644
index 00000000..b2d3b38b
--- /dev/null
+++ b/config/orionids-dev/patches/spoink_patch/2.8.6/util.c
@@ -0,0 +1,3233 @@
+/* $Id$ */
+/*
+** Copyright (C) 2002-2010 Sourcefire, Inc.
+** Copyright (C) 2002 Martin Roesch <roesch@sourcefire.com>
+**
+** This program is free software; you can redistribute it and/or modify
+** it under the terms of the GNU General Public License Version 2 as
+** published by the Free Software Foundation. You may not use, modify or
+** distribute this program under any other version of the GNU General
+** Public License.
+**
+** This program is distributed in the hope that it will be useful,
+** but WITHOUT ANY WARRANTY; without even the implied warranty of
+** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+** GNU General Public License for more details.
+**
+** You should have received a copy of the GNU General Public License
+** along with this program; if not, write to the Free Software
+** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+*/
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <sys/types.h>
+
+#ifndef WIN32
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <sys/wait.h>
+#include <dirent.h>
+#include <fnmatch.h>
+#endif /* !WIN32 */
+
+#include <stdarg.h>
+#include <syslog.h>
+#include <errno.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <signal.h>
+#include <unistd.h>
+
+#ifndef WIN32
+#include <grp.h>
+#include <pwd.h>
+#include <netdb.h>
+#include <limits.h>
+#endif /* !WIN32 */
+
+#include <fcntl.h>
+
+#ifdef HAVE_STRINGS_H
+#include <strings.h>
+#endif
+
+#ifdef ZLIB
+#include <zlib.h>
+#endif
+
+#include "snort.h"
+#include "mstring.h"
+#include "debug.h"
+#include "util.h"
+#include "parser.h"
+#include "inline.h"
+#include "build.h"
+#include "plugbase.h"
+#include "sf_types.h"
+#include "sflsq.h"
+#include "ipv6_port.h"
+
+#include "pcre.h"
+
+#include "mpse.h"
+
+#include "ppm.h"
+
+#ifdef TARGET_BASED
+#include "sftarget_reader.h"
+#endif
+
+#ifdef WIN32
+#include "win32/WIN32-Code/name.h"
+#endif
+
+#include "stream5_common.h"
+
+#ifdef PATH_MAX
+#define PATH_MAX_UTIL PATH_MAX
+#else
+#define PATH_MAX_UTIL 1024
+#endif /* PATH_MAX */
+
+extern Stream5Stats s5stats;
+extern int datalink;
+extern pcap_t *pcap_handle;
+extern PreprocStatsFuncNode *preproc_stats_funcs;
+
+static PcapPktStats pkt_stats;
+
+/*
+ * you may need to adjust this on the systems which don't have standard
+ * paths defined
+ */
+#ifndef _PATH_VARRUN
+static char _PATH_VARRUN[STD_BUF];
+#endif
+
+
+#ifdef NAME_MAX
+#define NAME_MAX_UTIL NAME_MAX
+#else
+#define NAME_MAX_UTIL 256
+#endif /* NAME_MAX */
+
+#define FILE_MAX_UTIL (PATH_MAX_UTIL + NAME_MAX_UTIL)
+
+/****************************************************************************
+ *
+ * Function: CalcPct(uint64_t, uint64_t)
+ *
+ * Purpose: Calculate the percentage of a value compared to a total
+ *
+ * Arguments: cnt => the numerator in the equation
+ * total => the denominator in the calculation
+ *
+ * Returns: pct -> the percentage of cnt to value
+ *
+ ****************************************************************************/
+double CalcPct(uint64_t cnt, uint64_t total)
+{
+ double pct = 0.0;
+
+ if (total == 0.0)
+ {
+ pct = (double)cnt;
+ }
+ else
+ {
+ pct = (double)cnt / (double)total;
+ }
+
+ pct *= 100.0;
+
+ return pct;
+}
+
+
+/****************************************************************************
+ *
+ * Function: DisplayBanner()
+ *
+ * Purpose: Show valuable proggie info
+ *
+ * Arguments: None.
+ *
+ * Returns: 0 all the time
+ *
+ ****************************************************************************/
+int DisplayBanner(void)
+{
+ const char * info;
+ const char * pcre_ver;
+#ifdef ZLIB
+ const char * zlib_ver;
+#endif
+
+ info = getenv("HOSTTYPE");
+ if( !info )
+ {
+ info="";
+ }
+
+ pcre_ver = pcre_version();
+#ifdef ZLIB
+ zlib_ver = zlib_version;
+#endif
+
+ LogMessage("\n");
+ LogMessage(" ,,_ -*> Snort! <*-\n");
+ LogMessage(" o\" )~ Version %s%s%s (Build %s) %s %s\n",
+ VERSION,
+#ifdef SUP_IP6
+ " IPv6",
+#else
+ "",
+#endif
+#ifdef GRE
+ " GRE",
+#else
+ "",
+#endif
+ BUILD,
+#ifdef GIDS
+ "inline",
+#else
+ "",
+#endif
+ info);
+ LogMessage(" '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team\n");
+ LogMessage(" Copyright (C) 1998-2010 Sourcefire, Inc., et al.\n");
+ LogMessage(" Using PCRE version: %s\n", pcre_ver);
+#ifdef ZLIB
+ LogMessage(" Using ZLIB version: %s\n", zlib_ver);
+#endif
+ LogMessage("\n");
+ LogMessage(" ___ Built Date for Snort on Pfsense 2.0 is May 25 2010.\n");
+ LogMessage(" ___/ f \\ Orion IPS Output Code Copyright (C) 2009-2010 Robert Zelaya.\n");
+ LogMessage("/ p \\___/Sense\n");
+ LogMessage("\\___/ \\\n");
+ LogMessage(" \\___/ Using Snort.org dynamic plugins and Orion IPS source.\n");
+ LogMessage("\n");
+
+ return 0;
+}
+
+
+
+/****************************************************************************
+ *
+ * Function: ts_print(register const struct, char *)
+ *
+ * Purpose: Generate a time stamp and stuff it in a buffer. This one has
+ * millisecond precision. Oh yeah, I ripped this code off from
+ * TCPdump, props to those guys.
+ *
+ * Arguments: timeval => clock struct coming out of libpcap
+ * timebuf => buffer to stuff timestamp into
+ *
+ * Returns: void function
+ *
+ ****************************************************************************/
+void ts_print(register const struct timeval *tvp, char *timebuf)
+{
+ register int s;
+ int localzone;
+ time_t Time;
+ struct timeval tv;
+ struct timezone tz;
+ struct tm *lt; /* place to stick the adjusted clock data */
+
+ /* if null was passed, we use current time */
+ if(!tvp)
+ {
+ /* manual page (for linux) says tz is never used, so.. */
+ bzero((char *) &tz, sizeof(tz));
+ gettimeofday(&tv, &tz);
+ tvp = &tv;
+ }
+
+ localzone = snort_conf->thiszone;
+
+ /*
+ ** If we're doing UTC, then make sure that the timezone is correct.
+ */
+ if (ScOutputUseUtc())
+ localzone = 0;
+
+ s = (tvp->tv_sec + localzone) % 86400;
+ Time = (tvp->tv_sec + localzone) - s;
+
+ lt = gmtime(&Time);
+
+ if (ScOutputIncludeYear())
+ {
+ (void) SnortSnprintf(timebuf, TIMEBUF_SIZE,
+ "%02d/%02d/%02d-%02d:%02d:%02d.%06u ",
+ lt->tm_mon + 1, lt->tm_mday, lt->tm_year - 100,
+ s / 3600, (s % 3600) / 60, s % 60,
+ (u_int) tvp->tv_usec);
+ }
+ else
+ {
+ (void) SnortSnprintf(timebuf, TIMEBUF_SIZE,
+ "%02d/%02d-%02d:%02d:%02d.%06u ", lt->tm_mon + 1,
+ lt->tm_mday, s / 3600, (s % 3600) / 60, s % 60,
+ (u_int) tvp->tv_usec);
+ }
+}
+
+
+
+/****************************************************************************
+ *
+ * Function: gmt2local(time_t)
+ *
+ * Purpose: Figures out how to adjust the current clock reading based on the
+ * timezone you're in. Ripped off from TCPdump.
+ *
+ * Arguments: time_t => offset from GMT
+ *
+ * Returns: offset seconds from GMT
+ *
+ ****************************************************************************/
+int gmt2local(time_t t)
+{
+ register int dt, dir;
+ register struct tm *gmt, *loc;
+ struct tm sgmt;
+
+ if(t == 0)
+ t = time(NULL);
+
+ gmt = &sgmt;
+ *gmt = *gmtime(&t);
+ loc = localtime(&t);
+
+ dt = (loc->tm_hour - gmt->tm_hour) * 60 * 60 +
+ (loc->tm_min - gmt->tm_min) * 60;
+
+ dir = loc->tm_year - gmt->tm_year;
+
+ if(dir == 0)
+ dir = loc->tm_yday - gmt->tm_yday;
+
+ dt += dir * 24 * 60 * 60;
+
+ return(dt);
+}
+
+
+
+
+/****************************************************************************
+ *
+ * Function: copy_argv(u_char **)
+ *
+ * Purpose: Copies a 2D array (like argv) into a flat string. Stolen from
+ * TCPDump.
+ *
+ * Arguments: argv => 2D array to flatten
+ *
+ * Returns: Pointer to the flat string
+ *
+ ****************************************************************************/
+char *copy_argv(char **argv)
+{
+ char **p;
+ u_int len = 0;
+ char *buf;
+ char *src, *dst;
+ //void ftlerr(char *,...);
+
+ p = argv;
+ if(*p == 0)
+ return 0;
+
+ while(*p)
+ len += strlen(*p++) + 1;
+
+ buf = (char *) calloc(1,len);
+
+ if(buf == NULL)
+ {
+ FatalError("calloc() failed: %s\n", strerror(errno));
+ }
+ p = argv;
+ dst = buf;
+
+ while((src = *p++) != NULL)
+ {
+ while((*dst++ = *src++) != '\0');
+ dst[-1] = ' ';
+ }
+
+ dst[-1] = '\0';
+
+ /* Check for an empty string */
+ dst = buf;
+ while (isspace((int)*dst))
+ dst++;
+
+ if (strlen(dst) == 0)
+ {
+ free(buf);
+ buf = NULL;
+ }
+
+ return buf;
+}
+
+
+/****************************************************************************
+ *
+ * Function: strip(char *)
+ *
+ * Purpose: Strips a data buffer of CR/LF/TABs. Replaces CR/LF's with
+ * NULL and TABs with spaces.
+ *
+ * Arguments: data => ptr to the data buf to be stripped
+ *
+ * Returns: void
+ *
+ * 3/7/07 - changed to return void - use strlen to get size of string
+ *
+ * Note that this function will turn all '\n' and '\r' into null chars
+ * so, e.g. 'Hello\nWorld\n' => 'Hello\x00World\x00'
+ * note that the string is now just 'Hello' and the length is shortened
+ * by more than just an ending '\n' or '\r'
+ ****************************************************************************/
+void strip(char *data)
+{
+ int size;
+ char *end;
+ char *idx;
+
+ idx = data;
+ end = data + strlen(data);
+ size = end - idx;
+
+ while(idx != end)
+ {
+ if((*idx == '\n') ||
+ (*idx == '\r'))
+ {
+ *idx = 0;
+ size--;
+ }
+ if(*idx == '\t')
+ {
+ *idx = ' ';
+ }
+ idx++;
+ }
+}
+
+/*
+ * Function: ErrorMessage(const char *, ...)
+ *
+ * Purpose: Print a message to stderr.
+ *
+ * Arguments: format => the formatted error string to print out
+ * ... => format commands/fillers
+ *
+ * Returns: void function
+ */
+void ErrorMessage(const char *format,...)
+{
+ char buf[STD_BUF+1];
+ va_list ap;
+
+ if (snort_conf == NULL)
+ return;
+
+ va_start(ap, format);
+
+ if (ScDaemonMode() || ScLogSyslog())
+ {
+ vsnprintf(buf, STD_BUF, format, ap);
+ buf[STD_BUF] = '\0';
+ syslog(LOG_CONS | LOG_DAEMON | LOG_ERR, "%s", buf);
+ }
+ else
+ {
+ vfprintf(stderr, format, ap);
+ }
+ va_end(ap);
+}
+
+/*
+ * Function: LogMessage(const char *, ...)
+ *
+ * Purpose: Print a message to stderr or with logfacility.
+ *
+ * Arguments: format => the formatted error string to print out
+ * ... => format commands/fillers
+ *
+ * Returns: void function
+ */
+void LogMessage(const char *format,...)
+{
+ char buf[STD_BUF+1];
+ va_list ap;
+
+ if (snort_conf == NULL)
+ return;
+
+ if (ScLogQuiet() && !ScDaemonMode() && !ScLogSyslog())
+ return;
+
+ va_start(ap, format);
+
+ if (ScDaemonMode() || ScLogSyslog())
+ {
+ vsnprintf(buf, STD_BUF, format, ap);
+ buf[STD_BUF] = '\0';
+ syslog(LOG_DAEMON | LOG_NOTICE, "%s", buf);
+ }
+ else
+ {
+ vfprintf(stderr, format, ap);
+ }
+
+ va_end(ap);
+}
+
+/*
+ * Function: CreateApplicationEventLogEntry(const char *)
+ *
+ * Purpose: Add an entry to the Win32 "Application" EventLog
+ *
+ * Arguments: szMessage => the formatted error string to print out
+ *
+ * Returns: void function
+ */
+#if defined(WIN32) && defined(ENABLE_WIN32_SERVICE)
+void CreateApplicationEventLogEntry(const char *msg)
+{
+ HANDLE hEventLog;
+ char* pEventSourceName = "SnortService";
+
+ /* prepare to write to Application log on local host
+ * with Event Source of SnortService
+ */
+ AddEventSource(pEventSourceName);
+ hEventLog = RegisterEventSource(NULL, pEventSourceName);
+ if (hEventLog == NULL)
+ {
+ /* Could not register the event source. */
+ return;
+ }
+
+ if (!ReportEvent(hEventLog, /* event log handle */
+ EVENTLOG_ERROR_TYPE, /* event type */
+ 0, /* category zero */
+ EVMSG_SIMPLE, /* event identifier */
+ NULL, /* no user security identifier */
+ 1, /* one substitution string */
+ 0, /* no data */
+ &msg, /* pointer to array of strings */
+ NULL)) /* pointer to data */
+ {
+ /* Could not report the event. */
+ }
+
+ DeregisterEventSource(hEventLog);
+}
+#endif /* WIN32 && ENABLE_WIN32_SERVICE */
+
+
+/*
+ * Function: FatalError(const char *, ...)
