C++ DEBUG_WRAP函数代码示例

static int SIP_MethodAddFastPatterns(void *data, int protocol,
		int direction, FPContentInfo **info)
{

	char *sip = "SIP";
	FPContentInfo *method_fp;
	SipMethodRuleOptData *sdata = (SipMethodRuleOptData *)data;
	DEBUG_WRAP(DebugMessage(DEBUG_SIP,
				"Evaluating \"%s\" fast pattern rule option.\n", SIP_ROPT__METHOD));
	if ((sdata == NULL) || (info == NULL))
		return -1;

	if ((protocol != IPPROTO_TCP) && (protocol != IPPROTO_UDP))
		return -1;

	DEBUG_WRAP(DebugMessage(DEBUG_SIP,
					"adding info to \"%s\" fast pattern rule option.\n", SIP_ROPT__METHOD));

	method_fp = (FPContentInfo *)calloc(1,sizeof(FPContentInfo));
    if (NULL == method_fp)
    	return -1;

	method_fp->content = (char *)malloc(strlen(sip));
	if (NULL == method_fp->content)
    {
        free(method_fp);
		return -1;
    }

	memcpy(method_fp->content, sip, strlen(sip));
	method_fp->length =  strlen(sip);
    *info = method_fp;
	return 0;
}

/* Add/update a file entry specified by file_id in the file cache*/
void *file_cache_update_entry (FileCache *fileCache, void* p, uint64_t file_id,
        uint8_t *file_name, uint32_t file_name_size, uint64_t file_size)
{
    FileEntry *fileEntry;

    fileEntry = file_cache_get(fileCache, p, file_id, true);

    if (!fileEntry)
        return NULL;

    if (file_name)
    {
        DEBUG_WRAP(DebugMessage(DEBUG_FILE,
                "Add file: %s (%p)with file id %d \n", file_name, file_name, file_id));
        if (fileEntry->file_name && fileEntry->file_name != file_name)
        {
            DEBUG_WRAP(DebugMessage(DEBUG_FILE,
                    "File name: %s released (%p)\n", fileEntry->file_name , fileEntry->file_name ));
            free(fileEntry->file_name);
        }
        fileEntry->file_name = file_name;
        fileEntry->file_name_size = file_name_size;
    }

    if (file_size)
    {
        fileEntry->file_size = file_size;
    }

    return fileEntry;
}

/* Rule option evaluation */
static int SIP_BodyEval(void *pkt, const uint8_t **cursor, void *data)
{
	SFSnortPacket *p = (SFSnortPacket *)pkt;
	SIPData *sd;
	SIP_Roptions *ropts;

	DEBUG_WRAP(DebugMessage(DEBUG_SIP,
			"Evaluating \"%s\" rule option.\n", SIP_ROPT__BODY));

	if (!SIP_RoptDoEval(p))
		return RULE_NOMATCH;

	sd = (SIPData *)_dpd.sessionAPI->get_application_data(p->stream_session, PP_SIP);
	if (sd == NULL)
	{
		DEBUG_WRAP(DebugMessage(DEBUG_SIP,
				"No session data - not evaluating.\n"));
		return RULE_NOMATCH;
	}

	ropts = &sd->ropts;

	if (ropts->body_data != NULL)
	{
		DEBUG_WRAP(DebugMessage(DEBUG_SIP,
				"Setting cursor to body data: %p.\n", ropts->body_data));
		*cursor = ropts->body_data;
		//Limit the length
	    _dpd.SetAltDetect((uint8_t *)ropts->body_data, ropts->body_len);

		return RULE_MATCH;
	}

	return RULE_NOMATCH;
}

/* Rule option evaluation */
static int SIP_MethodEval(void *pkt, const uint8_t **cursor, void *data)
{
	SFSnortPacket *p = (SFSnortPacket *)pkt;
	SIPData *sd;
	SIP_Roptions *ropts;
	SipMethodRuleOptData *sdata = (SipMethodRuleOptData *)data;
    uint32_t methodFlag;

