appid_dns_session.h
appid_eve_process_event_handler.cc
appid_eve_process_event_handler.h
+ appid_flow_data.h
appid_ha.cc
appid_ha.h
appid_http_session.cc
{
asd->tsession->process_sni_mismatch();
}
-
+
if (sni_mismatch)
asd->scan_flags |= SCAN_SPOOFED_SNI_FLAG;
const AppIdSessionApi* AppIdApi::get_appid_session_api(const Flow& flow) const
{
- AppIdSession* asd = (AppIdSession*)flow.get_flow_data(AppIdSession::inspector_id);
-
- if (asd)
- return &asd->get_api();
-
- return nullptr;
+ StashGenericObject* item;
+ return flow.get_attr(STASH_APPID_DATA, item) ? static_cast<AppIdSessionApi*>(item) : nullptr;
}
bool AppIdApi::is_inspection_needed(const Inspector& inspector) const
return service_disco_mgr;
}
- HostPortVal* host_port_cache_find(const snort::SfIp* ip, uint16_t port, IpProtocol proto)
+ const HostPortVal* host_port_cache_find(const snort::SfIp* ip, uint16_t port, IpProtocol proto)
{
return host_port_cache.find(ip, port, proto, *this);
}
return first_pkt_cache.add_host(sc, ip, netmask, port, proto, protocol_appid, client_appid, web_appid, reinspect);
}
- HostAppIdsVal* host_first_pkt_find(const snort::SfIp* ip, uint16_t port, IpProtocol proto)
+ const HostAppIdsVal* host_first_pkt_find(const snort::SfIp* ip, uint16_t port, IpProtocol proto)
{
return first_pkt_cache.find_on_first_pkt(ip, port, proto, *this);
}
return APPID_SUCCESS;
}
-void* AppIdDetector::data_get(const AppIdSession& asd)
+AppIdFlowData* AppIdDetector::data_get(const AppIdSession& asd)
{
return asd.get_flow_data(flow_data_index);
}
-int AppIdDetector::data_add(AppIdSession& asd, void* data, AppIdFreeFCN fcn)
+int AppIdDetector::data_add(AppIdSession& asd, AppIdFlowData* data)
{
- return asd.add_flow_data(data, flow_data_index, fcn);
+ return asd.add_flow_data(data, flow_data_index);
}
void AppIdDetector::add_user(AppIdSession& asd, const char* username, AppId appId, bool success,
virtual int validate(AppIdDiscoveryArgs&) = 0;
virtual void register_appid(AppId, unsigned extractsInfo, OdpContext& odp_ctxt) = 0;
- void* data_get(const AppIdSession&);
- int data_add(AppIdSession&, void*, AppIdFreeFCN);
+ AppIdFlowData* data_get(const AppIdSession&);
+ int data_add(AppIdSession&, AppIdFlowData*);
void add_user(AppIdSession&, const char*, AppId, bool, AppidChangeBits&);
void add_payload(AppIdSession&, AppId);
void add_app(AppIdSession& asd, AppId service_id, AppId client_id, const char* version, AppidChangeBits& change_bits)
bool is_client() const
{ return client; }
- virtual LuaStateDescriptor* validate_lua_state(bool /*packet_context*/)
- { return nullptr; }
-
protected:
AppIdDiscovery* handler = nullptr;
std::string name; // unique name to map detector; can be UUID file name for lua-detector
port = p->ptrs.sp;
}
}
- HostPortVal* hv = nullptr;
+ const HostPortVal* hv = nullptr;
if (check_static and
(hv = asd.get_odp_ctxt().host_port_cache_find(ip, port, protocol)))
port = p->ptrs.sp;
}
- HostAppIdsVal* hv = nullptr;
- hv = asd.get_odp_ctxt().host_first_pkt_find(ip, port, protocol);
+ const HostAppIdsVal* hv = asd.get_odp_ctxt().host_first_pkt_find(ip, port, protocol);
if (hv)
{
const char *service_app_name = nullptr, *client_app_name = nullptr, *payload_app_name = nullptr;
--- /dev/null
+//--------------------------------------------------------------------------
+// Copyright (C) 2024-2025 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation. You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// appid_flow_data.h author Ron Dempster <rdempste@cisco.com>
+
+#ifndef APPID_FLOW_DATA_H
+#define APPID_FLOW_DATA_H
+
+class AppIdFlowData
+{
+public:
+ AppIdFlowData() = default;
+ virtual ~AppIdFlowData() = default;
+};
+
+#endif
delete tsession;
}
-int AppIdSession::add_flow_data(void* data, unsigned id, AppIdFreeFCN fcn)
+int AppIdSession::add_flow_data(AppIdFlowData* data, unsigned id)
{
- AppIdFlowDataIter it = flow_data.find(id);
+ auto it = flow_data.find(id);
if (it != flow_data.end())
return -1;
- AppIdFlowData* fd = new AppIdFlowData(data, id, fcn);
- flow_data[id] = fd;
+ flow_data[id] = data;
return 0;
}
-void* AppIdSession::get_flow_data(unsigned id) const
+AppIdFlowData* AppIdSession::get_flow_data(unsigned id) const
{
- AppIdFlowDataIter it = flow_data.find(id);
+ auto it = flow_data.find(id);
if (it != flow_data.end())
- return it->second->fd_data;
+ {
+ assert(id == it->first);
+ return it->second;
+ }
else
return nullptr;
}
void AppIdSession::free_flow_data()
{
- for (AppIdFlowDataIter it = flow_data.cbegin();
- it != flow_data.cend();
- ++it)
- delete it->second;
-
+ std::for_each(std::cbegin(flow_data), std::cend(flow_data),
+ [](const std::pair<unsigned, AppIdFlowData*>& p)
+ {
+ delete p.second;
+ });
flow_data.clear();
}
void AppIdSession::free_flow_data_by_id(unsigned id)
{
- AppIdFlowDataIter it = flow_data.find(id);
+ auto it = flow_data.find(id);
if (it != flow_data.end())
{
+ assert(id == it->first);
delete it->second;
flow_data.erase(it);
}
void AppIdSession::free_flow_data_by_mask(unsigned mask)
{
- for (AppIdFlowDataIter it = flow_data.cbegin(); it != flow_data.cend();)
- if (!mask or (it->second->fd_id & mask))
+ for (auto it = flow_data.cbegin(); it != flow_data.cend();)
+ {
+ if (!mask or (it->first & mask))
{
delete it->second;
it = flow_data.erase(it);
}
else
++it;
+ }
}
int AppIdSession::add_flow_data_id(uint16_t port, ServiceDetector* service)
#include "appid_api.h"
#include "appid_app_descriptor.h"
#include "appid_config.h"
+#include "appid_flow_data.h"
#include "appid_http_session.h"
#include "appid_types.h"
#include "application_ids.h"
class AppIdHttpSession;
class ThirdPartyAppIdSession;
-using AppIdFreeFCN = void (*)(void*);
-
const uint8_t* service_strstr(const uint8_t* haystack, unsigned haystack_len,
const uint8_t* needle, unsigned needle_len);
APPID_DISCO_STATE_FINISHED
};
-class AppIdFlowData
-{
-public:
- AppIdFlowData(void* data, unsigned id, AppIdFreeFCN fcn) :
- fd_data(data), fd_id(id), fd_free(fcn)
- { }
-
- ~AppIdFlowData()
- {
- if (fd_data && fd_free)
- fd_free(fd_data);
- }
-
- void* fd_data;
- unsigned fd_id;
- AppIdFreeFCN fd_free;
-};
-typedef std::unordered_map<unsigned, AppIdFlowData*>::const_iterator AppIdFlowDataIter;
-
enum MatchedTlsType
{
MATCHED_TLS_NONE = 0,
bool is_decrypted() const { return ((flags & APPID_SESSION_DECRYPTED) == 0) ? false : true; }
bool is_svc_taking_too_much_time() const;
- void* get_flow_data(unsigned id) const;
- int add_flow_data(void* data, unsigned id, AppIdFreeFCN);
+ AppIdFlowData* get_flow_data(unsigned id) const;
+ int add_flow_data(AppIdFlowData* data, unsigned id);
int add_flow_data_id(uint16_t port, ServiceDetector*);
void free_flow_data_by_id(unsigned id);
void free_flow_data_by_mask(unsigned mask);
{
delete_all_http_sessions();