+ *
+ * Purpose: When a fatal error occurs, this function prints the error message
+ * and cleanly shuts down the program
+ *
+ * Arguments: format => the formatted error string to print out
+ * ... => format commands/fillers
+ *
+ * Returns: void function
+ */
+NORETURN void FatalError(const char *format,...)
+{
+ char buf[STD_BUF+1];
+ va_list ap;
+
+ va_start(ap, format);
+ vsnprintf(buf, STD_BUF, format, ap);
+ va_end(ap);
+
+ buf[STD_BUF] = '\0';
+
+ if ((snort_conf != NULL) && (ScDaemonMode() || ScLogSyslog()))
+ {
+ syslog(LOG_CONS | LOG_DAEMON | LOG_ERR, "FATAL ERROR: %s", buf);
+ }
+ else
+ {
+ fprintf(stderr, "ERROR: %s", buf);
+ fprintf(stderr,"Fatal Error, Quitting..\n");
+#if defined(WIN32) && defined(ENABLE_WIN32_SERVICE)
+ CreateApplicationEventLogEntry(buf);
+#endif
+ }
+
+ exit(1);
+}
+
+
+/****************************************************************************
+ *
+ * Function: CreatePidFile(char *)
+ *
+ * Purpose: Creates a PID file
+ *
+ * Arguments: Interface opened.
+ *
+ * Returns: void function
+ *
+ ****************************************************************************/
+static FILE *pid_lockfile = NULL;
+static FILE *pid_file = NULL;
+void CreatePidFile(char *intf)
+{
+ struct stat pt;
+ int pid = (int) getpid();
+#ifdef WIN32
+ char dir[STD_BUF + 1];
+#endif
+
+ if (!ScReadMode())
+ {
+ LogMessage("Checking PID path...\n");
+
+ if (strlen(snort_conf->pid_path) != 0)
+ {
+ if((stat(snort_conf->pid_path, &pt) == -1) ||
+ !S_ISDIR(pt.st_mode) || access(snort_conf->pid_path, W_OK) == -1)
+ {
+#ifndef WIN32
+ /* Save this just in case it's reset with LogMessage call */
+ int err = errno;
+
+ LogMessage("WARNING: %s is invalid, trying "
+ "/var/run...\n", snort_conf->pid_path);
+ if (err)
+ {
+ LogMessage("Previous Error, errno=%d, (%s)\n",
+ err, strerror(err) == NULL ? "Unknown error" : strerror(err));
+ }
+#endif
+ memset(snort_conf->pid_path, 0, sizeof(snort_conf->pid_path));
+ }
+ else
+ {
+ LogMessage("PID path stat checked out ok, "
+ "PID path set to %s\n", snort_conf->pid_path);
+ }
+ }
+
+ if (strlen(snort_conf->pid_path) == 0)
+ {
+#ifndef _PATH_VARRUN
+# ifndef WIN32
+ SnortStrncpy(_PATH_VARRUN, "/var/run/", sizeof(_PATH_VARRUN));
+# else
+ if (GetCurrentDirectory(sizeof(dir) - 1, dir))
+ SnortStrncpy(_PATH_VARRUN, dir, sizeof(_PATH_VARRUN));
+# endif /* WIN32 */
+#else
+ LogMessage("PATH_VARRUN is set to %s on this operating "
+ "system\n", _PATH_VARRUN);
+#endif /* _PATH_VARRUN */
+
+ stat(_PATH_VARRUN, &pt);
+
+ if(!S_ISDIR(pt.st_mode) || access(_PATH_VARRUN, W_OK) == -1)
+ {
+ LogMessage("WARNING: _PATH_VARRUN is invalid, trying "
+ "/var/log...\n");
+ SnortStrncpy(snort_conf->pid_path, "/var/log/", sizeof(snort_conf->pid_path));
+ stat(snort_conf->pid_path, &pt);
+
+ if(!S_ISDIR(pt.st_mode) || access(snort_conf->pid_path, W_OK) == -1)
+ {
+ LogMessage("WARNING: %s is invalid, logging Snort "
+ "PID path to log directory (%s)\n", snort_conf->pid_path,
+ snort_conf->log_dir);
+ CheckLogDir();
+ SnortSnprintf(snort_conf->pid_path, sizeof(snort_conf->pid_path),
+ "%s/", snort_conf->log_dir);
+ }
+ }
+ else
+ {
+ LogMessage("PID path stat checked out ok, "
+ "PID path set to %s\n", _PATH_VARRUN);
+ SnortStrncpy(snort_conf->pid_path, _PATH_VARRUN, sizeof(snort_conf->pid_path));
+ }
+ }
+ }
+
+ if(intf == NULL || strlen(snort_conf->pid_path) == 0)
+ {
+ /* snort_conf->pid_path should have some value by now
+ * so let us just be sane. */
+ FatalError("CreatePidFile() failed to lookup interface or pid_path is unknown!\n");
+ }
+
+ SnortSnprintf(snort_conf->pid_filename, sizeof(snort_conf->pid_filename),
+ "%s/snort_%s%s.pid", snort_conf->pid_path, intf, snort_conf->pidfile_suffix);
+
+#ifndef WIN32
+ if (!ScNoLockPidFile())
+ {
+ char pid_lockfilename[STD_BUF+1];
+ int lock_fd;
+
+ /* First, lock the PID file */
+ SnortSnprintf(pid_lockfilename, STD_BUF, "%s.lck", snort_conf->pid_filename);
+ pid_lockfile = fopen(pid_lockfilename, "w");
+
+ if (pid_lockfile)
+ {
+ struct flock lock;
+ lock_fd = fileno(pid_lockfile);
+
+ lock.l_type = F_WRLCK;
+ lock.l_whence = SEEK_SET;
+ lock.l_start = 0;
+ lock.l_len = 0;
+
+ if (fcntl(lock_fd, F_SETLK, &lock) == -1)
+ {
+ ClosePidFile();
+ FatalError("Failed to Lock PID File \"%s\" for PID \"%d\"\n", snort_conf->pid_filename, pid);
+ }
+ }
+ }
+#endif
+
+ /* Okay, were able to lock PID file, now open and write PID */
+ pid_file = fopen(snort_conf->pid_filename, "w");
+ if(pid_file)
+ {
+ LogMessage("Writing PID \"%d\" to file \"%s\"\n", pid, snort_conf->pid_filename);
+ fprintf(pid_file, "%d\n", pid);
+ fflush(pid_file);
+ }
+ else
+ {
+ ErrorMessage("Failed to create pid file %s", snort_conf->pid_filename);
+ snort_conf->pid_filename[0] = 0;
+ }
+}
+
+/****************************************************************************
+ *
+ * Function: ClosePidFile(char *)
+ *
+ * Purpose: Releases lock on a PID file
+ *
+ * Arguments: None
+ *
+ * Returns: void function
+ *
+ ****************************************************************************/
+void ClosePidFile(void)
+{
+ if (pid_file)
+ {
+ fclose(pid_file);
+ pid_file = NULL;
+ }
+ if (pid_lockfile)
+ {
+ fclose(pid_lockfile);
+ pid_lockfile = NULL;
+ }
+}
+
+/****************************************************************************
+ *
+ * Function: SetUidGid()
+ *
+ * Purpose: Sets safe UserID and GroupID if needed
+ *
+ * Arguments: none
+ *
+ * Returns: void function
+ *
+ ****************************************************************************/
+void SetUidGid(int user_id, int group_id)
+{
+#ifndef WIN32
+
+ if ((group_id != -1) && (getgid() != (gid_t)group_id))
+ {
+ if (!InlineModeSetPrivsAllowed())
+ {
+ ErrorMessage("Cannot set uid and gid when running Snort in "
+ "inline mode.\n");
+ return;
+ }
+
+ if (setgid(group_id) < 0)
+ FatalError("Cannot set gid: %d\n", group_id);
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Set gid to %d\n", group_id););
+ }
+
+ if ((user_id != -1) && (getuid() != (uid_t)user_id))
+ {
+ struct passwd *pw = getpwuid(user_id);
+
+ if (!InlineModeSetPrivsAllowed())
+ {
+ ErrorMessage("Cannot set uid and gid when running Snort in "
+ "inline mode.\n");
+ return;
+ }
+
+ if (pw != NULL)
+ {
+ /* getpwuid and initgroups may use the same static buffers */
+ char *username = SnortStrdup(pw->pw_name);
+
+ if ((getuid() == 0) && (initgroups(username, group_id) < 0))
+ {
+ free(username);
+ FatalError("Can not initgroups(%s,%d)",
+ username, group_id);
+ }
+
+ free(username);
+ }
+
+ /** just to be on a safe side... **/
+ endgrent();
+ endpwent();
+
+ if (setuid(user_id) < 0)
+ FatalError("Can not set uid: %d\n", user_id);
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Set uid to %d\n", user_id););
+ }
+#endif /* WIN32 */
+}
+
+#ifdef TIMESTATS
+
+static IntervalStats istats = {0};
+time_t start_time;
+
+void InitTimeStats(void)
+{
+ start_time = time(NULL);
+}
+
+void ResetTimeStats(void)
+{
+ memset(&istats, 0, sizeof(istats));
+}
+
+/* This function prints out stats based on a configurable time
+ * interval. It is an indication on how well snort is */
+/* processing packets, including types, drops, etc */
+void DropStatsPerTimeInterval(void)
+{
+ double per_sec, per_minute, per_hour;
+ uint64_t recv, drop;
+ uint64_t total = 0;
+ uint32_t timestats_interval = ScTimestatsInterval();
+
+#ifdef PCAP_CLOSE
+ if (UpdatePcapPktStats(0) != -1)
+#else
+ if (UpdatePcapPktStats() != -1)
+#endif
+ {
+ recv = GetPcapPktStatsRecv();
+ drop = GetPcapPktStatsDrop();
+
+ istats.recv = recv - istats.recv_total;
+ istats.recv_total = recv;
+
+ istats.drop = drop - istats.drop_total;
+ istats.drop_total = drop;
+
+ /* calculate received packets by type */
+ istats.tcp = pc.tcp - istats.tcp_total;
+ istats.tcp_total = pc.tcp;
+
+ istats.udp = pc.udp - istats.udp_total;
+ istats.udp_total = pc.udp;
+
+ istats.icmp = pc.icmp - istats.icmp_total;
+ istats.icmp_total = pc.icmp;
+
+ istats.arp = pc.arp - istats.arp_total;
+ istats.arp_total = pc.arp;
+
+#ifdef GRE
+ istats.ip4ip4 = pc.ip4ip4 - istats.ip4ip4_total;
+ istats.ip4ip4_total = pc.ip4ip4;
+
+ istats.ip4ip6 = pc.ip4ip6 - istats.ip4ip6_total;
+ istats.ip4ip6_total = pc.ip4ip6;
+
+ istats.ip6ip4 = pc.ip6ip4 - istats.ip6ip4_total;
+ istats.ip6ip4_total = pc.ip6ip4;
+
+ istats.ip6ip6 = pc.ip6ip6 - istats.ip6ip6_total;
+ istats.ip6ip6_total = pc.ip6ip6;
+
+ istats.gre = pc.gre - istats.gre_total;
+ istats.gre_total = pc.gre;
+
+ istats.gre_ip = pc.gre_ip - istats.gre_ip_total;
+ istats.gre_ip_total = pc.gre_ip;
+
+ istats.gre_eth = pc.gre_eth - istats.gre_eth_total;
+ istats.gre_eth_total = pc.gre_eth;
+
+ istats.gre_arp = pc.gre_arp - istats.gre_arp_total;
+ istats.gre_arp_total = pc.gre_arp;
+
+ istats.gre_ipv6 = pc.gre_ipv6 - istats.gre_ipv6_total;
+ istats.gre_ipv6_total = pc.gre_ipv6;
+
+ istats.gre_ipx = pc.gre_ipx - istats.gre_ipx_total;
+ istats.gre_ipx_total = pc.gre_ipx;
+
+ istats.gre_loopback = pc.gre_loopback - istats.gre_loopback_total;
+ istats.gre_loopback_total = pc.gre_loopback;
+
+ istats.gre_vlan = pc.gre_vlan - istats.gre_vlan_total;
+ istats.gre_vlan_total = pc.gre_vlan;
+
+ istats.gre_ppp = pc.gre_ppp - istats.gre_ppp_total;
+ istats.gre_ppp_total = pc.gre_ppp;
+#endif
+
+#ifdef DLT_IEEE802_11 /* if we are tracking wireless, add this to output */
+ istats.wifi_mgmt = pc.wifi_mgmt - istats.wifi_mgmt_total;
+ istats.wifi_mgmt_total = pc.wifi_mgmt;
+
+ istats.wifi_control = pc.wifi_control - istats.wifi_control_total;
+ istats.wifi_control_total = pc.wifi_control;
+
+ istats.wifi_data = pc.wifi_data - istats.wifi_data_total;
+ istats.wifi_data_total = pc.wifi_data;
+#endif
+
+ istats.ipx = pc.ipx - istats.ipx_total;
+ istats.ipx_total = pc.ipx;
+
+ istats.eapol = pc.eapol - istats.eapol_total;
+ istats.eapol_total = pc.eapol;
+
+ istats.ipv6 = pc.ipv6 - istats.ipv6_total;
+ istats.ipv6_total = pc.ipv6;
+
+ istats.ethloopback = pc.ethloopback - istats.ethloopback_total;
+ istats.ethloopback_total = pc.ethloopback;
+
+ istats.other = pc.other - istats.other_total;
+ istats.other_total = pc.other;
+
+ istats.discards = pc.discards - istats.discards_total;
+ istats.discards_total = pc.discards;
+
+ if (pc.frags > 0) /* do we have any fragmented packets being seen? */
+ {
+ istats.frags = pc.frags - istats.frags_total;
+ istats.frags_total = pc.frags;
+
+ istats.frag_trackers = pc.frag_trackers - istats.frag_trackers_total;
+ istats.frag_trackers_total = pc.frag_trackers;
+
+ istats.frag_rebuilt = pc.rebuilt_frags - istats.frag_rebuilt_total;
+ istats.frag_rebuilt_total = pc.rebuilt_frags;
+
+ istats.frag_element = pc.rebuild_element - istats.frag_element_total;
+ istats.frag_element_total = pc.rebuild_element;
+
+ istats.frag_incomp = pc.frag_incomp - istats.frag_incomp_total;
+ istats.frag_incomp_total = pc.frag_incomp;
+
+ istats.frag_timeout = pc.frag_timeout - istats.frag_timeout_total;
+ istats.frag_timeout_total = pc.frag_timeout;
+
+ istats.frag_mem_faults = pc.frag_mem_faults - istats.frag_mem_faults_total;
+ istats.frag_mem_faults_total = pc.frag_mem_faults;
+ }
+
+ if (pc.tcp_stream_pkts > 0) /* do we have TCP stream re-assembly going on? */