	DEBUG_WRAP(DebugMessage(DEBUG_SIP,
			"Evaluating \"%s\" rule option.\n", SIP_ROPT__METHOD));

	if (!SIP_RoptDoEval(p))
		return RULE_NOMATCH;

	sd = (SIPData *)_dpd.sessionAPI->get_application_data(p->stream_session, PP_SIP);
	if (sd == NULL)
	{
		DEBUG_WRAP(DebugMessage(DEBUG_SIP,
				"No session data - not evaluating.\n"));
		return RULE_NOMATCH;
	}

	ropts = &sd->ropts;

	DEBUG_WRAP(DebugMessage(DEBUG_SIP,
			"Rule Flags: %x Data Flags: %x, Mask: %x \n", sdata->flags, ropts->methodFlag, sdata->mask ));
    // Not response
	methodFlag = 1 << (ropts->methodFlag - 1);
	if (IsRequest(ropts) && ((sdata->flags & methodFlag) ^ sdata->mask))
	{
		return RULE_MATCH;
	}
	return RULE_NOMATCH;

}

/* Rule option evaluation */
static int GTP_TypeEval(void *pkt, const uint8_t **cursor, void *data)
{
    SFSnortPacket *p = (SFSnortPacket *)pkt;
    GTPData *sd;
    GTP_Roptions *ropts;
    GTP_TypeRuleOptData *sdata = (GTP_TypeRuleOptData *)data;

    DEBUG_WRAP(DebugMessage(DEBUG_GTP,
            "Evaluating \"%s\" rule option.\n", GTP_ROPT__TYPE));

    if (!GTP_RoptDoEval(p))
        return RULE_NOMATCH;

    sd = (GTPData *)_dpd.sessionAPI->get_application_data(p->stream_session, PP_GTP);

    if (sd == NULL)
    {
        DEBUG_WRAP(DebugMessage(DEBUG_GTP,
                "No session data - not evaluating.\n"));
        return RULE_NOMATCH;
    }

    ropts = &sd->ropts;

    DEBUG_WRAP(DebugMessage(DEBUG_GTP,
            "GTP type in packet: %d \n", ropts->gtp_type));

    /*Match the GTP type*/
    if ((1 << ropts->gtp_version) & sdata->types[ropts->gtp_type])
        return RULE_MATCH;

    DEBUG_WRAP(DebugMessage(DEBUG_GTP,
            "Rule No Match\n"));
    return RULE_NOMATCH;
}

/*********************************************************************
 * Function: DCE2_PafAbort()
 *
 * Purpose: Queries the dcerpc2 session data to see if paf abort
 *          flag is set.
 *
 * Arguments:
 *  void *   - stream session pointer
 *  uint32_t - flags passed in to callback.
 *             Should have PKT_FROM_CLIENT or PKT_FROM_SERVER set.
 *
 * Returns:
 *  bool - true if we should abort PAF, false if not.
 *
 *********************************************************************/
static inline bool DCE2_PafAbort(void *ssn, uint32_t flags)
{
    DCE2_SsnData *sd;

    if (_dpd.sessionAPI->get_session_flags(ssn) & SSNFLAG_MIDSTREAM)
    {
        DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__PAF,
                    "Aborting PAF because of midstream pickup.\n"));
        return true;
    }
    else if (!(_dpd.sessionAPI->get_session_flags(ssn) & SSNFLAG_ESTABLISHED))
    {
        DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__PAF,
                    "Aborting PAF because of unestablished session.\n"));
        return true;
    }

    sd = (DCE2_SsnData *)_dpd.sessionAPI->get_application_data(ssn, PP_DCE2);
    if ((sd != NULL) && DCE2_SsnNoInspect(sd))
    {
        DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__PAF, "Aborting PAF because of session data check.\n"));
        return true;
    }

    return false;
}

/* Display the configuration for the GTP preprocessor.
 *
 * PARAMETERS:
 *
 * GTPConfig *config: GTP preprocessor configuration.
 *
 * RETURNS: Nothing.
 */
static void DisplayGTPConfig(GTPConfig *config)
{
    int index;
    int newline;

    if (config == NULL)
        return;

    _dpd.logMsg("GTP config: \n");

    /* Traverse list, printing ports, 5 per line */
    newline = 1;
    _dpd.logMsg("    Ports:\n");
    for(index = 0; index < MAXPORTS; index++)
    {
        if( config->ports[ PORT_INDEX(index) ] & CONV_PORT(index) )
        {
            _dpd.logMsg("\t%d", index);
            if ( !((newline++)% 5) )
                _dpd.logMsg("\n");
        }
    }
    _dpd.logMsg("\n");
    DEBUG_WRAP(DisplayMsgTypes(config));
    DEBUG_WRAP(DisplayInfoElements(config));

