|
|
@@ -23,7 +23,7 @@ using namespace std; |
|
|
|
|
|
|
|
//// Version Info |
|
|
|
|
|
|
|
const char* SNF_ENGINE_VERSION = "SNFMulti Engine Version 3.0.1 Build: " __DATE__ " " __TIME__; |
|
|
|
const char* SNF_ENGINE_VERSION = "SNFMulti Engine Version 3.0.5 Build: " __DATE__ " " __TIME__; |
|
|
|
|
|
|
|
//// Script Caller Methods |
|
|
|
|
|
|
@@ -331,9 +331,11 @@ bool snf_RulebaseHandler::AutoRefresh() { |
|
|
|
// done it will reset from the "RefreshInProgress" state and along the way will throw any errors that |
|
|
|
// are appropriate. The other functions can count on this one to polish off the various forms of rulebase |
|
|
|
// load activity. |
|
|
|
|
|
|
|
const LogicCheck SaneRefreshProcessCheck("snf_RulebaseHandler::_snf_LoadNewRulebase():SaneRefreshProcessCheck(RefreshInProgress)");
|
|
|
|
|
|
|
|
void snf_RulebaseHandler::_snf_LoadNewRulebase(){ // Common internal load/check routine. |
|
|
|
assert(RefreshInProgress); // We only get called when this flag is set. |
|
|
|
SaneRefreshProcessCheck(RefreshInProgress); // We only get called when this flag is set. |
|
|
|
try { MyCFGmgr.load(); } // Load a fresh copy of the configuration. |
|
|
|
catch(...) { // If something goes wrong: |
|
|
|
RefreshInProgress = false; // we are no longer "in refresh" |
|
|
@@ -1265,6 +1267,9 @@ string snf_EngineHandler::extractMessageID( |
|
|
|
|
|
|
|
return ExtractedID; // Return the extracted id or substitute. |
|
|
|
} |
|
|
|
|
|
|
|
const LogicFault FaultBadMessageBuffer1("snf_EngineHandler::scanMessage():FaultBadMessageBuffer1(NULL == inputMessageBuffer)");
|
|
|
|
const LogicFault FaultBadMessageBuffer2("snf_EngineHandler::scanMessage():FaultBadMessageBuffer2(0 >= inputMessageLength)");
|
|
|
|
|
|
|
|
int snf_EngineHandler::scanMessage( // Scan this message (in buffer). |
|
|
|
const unsigned char* inputMessageBuffer, // -- this is the message buffer. |
|
|
@@ -1274,9 +1279,16 @@ int snf_EngineHandler::scanMessage( |
|
|
|
const IP4Address MessageSource // -- message source IP (for injection). |
|
|
|
) { |
|
|
|
|
|
|
|
// Protect this code - only one thread at a time per EngineHandler ;-) |
|
|
|
ScopeTimer ScanTimeCapture(MyScanData.ScanTime); // Start the scan time clock.
|
|
|
|
|
|
|
|
unsigned char* MessageBuffer = NULL; // Explicitly initialize these two
|
|
|
|
int MessageLength = 0; // so the compiler will be happy.
|
|
|
|
|
|
|
|
FaultBadMessageBuffer1(NULL == inputMessageBuffer); // Fault on null message buffer.
|
|
|
|
FaultBadMessageBuffer2(0 >= inputMessageLength); // Fault on bad message bfr length.
|
|
|
|
|
|
|
|
// Protect this engine - only one scan at a time per EngineHandler ;-) |
|
|
|
|
|
|
|
ScopeTimer ScanTimeCapture(MyScanData.ScanTime); // Start the scan time clock. |
|
|
|
ScopeMutex ScannerIsBusy(MyMutex); // Serialize this... |
|
|
|
|
|
|
|
// Preliminary job setup. |
|
|
@@ -1285,9 +1297,8 @@ int snf_EngineHandler::scanMessage( |
|
|
|
// originals and then use the captured values. For example if we are scanning |
|
|
|
// Communigate message files we will want to skip the communigate headers. |
|
|
|
|
|
|
|
unsigned char* MessageBuffer = |
|
|
|
const_cast<unsigned char*>(inputMessageBuffer); // Capture the input buffer. |
|
|
|
int MessageLength = inputMessageLength; // Capture the input length. |
|
|
|
MessageBuffer = const_cast<unsigned char*>(inputMessageBuffer); // Capture the input buffer. |
|
|
|
MessageLength = inputMessageLength; // Capture the input length. |
|
|
|
|
|
|
|
MyScanData.clear(); // Clear the scan data. |
|
|
|
MyScanData.ScanSize = MessageLength; // Grab the message length. |
|
|
@@ -1609,7 +1620,7 @@ int snf_EngineHandler::scanMessage( |
|
|
|
|
|
|
|
// To integrate GBUdb we need to generalize the result from the pattern scan. |
|
|
|
|
|
|
|
PatternResultTypes ScanResultType; // What kind of result have we here? |
|
|
|
PatternResultTypes ScanResultType = NoPattern; // What kind of result have we here? |
|
|
|
if(0 < (MyScanData.HeaderDirectiveFlags & HeaderDirectiveWhite)) { // If a white header directive matched |
|
|
|
ScanResultType = WhitePattern; // then we have a "WhitePattern'. |
|
|
|
} else |