+ {
+ istats.tcp_str_packets = pc.tcp_stream_pkts - istats.tcp_str_packets_total;
+ istats.tcp_str_packets_total = pc.tcp_stream_pkts;
+
+ istats.tcp_str_trackers = pc.tcp_streams - istats.tcp_str_trackers_total;
+ istats.tcp_str_trackers_total = pc.tcp_streams;
+
+ istats.tcp_str_flushes = pc.rebuilt_tcp - istats.tcp_str_flushes_total;
+ istats.tcp_str_flushes_total = pc.rebuilt_tcp;
+
+ istats.tcp_str_segs_used = pc.rebuilt_segs - istats.tcp_str_segs_used_total;
+ istats.tcp_str_segs_used_total = pc.rebuilt_segs;
+
+ istats.tcp_str_segs_queued = pc.queued_segs - istats.tcp_str_segs_queued_total;
+ istats.tcp_str_segs_queued_total = pc.queued_segs;
+
+ istats.tcp_str_mem_faults = pc.str_mem_faults - istats.tcp_str_mem_faults_total;
+ istats.tcp_str_mem_faults_total = pc.str_mem_faults;
+ }
+
+ istats.processed = pc.total_processed - istats.processed_total;
+ istats.processed_total = pc.total_processed;
+ total = istats.processed;
+
+ /* prepare packet type per time interval routine */
+ LogMessage("================================================"
+ "===============================\n");
+
+ LogMessage("\n");
+ LogMessage("Statistics Report (last %d seconds)\n", timestats_interval);
+ LogMessage("\n");
+
+ per_sec = (double)istats.recv / (double)timestats_interval;
+
+ LogMessage("Packet Wire Totals:\n");
+ LogMessage("Packets received: " FMTu64("13") "\n", istats.recv);
+
+ if (timestats_interval >= SECONDS_PER_HOUR)
+ {
+ per_hour = (double)(istats.recv * SECONDS_PER_HOUR) / (double)timestats_interval;
+ LogMessage(" per hour: %13.2f\n", per_hour);
+ }
+ if (timestats_interval >= SECONDS_PER_MIN)
+ {
+ per_minute = (double)(istats.recv * SECONDS_PER_MIN) / (double)timestats_interval;
+ LogMessage(" per minute: %13.2f\n", per_minute);
+ }
+ LogMessage(" per second: %13.2f\n", per_sec);
+ LogMessage(" Packets dropped: " FMTu64("13") "\n", istats.drop);
+ LogMessage("\n");
+ LogMessage("Packet Breakdown by Protocol (includes rebuilt packets):\n");
+
+ LogMessage(" TCP: " FMTu64("10") " (%.3f%%)\n",
+ istats.tcp, CalcPct(istats.tcp, total));
+ LogMessage(" UDP: " FMTu64("10") " (%.3f%%)\n",
+ istats.udp, CalcPct(istats.udp, total));
+ LogMessage(" ICMP: " FMTu64("10") " (%.3f%%)\n",
+ istats.icmp, CalcPct(istats.icmp, total));
+ LogMessage(" ARP: " FMTu64("10") " (%.3f%%)\n",
+ istats.arp, CalcPct(istats.arp, total));
+#ifndef NO_NON_ETHER_DECODER
+ LogMessage(" EAPOL: " FMTu64("10") " (%.3f%%)\n",
+ istats.eapol, CalcPct(istats.eapol, total));
+#endif
+ LogMessage(" IPv6: " FMTu64("10") " (%.3f%%)\n",
+ istats.ipv6, CalcPct(istats.ipv6, total));
+ LogMessage(" ETHLOOP: " FMTu64("10") " (%.3f%%)\n",
+ istats.ethloopback, CalcPct(istats.ethloopback, total));
+ LogMessage(" IPX: " FMTu64("10") " (%.3f%%)\n",
+ istats.ipx, CalcPct(istats.ipx, total));
+
+#ifdef GRE
+ LogMessage(" IP4/IP4: " FMTu64("-10") " (%.3f%%)\n",
+ istats.ip4ip4, CalcPct(istats.ip4ip4, total));
+ LogMessage(" IP4/IP6: " FMTu64("-10") " (%.3f%%)\n",
+ istats.ip4ip6, CalcPct(istats.ip4ip6, total));
+ LogMessage(" IP6/IP4: " FMTu64("-10") " (%.3f%%)\n",
+ istats.ip6ip4, CalcPct(istats.ip6ip4, total));
+ LogMessage(" IP6/IP6: " FMTu64("-10") " (%.3f%%)\n",
+ istats.ip6ip6, CalcPct(istats.ip6ip6, total));
+ LogMessage(" GRE: " FMTu64("10") " (%.3f%%)\n",
+ istats.gre, CalcPct(istats.gre, total));
+ LogMessage(" GRE ETH: " FMTu64("-10") " (%.3f%%)\n",
+ istats.gre_eth, CalcPct(istats.gre_eth, total));
+ LogMessage("GRE VLAN: " FMTu64("-10") " (%.3f%%)\n",
+ istats.gre_vlan, CalcPct(istats.gre_vlan, total));
+ LogMessage(" GRE IP: " FMTu64("-10") " (%.3f%%)\n",
+ istats.gre_ip, CalcPct(istats.gre_ip, total));
+ LogMessage("GRE IPv6: " FMTu64("-10") " (%.3f%%)\n",
+ istats.gre_ipv6, CalcPct(istats.gre_ipv6, total));
+ LogMessage("GRE PPTP: " FMTu64("-10") " (%.3f%%)\n",
+ istats.gre_ppp, CalcPct(istats.gre_ppp, total));
+ LogMessage(" GRE ARP: " FMTu64("-10") " (%.3f%%)\n",
+ istats.gre_arp, CalcPct(istats.gre_arp, total));
+ LogMessage(" GRE IPX: " FMTu64("-10") " (%.3f%%)\n",
+ istats.gre_ipx, CalcPct(istats.gre_ipx, total));
+ LogMessage("GRE LOOP: " FMTu64("-10") " (%.3f%%)\n",
+ istats.gre_loopback, CalcPct(istats.gre_loopback, total));
+#endif
+
+ LogMessage(" FRAG: " FMTu64("10") " (%.3f%%)\n",
+ istats.frags, CalcPct(istats.frags, total));
+ LogMessage(" OTHER: " FMTu64("10") " (%.3f%%)\n",
+ istats.other, CalcPct(istats.other, total));
+ LogMessage(" DISCARD: " FMTu64("10") " (%.3f%%)\n",
+ istats.discards, CalcPct(istats.discards, total));
+ LogMessage(" Total: " FMTu64("10") "\n", total);
+
+ LogMessage("\n");
+
+
+ /* handle case where wireless is enabled... */
+
+#ifndef NO_NON_ETHER_DECODER
+#ifdef DLT_IEEE802_11
+ if (datalink == DLT_IEEE802_11)
+ {
+ LogMessage("\n");
+ LogMessage("Wireless Stats:\n\n");
+ LogMessage("Management Packets: " FMTu64("10") " (%.3f%%)\n",
+ istats.wifi_mgmt, CalcPct(istats.wifi_mgmt, total));
+ LogMessage(" Control Packets: " FMTu64("10") " (%.3f%%)\n",
+ istats.wifi_control, CalcPct(istats.wifi_control, total));
+ LogMessage(" Data Packets: " FMTu64("10") " (%.3f%%)\n",
+ istats.wifi_data, CalcPct(istats.wifi_data, total));
+ LogMessage("\n");
+ }
+
+#endif /* if wireless is enabled... */
+#endif // NO_NON_ETHER_DECODER
+
+ /* handle case where we have snort seeing fragmented packets */
+
+ if (pc.frags > 0) /* begin if (pc.frags > 0) */
+ {
+ LogMessage("\n");
+ LogMessage("Fragmentation Stats:\n\n");
+ LogMessage("Fragmented IP Packets: " FMTu64("10") "\n", istats.frags);
+ LogMessage(" Fragment Trackers: " FMTu64("10") "\n", istats.frag_trackers);
+ LogMessage(" Rebuilt IP Packets: " FMTu64("10") "\n", istats.frag_rebuilt);
+ LogMessage(" Frag Elements Used: " FMTu64("10") "\n", istats.frag_element);
+ LogMessage("Discarded(incomplete): " FMTu64("10") "\n", istats.frag_incomp);
+ LogMessage(" Discarded(timeout): " FMTu64("10") "\n", istats.frag_timeout);
+ LogMessage(" Frag2 memory faults: " FMTu64("10") "\n", istats.frag_mem_faults);
+ LogMessage("\n");
+ } /* end if (pc.frags > 0) */
+
+ /* handle TCP stream re-assy stuff here */
+
+ if (pc.tcp_stream_pkts > 0)
+ {
+ LogMessage("\n");
+ LogMessage("TCP Stream Reassembly Stats:\n\n");
+ LogMessage(" TCP Packets Used: " FMTu64("10") "\n", istats.tcp_str_packets);
+ LogMessage(" Stream Trackers: " FMTu64("10") "\n", istats.tcp_str_trackers);
+ LogMessage(" Stream Flushes: " FMTu64("10") "\n", istats.tcp_str_flushes);
+ LogMessage(" Stream Segments Used: " FMTu64("10") "\n", istats.tcp_str_segs_used);
+ LogMessage("Stream Segments Queued: " FMTu64("10") "\n", istats.tcp_str_segs_queued);
+ LogMessage(" Stream4 Memory Faults: " FMTu64("10") "\n", istats.tcp_str_mem_faults);
+ LogMessage("\n");
+ }
+
+ //mpse_print_qinfo();
+
+ } /* end if pcap_stats(ps, &ps) */
+
+ alarm(timestats_interval); /* reset the alarm to go off again */
+}
+
+/* print out stats on how long snort ran */
+void TimeStats(void)
+{
+
+/*
+ * variable definitions for improved statistics handling
+ *
+ * end_time = time which snort finished running (unix epoch)
+ * total_secs = total amount of time snort ran
+ * int_total_secs = used to eliminate casts from this function (temp. var)
+ * days = number of days snort ran
+ * hrs = number of hrs snort ran
+ * mins = number of minutes snort ran
+ * secs = number of seconds snort ran
+ *
+ * ival = temp. variable for integer/modulus math
+ * ppd = packets per day processed
+ * pph = packets per hour processed
+ * ppm = packets per minute processed
+ * pps = packets per second processed
+ *
+ * hflag = used to flag when hrs = zero, but days > 0
+ * mflag = used to flag when min = zero, but hrs > 0
+ *
+ */
+
+ time_t end_time, total_secs;
+ uint32_t days = 0, hrs = 0, mins = 0, secs = 0, tmp = 0;
+ uint64_t pps = 0, ppm = 0, pph = 0, ppd = 0;
+ uint32_t int_total_secs = 0;
+ char hflag = 0, mflag = 0;
+
+
+ end_time = time(NULL); /* grab epoch for end time value (in seconds) */
+ total_secs = end_time - start_time; /* total_secs is how many seconds snort ran for */
+
+ tmp = (uint32_t)total_secs;
+ int_total_secs = tmp; /* used for cast elimination */
+
+ days = tmp / SECONDS_PER_DAY; /* 86400 is number of seconds in a day */
+ tmp = tmp % SECONDS_PER_DAY; /* grab remainder to process hours */
+ hrs = tmp / SECONDS_PER_HOUR; /* 3600 is number of seconds in a(n) hour */
+ tmp = tmp % SECONDS_PER_HOUR; /* grab remainder to process minutes */
+ mins = tmp / SECONDS_PER_MIN; /* 60 is number of seconds in a minute */
+ secs = tmp % SECONDS_PER_MIN; /* grab remainder to process seconds */
+
+ if (total_secs)
+ pps = (pc.total_from_pcap / int_total_secs);
+ else
+ pps = pc.total_from_pcap; /* guard against division by zero */
+
+ /* Use ErrorMessage because this is logged whether
+ * or not logging quietly */
+ ErrorMessage("Snort ran for %u Days %u Hours %u Minutes %u Seconds\n",
+ days, hrs, mins, secs);
+
+ if (days > 0)
+ {
+ ppd = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_DAY));
+ ErrorMessage("Snort Analyzed " STDu64 " Packets Per Day\n", ppd);
+ hflag = 1;
+ }
+
+ if (hrs > 0 || hflag == 1)
+ {
+ pph = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_HOUR));
+ ErrorMessage("Snort Analyzed " STDu64 " Packets Per Hour\n", pph);
+ mflag = 1;
+ }
+
+ if (mins > 0 || mflag == 1)
+ {
+ ppm = (pc.total_from_pcap / (int_total_secs / SECONDS_PER_MIN));
+ ErrorMessage("Snort Analyzed " STDu64 " Packets Per Minute\n", ppm);
+ }
+
+ ErrorMessage("Snort Analyzed " STDu64 " Packets Per Second\n", pps);
+ ErrorMessage("\n");
+}
+#endif /* TIMESTATS */
+
+
+#ifdef PCAP_CLOSE
+int UpdatePcapPktStats(int cacheReturn)
+#else
+int UpdatePcapPktStats(void)
+#endif
+{
+ struct pcap_stat ps;
+ uint32_t recv, drop;
+ static char not_initialized = 1;
+
+#ifdef PCAP_CLOSE
+ static int priorReturn = 0;
+ static int returnWasCached = 0;
+
+ if ( !cacheReturn && returnWasCached )
+ {
+ returnWasCached = 0;
+ return priorReturn;
+ }
+ priorReturn = -1;
+ returnWasCached = cacheReturn;
+#endif
+
+ if (not_initialized)
+ {
+ memset(&pkt_stats, 0, sizeof(PcapPktStats));
+ not_initialized = 0;
+ }
+
+ if ((pcap_handle == NULL) || ScReadMode())
+ return -1;
+
+ if (pcap_stats(pcap_handle, &ps) == -1)
+ {
+ pcap_perror(pcap_handle, "pcap_stats");
+ return -1;
+ }
+
+ recv = (uint32_t)ps.ps_recv;
+ drop = (uint32_t)ps.ps_drop;
+
+#ifdef LINUX_LIBPCAP_DOUBLES_STATS
+ recv /= 2;
+ drop /= 2;
+#endif
+
+#ifdef LIBPCAP_ACCUMULATES
+ /* pcap recv wrapped */
+ if (recv < pkt_stats.wrap_recv)
+ pkt_stats.recv += (uint64_t)UINT32_MAX;
+
+ /* pcap drop wrapped */
+ if (drop < pkt_stats.wrap_drop)
+ pkt_stats.drop += (uint64_t)UINT32_MAX;
+
+ pkt_stats.wrap_recv = recv;
+ pkt_stats.wrap_drop = drop;
+#else
+ pkt_stats.recv += (uint64_t)recv;
+ pkt_stats.drop += (uint64_t)drop;
+#endif /* LIBPCAP_ACCUMULATES */
+
+#ifdef PCAP_CLOSE
+ priorReturn = 0;
+#endif
+ return 0;
+}
+
+uint64_t GetPcapPktStatsRecv(void)
+{
+ return pkt_stats.recv + (uint64_t)pkt_stats.wrap_recv;
+}
+
+uint64_t GetPcapPktStatsDrop(void)
+{
+ return pkt_stats.drop + (uint64_t)pkt_stats.wrap_drop;
+}
+
+
+#ifdef PCAP_CLOSE
+/* exiting should be 0 for if not exiting, 1 if restarting, and 2 if exiting */