}

/* Rule option evaluation */
static int GTP_IEEval(void *pkt, const uint8_t **cursor, void *data)
{
    SFSnortPacket *p = (SFSnortPacket *)pkt;
    GTPData *sd;
    GTP_Roptions *ropts;
    GTP_InfoRuleOptData *ie;
    uint8_t ieType;
    GTP_IEData *ieData;

    DEBUG_WRAP(DebugMessage(DEBUG_GTP,
            "Evaluating \"%s\" rule option.\n", GTP_ROPT__IE));

    if (!GTP_RoptDoEval(p))
        return RULE_NOMATCH;

    sd = (GTPData *)_dpd.sessionAPI->get_application_data(p->stream_session, PP_GTP);

    if (sd == NULL)
    {
        DEBUG_WRAP(DebugMessage(DEBUG_GTP,
                "No session data - not evaluating.\n"));
        return RULE_NOMATCH;
    }

    ropts = &sd->ropts;

    if (NULL == ropts->gtp_infoElements)
        return RULE_NOMATCH;

    /*Match the status code*/
    ie = (GTP_InfoRuleOptData *)data;
    ieType = ie->types[ropts->gtp_version];
    if (!ieType)
    {
        return RULE_NOMATCH;
    }

    ieData = &ropts->gtp_infoElements[ieType];

    /*if the data is up to date*/
    if (ieData->msg_id == ropts->msg_id)
    {
        *cursor = ieData->shift + (uint8_t *)ropts->gtp_header;
        DEBUG_WRAP(DebugMessage(DEBUG_GTP,
                "Setting cursor to IE data: %p.\n", *cursor));
        /*Limit the length*/
        _dpd.SetAltDetect((uint8_t *)*cursor, ieData->length);
        return RULE_MATCH;
    }

    DEBUG_WRAP(DebugMessage(DEBUG_GTP,
            "Rule No Match\n"));
    return RULE_NOMATCH;
}

/* detection functions */
int rule13897eval(void *p) {
   const u_int8_t *cursor_normal = 0;
   SFSnortPacket *sp = (SFSnortPacket *) p;

   const u_int8_t *beg_of_payload, *end_of_payload;
   u_int32_t atom_size;
   u_int16_t region_size;
      
   if(sp == NULL)
      return RULE_NOMATCH;

   if(sp->payload == NULL)
      return RULE_NOMATCH;
    
   // flow:established, to_client;
   if(checkFlow(p, rule13897options[0]->option_u.flowFlags) > 0 ) {
      // flowbits:isset "file.quicktime";
      if(processFlowbits(p, rule13897options[1]->option_u.flowBit) > 0) {
        // content:"crgn";
        if(contentMatch(p, rule13897options[2]->option_u.content, &cursor_normal) > 0) {
           if(getBuffer(sp, CONTENT_BUF_NORMALIZED, &beg_of_payload, &end_of_payload) <= 0)
              return RULE_NOMATCH;
                
           if(cursor_normal + 2 >= end_of_payload)
              return RULE_NOMATCH;
   
           region_size = (*cursor_normal++) << 8;
           region_size |= *cursor_normal++;
   
           DEBUG_WRAP(printf("REGION SIZE: %d\n", region_size));
      
           cursor_normal = cursor_normal - 10;

           if(cursor_normal < beg_of_payload)
              return RULE_NOMATCH;
      
           atom_size = (*cursor_normal++) << 24;   
           atom_size |= (*cursor_normal++) << 16;
           atom_size |= (*cursor_normal++) << 8;
           atom_size |= *cursor_normal++;
   
           DEBUG_WRAP(printf("ATOM SIZE: %d\n", atom_size));
  