snort_free(tls_host);
+ tls_host = nullptr;
snort_free(netbios_name);
+ netbios_name = nullptr;
snort_free(netbios_domain);
+ netbios_domain = nullptr;
snort_free(tls_sni);
+ tls_sni = nullptr;
delete dsession;
+ dsession = nullptr;
}
void delete_all_http_sessions()
{
if (host)
{
- if (tls_host)
- snort_free(tls_host);
+ snort_free(tls_host);
tls_host = snort_strdup(host);
}
}
{
if (sni and sni != tls_sni)
{
- if (tls_sni)
- snort_free(tls_sni);
+ snort_free(tls_sni);
tls_sni = snort_strdup(sni);
}
}
APPID_LOG(CURRENT_PACKET, TRACE_DEBUG_LEVEL, "SSH event handler service detected\n");
}
-
-static void free_ssh_flow_data(void* data)
-{
- delete (SshEventFlowData* )data;
-}
-
unsigned int SshEventHandler::id;
void SshEventHandler::handle(DataEvent& event, Flow* flow)
if (!data)
{
data = new SshEventFlowData;
- asd->add_flow_data(data, id, &free_ssh_flow_data);
+ asd->add_flow_data(data, id);
}
SshEvent& ssh_event = (SshEvent&)event;
#include "pub_sub/ssh_events.h"
+#include "appid_flow_data.h"
#include "appid_module.h"
class SshEventHandler : public snort::DataHandler
bool finished = false;
};
-struct SshEventFlowData
+class SshEventFlowData : public AppIdFlowData
{
+public:
+ ~SshEventFlowData() override = default;
SshAppIdInfo service_info;
SshAppIdInfo client_info;
bool failed = false;
BIT_STATE_MESSAGE_DATA
};
-struct ClientBITData
+class ClientBITData : public AppIdFlowData
{
- BITState state;
- unsigned stringlen;
- unsigned pos;
+public:
+ ~ClientBITData() override = default;
+
+ BITState state = BIT_STATE_BANNER;
+ unsigned stringlen = 0;
+ unsigned pos = 0;
union
{
uint32_t len;
uint8_t raw_len[4];
- } l;
+ } l = {};
};
#pragma pack(1)
fd = (ClientBITData*)data_get(args.asd);
if (!fd)
{
- fd = (ClientBITData*)snort_calloc(sizeof(ClientBITData));
- data_add(args.asd, fd, &snort_free);
- fd->state = BIT_STATE_BANNER;
+ fd = new ClientBITData;
+ data_add(args.asd, fd);
}
offset = 0;
BIT_TYPE_ERROR
};
-struct ClientBITData
+class ClientBITData : public AppIdFlowData
{
- BITState state;
- BITType type;
- unsigned pos;
+public:
+ ~ClientBITData() override = default;
+
+ BITState state = BIT_STATE_BANNER;
+ BITType type = {};
+ unsigned pos = 0;
};
} // anonymous
int BitTrackerClientDetector::validate(AppIdDiscoveryArgs& args)
{
- ClientBITData* fd;
- uint16_t offset;
-
if (args.size < (UDP_BIT_FIRST_LEN + UDP_BIT_END_LEN + 3))
return APPID_EINVALID;
- fd = (ClientBITData*)data_get(args.asd);
+ ClientBITData* fd = (ClientBITData*)data_get(args.asd);
if (!fd)
{
- fd = (ClientBITData*)snort_calloc(sizeof(ClientBITData));
- data_add(args.asd, fd, &snort_free);
- fd->state = BIT_STATE_BANNER;
+ fd = new ClientBITData;
+ data_add(args.asd, fd);
}
- offset = 0;
+ uint16_t offset = 0;
while (offset < args.size)
{
switch (fd->state)
#define MAX_REMOTE_SIZE 128
#define NUMBER_OF_PACKETS 3
-struct ClientRTPData
+class ClientRTPData : public AppIdFlowData
{
- RTPState state;
- uint8_t pos;
- uint16_t init_seq;
- uint16_t resp_seq;
- uint8_t init_count;
- uint8_t resp_count;
- uint32_t init_timestamp;
- uint32_t resp_timestamp;
- uint32_t init_ssrc;
- uint32_t resp_ssrc;
+public:
+ ~ClientRTPData() override = default;
+
+ RTPState state = RTP_STATE_CONNECTION;
+ uint8_t pos = 0;
+ uint16_t init_seq = 0;
+ uint16_t resp_seq = 0;
+ uint8_t init_count = 0;
+ uint8_t resp_count = 0;
+ uint32_t init_timestamp = 0;
+ uint32_t resp_timestamp = 0;
+ uint32_t init_ssrc = 0;
+ uint32_t resp_ssrc = 0;
};
#pragma pack(1)
int RtpClientDetector::validate(AppIdDiscoveryArgs& args)
{
- ClientRTPData* fd;
- const ClientRTPMsg* hdr;
-
if (!args.size)
return APPID_INPROCESS;
- fd = (ClientRTPData*)data_get(args.asd);
+ ClientRTPData* fd = (ClientRTPData*)data_get(args.asd);
if (!fd)
{
- fd = (ClientRTPData*)snort_calloc(sizeof(ClientRTPData));
- data_add(args.asd, fd, &snort_free);
- fd->state = RTP_STATE_CONNECTION;
+ fd = new ClientRTPData;
+ data_add(args.asd, fd);
}
+ const ClientRTPMsg* hdr;
switch (fd->state)
{
case RTP_STATE_CONNECTION:
};
}
-struct ClientTIMBUKTUData
+class ClientTIMBUKTUData : public AppIdFlowData
{
- TIMBUKTUState state;
- uint16_t stringlen;
- unsigned pos;
+public:
+ ~ClientTIMBUKTUData() override = default;
+
+ TIMBUKTUState state = TIMBUKTU_STATE_BANNER;
+ uint16_t stringlen = 0;
+ unsigned pos = 0;
union
{
uint16_t len;
uint8_t raw_len[2];
- } l;
+ } l = {};
};
#pragma pack(1)
int TimbuktuClientDetector::validate(AppIdDiscoveryArgs& args)
{
- ClientTIMBUKTUData* fd;
- uint16_t offset;
-
if (args.dir != APP_ID_FROM_INITIATOR)
return APPID_INPROCESS;
- fd = (ClientTIMBUKTUData*)data_get(args.asd);
+ ClientTIMBUKTUData* fd = (ClientTIMBUKTUData*)data_get(args.asd);
if (!fd)
{
- fd = (ClientTIMBUKTUData*)snort_calloc(sizeof(ClientTIMBUKTUData));
- data_add(args.asd, fd, &snort_free);
- fd->state = TIMBUKTU_STATE_BANNER;
+ fd = new ClientTIMBUKTUData;
+ data_add(args.asd, fd);
}
- offset = 0;
+ uint16_t offset = 0;
while (offset < args.size)
{
switch (fd->state)
#define USER_STRING "user="
#define MAX_USER_POS ((int)sizeof(USER_STRING) - 2)
-namespace
+enum TNSClntState
{
-enum TNSState
-{
- TNS_STATE_MESSAGE_LEN = 0,
- TNS_STATE_MESSAGE_CHECKSUM,
- TNS_STATE_MESSAGE,
- TNS_STATE_MESSAGE_RES,
- TNS_STATE_MESSAGE_HD_CHECKSUM,
- TNS_STATE_MESSAGE_DATA,
- TNS_STATE_MESSAGE_CONNECT,
- TNS_STATE_MESSAGE_CONNECT_OFFSET_DC,
- TNS_STATE_MESSAGE_CONNECT_OFFSET,
- TNS_STATE_MESSAGE_CONNECT_PREDATA,
- TNS_STATE_MESSAGE_CONNECT_DATA,
- TNS_STATE_COLLECT_USER
+ CLNT_MSG_LEN = 0,
+ CLNT_MSG_CHECKSUM,
+ CLNT_MSG,
+ CLNT_MSG_RES,
+ CLNT_MSG_HD_CHECKSUM,
+ CLNT_MSG_DATA,
+ CLNT_MSG_CONNECT,
+ CLNT_MSG_CONNECT_OFFSET_DC,
+ CLNT_MSG_CONNECT_OFFSET,
+ CLNT_MSG_CONNECT_PREDATA,
+ CLNT_MSG_CONNECT_DATA,
+ CLNT_COLLECT_USER
};
-}
-struct ClientTNSData
+class ClientTNSData : public AppIdFlowData
{
- TNSState state;
- unsigned stringlen;
- unsigned offsetlen;
- unsigned pos;
- unsigned message;
+public:
+ ~ClientTNSData() override = default;
+
+ const char* version = nullptr;
+ TNSClntState state = CLNT_MSG_LEN;
+ unsigned stringlen = 0;
+ unsigned offsetlen = 0;
+ unsigned pos = 0;
+ unsigned message = 0;
union
{
uint16_t len;
uint8_t raw_len[2];
- } l;
- const char* version;
- uint8_t* data;
+ } l = {};
};
#pragma pack(1)
}
-static int reset_flow_data(ClientTNSData* fd)
+static int reset_flow_data(ClientTNSData& fd)
{
- memset(fd, '\0', sizeof(ClientTNSData));
- fd->state = TNS_STATE_MESSAGE_LEN;
+ fd = {};
return APPID_EINVALID;
}
#define TNS_MAX_INFO_SIZE 63
int TnsClientDetector::validate(AppIdDiscoveryArgs& args)
{
- char username[TNS_MAX_INFO_SIZE + 1];
- ClientTNSData* fd;
- uint16_t offset;
- int user_pos = 0;
- int user_size = 0;
- uint16_t user_start = 0;
- uint16_t user_end = 0;
-
if (args.dir != APP_ID_FROM_INITIATOR)