+#else
+/* exiting should be 0 for if not exiting and 1 if exiting */
+#endif
+void DropStats(int exiting)
+{
+ PreprocStatsFuncNode *idx;
+ uint64_t total = 0;
+ uint64_t pkts_recv;
+ uint64_t pkts_drop;
+
+ total = pc.total_processed;
+
+#ifdef PPM_MGR
+ PPM_PRINT_SUMMARY(&snort_conf->ppm_cfg);
+#endif
+
+ LogMessage("================================================"
+ "===============================\n");
+
+#ifdef TIMESTATS
+ TimeStats(); /* how long did snort run? */
+#endif
+
+ if (ScReadMode()
+#ifdef GIDS
+ || ScAdapterInlineMode()
+#endif
+ )
+ {
+ LogMessage("Snort processed " STDu64 " packets.\n", total);
+ }
+ else
+ {
+#ifdef PCAP_CLOSE
+ if (exiting < 2 && (pcap_handle == NULL))
+#else
+ if (pcap_handle == NULL)
+#endif
+ {
+ LogMessage("Snort received 0 packets\n");
+ }
+ else
+ {
+#ifdef PCAP_CLOSE
+ if (UpdatePcapPktStats(0) != -1)
+#else
+ if (UpdatePcapPktStats() != -1)
+#endif
+ {
+ pkts_recv = GetPcapPktStatsRecv();
+ pkts_drop = GetPcapPktStatsDrop();
+
+ LogMessage("Packet Wire Totals:\n");
+ LogMessage(" Received: " FMTu64("12") "\n", pkts_recv);
+ LogMessage(" Analyzed: " FMTu64("12") " (%.3f%%)\n", pc.total_from_pcap,
+ CalcPct(pc.total_from_pcap, pkts_recv));
+ LogMessage(" Dropped: " FMTu64("12") " (%.3f%%)\n", pkts_drop,
+ CalcPct(pkts_drop, pkts_recv));
+ LogMessage("Outstanding: " FMTu64("12") " (%.3f%%)\n",
+ pkts_recv - pkts_drop - pc.total_from_pcap,
+ CalcPct((pkts_recv - pkts_drop - pc.total_from_pcap), pkts_recv));
+ }
+ else
+ {
+ LogMessage("Unable to calculate percentages for stats\n");
+ LogMessage("Total number of packets Analyzed: " FMTu64("12") "\n", pc.total_from_pcap);
+ }
+ }
+ }
+
+ LogMessage("================================================"
+ "===============================\n");
+
+ LogMessage("Breakdown by protocol (includes rebuilt packets):\n");
+
+ LogMessage(" ETH: " FMTu64("-10") " (%.3f%%)\n",
+ pc.eth, CalcPct(pc.eth, total));
+ LogMessage(" ETHdisc: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ethdisc, CalcPct(pc.ethdisc, total));
+#ifdef GIDS
+#ifndef IPFW
+ LogMessage(" IPTables: " FMTu64("-10") " (%.3f%%)\n",
+ pc.iptables, CalcPct(pc.iptables, total));
+#else
+ LogMessage(" IPFW: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ipfw, CalcPct(pc.ipfw, total));
+#endif /* IPFW */
+#endif /* GIDS */
+ LogMessage(" VLAN: " FMTu64("-10") " (%.3f%%)\n",
+ pc.vlan, CalcPct(pc.vlan, total));
+
+ if (pc.nested_vlan != 0)
+ LogMessage("Nested VLAN: " FMTu64("-10") " (%.3f%%)\n",
+ pc.nested_vlan, CalcPct(pc.nested_vlan, total));
+
+ LogMessage(" IPV6: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ipv6, CalcPct(pc.ipv6, total));
+ LogMessage(" IP6 EXT: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ip6ext, CalcPct(pc.ip6ext, total));
+ LogMessage(" IP6opts: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ipv6opts, CalcPct(pc.ipv6opts, total));
+ LogMessage(" IP6disc: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ipv6disc, CalcPct(pc.ipv6disc, total));
+
+ LogMessage(" IP4: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ip, CalcPct(pc.ip, total));
+ LogMessage(" IP4disc: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ipdisc, CalcPct(pc.ipdisc, total));
+
+ LogMessage(" TCP 6: " FMTu64("-10") " (%.3f%%)\n",
+ pc.tcp6, CalcPct(pc.tcp6, total));
+ LogMessage(" UDP 6: " FMTu64("-10") " (%.3f%%)\n",
+ pc.udp6, CalcPct(pc.udp6, total));
+ LogMessage(" ICMP6: " FMTu64("-10") " (%.3f%%)\n",
+ pc.icmp6, CalcPct(pc.icmp6, total));
+ LogMessage(" ICMP-IP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.embdip, CalcPct(pc.embdip, total));
+
+ LogMessage(" TCP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.tcp, CalcPct(pc.tcp, total));
+ LogMessage(" UDP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.udp, CalcPct(pc.udp, total));
+ LogMessage(" ICMP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.icmp, CalcPct(pc.icmp, total));
+
+ LogMessage(" TCPdisc: " FMTu64("-10") " (%.3f%%)\n",
+ pc.tdisc, CalcPct(pc.tdisc, total));
+ LogMessage(" UDPdisc: " FMTu64("-10") " (%.3f%%)\n",
+ pc.udisc, CalcPct(pc.udisc, total));
+ LogMessage(" ICMPdis: " FMTu64("-10") " (%.3f%%)\n",
+ pc.icmpdisc, CalcPct(pc.icmpdisc, total));
+
+ LogMessage(" FRAG: " FMTu64("-10") " (%.3f%%)\n",
+ pc.frags, CalcPct(pc.frags, total));
+ LogMessage(" FRAG 6: " FMTu64("-10") " (%.3f%%)\n",
+ pc.frag6, CalcPct(pc.frag6, total));
+
+ LogMessage(" ARP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.arp, CalcPct(pc.arp, total));
+#ifndef NO_NON_ETHER_DECODER
+ LogMessage(" EAPOL: " FMTu64("-10") " (%.3f%%)\n",
+ pc.eapol, CalcPct(pc.eapol, total));
+#endif
+ LogMessage(" ETHLOOP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ethloopback, CalcPct(pc.ethloopback, total));
+ LogMessage(" IPX: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ipx, CalcPct(pc.ipx, total));
+#ifdef GRE
+ LogMessage("IPv4/IPv4: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ip4ip4, CalcPct(pc.ip4ip4, total));
+ LogMessage("IPv4/IPv6: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ip4ip6, CalcPct(pc.ip4ip6, total));
+ LogMessage("IPv6/IPv4: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ip6ip4, CalcPct(pc.ip6ip4, total));
+ LogMessage("IPv6/IPv6: " FMTu64("-10") " (%.3f%%)\n",
+ pc.ip6ip6, CalcPct(pc.ip6ip6, total));
+ LogMessage(" GRE: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre, CalcPct(pc.gre, total));
+ LogMessage(" GRE ETH: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_eth, CalcPct(pc.gre_eth, total));
+ LogMessage(" GRE VLAN: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_vlan, CalcPct(pc.gre_vlan, total));
+ LogMessage(" GRE IPv4: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_ip, CalcPct(pc.gre_ip, total));
+ LogMessage(" GRE IPv6: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_ipv6, CalcPct(pc.gre_ipv6, total));
+ LogMessage("GRE IP6 E: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_ipv6ext, CalcPct(pc.gre_ipv6ext, total));
+ LogMessage(" GRE PPTP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_ppp, CalcPct(pc.gre_ppp, total));
+ LogMessage(" GRE ARP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_arp, CalcPct(pc.gre_arp, total));
+ LogMessage(" GRE IPX: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_ipx, CalcPct(pc.gre_ipx, total));
+ LogMessage(" GRE LOOP: " FMTu64("-10") " (%.3f%%)\n",
+ pc.gre_loopback, CalcPct(pc.gre_loopback, total));
+#endif /* GRE */
+#ifdef MPLS
+ LogMessage(" MPLS: " FMTu64("-10") " (%.3f%%)\n",
+ pc.mpls, CalcPct(pc.mpls, total));
+#endif
+ LogMessage(" OTHER: " FMTu64("-10") " (%.3f%%)\n",
+ pc.other, CalcPct(pc.other, total));
+ LogMessage(" DISCARD: " FMTu64("-10") " (%.3f%%)\n",
+ pc.discards, CalcPct(pc.discards, total));
+ LogMessage("InvChkSum: " FMTu64("-10") " (%.3f%%)\n",
+ pc.invalid_checksums, CalcPct(pc.invalid_checksums, total));
+
+ LogMessage(" S5 G 1: " FMTu64("-10") " (%.3f%%)\n",
+ pc.s5tcp1, CalcPct(pc.s5tcp1, total));
+ LogMessage(" S5 G 2: " FMTu64("-10") " (%.3f%%)\n",
+ pc.s5tcp2, CalcPct(pc.s5tcp2, total));
+
+ LogMessage(" Total: " FMTu64("-10") "\n", total);
+
+ LogMessage("================================================"
+ "===============================\n");
+
+ LogMessage("Action Stats:\n");
+ LogMessage("ALERTS: " STDu64 "\n", pc.alert_pkts);
+ LogMessage("LOGGED: " STDu64 "\n", pc.log_pkts);
+ LogMessage("PASSED: " STDu64 "\n", pc.pass_pkts);
+
+#ifdef TARGET_BASED
+ if (ScIdsMode() && IsAdaptiveConfigured(getDefaultPolicy(), 0))
+ {
+ LogMessage("================================================"
+ "===============================\n");
+ LogMessage("Attribute Table Stats:\n");
+ LogMessage(" Number Entries: %u\n", SFAT_NumberOfHosts());
+ LogMessage(" Table Reloaded: " STDu64 "\n", pc.attribute_table_reloads);
+ }
+#endif /* TARGET_BASED */
+
+ //mpse_print_qinfo();
+
+#ifndef NO_NON_ETHER_DECODER
+#ifdef DLT_IEEE802_11
+ if(datalink == DLT_IEEE802_11)
+ {
+ LogMessage("================================================"
+ "===============================\n");
+ LogMessage("Wireless Stats:\n");
+ LogMessage("Breakdown by type:\n");
+ LogMessage(" Management Packets: " FMTu64("-10") " (%.3f%%)\n",
+ pc.wifi_mgmt, CalcPct(pc.wifi_mgmt, total));
+ LogMessage(" Control Packets: " FMTu64("-10") " (%.3f%%)\n",
+ pc.wifi_control, CalcPct(pc.wifi_control, total));
+ LogMessage(" Data Packets: " FMTu64("-10") " (%.3f%%)\n",
+ pc.wifi_data, CalcPct(pc.wifi_data, total));
+ }
+#endif /* DLT_IEEE802_11 */
+#endif // NO_NON_ETHER_DECODER
+
+ for (idx = preproc_stats_funcs; idx != NULL; idx = idx->next)
+ {
+ LogMessage("=============================================="
+ "=================================\n");
+
+#ifdef PCAP_CLOSE
+ idx->func(exiting ? 1 : 0);
+#else
+ idx->func(exiting);
+#endif
+ }
+
+ LogMessage("=============================================="
+ "=================================\n");
+
+ return;
+}
+
+/****************************************************************************
+ *
+ * Function: CleanupProtoNames()
+ *
+ * Purpose: Frees the protocol names
+ *
+ * Arguments: None.
+ *
+ * Returns: void function
+ *
+ ****************************************************************************/
+void CleanupProtoNames(void)
+{
+ int i;
+
+ for(i = 0; i < 256; i++)
+ {
+ if( protocol_names[i] != NULL )
+ {
+ free( protocol_names[i] );
+ protocol_names[i] = NULL;
+ }
+ }
+}
+
+/****************************************************************************
+ *
+ * Function: read_infile(char *)
+ *
+ * Purpose: Reads the BPF filters in from a file. Ripped from tcpdump.
+ *
+ * Arguments: fname => the name of the file containing the BPF filters
+ *
+ * Returns: the processed BPF string
+ *
+ ****************************************************************************/
+char *read_infile(char *fname)
+{
+ register int fd, cc;
+ register char *cp, *cmt;
+ struct stat buf;
+
+ fd = open(fname, O_RDONLY);
+
+ if(fd < 0)
+ FatalError("can't open %s: %s\n", fname, pcap_strerror(errno));
+
+ if(fstat(fd, &buf) < 0)
+ FatalError("can't stat %s: %s\n", fname, pcap_strerror(errno));
+
+ cp = (char *)SnortAlloc(((u_int)buf.st_size + 1) * sizeof(char));
+
+ cc = read(fd, cp, (int) buf.st_size);
+
+ if(cc < 0)
+ FatalError("read %s: %s\n", fname, pcap_strerror(errno));
+
+ if(cc != buf.st_size)
+ FatalError("short read %s (%d != %d)\n", fname, cc, (int) buf.st_size);
+
+ cp[(int) buf.st_size] = '\0';
+
+ close(fd);
+
+ /* Treat everything upto the end of the line as a space
+ * so that we can put comments in our BPF filters
+ */
+
+ while((cmt = strchr(cp, '#')) != NULL)
+ {
+ while (*cmt != '\r' && *cmt != '\n' && *cmt != '\0')
+ {
+ *cmt++ = ' ';
+ }
+ }
+
+ /** LogMessage("BPF filter file: %s\n", fname); **/
+
+ return(cp);
+}
+
+
+ /****************************************************************************
+ *
+ * Function: CheckLogDir()
+ *
+ * Purpose: CyberPsychotic sez: basically we only check if logdir exist and
+ * writable, since it might screw the whole thing in the middle. Any
+ * other checks could be performed here as well.
+ *
+ * Arguments: None.