           // Changed from region_size > (atom_size - 8) to avoid
           // integer underflow from (atom_size - 8)
           if(((u_int32_t)region_size + 8) > atom_size) 
              return RULE_MATCH;
         }
      }
   }

   return RULE_NOMATCH;
}

/*********************************************************************
 * Function:
 *
 * Purpose:
 *
 * Arguments:
 *
 * Returns:
 *
 *********************************************************************/
void DCE2_Detect(DCE2_SsnData *sd)
{
    SFSnortPacket *top_pkt = (SFSnortPacket *)DCE2_CStackTop(dce2_pkt_stack);
    PROFILE_VARS;

    if (top_pkt == NULL)
    {
        DCE2_Log(DCE2_LOG_TYPE__ERROR,
                 "%s(%d) No packet on top of stack.",
                 __FILE__, __LINE__);
        return;
    }

    DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Detecting ------------------------------------------------\n"));
    DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__ROPTIONS, " Rule options:\n"));
    DCE2_DEBUG_CODE(DCE2_DEBUG__ROPTIONS, DCE2_PrintRoptions(&sd->ropts););

/*gtp type can be numbers*/
static bool GTP_AddTypeByNumer(GTP_TypeRuleOptData *sdata, char *tok)
{
    char *endStr = NULL;
    unsigned long gtpType;

    gtpType = _dpd.SnortStrtoul(tok, &endStr, 10);

    if ( *endStr)
    {
        DynamicPreprocessorFatalMessage(" %s(%d) => Bad value specified for %s. "
                "Please specify an integer between %d and %d, OR a correct name.\n",
                *(_dpd.config_file), *(_dpd.config_line),
                GTP_ROPT__TYPE, MIN_GTP_TYPE_CODE, MAX_GTP_TYPE_CODE);
    }

    if ((gtpType > MAX_GTP_TYPE_CODE) || (errno == ERANGE))
    {
        DynamicPreprocessorFatalMessage(" %s(%d) => Value specified for %s is out of "
                "bounds.  Please specify an integer between %d and %d, OR a correct name.\n",
                *(_dpd.config_file), *(_dpd.config_line),
                GTP_ROPT__TYPE, MIN_GTP_TYPE_CODE, MAX_GTP_TYPE_CODE);
    }

    DEBUG_WRAP(DebugMessage(DEBUG_GTP,
            "Rule GTP type: %d.\n",gtpType));

    sdata->types[gtpType] = GTP_VERSION_ALL_FLAG;

    return true;
}

static inline void file_entry_free(FileEntry *file_entry)
{

    if (!file_entry)
        return;

    if (file_entry->file_name)
    {
        DEBUG_WRAP(DebugMessage(DEBUG_FILE,
                "File name: %s released (%p)\n", file_entry->file_name, file_entry->file_name));
        free(file_entry->file_name);
        file_entry->file_name = NULL;
        file_entry->file_name_size = 0;
    }

    if (file_entry->context)
    {
        file_context_free(file_entry->context);
        file_entry->context = NULL;
    }

    file_entry->file_size = 0;

    file_segments_free(file_entry);

}

/**********************************************************************
 *  Retrieves the GTP data block registered with the stream
 * session associated w/ the current packet. If none exists,
 * allocates it and registers it with the stream API.
 *
 * Arguments:
 *
 * packetp:	Pointer to the packet from which/in which to
 * 		retrieve/store the GTP data block.
 *
 * RETURNS:	Pointer to an GTP data block, upon success.
 *		NULL, upon failure.
 **********************************************************************/
GTPData * GTPGetNewSession(SFSnortPacket *packetp, tSfPolicyId policy_id)
{
    GTPData* datap = NULL;

    /* Sanity check(s) */
    assert( packetp );
    if ( !packetp->stream_session_ptr )
    {
        return NULL;
    }

    datap = (GTPData *)calloc(1, sizeof(GTPData));

    if ( !datap )
        return NULL;

    /*Register the new GTP data block in the stream session. */
    _dpd.streamAPI->set_application_data(
            packetp->stream_session_ptr,
            PP_GTP, datap, FreeGTPData );

    datap->policy_id = policy_id;
    datap->config = gtp_config;
    ((GTPConfig *)sfPolicyUserDataGetCurrent(gtp_config))->ref_count++;

    gtp_stats.sessions++;
    DEBUG_WRAP(DebugMessage(DEBUG_GTP, "Number of sessions created: %u\n", gtp_stats.sessions));

    return datap;
}

/*********************************************************************
 * Main entry point for SIP processing.
 *
 * Arguments:
 *  SFSnortPacket * - pointer to packet structure
 *
 * Returns:
 *  int - 	SIP_SUCCESS
 *		    SIP_FAILURE
 *
 *********************************************************************/
static inline int SIP_Process(SFSnortPacket *p, SIPData* sessp)
{
    int status;
    char* sip_buff = (char*) p->payload;
    char* end;
    SIP_Roptions *pRopts;
    SIPMsg sipMsg;

    memset(&sipMsg, 0, SIPMSG_ZERO_LEN);