return APPID_INPROCESS;
- fd = (ClientTNSData*)data_get(args.asd);
+ ClientTNSData* fd = (ClientTNSData*)data_get(args.asd);
if (!fd)
{
- fd = (ClientTNSData*)snort_calloc(sizeof(ClientTNSData));
- data_add(args.asd, fd, &snort_free);
- fd->state = TNS_STATE_MESSAGE_LEN;
+ fd = new ClientTNSData;
+ data_add(args.asd, fd);
}
- offset = 0;
+ char username[TNS_MAX_INFO_SIZE + 1];
+ int user_pos = 0;
+ int user_size = 0;
+ uint16_t user_start = 0;
+ uint16_t user_end = 0;
+
+ uint16_t offset = 0;
while (offset < args.size)
{
+ // For some reason, coverity cannot follow the state machine. It does state transitions that are not possible
+ // This makes the coverity overrun exceptions necessary
switch (fd->state)
{
- case TNS_STATE_MESSAGE_LEN:
- if (fd->pos >= 2)
- break;
-
+ case CLNT_MSG_LEN:
+ // coverity[overrun]
fd->l.raw_len[fd->pos++] = args.data[offset];
if (fd->pos >= offsetof(ClientTNSMsg, checksum))
{
{
if (offset == args.size - 1)
goto done;
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
}
else if (fd->stringlen < 2)
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
else if (fd->stringlen > args.size)
- return reset_flow_data(fd);
- else
- fd->state = TNS_STATE_MESSAGE_CHECKSUM;
+ return reset_flow_data(*fd);
+ fd->state = CLNT_MSG_CHECKSUM;
}
break;
- case TNS_STATE_MESSAGE_CHECKSUM:
+ case CLNT_MSG_CHECKSUM:
if (args.data[offset] != 0)
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
fd->pos++;
if (fd->pos >= offsetof(ClientTNSMsg, msg))
- fd->state = TNS_STATE_MESSAGE;
+ fd->state = CLNT_MSG;
break;
- case TNS_STATE_MESSAGE:
+ case CLNT_MSG:
fd->message = args.data[offset];
if (fd->message < TNS_TYPE_CONNECT || fd->message > TNS_TYPE_MAX)
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
fd->pos++;
- fd->state = TNS_STATE_MESSAGE_RES;
+ fd->state = CLNT_MSG_RES;
break;
- case TNS_STATE_MESSAGE_RES:
- fd->state = TNS_STATE_MESSAGE_HD_CHECKSUM;
+ case CLNT_MSG_RES:
+ fd->state = CLNT_MSG_HD_CHECKSUM;
fd->pos++;
break;
- case TNS_STATE_MESSAGE_HD_CHECKSUM:
+ case CLNT_MSG_HD_CHECKSUM:
fd->pos++;
if (fd->pos >= offsetof(ClientTNSMsg, data))
{
switch (fd->message)
{
case TNS_TYPE_CONNECT:
- fd->state = TNS_STATE_MESSAGE_CONNECT;
+ fd->state = CLNT_MSG_CONNECT;
break;
case TNS_TYPE_ACK:
case TNS_TYPE_REFUSE:
{
if (offset == (args.size - 1))
goto done;
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
}
- fd->state = TNS_STATE_MESSAGE_DATA;
+ fd->state = CLNT_MSG_DATA;
break;
case TNS_TYPE_ACCEPT:
case TNS_TYPE_REDIRECT:
default:
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
}
}
break;
- case TNS_STATE_MESSAGE_CONNECT:
- if (fd->pos >= (CONNECT_VERSION_OFFSET + 2))
- break;
+ case CLNT_MSG_CONNECT:
+ // coverity[overrun]
fd->l.raw_len[fd->pos - CONNECT_VERSION_OFFSET] = args.data[offset];
fd->pos++;
if (fd->pos == (CONNECT_VERSION_OFFSET + 2))
{
+ switch (ntohs(fd->l.len))
{
- switch (ntohs(fd->l.len))
- {
- case 0x136:
- fd->version = "8";
- break;
- case 0x137:
- fd->version = "9i R1";
- break;
- case 0x138:
- fd->version = "9i R2";
- break;
- case 0x139:
- fd->version = "10g R1/R2";
- break;
- case 0x13A:
- fd->version = "11g R1";
- break;
- default:
- break;
- }
+ case 0x136:
+ fd->version = "8";
+ break;
+ case 0x137:
+ fd->version = "9i R1";
+ break;
+ case 0x138:
+ fd->version = "9i R2";
+ break;
+ case 0x139:
+ fd->version = "10g R1/R2";
+ break;
+ case 0x13A:
+ fd->version = "11g R1";
+ break;
+ default:
+ break;
}
fd->l.len = 0;
- fd->state = TNS_STATE_MESSAGE_CONNECT_OFFSET_DC;
+ fd->state = CLNT_MSG_CONNECT_OFFSET_DC;
}
break;
- case TNS_STATE_MESSAGE_CONNECT_OFFSET_DC:
+ case CLNT_MSG_CONNECT_OFFSET_DC:
fd->pos++;
if (fd->pos >= CONNECT_DATA_OFFSET)
- fd->state = TNS_STATE_MESSAGE_CONNECT_OFFSET;
+ fd->state = CLNT_MSG_CONNECT_OFFSET;
break;
- case TNS_STATE_MESSAGE_CONNECT_OFFSET:
+ case CLNT_MSG_CONNECT_OFFSET:
if (fd->pos >= CONNECT_DATA_OFFSET + 2)
- break;
+ break;
+ // coverity[overrun]
fd->l.raw_len[fd->pos - CONNECT_DATA_OFFSET] = args.data[offset];
fd->pos++;
if (fd->pos == (CONNECT_DATA_OFFSET + 2))
{
fd->offsetlen = ntohs(fd->l.len);
if (fd->offsetlen > args.size)
- {
- return reset_flow_data(fd);
- }
- fd->state = TNS_STATE_MESSAGE_CONNECT_PREDATA;
+ return reset_flow_data(*fd);
+ fd->state = CLNT_MSG_CONNECT_PREDATA;
}
break;
- case TNS_STATE_MESSAGE_CONNECT_PREDATA:
+ case CLNT_MSG_CONNECT_PREDATA:
fd->pos++;
if (fd->pos >= fd->offsetlen)
- {
- fd->state = TNS_STATE_MESSAGE_CONNECT_DATA;
- }
+ fd->state = CLNT_MSG_CONNECT_DATA;
break;
- case TNS_STATE_MESSAGE_CONNECT_DATA:
+ case CLNT_MSG_CONNECT_DATA:
if (tolower(args.data[offset]) != USER_STRING[user_pos])
{
user_pos = 0;
else if (++user_pos > MAX_USER_POS)
{
user_start = offset+1;
- fd->state = TNS_STATE_COLLECT_USER;
+ fd->state = CLNT_COLLECT_USER;
}
fd->pos++;
{
if (offset == (args.size - 1))
goto done;
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
}
break;
- case TNS_STATE_COLLECT_USER:
+ case CLNT_COLLECT_USER:
if (user_end == 0 && args.data[offset] == ')')
- {
user_end = offset;
- }
fd->pos++;
- if (fd->pos >= fd->stringlen)
+ if (fd->pos >= fd->stringlen)
{
if (offset == (args.size - 1))
goto done;
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
}
break;
- case TNS_STATE_MESSAGE_DATA:
+ case CLNT_MSG_DATA:
fd->pos++;
if (fd->pos >= fd->stringlen)
{
if (offset == (args.size - 1))
goto done;
- return reset_flow_data(fd);
+ return reset_flow_data(*fd);
}
break;
default:
};
#define MAX_VNC_VERSION_SIZE 8
-struct ClientVNCData
+class ClientVNCData : public AppIdFlowData
{
- VNCState state;
- unsigned pos;
- uint8_t version[MAX_VNC_VERSION_SIZE];
+public:
+ ~ClientVNCData() override = default;
+
+ VNCState state = VNC_STATE_BANNER;
+ unsigned pos = 0;
+ uint8_t version[MAX_VNC_VERSION_SIZE] = {};
};
VncClientDetector::VncClientDetector(ClientDiscovery* cdm)
int VncClientDetector::validate(AppIdDiscoveryArgs& args)
{
- ClientVNCData* fd;
- uint16_t offset;
-
if (args.dir != APP_ID_FROM_INITIATOR)
return APPID_INPROCESS;
- fd = (ClientVNCData*)data_get(args.asd);
+ ClientVNCData* fd = (ClientVNCData*)data_get(args.asd);
if (!fd)
{
- fd = (ClientVNCData*)snort_calloc(sizeof(ClientVNCData));
- data_add(args.asd, fd, &snort_free);
- fd->state = VNC_STATE_BANNER;
+ fd = new ClientVNCData;
+ data_add(args.asd, fd);
}
- offset = 0;
+ uint16_t offset = 0;
while (offset < args.size)
{
switch (fd->state)
DNS_STATE_RESPONSE
};
-struct ServiceDNSData
+class ServiceDNSData : public AppIdFlowData
{
- DNSState state;
- uint16_t id;
+public:
+ ~ServiceDNSData() override = default;
+
+ DNSState state = DNS_STATE_QUERY;
+ uint16_t id = 0;
};
DnsTcpServiceDetector::DnsTcpServiceDetector(ServiceDiscovery* sd)
{
// To get here, we missed the initial query, but now we've got
// a response.