+ *
+ * Returns: void function
+ *
+ ****************************************************************************/
+void CheckLogDir(void)
+{
+ struct stat st;
+
+ if (snort_conf->log_dir == NULL)
+ return;
+
+ if (stat(snort_conf->log_dir, &st) == -1)
+ FatalError("Stat check on log dir failed: %s.\n", strerror(errno));
+
+ if (!S_ISDIR(st.st_mode) || (access(snort_conf->log_dir, W_OK) == -1))
+ {
+ FatalError("Can not get write access to logging directory \"%s\". "
+ "(directory doesn't exist or permissions are set incorrectly "
+ "or it is not a directory at all)\n",
+ snort_conf->log_dir);
+ }
+}
+
+/* Signal handler for child process signaling the parent
+ * that is is ready */
+static int parent_wait = 1;
+static void SigChildReadyHandler(int signal)
+{
+#ifdef DEBUG
+ LogMessage("Received Signal from Child\n");
+#endif
+ parent_wait = 0;
+}
+
+/****************************************************************************
+ *
+ * Function: GoDaemon()
+ *
+ * Purpose: Puts the program into daemon mode, nice and quiet like....
+ *
+ * Arguments: None.
+ *
+ * Returns: void function
+ *
+ ****************************************************************************/
+void GoDaemon(void)
+{
+#ifndef WIN32
+ int exit_val = 0;
+ pid_t fs;
+
+ LogMessage("Initializing daemon mode\n");
+
+ if (ScDaemonRestart())
+ return;
+
+ /* Don't daemonize if we've already daemonized and
+ * received a SIGHUP. */
+ if(getppid() != 1)
+ {
+ /* Register signal handler that parent can trap signal */
+ signal(SIGNAL_SNORT_CHILD_READY, SigChildReadyHandler);
+ if (errno != 0) errno=0;
+
+ /* now fork the child */
+ fs = fork();
+
+ if(fs > 0)
+ {
+ /* Parent */
+
+ /* Don't exit quite yet. Wait for the child
+ * to signal that is there and created the PID
+ * file.
+ */
+ while (parent_wait)
+ {
+ /* Continue waiting until receiving signal from child */
+ int status;
+ if (waitpid(fs, &status, WNOHANG) == fs)
+ {
+ /* If the child is gone, parent should go away, too */
+ if (WIFEXITED(status))
+ {
+ LogMessage("Child exited unexpectedly\n");
+ exit_val = -1;
+ break;
+ }
+
+ if (WIFSIGNALED(status))
+ {
+ LogMessage("Child terminated unexpectedly\n");
+ exit_val = -2;
+ break;
+ }
+ }
+#ifdef DEBUG
+ LogMessage("Parent waiting for child...\n");
+#endif
+
+ sleep(1);
+ }
+
+ LogMessage("Daemon parent exiting\n");
+
+ exit(exit_val); /* parent */
+ }
+
+ if(fs < 0)
+ {
+ /* Daemonizing failed... */
+ perror("fork");
+ exit(1);
+ }
+
+ /* Child */
+ setsid();
+ }
+
+ close(0);
+ close(1);
+ close(2);
+
+#ifdef DEBUG
+ /* redirect stdin/stdout/stderr to a file */
+ open("/tmp/snort.debug", O_CREAT | O_RDWR); /* stdin, fd 0 */
+
+ /* Change ownership to that which we will drop privileges to */
+ if ((snort_conf->user_id != -1) || (snort_conf->group_id != -1))
+ {
+ uid_t user_id = getuid();
+ gid_t group_id = getgid();
+
+ if (snort_conf->user_id != -1)
+ user_id = snort_conf->user_id;
+ if (snort_conf->group_id != -1)
+ group_id = snort_conf->group_id;
+
+ chown("/tmp/snort.debug", user_id, group_id);
+ }
+#else
+ /* redirect stdin/stdout/stderr to /dev/null */
+ (void)open("/dev/null", O_RDWR); /* stdin, fd 0 */
+#endif
+
+ dup(0); /* stdout, fd 0 => fd 1 */
+ dup(0); /* stderr, fd 0 => fd 2 */
+
+ SignalWaitingParent();
+
+#endif /* ! WIN32 */
+}
+
+/* Signal the parent that child is ready */
+void SignalWaitingParent(void)
+{
+#ifndef WIN32
+ pid_t parentpid = getppid();
+#ifdef DEBUG
+ LogMessage("Signaling parent %d from child %d\n", parentpid, getpid());
+#endif
+
+ if (kill(parentpid, SIGNAL_SNORT_CHILD_READY))
+ {
+ LogMessage("Daemon initialized, failed to signal parent pid: %d, failure: %d, %s\n", parentpid, errno, strerror(errno));
+ }
+ else
+ {
+ LogMessage("Daemon initialized, signaled parent pid: %d\n", parentpid);
+ }
+#endif
+}
+
+/* This function has been moved into mstring.c, since that
+* is where the allocation actually occurs. It has been
+* renamed to mSplitFree().
+*
+void FreeToks(char **toks, int num_toks)
+{
+ if (toks)
+ {
+ if (num_toks > 0)
+ {
+ do
+ {
+ num_toks--;
+ free(toks[num_toks]);
+ } while(num_toks);
+ }
+ free(toks);
+ }
+}
+*/
+
+
+/* Self preserving memory allocator */
+void *SPAlloc(unsigned long size, struct _SPMemControl *spmc)
+{
+ void *tmp;
+
+ spmc->mem_usage += size;
+
+ if(spmc->mem_usage > spmc->memcap)
+ {
+ spmc->sp_func(spmc);
+ }
+
+ tmp = (void *) calloc(size, sizeof(char));
+
+ if(tmp == NULL)
+ {
+ FatalError("Unable to allocate memory! (%lu requested, %lu in use)\n",
+ size, spmc->mem_usage);
+ }
+
+ return tmp;
+}
+
+/* Guaranteed to be '\0' terminated even if truncation occurs.
+ *
+ * returns SNORT_SNPRINTF_SUCCESS if successful
+ * returns SNORT_SNPRINTF_TRUNCATION on truncation
+ * returns SNORT_SNPRINTF_ERROR on error
+ */
+int SnortSnprintf(char *buf, size_t buf_size, const char *format, ...)
+{
+ va_list ap;
+ int ret;
+
+ if (buf == NULL || buf_size <= 0 || format == NULL)
+ return SNORT_SNPRINTF_ERROR;
+
+ /* zero first byte in case an error occurs with
+ * vsnprintf, so buffer is null terminated with
+ * zero length */
+ buf[0] = '\0';
+ buf[buf_size - 1] = '\0';
+
+ va_start(ap, format);
+
+ ret = vsnprintf(buf, buf_size, format, ap);
+
+ va_end(ap);
+
+ if (ret < 0)
+ return SNORT_SNPRINTF_ERROR;
+
+ if (buf[buf_size - 1] != '\0' || (size_t)ret >= buf_size)
+ {
+ /* result was truncated */
+ buf[buf_size - 1] = '\0';
+ return SNORT_SNPRINTF_TRUNCATION;
+ }
+
+ return SNORT_SNPRINTF_SUCCESS;
+}
+
+/* Appends to a given string
+ * Guaranteed to be '\0' terminated even if truncation occurs.
+ *
+ * returns SNORT_SNPRINTF_SUCCESS if successful
+ * returns SNORT_SNPRINTF_TRUNCATION on truncation
+ * returns SNORT_SNPRINTF_ERROR on error
+ */
+int SnortSnprintfAppend(char *buf, size_t buf_size, const char *format, ...)
+{
+ int str_len;
+ int ret;
+ va_list ap;
+
+ if (buf == NULL || buf_size <= 0 || format == NULL)
+ return SNORT_SNPRINTF_ERROR;
+
+ str_len = SnortStrnlen(buf, buf_size);
+
+ /* since we've already checked buf and buf_size an error
+ * indicates no null termination, so just start at
+ * beginning of buffer */
+ if (str_len == SNORT_STRNLEN_ERROR)
+ {
+ buf[0] = '\0';
+ str_len = 0;
+ }
+
+ buf[buf_size - 1] = '\0';
+
+ va_start(ap, format);
+
+ ret = vsnprintf(buf + str_len, buf_size - (size_t)str_len, format, ap);
+
+ va_end(ap);
+
+ if (ret < 0)
+ return SNORT_SNPRINTF_ERROR;
+
+ if (buf[buf_size - 1] != '\0' || (size_t)ret >= buf_size)
+ {
+ /* truncation occured */
+ buf[buf_size - 1] = '\0';
+ return SNORT_SNPRINTF_TRUNCATION;
+ }
+
+ return SNORT_SNPRINTF_SUCCESS;
+}
+
+/* Guaranteed to be '\0' terminated even if truncation occurs.
+ *
+ * Arguments: dst - the string to contain the copy
+ * src - the string to copy from
+ * dst_size - the size of the destination buffer
+ * including the null byte.
+ *
+ * returns SNORT_STRNCPY_SUCCESS if successful
+ * returns SNORT_STRNCPY_TRUNCATION on truncation
+ * returns SNORT_STRNCPY_ERROR on error
+ *
+ * Note: Do not set dst[0] = '\0' on error since it's possible that
+ * dst and src are the same pointer - it will at least be null
+ * terminated in any case
+ */
+int SnortStrncpy(char *dst, const char *src, size_t dst_size)
+{
+ char *ret = NULL;
+
+ if (dst == NULL || src == NULL || dst_size <= 0)
+ return SNORT_STRNCPY_ERROR;
+
+ dst[dst_size - 1] = '\0';
+
+ ret = strncpy(dst, src, dst_size);
+
+ /* Not sure if this ever happens but might as
+ * well be on the safe side */
+ if (ret == NULL)
+ return SNORT_STRNCPY_ERROR;
+
+ if (dst[dst_size - 1] != '\0')
+ {
+ /* result was truncated */
+ dst[dst_size - 1] = '\0';
+ return SNORT_STRNCPY_TRUNCATION;
+ }
+
+ return SNORT_STRNCPY_SUCCESS;
+}
+
+char *SnortStrndup(const char *src, size_t dst_size)
+{
+ char *ret = SnortAlloc(dst_size + 1);
+ int ret_val;
+
+ ret_val = SnortStrncpy(ret, src, dst_size + 1);
+
+ if(ret_val == SNORT_STRNCPY_ERROR)
+ {
+ free(ret);
+ return NULL;
+ }
+
+ return ret;
+}
+
+/* Determines whether a buffer is '\0' terminated and returns the
+ * string length if so
+ *
+ * returns the string length if '\0' terminated
+ * returns SNORT_STRNLEN_ERROR if not '\0' terminated
+ */
+int SnortStrnlen(const char *buf, int buf_size)
+{
+ int i = 0;
+
+ if (buf == NULL || buf_size <= 0)
+ return SNORT_STRNLEN_ERROR;
+
+ for (i = 0; i < buf_size; i++)
+ {
+ if (buf[i] == '\0')
+ break;
+ }
+
+ if (i == buf_size)
+ return SNORT_STRNLEN_ERROR;
+
+ return i;
+}
+
+char * SnortStrdup(const char *str)
+{
+ char *copy = NULL;
+
+ if (!str)
+ {
+ FatalError("Unable to duplicate string: NULL!\n");
+ }
+
+ copy = strdup(str);
+
+ if (copy == NULL)
+ {
+ FatalError("Unable to duplicate string: %s!\n", str);
+ }
+
+ return copy;
+}
+
+/*
+ * Find first occurrence of char of accept in s, limited by slen.
+ * A 'safe' version of strpbrk that won't read past end of buffer s
+ * in cases that s is not NULL terminated.
+ *
+ * This code assumes 'accept' is a static string.
+ */
+const char *SnortStrnPbrk(const char *s, int slen, const char *accept)
+{
+ char ch;
+ const char *s_end;
+ if (!s || !*s || !accept || slen == 0)
+ return NULL;
+
+ s_end = s + slen;
+ while (s < s_end)
+ {
+ ch = *s;
+ if (strchr(accept, ch))
+ return s;
+ s++;
+ }
+ return NULL;
+}
+
+/*
+ * Find first occurrence of searchstr in s, limited by slen.
+ * A 'safe' version of strstr that won't read past end of buffer s
+ * in cases that s is not NULL terminated.
+ */
+const char *SnortStrnStr(const char *s, int slen, const char *searchstr)
+{
+ char ch, nc;
+ int len;
+ if (!s || !*s || !searchstr || slen == 0)
+ return NULL;
+
+ if ((ch = *searchstr++) != 0)
+ {
+ len = strlen(searchstr);
+ do
+ {
+ do
+ {
+ if ((nc = *s++) == 0)
+ {
+ return NULL;
+ }
+ slen--;
+ if (slen == 0)
+ return NULL;
+ } while (nc != ch);
+ if (slen - len < 0)
+ return NULL;
+ } while (memcmp(s, searchstr, len) != 0);
+ s--;
+ slen++;
+ }
+ return s;
+}
+
+/*
+ * Find first occurrence of substring in s, ignore case.
+*/
+const char *SnortStrcasestr(const char *s, const char *substr)
+{
+ char ch, nc;
+ int len;
+
+ if (!s || !*s || !substr)
+ return NULL;
+
+ if ((ch = *substr++) != 0)
+ {
+ ch = tolower((char)ch);
+ len = strlen(substr);
+ do
+ {
+ do
+ {
+ if ((nc = *s++) == 0)
+ {
+ return NULL;
+ }
+ } while ((char)tolower((uint8_t)nc) != ch);
+ } while (strncasecmp(s, substr, len) != 0);
+ s--;
+ }
+ return s;
+}
+
+void *SnortAlloc(unsigned long size)
+{
+ void *tmp;
+
+ tmp = (void *) calloc(size, sizeof(char));
+
+ if(tmp == NULL)
+ {
+ FatalError("Unable to allocate memory! (%lu requested)\n", size);
+ }
+
+ return tmp;
+}
+
+void * SnortAlloc2(size_t size, const char *format, ...)
