Pull request #4727: smtp/pop/imap file_cache retry/retransmit fix.

Merge in SNORT/snort3 from ~VIIZHYK/snort3:smtp_pop_imap_id_fix to master

Squashed commit of the following:

commit c52a1e457a7780106d391a56416e355a132ac000
Author: viizhyk <viizhyk@cisco.com>
Date:   Tue Aug 5 10:15:56 2025 -0400

    service_inspectors: Added random base file id generation for imap/pop/smtp.

diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc
index df9a21d5b5d428d2a5cd4d2768a593ff24ba40a9..89abfc38437442e8fa51b8eccc4ddf4b03c3a328 100644 (file)
--- a/src/service_inspectors/imap/imap.cc
+++ b/src/service_inspectors/imap/imap.cc
@@ -23,6 +23,7 @@
 #endif
 
 #include "imap.h"
+#include <random>
 
 #include "detection/detection_engine.h"
 #include "js_norm/js_pdf_norm.h"
@@ -197,16 +198,26 @@ static inline PDFJSNorm* acquire_js_ctx(IMAPData& imap_ssn, const void* data, si
     return imap_ssn.jsn;
 }
 
+static uint64_t get_imap_base_file_id()
+{    
+    std::random_device rd;
+    std::mt19937 gen(rd());
+    std::uniform_int_distribution<> distrib(IMAP_MIN_BASE_FILE_ID, IMAP_MAX_BASE_FILE_ID);
+    uint64_t randomId = distrib(gen);   
+    return randomId;
+}
+
 static IMAPData* SetNewIMAPData(IMAP_PROTO_CONF* config, Packet* p)
 {
     IMAPData* imap_ssn;
     ImapFlowData* fd = new ImapFlowData;
+    uint64_t base_file_id = get_imap_base_file_id();
 
     p->flow->set_flow_data(fd);
     imap_ssn = &fd->session;
 
     imapstats.sessions++;
-    imap_ssn->mime_ssn= new ImapMime(p, &(config->decode_conf), &(config->log_config));
+    imap_ssn->mime_ssn= new ImapMime(p, &(config->decode_conf), &(config->log_config), base_file_id);
     imap_ssn->mime_ssn->set_mime_stats(&(imapstats.mime_stats));
 
     if (Stream::is_midstream(p->flow))

diff --git a/src/service_inspectors/imap/imap.h b/src/service_inspectors/imap/imap.h
index 2aa599bb3fb7129689724f7687fb3ec397a32042..637bca2768fd75a73019f3a5cc61eeb5222f3ca1 100644 (file)
--- a/src/service_inspectors/imap/imap.h
+++ b/src/service_inspectors/imap/imap.h
@@ -46,6 +46,9 @@
 #define IMAP_FLAG_CHECK_SSL                  0x00000010
 #define IMAP_FLAG_ABANDON_EVT                0x00000020
 
+#define IMAP_MIN_BASE_FILE_ID 1
+#define IMAP_MAX_BASE_FILE_ID 10000000
+
 typedef enum _IMAPCmdEnum
 {
     CMD_APPEND = 0,

diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc
index 9e3e813f6a9900bed0ada1d38181b6723c3ae9d2..2c780282a1fdaee1f574dcc77046c2a4ac9c8809 100644 (file)
--- a/src/service_inspectors/pop/pop.cc
+++ b/src/service_inspectors/pop/pop.cc
@@ -23,6 +23,7 @@
 #endif
 
 #include "pop.h"
+#include <random>
 
 #include "detection/detection_engine.h"
 #include "js_norm/js_pdf_norm.h"
@@ -154,16 +155,26 @@ static inline PDFJSNorm* acquire_js_ctx(POPData& pop_ssn, const void* data, size
     return pop_ssn.jsn;
 }
 