+ // Coverity doesn't realize that validate_packet() checks the packet data for valid values
+ // coverity[tainted_scalar]
rval = validate_packet(args.data, args.size, args.dir,
args.asd.get_odp_ctxt().dns_host_reporting, args.asd, args.change_bits);
if (rval == APPID_SUCCESS)
goto udp_done;
}
+ // Coverity doesn't realize that validate_packet() checks the packet data for valid values
+ // coverity[tainted_scalar]
rval = validate_packet(args.data, args.size, args.dir,
args.asd.get_odp_ctxt().dns_host_reporting, args.asd, args.change_bits);
if ((rval == APPID_SUCCESS) && (args.dir == APP_ID_FROM_INITIATOR))
goto fail;
}
+ // Coverity doesn't realize that validate_packet() checks the packet data for valid values
+ // coverity[tainted_scalar]
rval = validate_packet(data, size, args.dir,
args.asd.get_odp_ctxt().dns_host_reporting, args.asd, args.change_bits);
if (rval != APPID_SUCCESS)
ServiceDNSData* dd = static_cast<ServiceDNSData*>(data_get(args.asd));
if (!dd)
{
- dd = static_cast<ServiceDNSData*>(snort_calloc(sizeof(ServiceDNSData)));
- if (data_add(args.asd, dd, &snort_free))
- dd->state = DNS_STATE_QUERY;
+ dd = new ServiceDNSData;
+ data_add(args.asd, dd);
}
if (dd->state == DNS_STATE_QUERY)
char tagValue[IMAP_TAG_MAX_LEN+1];
};
-struct ImapDetectorData
+class ImapDetectorData : public AppIdFlowData
{
- ImapClientData client;
- ImapServiceData server;
- int need_continue;
+public:
+ ImapDetectorData()
+ {
+ server.state = IMAP_STATE_BEGIN;
+ server.flags = IMAP_FLAG_FIRST_PACKET;
+ }
+ ~ImapDetectorData() override = default;
+
+ ImapClientData client = {};
+ ImapServiceData server = {};
+ int need_continue = 1;
};
static int isImapTagChar(uint8_t tag)
ImapDetectorData* dd = (ImapDetectorData*)data_get(asd);
if (!dd)
{
- dd = (ImapDetectorData*)snort_calloc(sizeof(ImapDetectorData));
- data_add(asd, dd, &snort_free);
- dd->server.state = IMAP_STATE_BEGIN;
- dd->server.flags = IMAP_FLAG_FIRST_PACKET;
- dd->need_continue = 1;
+ dd = new ImapDetectorData;
+ data_add(asd, dd);
asd.set_session_flags(APPID_SESSION_CLIENT_GETS_SERVER_PACKETS);
}
#include "service_plugins/service_detector.h"
class AppIdSession;
-struct ImapDetectorData;
+class ImapDetectorData;
class ImapClientDetector : public ClientDetector
{
unsigned flags;
};
-struct KerberosDetectorData
+class KerberosDetectorData : public AppIdFlowData
{
- KRBState clnt_state;
- KRBState svr_state;
- int need_continue;
+public:
+ ~KerberosDetectorData() override = default;
+
+ KRBState clnt_state = {};
+ KRBState svr_state = {};
+ int need_continue = 1;
};
#define ASN_1_APPLICATION 0x40
KerberosDetectorData* dd = (KerberosDetectorData*)data_get(asd);
if (!dd)
{
- dd = (KerberosDetectorData*)snort_calloc(sizeof(KerberosDetectorData));
- data_add(asd, dd, &snort_free);
+ dd = new KerberosDetectorData;
+ data_add(asd, dd);
if (asd.protocol == IpProtocol::TCP)
{
dd->clnt_state.state = KRB_STATE_TCP_LENGTH;
dd->svr_state.state = KRB_STATE_APP;
}
- dd->need_continue = 1;
asd.set_session_flags(APPID_SESSION_CLIENT_GETS_SERVER_PACKETS);
}
}
struct KRBState;
-struct KerberosDetectorData;
+class KerberosDetectorData;
class KerberosServiceDetector;
class KerberosClientDetector : public ClientDetector
int error;
};
-struct POP3DetectorData
+class POP3DetectorData : public AppIdFlowData
{
- ClientPOP3Data client;
- ServicePOP3Data server;
- int need_continue;
+public:
+ POP3DetectorData()
+ {
+ server.state = POP3_STATE_CONNECT;
+ client.state = POP3_CLIENT_STATE_AUTH;
+ }
+ ~POP3DetectorData() override;
+
+ ClientPOP3Data client = {};
+ ServicePOP3Data server = {};
+ int need_continue = 1;
};
static AppIdFlowContentPattern pop3_client_patterns[] =
return 1;
}
-static void pop3_free_state(void* data)
+POP3DetectorData::~POP3DetectorData()
{
- POP3DetectorData* dd = (POP3DetectorData*)data;
- if (dd)
+ while (server.subtype)
{
- ServicePOP3Data* sd = &dd->server;
- while (sd->subtype)
- {
- AppIdServiceSubtype* sub = sd->subtype;
- sd->subtype = sub->next;
- delete sub;
- }
- ClientPOP3Data* cd = &dd->client;
- if (cd->username)
- snort_free(cd->username);
- snort_free(dd);
+ AppIdServiceSubtype* sub = server.subtype;
+ server.subtype = sub->next;
+ delete sub;
}
+ if (client.username)
+ snort_free(client.username);
}
static int pop3_check_line(const uint8_t** data, const uint8_t* end)
POP3DetectorData* dd = (POP3DetectorData*)data_get(asd);
if (!dd)
{
- dd = (POP3DetectorData*)snort_calloc(sizeof(POP3DetectorData));
- data_add(asd, dd, &pop3_free_state);
- dd->server.state = POP3_STATE_CONNECT;
- dd->client.state = POP3_CLIENT_STATE_AUTH;
- dd->need_continue = 1;
+ dd = new POP3DetectorData;
+ data_add(asd, dd);
asd.set_session_flags(APPID_SESSION_CLIENT_GETS_SERVER_PACKETS);
}
#include "client_plugins/client_detector.h"
#include "service_plugins/service_detector.h"
-struct POP3DetectorData;
+class POP3DetectorData;
class Pop3ServiceDetector;
class Pop3ClientDetector : public ClientDetector
SIP_FLAG_SERVER_CHECKED = (1<< 0)
};
-struct ClientSIPData
+class ClientSIPData : public AppIdFlowData
{
+public:
+ explicit ClientSIPData(void* owner) : owner(owner)
+ { }
+ ~ClientSIPData() override = default;
+
void* owner = nullptr;
SIPState state = SIP_STATE_INIT;
uint32_t flags = 0;
std::string from;
};
-static void clientDataFree(void* data)
-{
- delete (ClientSIPData*)data;
-}
-
SipUdpClientDetector::SipUdpClientDetector(ClientDiscovery* cdm)
{
handler = cdm;
ClientSIPData* fd = (ClientSIPData*)data_get(args.asd);
if ( !fd )
{
- fd = new ClientSIPData();
- data_add(args.asd, fd, &clientDataFree);
- fd->owner = this;
+ fd = new ClientSIPData(this);
+ data_add(args.asd, fd);
args.asd.set_session_flags(APPID_SESSION_CLIENT_GETS_SERVER_PACKETS);
}
ClientSIPData* fd = (ClientSIPData*)data_get(args.asd);
if ( !fd )
{
- fd = new ClientSIPData();
- data_add(args.asd, fd, &clientDataFree);
- fd->owner = this;
+ fd = new ClientSIPData(this);
+ data_add(args.asd, fd);
args.asd.set_session_flags(APPID_SESSION_CLIENT_GETS_SERVER_PACKETS);
}
return APPID_INPROCESS;
}
-struct ServiceSIPData