+{
+ void *tmp;
+
+ tmp = (void *)calloc(size, sizeof(char));
+
+ if(tmp == NULL)
+ {
+ va_list ap;
+ char buf[STD_BUF];
+
+ buf[STD_BUF - 1] = '\0';
+
+ va_start(ap, format);
+
+ vsnprintf(buf, STD_BUF - 1, format, ap);
+
+ va_end(ap);
+
+ FatalError("%s", buf);
+ }
+
+ return tmp;
+}
+
+/**
+ * Chroot and adjust the snort_conf->log_dir reference
+ *
+ * @param directory directory to chroot to
+ * @param logstore ptr to snort_conf->log_dir which must be dynamically allocated
+ */
+void SetChroot(char *directory, char **logstore)
+{
+#ifdef WIN32
+ FatalError("SetChroot() should not be called under Win32!\n");
+#else
+ char *absdir;
+ size_t abslen;
+ char *logdir;
+
+ if(!directory || !logstore)
+ {
+ FatalError("Null parameter passed\n");
+ }
+
+ logdir = *logstore;
+
+ if(logdir == NULL || *logdir == '\0')
+ {
+ FatalError("Null log directory\n");
+ }
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT,"SetChroot: %s\n",
+ CurrentWorkingDir()););
+
+ logdir = GetAbsolutePath(logdir);
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT, "SetChroot: %s\n",
+ CurrentWorkingDir()));
+
+ logdir = SnortStrdup(logdir);
+
+ /* We're going to reset logstore, so free it now */
+ free(*logstore);
+ *logstore = NULL;
+
+ /* change to the directory */
+ if(chdir(directory) != 0)
+ {
+ FatalError("SetChroot: Can not chdir to \"%s\": %s\n", directory,
+ strerror(errno));
+ }
+
+ /* always returns an absolute pathname */
+ absdir = CurrentWorkingDir();
+
+ if(absdir == NULL)
+ {
+ FatalError("NULL Chroot found\n");
+ }
+
+ abslen = strlen(absdir);
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT, "ABS: %s %d\n", absdir, abslen););
+
+ /* make the chroot call */
+ if(chroot(absdir) < 0)
+ {
+ FatalError("Can not chroot to \"%s\": absolute: %s: %s\n",
+ directory, absdir, strerror(errno));
+ }
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chroot success (%s ->", absdir););
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT,"%s)\n ", CurrentWorkingDir()););
+
+ /* change to "/" in the new directory */
+ if(chdir("/") < 0)
+ {
+ FatalError("Can not chdir to \"/\" after chroot: %s\n",
+ strerror(errno));
+ }
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT,"chdir success (%s)\n",
+ CurrentWorkingDir()););
+
+
+ if(strncmp(absdir, logdir, strlen(absdir)))
+ {
+ FatalError("Absdir is not a subset of the logdir");
+ }
+
+ if(abslen >= strlen(logdir))
+ {
+ *logstore = SnortStrdup("/");
+ }
+ else
+ {
+ *logstore = SnortStrdup(logdir + abslen);
+ }
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT,"new logdir from %s to %s\n",
+ logdir, *logstore));
+
+ LogMessage("Chroot directory = %s\n", directory);
+
+#if 0
+ /* XXX XXX */
+ /* install the I can't do this signal handler */
+ signal(SIGHUP, SigCantHupHandler);
+#endif
+#endif /* !WIN32 */
+}
+
+
+/**
+ * Return a ptr to the absolute pathname of snort. This memory must
+ * be copied to another region if you wish to save it for later use.
+ */
+char *CurrentWorkingDir(void)
+{
+ static char buf[PATH_MAX_UTIL + 1];
+
+ if(getcwd((char *) buf, PATH_MAX_UTIL) == NULL)
+ {
+ return NULL;
+ }
+
+ buf[PATH_MAX_UTIL] = '\0';
+
+ return (char *) buf;
+}
+
+/**
+ * Given a directory name, return a ptr to a static
+ */
+char *GetAbsolutePath(char *dir)
+{
+ char *savedir, *dirp;
+ static char buf[PATH_MAX_UTIL + 1];
+
+ if(dir == NULL)
+ {
+ return NULL;
+ }
+
+ savedir = strdup(CurrentWorkingDir());
+
+ if(savedir == NULL)
+ {
+ return NULL;
+ }
+
+ if(chdir(dir) < 0)
+ {
+ LogMessage("Can't change to directory: %s\n", dir);
+ free(savedir);
+ return NULL;
+ }
+
+ dirp = CurrentWorkingDir();
+
+ if(dirp == NULL)
+ {
+ LogMessage("Unable to access current directory\n");
+ free(savedir);
+ return NULL;
+ }
+ else
+ {
+ strncpy(buf, dirp, PATH_MAX_UTIL);
+ buf[PATH_MAX_UTIL] = '\0';
+ }
+
+ if(chdir(savedir) < 0)
+ {
+ LogMessage("Can't change back to directory: %s\n", dir);
+ free(savedir);
+ return NULL;
+ }
+
+ free(savedir);
+ return (char *) buf;
+}
+
+
+#ifndef WIN32
+/* very slow sort - do not use at runtime! */
+SF_LIST * SortDirectory(const char *path)
+{
+ SF_LIST *dir_entries;
+ DIR *dir;
+ struct dirent *direntry;
+ int ret = 0;
+
+ if (path == NULL)
+ return NULL;
+
+ dir_entries = sflist_new();
+ if (dir_entries == NULL)
+ {
+ ErrorMessage("Could not allocate new list for directory entries\n");
+ return NULL;
+ }
+
+ dir = opendir(path);
+ if (dir == NULL)
+ {
+ ErrorMessage("Error opening directory: %s: %s\n",
+ path, strerror(errno));
+ sflist_free_all(dir_entries, free);
+ return NULL;
+ }
+
+ /* Reset errno since we'll be checking it unconditionally */
+ errno = 0;
+
+ while ((direntry = readdir(dir)) != NULL)
+ {
+ char *node_entry_name, *dir_entry_name;
+ SF_LNODE *node;
+
+ dir_entry_name = SnortStrdup(direntry->d_name);
+
+ for (node = sflist_first_node(dir_entries);
+ node != NULL;
+ node = sflist_next_node(dir_entries))
+ {
+ node_entry_name = (char *)node->ndata;
+ if (strcmp(dir_entry_name, node_entry_name) < 0)
+ break;
+ }
+
+ if (node == NULL)
+ ret = sflist_add_tail(dir_entries, (NODE_DATA)dir_entry_name);
+ else
+ ret = sflist_add_before(dir_entries, node, (NODE_DATA)dir_entry_name);
+
+ if (ret == -1)
+ {
+ ErrorMessage("Error adding directory entry to list\n");
+ sflist_free_all(dir_entries, free);
+ closedir(dir);
+ return NULL;
+ }
+ }
+
+ if (errno != 0)
+ {
+ ErrorMessage("Error reading directory: %s: %s\n",
+ path, strerror(errno));
+ errno = 0;
+ sflist_free_all(dir_entries, free);
+ closedir(dir);
+ return NULL;
+ }
+
+ closedir(dir);
+
+ return dir_entries;
+}
+
+int GetFilesUnderDir(const char *path, SF_QUEUE *dir_queue, const char *filter)
+{
+ SF_LIST *dir_entries;
+ char *direntry;
+ int ret = 0;
+ int num_files = 0;
+
+ if ((path == NULL) || (dir_queue == NULL))
+ return -1;
+
+ dir_entries = SortDirectory(path);
+ if (dir_entries == NULL)
+ {
+ ErrorMessage("Error sorting entries in directory: %s\n", path);
+ return -1;
+ }
+
+ for (direntry = (char *)sflist_first(dir_entries);
+ direntry != NULL;
+ direntry = (char *)sflist_next(dir_entries))
+ {
+ char path_buf[PATH_MAX];
+ struct stat file_stat;
+
+ /* Don't look at dot files */
+ if (strncmp(".", direntry, 1) == 0)
+ continue;
+
+ ret = SnortSnprintf(path_buf, PATH_MAX, "%s%s%s",
+ path, path[strlen(path) - 1] == '/' ? "" : "/", direntry);
+ if (ret == SNORT_SNPRINTF_TRUNCATION)
+ {
+ ErrorMessage("Error copying file to buffer: Path too long\n");
+ sflist_free_all(dir_entries, free);
+ return -1;
+ }
+ else if (ret != SNORT_SNPRINTF_SUCCESS)
+ {
+ ErrorMessage("Error copying file to buffer\n");
+ sflist_free_all(dir_entries, free);
+ return -1;
+ }
+
+ ret = stat(path_buf, &file_stat);
+ if (ret == -1)
+ {
+ ErrorMessage("Could not stat file: %s: %s\n",
+ path_buf, strerror(errno));
+ sflist_free_all(dir_entries, free);
+ return -1;
+ }
+
+ if (file_stat.st_mode & S_IFDIR)
+ {
+ ret = GetFilesUnderDir(path_buf, dir_queue, filter);
+ if (ret == -1)
+ {
+ sflist_free_all(dir_entries, free);
+ return -1;
+ }
+
+ num_files += ret;
+ }
+ else if (file_stat.st_mode & S_IFREG)
+ {
+ if ((filter == NULL) || (fnmatch(filter, direntry, 0) == 0))
+ {
+ char *file = SnortStrdup(path_buf);
+
+ ret = sfqueue_add(dir_queue, (NODE_DATA)file);
+ if (ret == -1)
+ {
+ ErrorMessage("Could not append item to list: %s\n", file);
+ free(file);
+ sflist_free_all(dir_entries, free);
+ return -1;
+ }
+
+ num_files++;
+ }
+ }
+ }
+
+ sflist_free_all(dir_entries, free);
+
+ return num_files;
+}
+#endif
+
+/****************************************************************************
+ *
+ * Function: GetUniqueName(char * iface)
+ *
+ * Purpose: To return a string that has a high probability of being unique
+ * for a given sensor.
+ *
+ * Arguments: char * iface - The network interface you are sniffing
+ *
+ * Returns: A char * -- its a static char * so you should not free it
+ *
+ ***************************************************************************/
+char *GetUniqueName(char * iface)
+{
+ char * rptr;
+ static char uniq_name[256];
+
+ if (iface == NULL) LogMessage("Interface is NULL. Name may not be unique for the host\n");
+#ifndef WIN32
+ rptr = GetIP(iface);
+ if(rptr == NULL || !strcmp(rptr, "unknown"))
+#endif
+ {
+ SnortSnprintf(uniq_name, 255, "%s:%s\n",GetHostname(),iface);
+ rptr = uniq_name;
+ }
+ if (ScLogVerbose()) LogMessage("Node unique name is: %s\n", rptr);
+ return rptr;
+}
+
+/****************************************************************************
+ *
+ * Function: GetIP(char * iface)
+ *
+ * Purpose: To return a string representing the IP address for an interface
+ *
+ * Arguments: char * iface - The network interface you want to find an IP
+ * address for.
+ *
+ * Returns: A char * -- make sure you call free on this when you are done
+ * with it.
+ *
+ ***************************************************************************/
+char *GetIP(char * iface)
+{
+ struct ifreq ifr;
+ struct sockaddr_in *addr;
+ int s;
+#ifdef SUP_IP6
+ sfip_t ret;
+#endif
+
+ if(iface)
+ {
+ /* Set up a dummy socket just so we can use ioctl to find the
+ ip address of the interface */
+ s = socket(PF_INET, SOCK_DGRAM, 0);
+ if(s == -1)
+ {
+ FatalError("Problem establishing socket to find IP address for interface: %s\n", iface);
+ }
+
+ SnortStrncpy(ifr.ifr_name, iface, strlen(iface) + 1);
+
+#ifndef WIN32
+ if(ioctl(s, SIOCGIFADDR, &ifr) < 0) return NULL;
+ else
+#endif
+ {
+ addr = (struct sockaddr_in *) &ifr.ifr_broadaddr;
+ }
+ close(s);
+
+#ifdef SUP_IP6
+// XXX-IPv6 uses ioctl to populate a sockaddr_in structure ... but what if the interface only has an IPv6 address?
+ sfip_set_raw(&ret, addr, AF_INET);
+ return SnortStrdup(sfip_ntoa(&ret));
+#else
+ return SnortStrdup(inet_ntoa(addr->sin_addr));
+#endif
+ }
+ else
+ {
+ return "unknown";
+ }
+}
+
+/****************************************************************************
+ *
+ * Function: GetHostname()
+ *
+ * Purpose: To return a string representing the hostname
+ *
+ * Arguments: None
+ *
+ * Returns: A static char * representing the hostname.
+ *
+ ***************************************************************************/
+char *GetHostname(void)
+{
+#ifdef WIN32
+ DWORD bufflen = 256;
+ static char buff[256];
+ GetComputerName(buff, &bufflen);
+ return buff;
+#else
+ char * error = "unknown";
+ if(getenv("HOSTNAME")) return getenv("HOSTNAME");
+ else if(getenv("HOST")) return getenv("HOST");
+ else return error;
+#endif
+}
+
+/****************************************************************************
+ *
+ * Function: GetTimestamp(register const struct timeval *tvp, int tz)
+ *
+ * Purpose: Get an ISO-8601 formatted timestamp for tvp within the tz
+ * timezone.
+ *
+ * Arguments: tvp is a timeval pointer. tz is a timezone.
+ *
+ * Returns: char * -- You must free this char * when you are done with it.
+ *
+ ***************************************************************************/
+char *GetTimestamp(register const struct timeval *tvp, int tz)
+{
+ struct tm *lt; /* localtime */
+ char * buf;
+ int msec;
+
+ buf = (char *)SnortAlloc(SMALLBUFFER * sizeof(char));
+
+ msec = tvp->tv_usec / 1000;
+
+ if (ScOutputUseUtc())
+ {
+ lt = gmtime((time_t *)&tvp->tv_sec);
+ SnortSnprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i.%03i",
+ 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday,
+ lt->tm_hour, lt->tm_min, lt->tm_sec, msec);
+ }
+ else
+ {
+ lt = localtime((time_t *)&tvp->tv_sec);
+ SnortSnprintf(buf, SMALLBUFFER,
+ "%04i-%02i-%02i %02i:%02i:%02i.%03i+%03i",
+ 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday,
+ lt->tm_hour, lt->tm_min, lt->tm_sec, msec, tz);
+ }
+
+ return buf;
+}
+
+/****************************************************************************
+ *
+ * Function: GetLocalTimezone()
+ *
+ * Purpose: Find the offset from GMT for current host
+ *
+ * Arguments: none
+ *
+ * Returns: int representing the offset from GMT
+ *
+ ***************************************************************************/
+int GetLocalTimezone(void)
+{
+ time_t ut;
+ struct tm * ltm;
+ long seconds_away_from_utc;
+
+ time(&ut);
+ ltm = localtime(&ut);
+
+#if defined(WIN32) || defined(SOLARIS) || defined(AIX) || defined(HPUX)
+ /* localtime() sets the global timezone variable,
+ which is defined in <time.h> */
+ seconds_away_from_utc = timezone;
+#else
+ seconds_away_from_utc = ltm->tm_gmtoff;
+#endif
+
+ return seconds_away_from_utc/3600;
+}
+
+/****************************************************************************
+ *
+ * Function: GetCurrentTimestamp()
+ *
+ * Purpose: Generate an ISO-8601 formatted timestamp for the current time.
+ *
+ * Arguments: none
+ *
+ * Returns: char * -- You must free this char * when you are done with it.