    /*Input parameters*/
    sipMsg.isTcp = IsTCP(p);

    end =  sip_buff + p->payload_size;

    status = sip_parse(&sipMsg, sip_buff, end);

    if (SIP_SUCCESS == status)
    {
        SIP_overloadURI(p, &sipMsg);
        /*Update the dialog state*/
        SIP_updateDialog(&sipMsg, &(sessp->dialogs), p);
    }
    /*Update the session data*/
    pRopts = &(sessp->ropts);
    pRopts->methodFlag = sipMsg.methodFlag;
    pRopts->header_data = sipMsg.header;
    pRopts->header_len = sipMsg.headerLen;
    pRopts->body_len = sipMsg.bodyLen;
    pRopts->body_data = sipMsg.body_data;
    pRopts->status_code = sipMsg.status_code;

    DEBUG_WRAP(DebugMessage(DEBUG_SIP, "SIP message header length: %d\n",
            sipMsg.headerLen));
    DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed method: %.*s, Flag: 0x%x\n",
            sipMsg.methodLen, sipMsg.method, sipMsg.methodFlag));
    DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed status code:  %d\n",
            sipMsg.status_code));
    DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed header address: %p.\n",
            sipMsg.header));
    DEBUG_WRAP(DebugMessage(DEBUG_SIP, "Parsed body address: %p.\n",
            sipMsg.body_data));

    sip_freeMsg(&sipMsg);

    return status;
}

/********************************************************************
 * Function: sip_process_headField()
 *
 * Process the header fields (lines). This also deals with folding.
 *
 * Arguments:
 *  SIPMsg *    - sip message
 *  char* start - start of the header line
 *  char* end   - end of the header line
 *  int*        - index of last field processed. Used for folding processing
 *                This value will be updated after current field been processed
 * Returns:
 *  SIP_PARSE_ERROR
 *  SIP_PARSE_SUCCESS
 ********************************************************************/
static int sip_process_headField(SIPMsg *msg, const char *start, const char *end, int *lastFieldIndex)
{
	int findex =0;
	int length = end -start;
	char *colonIndex;
    char *newStart, *newEnd, newLength;
	DEBUG_WRAP(DebugMessage(DEBUG_SIP, "process line: %.*s\n", length, start));

	// If this is folding
	if((' ' == start[0]) || ('\t' == start[0]))
	{
		if(SIP_PARSE_NOFOLDING != *lastFieldIndex)
		{
			SIP_TrimSP(start, end, &newStart, &newEnd);
			return(headerFields[*lastFieldIndex].setfield(msg, newStart, newEnd));
		}
	}
	// Otherwise, continue normal processing
	colonIndex = memchr(start, ':', length);

	if (!colonIndex || (colonIndex < start + 1))
		return SIP_PARSE_ERROR;

	if (!SIP_TrimSP(start, colonIndex, &newStart, &newEnd))
		return SIP_PARSE_ERROR;

	newLength =  newEnd - newStart;

	/*Find out whether the field name needs to process*/
	while (NULL != headerFields[findex].fname)
	{
		//Use the full name to check
		if ((headerFields[findex].fnameLen == newLength)&&
				(0 == strncasecmp(headerFields[findex].fname, newStart, newLength)))
		{
			break;
		}
		//Use short name to check
		else if ((NULL != headerFields[findex].shortName) &&
				( 1 == newLength)&&
				(0 == strncasecmp(headerFields[findex].shortName, newStart, newLength)))
		{
			break;
		}
		findex++;
	}

	if (NULL != headerFields[findex].fname)
	{
		// Found the field name, evaluate the value
		SIP_TrimSP(colonIndex + 1, end, &newStart, &newEnd);
		*lastFieldIndex = findex;
		return (headerFields[findex].setfield(msg, newStart, newEnd));
	}
	*lastFieldIndex = SIP_PARSE_NOFOLDING;
	return SIP_PARSE_SUCCESS;
}