+class ServiceSIPData : public AppIdFlowData
{
- uint8_t serverPkt;
- char vendor[MAX_VENDOR_SIZE];
+public:
+ ~ServiceSIPData() override = default;
+
+ uint8_t serverPkt = 0;
+ char vendor[MAX_VENDOR_SIZE] = {};
};
void SipServiceDetector::createRtpFlow(AppIdSession& asd, const Packet* pkt, const SfIp* cliIp,
ServiceSIPData* ss = (ServiceSIPData*)data_get(args.asd);
if (!ss)
{
- ss = (ServiceSIPData*)snort_calloc(sizeof(ServiceSIPData));
- data_add(args.asd, ss, &snort_free);
+ ss = new ServiceSIPData;
+ data_add(args.asd, ss);
}
if (args.size && args.dir == APP_ID_FROM_RESPONDER)
ClientSIPData* fd = (ClientSIPData*)client->data_get(asd);
if ( !fd )
{
- fd = new ClientSIPData();
- client->data_add(asd, fd, &clientDataFree);
- fd->owner = client;
+ fd = new ClientSIPData(client);
+ client->data_add(asd, fd);
asd.set_session_flags(APPID_SESSION_CLIENT_GETS_SERVER_PACKETS);
}
return;
ServiceSIPData* ss = (ServiceSIPData*)service->data_get(asd);
- if ( !ss )
+ if (!ss)
{
- ss = (ServiceSIPData*)snort_calloc(sizeof(ServiceSIPData));
- service->data_add(asd, ss, &snort_free);
+ ss = new ServiceSIPData;
+ service->data_add(asd, ss);
}
ss->serverPkt = 0;
int multiline;
};
-struct SMTPDetectorData
+class SMTPDetectorData : public AppIdFlowData
{
- ClientSMTPData client;
- ServiceSMTPData server;
- int need_continue;
+public:
+ SMTPDetectorData()
+ {
+ client.state = SMTP_CLIENT_STATE_HELO;
+ }
+ ~SMTPDetectorData() override;
+
+ ClientSMTPData client = {};
+ ServiceSMTPData server = {};
+ int need_continue = 1;
};
#define HELO "HELO "
return 1;
}
-static void smtp_free_state(void* data)
+SMTPDetectorData::~SMTPDetectorData()
{
- SMTPDetectorData* dd = (SMTPDetectorData*)data;
- if (dd)
- {
- ClientSMTPData* cd = &dd->client;
- if (cd->headerline)
- snort_free(cd->headerline);
- snort_free(dd);
- }
+ if (client.headerline)
+ snort_free(client.headerline);
}
SMTPDetectorData* SmtpClientDetector::get_common_data(AppIdSession& asd)
SMTPDetectorData* dd = (SMTPDetectorData*)data_get(asd);
if (!dd)
{
- dd = (SMTPDetectorData*)snort_calloc(1, sizeof(*dd));
- data_add(asd, dd, &smtp_free_state);
+ dd = new SMTPDetectorData;
+ data_add(asd, dd);
if (asd.get_session_flags(APPID_SESSION_DECRYPTED))
{
else
dd->server.state = SMTP_SERVICE_STATE_CONNECTION;
- dd->client.state = SMTP_CLIENT_STATE_HELO;
- dd->need_continue = 1;
asd.set_session_flags(APPID_SESSION_CLIENT_GETS_SERVER_PACKETS);
}
#include "framework/counts.h"
struct ClientSMTPData;
-struct SMTPDetectorData;
+class SMTPDetectorData;
class SmtpClientDetector : public ClientDetector
{
// LCOV_EXCL_START
void ClientDetector::register_appid(int, unsigned int, OdpContext&) { }
int AppIdDetector::initialize(AppIdInspector&) { return 1; }
-int AppIdDetector::data_add(AppIdSession&, void*, void (*)(void*)) { return 1; }
+int AppIdDetector::data_add(AppIdSession&, AppIdFlowData*) { return 1; }
void AppIdDetector::add_user(AppIdSession&, char const*, int, bool, AppidChangeBits&) { }
void AppIdDetector::add_payload(AppIdSession&, int) { }
void AppIdDetector::add_app(snort::Packet const&, AppIdSession&, AppidSessionDirection, int,
int SipPatternMatchers::get_client_from_ua(char const*, unsigned int, int&, char*&) { return 0; } // LCOV_EXCL_LINE
void SipEventHandler::service_handler(SipEvent&, AppIdSession&, AppidChangeBits&) { }
-void* AppIdDetector::data_get(const AppIdSession&)
+AppIdFlowData* AppIdDetector::data_get(const AppIdSession&)
{
- sip_data = new ClientSIPData();
+ sip_data = new ClientSIPData(nullptr);
sip_data->from = "<sip:1001@51.1.1.130:11810>";
- return (void*)sip_data;
+ return sip_data;
}
TEST_GROUP(detector_sip_tests)
return true;
}
-HostAppIdsVal* HostPortCache::find_on_first_pkt(const SfIp* ip, uint16_t port, IpProtocol protocol,
+const HostAppIdsVal* HostPortCache::find_on_first_pkt(const SfIp* ip, uint16_t port, IpProtocol protocol,
const OdpContext& odp_ctxt)
{
uint16_t lookup_port = (odp_ctxt.allow_port_wildcard_host_cache)? 0 : port;
return &check_cache->second;
}
- for (std::map<FirstPktkey ,HostAppIdsVal>::iterator iter = cache_first_subnet.begin(); iter != cache_first_subnet.end(); ++iter)
+ for (auto iter = cache_first_subnet.begin(); iter != cache_first_subnet.end(); ++iter)
{
if (iter->first.port == lookup_port and iter->first.proto == protocol and
check_ip_range(iter->first.max_network_range, iter->first.network_address, *ip, &iter->first.netmask[0]))
bool add(const snort::SnortConfig*, const snort::SfIp*, uint16_t port, IpProtocol,
unsigned type, AppId);
- HostAppIdsVal* find_on_first_pkt(const snort::SfIp*, uint16_t port, IpProtocol, const OdpContext&);
+ const HostAppIdsVal* find_on_first_pkt(const snort::SfIp*, uint16_t port, IpProtocol, const OdpContext&);
bool add_host(const snort::SnortConfig*, const snort::SfIp*, uint32_t* netmask, uint16_t port, IpProtocol,
AppId, AppId, AppId, unsigned reinspect);
void dump();
BGP_STATE_OPENSENT
};
-#pragma pack(1)
-
-struct ServiceBGPData
+class ServiceBGPData : public AppIdFlowData
{
- BGPState state;
- int v1;
+public:
+ ~ServiceBGPData() override = default;
+
+ BGPState state = BGP_STATE_CONNECTION;
+ bool v1 = false;
};
+#pragma pack(1)
+
union ServiceBGPHeader
{
struct
int BgpServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceBGPData* bd;
- const ServiceBGPHeader* bh;
- const uint8_t* data = args.data;
- uint16_t len;
- if (!args.size)
- goto inprocess;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
if (args.size < sizeof(ServiceBGPHeader))
- goto fail;
+ {
+ fail_service(args.asd, args.pkt, args.dir);
+ return APPID_NOMATCH;
+ }
- bd = (ServiceBGPData*)data_get(args.asd);
+ ServiceBGPData* bd = (ServiceBGPData*)data_get(args.asd);
if (!bd)
{
- bd = (ServiceBGPData*)snort_calloc(sizeof(ServiceBGPData));
- data_add(args.asd, bd, &snort_free);
- bd->state = BGP_STATE_CONNECTION;
+ bd = new ServiceBGPData;
+ data_add(args.asd, bd);
}
- bh = (const ServiceBGPHeader*)data;
+ const uint8_t* data = args.data;
+ const ServiceBGPHeader* bh = (const ServiceBGPHeader*)data;