+ *
+ ***************************************************************************/
+char *GetCurrentTimestamp(void)
+{
+ struct tm *lt;
+ struct timezone tz;
+ struct timeval tv;
+ struct timeval *tvp;
+ char * buf;
+ int tzone;
+ int msec;
+
+ buf = (char *)SnortAlloc(SMALLBUFFER * sizeof(char));
+
+ bzero((char *)&tz,sizeof(tz));
+ gettimeofday(&tv,&tz);
+ tvp = &tv;
+
+ msec = tvp->tv_usec/1000;
+
+ if (ScOutputUseUtc())
+ {
+ lt = gmtime((time_t *)&tvp->tv_sec);
+ SnortSnprintf(buf, SMALLBUFFER, "%04i-%02i-%02i %02i:%02i:%02i.%03i",
+ 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday,
+ lt->tm_hour, lt->tm_min, lt->tm_sec, msec);
+ }
+ else
+ {
+ lt = localtime((time_t *)&tvp->tv_sec);
+
+ tzone = GetLocalTimezone();
+
+ SnortSnprintf(buf, SMALLBUFFER,
+ "%04i-%02i-%02i %02i:%02i:%02i.%03i+%03i",
+ 1900 + lt->tm_year, lt->tm_mon + 1, lt->tm_mday,
+ lt->tm_hour, lt->tm_min, lt->tm_sec, msec, tzone);
+ }
+
+ return buf;
+}
+
+/****************************************************************************
+ * Function: base64(char * xdata, int length)
+ *
+ * Purpose: Insert data into the database
+ *
+ * Arguments: xdata => pointer to data to base64 encode
+ * length => how much data to encode
+ *
+ * Make sure you allocate memory for the output before you pass
+ * the output pointer into this function. You should allocate
+ * (1.5 * length) bytes to be safe.
+ *
+ * Returns: data base64 encoded as a char *
+ *
+ ***************************************************************************/
+char * base64(const u_char * xdata, int length)
+{
+ int count, cols, bits, c, char_count;
+ unsigned char alpha[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; /* 64 bytes */
+ char * payloadptr;
+ char * output;
+ char_count = 0;
+ bits = 0;
+ cols = 0;
+
+ output = (char *)SnortAlloc( ((unsigned int) (length * 1.5 + 4)) * sizeof(char) );
+
+ payloadptr = output;
+
+ for(count = 0; count < length; count++)
+ {
+ c = xdata[count];
+
+ if(c > 255)
+ {
+ ErrorMessage("plugbase.c->base64(): encountered char > 255 (decimal %d)\n If you see this error message a char is more than one byte on your machine\n This means your base64 results can not be trusted", c);
+ }
+
+ bits += c;
+ char_count++;
+
+ if(char_count == 3)
+ {
+ *output = alpha[bits >> 18]; output++;
+ *output = alpha[(bits >> 12) & 0x3f]; output++;
+ *output = alpha[(bits >> 6) & 0x3f]; output++;
+ *output = alpha[bits & 0x3f]; output++;
+ cols += 4;
+ if(cols == 72)
+ {
+ *output = '\n'; output++;
+ cols = 0;
+ }
+ bits = 0;
+ char_count = 0;
+ }
+ else
+ {
+ bits <<= 8;
+ }
+ }
+
+ if(char_count != 0)
+ {
+ bits <<= 16 - (8 * char_count);
+ *output = alpha[bits >> 18]; output++;
+ *output = alpha[(bits >> 12) & 0x3f]; output++;
+ if(char_count == 1)
+ {
+ *output = '='; output++;
+ *output = '='; output++;
+ }
+ else
+ {
+ *output = alpha[(bits >> 6) & 0x3f];
+ output++; *output = '=';
+ output++;
+ }
+ }
+ *output = '\0';
+ return payloadptr;
+}
+
+/****************************************************************************
+ *
+ * Function: ascii(u_char *xdata, int length)
+ *
+ * Purpose: This function takes takes a buffer "xdata" and its length then
+ * returns a string of only the printable ASCII characters.
+ *
+ * Arguments: xdata is the buffer, length is the length of the buffer in
+ * bytes
+ *
+ * Returns: char * -- You must free this char * when you are done with it.
+ *
+ ***************************************************************************/
+char *ascii(const u_char *xdata, int length)
+{
+ char *d_ptr, *ret_val;
+ int i,count = 0;
+ int size;
+
+ if(xdata == NULL)
+ {
+ return NULL;
+ }
+
+ for(i=0;i<length;i++)
+ {
+ if(xdata[i] == '<')
+ count+=4; /* &lt; */
+ else if(xdata[i] == '&')
+ count+=5; /* &amp; */
+ else if(xdata[i] == '>') /* &gt; */
+ count += 4;
+ }
+
+ size = length + count + 1;
+ ret_val = (char *) calloc(1,size);
+
+ if(ret_val == NULL)
+ {
+ LogMessage("plugbase.c: ascii(): Out of memory, can't log anything!\n");
+ return NULL;
+ }
+
+ d_ptr = ret_val;
+
+ for(i=0;i<length;i++)
+ {
+ if((xdata[i] > 0x1F) && (xdata[i] < 0x7F))
+ {
+ if(xdata[i] == '<')
+ {
+ SnortStrncpy(d_ptr, "&lt;", size - (d_ptr - ret_val));
+ d_ptr+=4;
+ }
+ else if(xdata[i] == '&')
+ {
+ SnortStrncpy(d_ptr, "&amp;", size - (d_ptr - ret_val));
+ d_ptr += 5;
+ }
+ else if(xdata[i] == '>')
+ {
+ SnortStrncpy(d_ptr, "&gt;", size - (d_ptr - ret_val));
+ d_ptr += 4;
+ }
+ else
+ {
+ *d_ptr++ = xdata[i];
+ }
+ }
+ else
+ {
+ *d_ptr++ = '.';
+ }
+ }
+
+ *d_ptr++ = '\0';
+
+ return ret_val;
+}
+
+/****************************************************************************
+ *
+ * Function: hex(u_char *xdata, int length)
+ *
+ * Purpose: This function takes takes a buffer "xdata" and its length then
+ * returns a string of hex with no spaces
+ *
+ * Arguments: xdata is the buffer, length is the length of the buffer in
+ * bytes
+ *
+ * Returns: char * -- You must free this char * when you are done with it.
+ *
+ ***************************************************************************/
+char *hex(const u_char *xdata, int length)
+{
+ int x;
+ char *rval = NULL;
+ char *buf = NULL;
+
+ if (xdata == NULL)
+ return NULL;
+
+ buf = (char *)calloc((length * 2) + 1, sizeof(char));
+
+ if (buf != NULL)
+ {
+ rval = buf;
+
+ for (x = 0; x < length; x++)
+ {
+ SnortSnprintf(buf, 3, "%02X", xdata[x]);
+ buf += 2;
+ }
+
+ rval[length * 2] = '\0';
+ }
+
+ return rval;
+}
+
+
+
+char *fasthex(const u_char *xdata, int length)
+{
+ char conv[] = "0123456789ABCDEF";
+ char *retbuf = NULL;
+ const u_char *index;
+ const u_char *end;
+ char *ridx;
+
+ index = xdata;
+ end = xdata + length;
+ retbuf = (char *)SnortAlloc(((length * 2) + 1) * sizeof(char));
+ ridx = retbuf;
+
+ while(index < end)
+ {
+ *ridx++ = conv[((*index & 0xFF)>>4)];
+ *ridx++ = conv[((*index & 0xFF)&0x0F)];
+ index++;
+ }
+
+ return retbuf;
+}
+
+/*
+ * Fatal Integer Parser
+ * Ascii to Integer conversion with fatal error support
+ */
+long int xatol(const char *s , const char *etext)
+{
+ long int val;
+ char *endptr;
+ char *default_error = "xatol() error\n";
+
+ if (etext == NULL)
+ etext = default_error;
+
+ if (s == NULL)
+ FatalError("%s: String is NULL\n", etext);
+
+ while (isspace((int)*s))
+ s++;
+
+ if (strlen(s) == 0)
+ FatalError("%s: String is empty\n", etext);
+
+
+ /*
+ * strtoul - errors on win32 : ERANGE (VS 6.0)
+ * errors on linux : ERANGE, EINVAL
+ * (for EINVAL, unsupported base which won't happen here)
+ */
+ val = SnortStrtol(s, &endptr, 0);
+
+ if ((errno == ERANGE) || (*endptr != '\0'))
+ FatalError("%s: Invalid integer input: %s\n", etext, s);
+
+ return val;
+}
+
+/*
+ * Fatal Integer Parser
+ * Ascii to Integer conversion with fatal error support
+ */
+unsigned long int xatou(const char *s , const char *etext)
+{
+ unsigned long int val;
+ char *endptr;
+ char *default_error = "xatou() error\n";
+
+ if (etext == NULL)
+ etext = default_error;
+
+ if (s == NULL)
+ FatalError("%s: String is NULL\n", etext);
+
+ while (isspace((int)*s))
+ s++;
+
+ if (strlen(s) == 0)
+ FatalError("%s: String is empty\n", etext);
+
+ if (*s == '-')
+ {
+ FatalError("%s: Invalid unsigned integer - negative sign found, "
+ "input: %s\n", etext, s);
+ }
+
+
+ /*
+ * strtoul - errors on win32 : ERANGE (VS 6.0)
+ * errors on linux : ERANGE, EINVAL
+ */
+ val = SnortStrtoul(s, &endptr, 0);
+
+ if ((errno == ERANGE) || (*endptr != '\0'))
+ FatalError("%s: Invalid integer input: %s\n", etext, s);
+
+ return val;
+}
+
+unsigned long int xatoup(const char *s , const char *etext)
+{
+ unsigned long int val = xatou(s, etext);
+ if ( !val )
+ FatalError("%s: must be > 0\n", etext);
+ return val;
+}
+
+#ifndef SUP_IP6
+char * ObfuscateIpToText(const struct in_addr ip_addr)
+#else
+char * ObfuscateIpToText(sfip_t *ip)
+#endif
+{
+ static char ip_buf1[INET6_ADDRSTRLEN];
+ static char ip_buf2[INET6_ADDRSTRLEN];
+ static int buf_num = 0;
+ int buf_size = INET6_ADDRSTRLEN;
+ char *ip_buf;
+#ifndef SUP_IP6
+ uint32_t ip = ip_addr.s_addr;
+#endif
+
+ if (buf_num)
+ ip_buf = ip_buf2;
+ else
+ ip_buf = ip_buf1;
+
+ buf_num ^= 1;
+ ip_buf[0] = 0;
+
+#ifndef SUP_IP6
+ if (ip == 0)
+ return ip_buf;
+
+ if (snort_conf->obfuscation_net == 0)
+ {
+ /* Fully obfuscate - just use 'x' */
+ SnortSnprintf(ip_buf, buf_size, "xxx.xxx.xxx.xxx");
+ }
+ else
+ {
+ if (snort_conf->homenet != 0)
+ {
+ if ((ip & snort_conf->netmask) == snort_conf->homenet)
+ ip = snort_conf->obfuscation_net | (ip & snort_conf->obfuscation_mask);
+ }
+ else
+ {
+ ip = snort_conf->obfuscation_net | (ip & snort_conf->obfuscation_mask);
+ }
+
+ SnortSnprintf(ip_buf, buf_size, "%s", inet_ntoa(*((struct in_addr *)&ip)));
+ }
+
+#else
+ if (ip == NULL)
+ return ip_buf;
+
+ if (!IS_SET(snort_conf->obfuscation_net))
+ {
+ if (IS_IP6(ip))
+ SnortSnprintf(ip_buf, buf_size, "x:x:x:x::x:x:x:x");
+ else
+ SnortSnprintf(ip_buf, buf_size, "xxx.xxx.xxx.xxx");
+ }
+ else
+ {
+ sfip_t tmp;
+ char *tmp_buf;
+
+ IP_COPY_VALUE(tmp, ip);
+
+ if (IS_SET(snort_conf->homenet))
+ {
+ if (sfip_contains(&snort_conf->homenet, &tmp) == SFIP_CONTAINS)
+ sfip_obfuscate(&snort_conf->obfuscation_net, &tmp);
+ }
+ else
+ {
+ sfip_obfuscate(&snort_conf->obfuscation_net, &tmp);
+ }
+
+ tmp_buf = sfip_to_str(&tmp);
+ SnortSnprintf(ip_buf, buf_size, "%s", tmp_buf);
+ }
+#endif
+
+ return ip_buf;
+}
+
+void PrintPacketData(const uint8_t *data, const uint32_t len)
+{
+ uint32_t i, j;
+ uint32_t total_len = 0;
+ uint8_t hex_buf[16];
+ uint8_t char_buf[16];
+ char *length_chars = " 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15\n"
+ "------------------------------------------------------\n";
+
+ LogMessage("%s", length_chars);
+
+ for (i = 0; i <= len; i++)
+ {
+ if ((i%16 == 0) && (i != 0))
+ {
+ LogMessage("%04x ", total_len);
+ total_len += 16;
+
+ for (j = 0; j < 16; j++)
+ {
+ LogMessage("%02x ", hex_buf[j]);
+ if (j == 7)
+ LogMessage(" ");
+ }
+
+ LogMessage(" ");
+
+ for (j = 0; j < 16; j++)
+ {
+ LogMessage("%c", char_buf[j]);
+ if (j == 7)
+ LogMessage(" ");
+ }
+
+ LogMessage("\n");
+ }
+
+ if (i == len)
+ break;
+
+ hex_buf[i%16] = data[i];
+
+ if (isprint((int)data[i]))
+ char_buf[i%16] = data[i];
+ else
+ char_buf[i%16] = '.';
+ }
+
+ if ((i-total_len) > 0)
+ {
+ LogMessage("%04x ", total_len);
+
+ for (j = 0; j < i-total_len; j++)
+ {
+ LogMessage("%02x ", hex_buf[j]);
+ if (j == 7)
+ LogMessage(" ");
+ }
+
+ if (j < 8)
+ LogMessage(" ");
+ LogMessage("%*s", (16-j)*3, "");
+ LogMessage(" ");
+
+ for (j = 0; j < i-total_len; j++)
+ {
+ LogMessage("%c", char_buf[j]);
+ if (j == 7)
+ LogMessage(" ");
+ }
+ }
+
+ LogMessage("\n");
+}
+
diff --git a/config/orionids-dev/patches/spoink_patch/spo_pf.c b/config/orionids-dev/patches/spoink_patch/spo_pf.c
new file mode 100644
index 00000000..121920fc
--- /dev/null
+++ b/config/orionids-dev/patches/spoink_patch/spo_pf.c
@@ -0,0 +1,462 @@
+/*
+*
+* Copyright (c) 2006 Antonio Benojar <zz.stalker@gmail.com>
+* Copyright (c) 2005 Antonio Benojar <zz.stalker@gmail.com>
+*
+* Copyright (c) 2003, 2004 Armin Wolfermann:
+*
+* s2c_pf_block and s2c_pf_unblock functions are based
+* in Armin's Wolfermann pftabled-1.03 functions.
+*
+* All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+*
+* 1. Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*
+* 2. Redistributions in binary form must reproduce the above copyright
+* notice, this list of conditions and the following disclaimer in the
+* documentation and/or other materials provided with the distribution.
+*
+* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
+* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+
+/*
+ TODO
+
+ - num. max ips.