+static uint64_t get_pop_base_file_id()
+{
+    std::random_device rd;
+    std::mt19937 gen(rd());
+    std::uniform_int_distribution<> distrib(POP_MIN_BASE_FILE_ID, POP_MAX_BASE_FILE_ID);
+    uint64_t randomId = distrib(gen);
+    return randomId;
+}
+
 static POPData* SetNewPOPData(POP_PROTO_CONF* config, Packet* p)
 {
     POPData* pop_ssn;
     PopFlowData* fd = new PopFlowData;
+    uint64_t base_file_id = get_pop_base_file_id();
 
     p->flow->set_flow_data(fd);
     pop_ssn = &fd->session;
 
     popstats.sessions++;
-    pop_ssn->mime_ssn = new PopMime(p, &(config->decode_conf), &(config->log_config));
+    pop_ssn->mime_ssn = new PopMime(p, &(config->decode_conf), &(config->log_config), base_file_id);
     pop_ssn->mime_ssn->set_mime_stats(&(popstats.mime_stats));
 
     if (Stream::is_midstream(p->flow))

diff --git a/src/service_inspectors/pop/pop.h b/src/service_inspectors/pop/pop.h
index 2201cbdd2c414746fb6428b57b098cc49c70674e..cee9060c42ba4a89c1f580fc97675a49e323dd4e 100644 (file)
--- a/src/service_inspectors/pop/pop.h
+++ b/src/service_inspectors/pop/pop.h
@@ -46,6 +46,9 @@
 #define POP_FLAG_CHECK_SSL                  0x00000010
 #define POP_FLAG_ABANDON_EVT               0x00000020
 
+#define POP_MIN_BASE_FILE_ID 1
+#define POP_MAX_BASE_FILE_ID 10000000
+
 typedef enum _POPCmdEnum
 {
     CMD_APOP = 0,

diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc
index 0984dc5235d1ecbe7fe6b5b3d7fbf67c2a8fa3ca..be06456bf38edb7ecdb7de258f66fc68097b3c34 100644 (file)
--- a/src/service_inspectors/smtp/smtp.cc
+++ b/src/service_inspectors/smtp/smtp.cc
@@ -22,6 +22,7 @@
 
 #include "smtp.h"
 
+#include <random>
 #include <string>
 
 #include "detection/detection_engine.h"
@@ -254,16 +255,26 @@ static inline PDFJSNorm* acquire_js_ctx(SMTPData& smtp_ssn, const void* data, si
     return smtp_ssn.jsn;
 }
 
+static uint64_t get_smtp_base_file_id()
+{
+    std::random_device rd;
+    std::mt19937 gen(rd());
+    std::uniform_int_distribution<> distrib(SMTP_MIN_BASE_FILE_ID, SMTP_MAX_BASE_FILE_ID);
+    uint64_t randomId = distrib(gen);
+    return randomId;
+}
+
 static SMTPData* SetNewSMTPData(SmtpProtoConf* config, Packet* p)
 {
     SMTPData* smtp_ssn;
     SmtpFlowData* fd = new SmtpFlowData;
+    uint64_t base_file_id = get_smtp_base_file_id();
 
     p->flow->set_flow_data(fd);
     smtp_ssn = &fd->session;
 
     smtpstats.sessions++;
-    smtp_ssn->mime_ssn = new SmtpMime(p, &(config->decode_conf), &(config->log_config));
+    smtp_ssn->mime_ssn = new SmtpMime(p, &(config->decode_conf), &(config->log_config), base_file_id);
     smtp_ssn->mime_ssn->config = config;
     smtp_ssn->mime_ssn->set_mime_stats(&(smtpstats.mime_stats));
 

diff --git a/src/service_inspectors/smtp/smtp.h b/src/service_inspectors/smtp/smtp.h
index e3a97f11e01f51c0b120f35b1f961192b6ead248..6c9d3703cf9bb1bd7fe5d1baac4de608b47011b3 100644 (file)
--- a/src/service_inspectors/smtp/smtp.h
+++ b/src/service_inspectors/smtp/smtp.h
@@ -79,6 +79,9 @@
 
 #define MAX_AUTH_NAME_LEN  20  // Max length of SASL mechanisms, defined in RFC 4422
 
+#define SMTP_MIN_BASE_FILE_ID 1
+#define SMTP_MAX_BASE_FILE_ID 10000000
+
 enum SMTPRespEnum
 {
     RESP_220 = 0,