switch (bd->state)
{
case BGP_STATE_CONNECTION:
bh->v1.marker == 0xFFFF &&
bh->v1.version == 0x01 && bh->v1.type == BGP_V1_TYPE_OPEN)
{
- const ServiceBGPV1Open* open;
-
- len = ntohs(bh->v1.len);
+ uint16_t len = ntohs(bh->v1.len);
if (len > 1024)
goto fail;
- open = (const ServiceBGPV1Open*)(data + sizeof(bh->v1));
+ const ServiceBGPV1Open* open = (const ServiceBGPV1Open*)(data + sizeof(bh->v1));
if (open->link > BGP_OPEN_LINK_MAX)
goto fail;
- bd->v1 = 1;
+ bd->v1 = true;
}
else if (args.size >= sizeof(bh->v) + sizeof(ServiceBGPOpen) &&
bh->v.marker[0] == 0xFFFFFFFF &&
bh->v.marker[3] == 0xFFFFFFFF &&
bh->v.type == BGP_TYPE_OPEN)
{
- const ServiceBGPOpen* open;
-
- len = ntohs(bh->v.len);
+ uint16_t len = ntohs(bh->v.len);
if (len > 4096)
goto fail;
- open = (const ServiceBGPOpen*)(data + sizeof(bh->v));
+ const ServiceBGPOpen* open = (const ServiceBGPOpen*)(data + sizeof(bh->v));
if (open->version > BGP_VERSION_MAX ||
open->version < BGP_VERSION_MIN)
{
goto fail;
}
- bd->v1 = 0;
+ bd->v1 = false;
}
else
goto fail;
bh->v1.version == 0x01 &&
bh->v1.type == BGP_V1_TYPE_OPEN_CONFIRM)
{
- len = ntohs(bh->v1.len);
+ uint16_t len = ntohs(bh->v1.len);
if (len != sizeof(bh->v1))
goto fail;
goto success;
if (args.size >= sizeof(bh->v) &&
bh->v.type == BGP_TYPE_KEEPALIVE)
{
- len = ntohs(bh->v.len);
+ uint16_t len = ntohs(bh->v.len);
if (len != sizeof(bh->v))
goto fail;
goto success;
goto fail;
}
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
BIT_STATE_MESSAGE_DATA
};
-struct ServiceBITData
+class ServiceBITData : public AppIdFlowData
{
- BITState state;
- unsigned stringlen;
- unsigned pos;
+public:
+ ~ServiceBITData() override = default;
+
+ BITState state = BIT_STATE_BANNER;
+ unsigned stringlen = 0;
+ unsigned pos = 0;
union
{
uint32_t len;
uint8_t raw_len[4];
- } l;
+ } l = {};
};
#pragma pack(1)
int BitServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceBITData* ss;
- const uint8_t* data = args.data;
- uint16_t offset;
-
- if (!args.size)
- goto inprocess;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- ss = (ServiceBITData*)data_get(args.asd);
+ ServiceBITData* ss = (ServiceBITData*)data_get(args.asd);
if (!ss)
{
- ss = (ServiceBITData*)snort_calloc(sizeof(ServiceBITData));
- data_add(args.asd, ss, &snort_free);
- ss->state = BIT_STATE_BANNER;
+ ss = new ServiceBITData;
+ data_add(args.asd, ss);
}
- offset = 0;
+ const uint8_t* data = args.data;
+ uint16_t offset = 0;
while (offset < args.size)
{
switch (ss->state)
offset++;
}
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
#define min(x,y) ((x)<(y) ? (x) : (y))
-struct ServiceDCERPCData
+class ServiceDCERPCData : public AppIdFlowData
{
- unsigned count;
+public:
+ ~ServiceDCERPCData() override = default;
+
+ unsigned count = 0;
};
DceRpcServiceDetector::DceRpcServiceDetector(ServiceDiscovery* sd)
int DceRpcServiceDetector::tcp_validate(AppIdDiscoveryArgs& args)
{
- ServiceDCERPCData* dd;
- int retval = APPID_INPROCESS;
- int length;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
- if (!size)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- dd = (ServiceDCERPCData*)data_get(args.asd);
+ ServiceDCERPCData* dd = (ServiceDCERPCData*)data_get(args.asd);
if (!dd)
{
- dd = (ServiceDCERPCData*)snort_calloc(sizeof(ServiceDCERPCData));
- data_add(args.asd, dd, &snort_free);
+ dd = new ServiceDCERPCData;
+ data_add(args.asd, dd);
}
+ int retval = APPID_INPROCESS;
+ int length;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+
while (size)
{
length = dcerpc_validate(data, size);
if (retval == APPID_SUCCESS)
return add_service(args.change_bits, args.asd, args.pkt, args.dir, APP_ID_DCE_RPC);
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
int DceRpcServiceDetector::udp_validate(AppIdDiscoveryArgs& args)
{
- ServiceDCERPCData* dd;
- int retval = APPID_NOMATCH;
- int length;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
- if (!size)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- dd = (ServiceDCERPCData*)data_get(args.asd);
+ ServiceDCERPCData* dd = (ServiceDCERPCData*)data_get(args.asd);
if (!dd)
{
- dd = (ServiceDCERPCData*)snort_calloc(sizeof(ServiceDCERPCData));
- data_add(args.asd, dd, &snort_free);
+ dd = new ServiceDCERPCData;
+ data_add(args.asd, dd);
}
+ int retval = APPID_NOMATCH;
+ int length;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+
while (size)
{
length = dcerpc_validate(data, size);
if (retval == APPID_SUCCESS)
return add_service(args.change_bits, args.asd, args.pkt, args.dir, APP_ID_DCE_RPC);
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
class AppIdSession;
class ServiceDiscovery;
-struct ServiceRPCData;
+class ServiceRPCData;
class DceRpcServiceDetector : public ServiceDetector
{
};
#define MAX_STRING_SIZE 64
-struct ServiceFTPData
+class ServiceFTPData : public AppIdFlowData
{
- FTPState state;
- FTPReplyState rstate;
- int code;
- char vendor[MAX_STRING_SIZE];
- char version[MAX_STRING_SIZE];
- FTPCmd cmd;
- SfIp address;
- uint16_t port;
- int part_code_resp = 0;
- int part_code_len;
+public:
+ ~ServiceFTPData() override = default;
+ FTPState state = FTP_STATE_CONNECTION;
+ FTPReplyState rstate = FTP_REPLY_BEGIN;
+ int code = 0;
+ char vendor[MAX_STRING_SIZE] = {};
+ char version[MAX_STRING_SIZE] = {};
+ FTPCmd cmd = FTP_CMD_NONE;
+ SfIp address = {};
+ int part_code_resp = 0;
+ int part_code_len = 0;
+ uint16_t port = 0;
};
#pragma pack(1)
static const char FTP_EPSV_CMD[] = "EPSV";
static const char FTP_PORT_CMD[] = "PORT ";
static const char FTP_EPRT_CMD[] = "EPRT ";
- ServiceFTPData* fd = nullptr;
- uint16_t offset = 0;
- uint16_t init_offset = 0;
- int code = 0;
- int code_index = 0;
- uint32_t address = 0;
- uint16_t port = 0;
- int retval = APPID_INPROCESS;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
- if (!size)
- goto inprocess;
//ignore packets while encryption is on in explicit mode. In future, this will be changed
//to direct traffic to SSL detector to extract payload from certs. This will require
// maintaining
//two detector states at the same time.