+ - ipwhitelisting structure
+ - best ip regex expr
+*/
+
+
+#ifndef LIST_END
+#define LIST_END(head) NULL
+#endif
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "event.h"
+#include "decode.h"
+#include "plugbase.h"
+#include "spo_plugbase.h"
+#include "debug.h"
+#include "parser.h"
+#include "util.h"
+#include "log.h"
+#include "mstring.h"
+
+#include "snort.h"
+
+#include "spo_pf.h"
+
+#ifdef HAVE_STRINGS_H
+#include <strings.h>
+#endif
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <arpa/inet.h>
+#include <errno.h>
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/queue.h>
+#include <ctype.h>
+#include <fcntl.h>
+#include <net/if.h>
+#include <net/pfvar.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <err.h>
+#include <unistd.h>
+#include <regex.h>
+
+#define PFDEVICE "/dev/pf"
+
+typedef struct _SpoAlertPfData {
+ FILE *wlfile;
+ char *pftable;
+ int fd;
+ struct wlist_head head;
+} SpoAlertPfData;
+
+void AlertPfInit(u_char *);
+SpoAlertPfData *ParseAlertPfArgs(char *);
+void AlertPf(Packet *, char *, void *, Event *);
+void AlertPfCleanExit(int, void *);
+void AlertPfRestart(int, void *);
+
+int s2c_pf_init(void);
+int s2c_pf_block(int, char *, char *, int);
+int s2c_pf_intbl(int, char *, int);
+
+int s2c_parse_line(char *, FILE*);
+int s2c_parse_load_wl(FILE*, struct wlist_head*, int);
+int s2c_parse_search_wl(char *, struct wlist_head);
+int s2c_parse_free_wl(struct wlist_head*);
+int s2c_parse_ip(char *, char *, int);
+
+
+void AlertPfSetup(void)
+{
+ RegisterOutputPlugin("alert_pf", OUTPUT_TYPE_FLAG__ALERT, AlertPfInit);
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Output plugin: AlertPf is setup...\n"););
+}
+
+void AlertPfInit(u_char *args)
+{
+ SpoAlertPfData *data;
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Output: AlertPf Initialized\n"););
+
+ data = ParseAlertPfArgs(args);
+
+ DEBUG_WRAP(DebugMessage(DEBUG_INIT,"Linking AlertPf functions to call lists...\n"););
+
+ AddFuncToOutputList(AlertPf, OUTPUT_TYPE_FLAG__ALERT, data);
+ AddFuncToCleanExitList(AlertPfCleanExit, data);
+ AddFuncToRestartList(AlertPfRestart, data);
+}
+
+
+void AlertPf(Packet *p, char *msg, void *arg, Event *event)
+{
+ SpoAlertPfData *data = (SpoAlertPfData *)arg;
+ char *ip;
+ int ret;
+
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG, "spoink block'n!!\n"););
+
+ ip = inet_ntoa(p->iph->ip_src);
+
+ if (ip == NULL)
+ FatalError("AlertPf() => inet_ntoa() = NULL\n", strerror(errno));
+
+ ret = s2c_parse_search_wl(ip, data->head);
+
+ if (ret == 0)
+ s2c_pf_block(data->fd, data->pftable, inet_ntoa(p->iph->ip_src), 0);
+
+ return;
+}
+
+SpoAlertPfData *ParseAlertPfArgs(char *args)
+{
+ char **toks;
+ int num_toks;
+ SpoAlertPfData *data;
+
+ int res = 0;
+
+ data = (SpoAlertPfData *)SnortAlloc(sizeof(SpoAlertPfData));
+
+ if(args == NULL)
+ FatalError("Unable to load pf args\n", strerror(errno));
+
+ data->fd = s2c_pf_init();
+
+ if (data->fd == -1)
+ FatalError("s2c_pf_init() => no pf device\n");
+
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,"ParseAlertPfArgs: %s\n", args););
+
+ toks = mSplit(args, ",", 2, &num_toks, 0);
+
+ if(num_toks <= 1)
+ FatalError("snort.conf => You must supply TWO arguments for the pf plugin...\n", strerror(errno));
+
+ if(strstr(toks[0], "..") != NULL)
+ FatalError("snort.conf => File definition contains \"..\". Do not do that!\n");
+
+ data->wlfile = fopen(toks[0], "r");
+
+ if (data->wlfile == NULL)
+ FatalError("snort.conf => Unable to open whitelist file\n", strerror(errno));
+
+ if (toks[1] == NULL)
+ FatalError("snort.conf => No pf table defined\n", strerror(errno));
+ else
+ data->pftable = toks[1];
+
+ if (s2c_pf_intbl(data->fd, data->pftable, 0) == 0)
+ FatalError("pf.conf => Table %s don't exists in packet filter\n", data->pftable, strerror(errno));
+
+ res = s2c_parse_load_wl(data->wlfile, &data->head, 0);
+ if (res == -1)
+ FatalError("snort.conf => Unable to load whitelist\n", strerror(errno));
+
+ return data;
+}
+
+void AlertPfCleanExit(int signal, void *arg)
+{
+ SpoAlertPfData *data = (SpoAlertPfData *)arg;
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,"AlertPfCleanExit\n"););
+
+ s2c_parse_free_wl(&data->head);
+ fclose(data->wlfile);
+ close(data->fd);
+
+ free(data);
+}
+
+void AlertPfRestart(int signal, void *arg)
+{
+ SpoAlertPfData *data = (SpoAlertPfData *)arg;
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,"AlertPfRestart\n"););
+
+ s2c_parse_free_wl(&data->head);
+ fclose(data->wlfile);
+ close(data->fd);
+
+ free(data);
+}
+
+
+int s2c_pf_init(void)
+{
+ return(open(PFDEVICE, O_RDWR));
+}
+
+int s2c_pf_block(int dev, char *tablename, char *ip, int debug)
+{
+
+ struct pfioc_table io;
+ struct pfr_table table;
+ struct pfr_addr addr;
+ struct in_addr *net_addr=NULL;
+
+ memset(&io, 0x00, sizeof(struct pfioc_table));
+ memset(&table, 0x00, sizeof(struct pfr_table));
+ memset(&addr, 0x00, sizeof(struct pfr_addr));
+
+ strlcpy(table.pfrt_name, tablename, PF_TABLE_NAME_SIZE);
+ net_addr=(struct in_addr*)malloc(sizeof(struct in_addr));
+
+ if (net_addr == NULL )
+ FatalError("s2c_pf_block() => malloc()\n", strerror(errno));
+
+ inet_aton(ip, (struct in_addr *)&net_addr);
+ memcpy(&addr.pfra_ip4addr.s_addr, &net_addr, sizeof(struct in_addr));
+
+ addr.pfra_af = AF_INET;
+ addr.pfra_net = 32;
+
+ io.pfrio_table = table;
+ io.pfrio_buffer = &addr;
+ io.pfrio_esize = sizeof(struct pfr_addr);
+ io.pfrio_size = 1;
+
+ if (ioctl(dev, DIOCRADDADDRS, &io))
+ FatalError("s2c_pf_block() => ioctl() DIOCRADDADDRS\n", strerror(errno));
+
+ return(0);
+}
+
+int s2c_pf_intbl(int dev, char * tablename, int debug)
+{
+ int i;
+ struct pfioc_table io;
+ struct pfr_table *table_aux = NULL;
+
+ memset(&io, 0x00, sizeof(struct pfioc_table));
+
+ io.pfrio_buffer = table_aux;
+ io.pfrio_esize = sizeof(struct pfr_table);
+ io.pfrio_size = 0;
+
+ if(ioctl(dev, DIOCRGETTABLES, &io))
+ FatalError("s2c_pf_intbl() => ioctl() DIOCRGETTABLES\n", strerror(errno));
+
+ table_aux = (struct pfr_table*)malloc(sizeof(struct pfr_table)*io.pfrio_size);
+
+ if (table_aux == NULL)
+ FatalError("s2c_pf_intbl() => malloc()\n", strerror(errno));
+
+ io.pfrio_buffer = table_aux;
+ io.pfrio_esize = sizeof(struct pfr_table);
+
+ if(ioctl(dev, DIOCRGETTABLES, &io))
+ FatalError("s2c_pf_intbl() => ioctl() DIOCRGETTABLES\n", strerror(errno));
+
+ for(i=0; i< io.pfrio_size; i++) {
+ if (!strcmp(table_aux[i].pfrt_name, tablename))
+ return 1;
+ }
+
+ return 0;
+
+}
+
+
+int s2c_parse_line(char buf[WLMAX] , FILE* wfile)
+{
+ static char next_ch = ' ';
+ int i = 0;
+
+ if (feof(wfile)) {
+ return (0);
+ }
+ do {
+ next_ch = fgetc(wfile);
+ if (i < WLMAX)
+ buf[i++] = next_ch;
+ } while (!feof(wfile) && !isspace(next_ch));
+ if (i >= WLMAX) {
+ return (-1);
+ }
+
+ buf[i] = '\0';
+ return (1);
+}
+
+
+int s2c_parse_load_wl(FILE *wfile, struct wlist_head *head, int debug)
+{
+
+ char cad[WLMAX];
+ char ret[WLMAX];
+ struct ipwlist *ipw2, *ipw1 = NULL;
+ struct flock lock;
+
+ if (wfile == NULL)
+ FatalError("s2c_parse_load_wl() => Unable to open whitelist file\n", strerror(errno));
+
+ memset(&lock, 0x00, sizeof(struct flock));
+ lock.l_type = F_RDLCK;
+ fcntl(fileno(wfile), F_SETLKW, &lock);
+
+ LIST_INIT(head);
+
+ if (s2c_parse_line(cad, wfile) == 1) {
+ if (s2c_parse_ip(cad, ret, debug) == 1) {
+ ipw1 = (struct ipwlist*)malloc(sizeof(struct ipwlist));
+ if (ipw1 == NULL)
+ FatalError("s2c_parse_load_wl() => malloc()\n", strerror(errno));
+ inet_aton(ret, &ipw1->waddr);
+ LIST_INSERT_HEAD(head, ipw1, elem);
+
+ } else {
+ FatalError("s2c_parse_load_wl() => Invalid data in whitelist file\n", strerror(errno));
+ }
+ }
+
+ while(s2c_parse_line(cad, wfile) == 1) {
+ if (s2c_parse_ip(cad, ret, debug) == 1) {
+ ipw2 = (struct ipwlist*)malloc(sizeof(struct ipwlist));
+ if (ipw2 == NULL)
+ FatalError("s2c_parse_load_wl() => malloc()\n", strerror(errno));
+ inet_aton(ret, &ipw2->waddr);
+ LIST_INSERT_AFTER(ipw1, ipw2, elem);
+ ipw1 = ipw2;
+ } else {
+ break;
+ }
+
+ }
+
+ lock.l_type = F_UNLCK;
+ fcntl(fileno(wfile), F_SETLKW, &lock);
+
+ return (0);
+}
+
+/* XXX: optimize */
+
+int
+s2c_parse_search_wl(char *ip, struct wlist_head wl)
+{
+ struct ipwlist *aux2;
+ char *ip_aux, ip1[IPMAX], ip2[IPMAX];
+ int ret;
+
+ strlcpy(ip1, ip, sizeof(ip1));
+
+ for(aux2=wl.lh_first; aux2 !=NULL; aux2=aux2->elem.le_next) {
+ ip_aux = inet_ntoa(aux2->waddr);
+ strlcpy(ip2, ip_aux, sizeof(ip2));
+ ret = strcmp(ip1, ip2);
+
+ if (ret == 0)
+ return 1;
+ }
+ return (0);
+}
+
+
+int s2c_parse_free_wl(struct wlist_head *wl)
+{
+ struct ipwlist *aux, *aux2;
+ for(aux = LIST_FIRST(wl); aux != LIST_END(wl); aux = aux2) {
+ aux2 = LIST_NEXT(aux, elem);
+ LIST_REMOVE(aux, elem);
+ free(aux);
+ }
+ if (LIST_EMPTY(wl)) {
+ return (1);
+ } else {
+ FatalError("s2c_parse_free_wl() => Unable to free whitelist\n", strerror(errno));
+ return (0);
+ }
+}
+
+/* XXX: too much complex ? */
+
+int s2c_parse_ip(char *cad, char ret[WLMAX], int debug)
+{
+ int len;
+ unsigned int enc=1;
+ regex_t *expr;
+ regmatch_t *resultado;
+ expr = (regex_t*)malloc(sizeof(regex_t));
+
+ bzero(ret, WLMAX);
+
+ if (expr == NULL)
+ FatalError("s2c_parse_ip() => malloc()\n", strerror(errno));
+
+ resultado = (regmatch_t*)malloc(sizeof(regmatch_t));
+
+ if (resultado == NULL)
+ FatalError("s2c_parse_ip() => malloc()\n", strerror(errno));
+
+ if (regcomp(expr, REG_ADDR, REG_EXTENDED) !=0)
+ FatalError("s2c_parse_ip() => regcomp()\n", strerror(errno));
+
+ if (regexec(expr, cad, 1, resultado, 0) !=0)
+ enc=0;
+
+ if (enc !=0) {
+ len = resultado->rm_eo - resultado->rm_so;
+ memcpy(ret, cad + resultado->rm_so, len);
+ ret[len]='\0';
+ }
+
+ free(resultado);
+ regfree(expr);
+
+ if(enc)
+ return (1);
+ else {
+ errno = EINVAL;
+ return (0);
+ }
+}
diff --git a/config/orionids-dev/patches/spoink_patch/spo_pf.h b/config/orionids-dev/patches/spoink_patch/spo_pf.h
new file mode 100644
index 00000000..af07dacd
--- /dev/null
+++ b/config/orionids-dev/patches/spoink_patch/spo_pf.h
@@ -0,0 +1,60 @@
+/*
+*
+* Copyright (c) 2006 Antonio Benojar <zz.stalker@gmail.com>
+* Copyright (c) 2005 Antonio Benojar <zz.stalker@gmail.com>
+*
+* All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+*
+* 1. Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*
+* 2. Redistributions in binary form must reproduce the above copyright
+* notice, this list of conditions and the following disclaimer in the
+* documentation and/or other materials provided with the distribution.
+*
+* THIS SOFTWARE IS PROVIDED BY THE AUTHOR `AS IS'' AND ANY EXPRESS OR
+* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef __SPO_PF_H__
+#define __SPO_PF_H__
+
+#include <sys/queue.h>
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <fcntl.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <stdio.h>
+
+#define WLMAX 1024
+#define IPMAX 20
+#define REG_ADDR "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}"
+
+
+struct ipwlist {
+ struct in_addr waddr;
+ LIST_ENTRY(ipwlist) elem;
+};
+
+LIST_HEAD(wlist_head, ipwlist);
+
+void AlertPfSetup(void);
+
+#endif
+
+