- if (args.asd.get_session_flags(APPID_SESSION_ENCRYPTED))
+ if (!args.size
+ || APPID_SESSION_ENCRYPTED == args.asd.get_session_flags(APPID_SESSION_ENCRYPTED | APPID_SESSION_DECRYPTED))
{
- if (!args.asd.get_session_flags(APPID_SESSION_DECRYPTED))
- {
- goto inprocess;
- }
+ if (!args.asd.is_service_detected())
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
}
- fd = (ServiceFTPData*)data_get(args.asd);
+ ServiceFTPData* fd = (ServiceFTPData*)data_get(args.asd);
if (!fd)
{
- fd = (ServiceFTPData*)snort_calloc(sizeof(ServiceFTPData));
- data_add(args.asd, fd, &snort_free);
- fd->state = FTP_STATE_CONNECTION;
- fd->rstate = FTP_REPLY_BEGIN;
- fd->cmd = FTP_CMD_NONE;
+ fd = new ServiceFTPData;
+ data_add(args.asd, fd);
}
+ uint16_t offset = 0;
+ uint16_t init_offset = 0;
+ int code = 0;
+ int code_index = 0;
+ uint32_t address = 0;
+ uint16_t port = 0;
+ int retval = APPID_INPROCESS;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+
if (args.dir != APP_ID_FROM_RESPONDER)
{
if (data[size-1] != 0x0a)
IRC_STATE_USER_MID_TERM
};
-struct ServiceIRCData
+class ServiceIRCData : public AppIdFlowData
{
- IRCState state;
- unsigned pos;
- const char* command;
- IRCState initiator_state;
- unsigned initiator_pos;
- const char* initiator_command;
- unsigned count;
+public:
+ ~ServiceIRCData() override = default;
+
+ const char* command = nullptr;
+ const char* initiator_command = nullptr;
+ IRCState state = IRC_STATE_BEGIN;
+ unsigned pos = 0;
+ IRCState initiator_state = IRC_STATE_BEGIN;
+ unsigned initiator_pos = 0;
+ unsigned count = 0;
};
IrcServiceDetector::IrcServiceDetector(ServiceDiscovery* sd)
int IrcServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceIRCData* id;
- const uint8_t* end;
- IRCState* state;
- unsigned* pos;
- const char** command;
- const uint8_t* data = args.data;
-
if (!args.size)
- goto inprocess;
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- id = (ServiceIRCData*)data_get(args.asd);
+ ServiceIRCData* id = (ServiceIRCData*)data_get(args.asd);
if (!id)
{
- id = (ServiceIRCData*)snort_calloc(sizeof(ServiceIRCData));
- data_add(args.asd, id, &snort_free);
- id->initiator_state = IRC_STATE_BEGIN;
- id->state = IRC_STATE_BEGIN;
+ id = new ServiceIRCData;
+ data_add(args.asd, id);
}
- end = (const uint8_t*)(data + args.size);
+ IRCState* state;
+ unsigned* pos;
+ const char** command;
+ const uint8_t* data = args.data;
+ const uint8_t* end = (const uint8_t*)(data + args.size);
if (args.dir == APP_ID_FROM_RESPONDER)
{
LPR_SUBCMD_DATA
};
-struct ServiceLPRData
+class ServiceLPRData : public AppIdFlowData
{
- LPRState state;
- unsigned no_data_count;
- unsigned count;
+public:
+ ~ServiceLPRData() override = default;
+
+ LPRState state = LPR_STATE_COMMAND;
+ unsigned no_data_count = 0;
+ unsigned count = 0;
};
LprServiceDetector::LprServiceDetector(ServiceDiscovery* sd)
int LprServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceLPRData* ld;
- int i;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
- if (!size)
- goto inprocess;
+ if (!args.size)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- ld = (ServiceLPRData*)data_get(args.asd);
+ ServiceLPRData* ld = (ServiceLPRData*)data_get(args.asd);
if (!ld)
{
- ld = (ServiceLPRData*)snort_calloc(sizeof(ServiceLPRData));
- data_add(args.asd, ld, &snort_free);
- ld->state = LPR_STATE_COMMAND;
+ ld = new ServiceLPRData;
+ data_add(args.asd, ld);
}
+ int i;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+
switch (ld->state)
{
case LPR_STATE_COMMAND:
MDNS_STATE_CONNECTION_ERROR
};
-struct ServiceMDNSData
+class ServiceMDNSData : public AppIdFlowData
{
- MDNSState state;
+public:
+ ~ServiceMDNSData() override = default;
+
+ MDNSState state = MDNS_STATE_CONNECTION;
};
struct MdnsPattern
int MdnsServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- int ret_val;
-
ServiceMDNSData* fd = (ServiceMDNSData*)data_get(args.asd);
if (!fd)
{
- fd = (ServiceMDNSData*)snort_calloc(sizeof(ServiceMDNSData));
- data_add(args.asd, fd, &snort_free);
- fd->state = MDNS_STATE_CONNECTION;
+ fd = new ServiceMDNSData();
+ data_add(args.asd, fd);
}
if (args.pkt->ptrs.dp == MDNS_PORT || args.pkt->ptrs.sp == MDNS_PORT )
{
- ret_val = validate_reply(args.data, args.size);
+ int ret_val = validate_reply(args.data, args.size);
if (ret_val == 1)
{
if (args.asd.get_odp_ctxt().mdns_user_reporting)
if (hdr->QCount)
{
count = ntohs(hdr->QCount);
+ // Coverity doesn't realize that nbns_validate_query() checks the packet data for valid values
+ // which validates the count
+ // coverity[tainted_scalar]
for (i=0; i<count; i++)
{
if (nbns_validate_query(&data, begin, end))
if (hdr->ACount)
{
count = ntohs(hdr->ACount);
+ // Coverity doesn't realize that nbns_validate_answer() checks the packet data for valid values
+ // which validates the count
+ // coverity[tainted_scalar]
for (i=0; i<count; i++)
{
if (nbns_validate_answer(&data, begin, end))
if (hdr->NSCount)
{
count = ntohs(hdr->NSCount);
+ // Coverity doesn't realize that nbns_validate_answer() checks the packet data for valid values
+ // which validates the count
+ // coverity[tainted_scalar]
for (i=0; i<count; i++)
{
if (nbns_validate_answer(&data, begin, end))
if (hdr->ARCount)
{
count = ntohs(hdr->ARCount);
+ // Coverity doesn't realize that nbns_validate_answer() checks the packet data for valid values
+ // which validates the count
+ // coverity[tainted_scalar]
for (i=0; i<count; i++)
{
if (nbns_validate_answer(&data, begin, end))
#define NNTP_MID_LINE 0x0002
#define NNTP_MID_TERM 0x0004
-struct ServiceNNTPData
+class ServiceNNTPData : public AppIdFlowData
{
- NNTPState state;
- uint32_t flags;
- unsigned count;
+public:
+ ~ServiceNNTPData() override = default;
+
+ NNTPState state = NNTP_STATE_CONNECTION;
+ uint32_t flags = 0;
+ unsigned count = 0;
};
#pragma pack(1)
int NntpServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceNNTPData* nd;
- uint16_t offset;
- int code;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
- if (!size)
- goto inprocess;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- nd = (ServiceNNTPData*)data_get(args.asd);
+ ServiceNNTPData* nd = (ServiceNNTPData*)data_get(args.asd);
if (!nd)
{
- nd = (ServiceNNTPData*)snort_calloc(sizeof(ServiceNNTPData));
- data_add(args.asd, nd, &snort_free);
- nd->state = NNTP_STATE_CONNECTION;
+ nd = new ServiceNNTPData();
+ data_add(args.asd, nd);
}
- offset = 0;
+ int code;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+ uint16_t offset = 0;
while (offset < size)
{
if (nd->state == NNTP_STATE_DATA)
RADIUS_STATE_RESPONSE
};
-struct ServiceRADIUSData
+class ServiceRADIUSData : public AppIdFlowData
{
- RADIUSState state;
- uint8_t id;
+public:
+ ~ServiceRADIUSData() override = default;
+
+ RADIUSState state = RADIUS_STATE_REQUEST;
+ uint8_t id = 0;
};
#pragma pack(1)
int RadiusServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceRADIUSData* rd;
- const RADIUSHeader* hdr = (const RADIUSHeader*)args.data;
- uint16_t len;
- int new_dir;
-
if (!args.size)
- goto inprocess;
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
if (args.size < sizeof(RADIUSHeader))
- goto fail;
+ {
+ fail_service(args.asd, args.pkt, args.dir);
+ return APPID_NOMATCH;
+ }
- rd = (ServiceRADIUSData*)data_get(args.asd);
+ ServiceRADIUSData* rd = (ServiceRADIUSData*)data_get(args.asd);
if (!rd)
{
- rd = (ServiceRADIUSData*)snort_calloc(sizeof(ServiceRADIUSData));
- data_add(args.asd, rd, &snort_free);
- rd->state = RADIUS_STATE_REQUEST;
+ rd = new ServiceRADIUSData;
+ data_add(args.asd, rd);
}
- new_dir = args.dir;
+ const RADIUSHeader* hdr = (const RADIUSHeader*)args.data;
+ uint16_t len;
+ int new_dir = args.dir;
+
if (rd->state == RADIUS_STATE_REQUEST)
{
if (hdr->code == RADIUS_CODE_ACCESS_ACCEPT ||
int RadiusAcctServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceRADIUSData* rd;
- const RADIUSHeader* hdr = (const RADIUSHeader*)args.data;
- uint16_t len;
- int new_dir;
-
if (!args.size)
- goto inprocess;
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
if (args.size < sizeof(RADIUSHeader))
- goto fail;
+ {
+ fail_service(args.asd, args.pkt, args.dir);
+ return APPID_NOMATCH;
+ }
- rd = (ServiceRADIUSData*)data_get(args.asd);
+ ServiceRADIUSData* rd = (ServiceRADIUSData*)data_get(args.asd);
if (!rd)
{
- rd = (ServiceRADIUSData*)snort_calloc(sizeof(ServiceRADIUSData));
- data_add(args.asd, rd, &snort_free);
- rd->state = RADIUS_STATE_REQUEST;
+ rd = new ServiceRADIUSData;
+ data_add(args.asd, rd);
}
- new_dir = args.dir;
+ const RADIUSHeader* hdr = (const RADIUSHeader*)args.data;
+ uint16_t len;
+ int new_dir = args.dir;
if (rd->state == RADIUS_STATE_REQUEST)
{
if (hdr->code == RADIUS_CODE_ACCOUNTING_RESPONSE)
REXEC_STATE_STDERR_DONE
};
-struct ServiceREXECData
+class ServiceREXECData : public AppIdFlowData
{
+public:
+ explicit ServiceREXECData(REXECState state) : state(state)
+ { }
+ ~ServiceREXECData() override;
+
+ ServiceREXECData* parent = nullptr;
+ ServiceREXECData* child = nullptr;
REXECState state;
- struct ServiceREXECData* parent;
- struct ServiceREXECData* child;
};
static const uint64_t REXEC_EXPECTED_SESSION_FLAGS = APPID_SESSION_CONTINUE |
}
-static void rexec_free_state(void* data)
+ServiceREXECData::~ServiceREXECData()
{
- ServiceREXECData* rd = (ServiceREXECData*)data;
-
- if (rd)
+ if (parent)
{
- if (rd->parent)
- {
- rd->parent->child = nullptr;
- rd->parent->parent = nullptr;
- }
- if (rd->child)
- {
- rd->child->parent = nullptr;
- rd->child->child = nullptr;
- }
- snort_free(rd);
+ parent->child = nullptr;
+ parent->parent = nullptr;
+ }
+ if (child)
+ {
+ child->parent = nullptr;
+ child->child = nullptr;
}
}
int RexecServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- int i = 0;
- uint32_t port = 0;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
ServiceREXECData* rd = (ServiceREXECData*)data_get(args.asd);
if (!rd)
{
- if (!size)
- goto inprocess;
- rd = (ServiceREXECData*)snort_calloc(sizeof(ServiceREXECData));
- data_add(args.asd, rd, &rexec_free_state);
- rd->state = REXEC_STATE_PORT;
+ if (!args.size)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
+ rd = new ServiceREXECData(REXEC_STATE_PORT);
+ data_add(args.asd, rd);
}
- // cppcheck-suppress nullPointerRedundantCheck
APPID_LOG(args.pkt, TRACE_DEBUG_LEVEL, "rexec state %d\n", rd->state);
- switch (rd->state) // cppcheck-suppress nullPointerRedundantCheck
+ int i = 0;
+ uint32_t port = 0;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+
+ switch (rd->state)
{
case REXEC_STATE_PORT:
if (args.dir != APP_ID_FROM_INITIATOR)
if (pf)
{
- ServiceREXECData* tmp_rd = (ServiceREXECData*)snort_calloc(
- sizeof(ServiceREXECData));
- tmp_rd->state = REXEC_STATE_STDERR_CONNECT_SYN;
+ ServiceREXECData* tmp_rd = new ServiceREXECData(REXEC_STATE_STDERR_CONNECT_SYN);
tmp_rd->parent = rd;
- data_add(*pf, tmp_rd, &rexec_free_state);
+ data_add(*pf, tmp_rd);
if (pf->add_flow_data_id((uint16_t)port, this))
{
pf->service_disco_state = APPID_DISCO_STATE_FINISHED;
#include "service_detector.h"
class ServiceDiscovery;
-struct ServiceREXECData;
+class ServiceREXECData;
class RexecServiceDetector : public ServiceDetector
{
RLOGIN_STATE_DONE
};
-struct ServiceRLOGINData
+class ServiceRLOGINData: public AppIdFlowData
{
- RLOGINState state;
+public:
+ ~ServiceRLOGINData() override = default;
+
+ RLOGINState state = RLOGIN_STATE_HANDSHAKE;
};
RloginServiceDetector::RloginServiceDetector(ServiceDiscovery* sd)
int RloginServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceRLOGINData* rd;
- const uint8_t* data = args.data;
-
- if (!args.size)
- goto inprocess;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- rd = (ServiceRLOGINData*)data_get(args.asd);
+ ServiceRLOGINData* rd = (ServiceRLOGINData*)data_get(args.asd);
if (!rd)
{
- rd = (ServiceRLOGINData*)snort_calloc(sizeof(ServiceRLOGINData));
- data_add(args.asd, rd, &snort_free);
- rd->state = RLOGIN_STATE_HANDSHAKE;
+ rd = new ServiceRLOGINData;
+ data_add(args.asd, rd);
}
+ const uint8_t* data = args.data;
+
switch (rd->state)
{
case RLOGIN_STATE_HANDSHAKE:
goto fail;
}
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
#pragma pack()
-struct ServiceRPCData
+class ServiceRPCData : public AppIdFlowData
{
+public:
+ explicit ServiceRPCData(RPCState state): state(state)
+ { }
+ ~ServiceRPCData() override = default;
+
RPCState state;
- RPCTCPState tcpstate[APP_ID_APPID_SESSION_DIRECTION_MAX];
- RPCTCPState tcpfragstate[APP_ID_APPID_SESSION_DIRECTION_MAX];
- uint32_t program;
- uint32_t program_version;
- uint32_t procedure;
- uint32_t xid;
- IpProtocol proto;
- uint32_t tcpsize[APP_ID_APPID_SESSION_DIRECTION_MAX];
- uint32_t tcpfragpos[APP_ID_APPID_SESSION_DIRECTION_MAX];
- uint32_t tcpauthsize[APP_ID_APPID_SESSION_DIRECTION_MAX];
- uint32_t tcppos[APP_ID_APPID_SESSION_DIRECTION_MAX];
- uint8_t tcpdata[APP_ID_APPID_SESSION_DIRECTION_MAX][RPC_MAX_TCP_PACKET_SIZE];
- int once;
+ RPCTCPState tcpstate[APP_ID_APPID_SESSION_DIRECTION_MAX] = {};
+ RPCTCPState tcpfragstate[APP_ID_APPID_SESSION_DIRECTION_MAX] = {};
+ uint32_t program = 0;
+ uint32_t program_version = 0;
+ uint32_t procedure = 0;
+ uint32_t xid = 0;
+ IpProtocol proto = {};
+ uint32_t tcpsize[APP_ID_APPID_SESSION_DIRECTION_MAX] = {};
+ uint32_t tcpfragpos[APP_ID_APPID_SESSION_DIRECTION_MAX] = {};
+ uint32_t tcpauthsize[APP_ID_APPID_SESSION_DIRECTION_MAX] = {};
+ uint32_t tcppos[APP_ID_APPID_SESSION_DIRECTION_MAX] = {};
+ uint8_t tcpdata[APP_ID_APPID_SESSION_DIRECTION_MAX][RPC_MAX_TCP_PACKET_SIZE] = {};
+ int once = 0;
};
#define RPC_PORT_PORTMAPPER 111
rd = (ServiceRPCData*)data_get(args.asd);
if (!rd)
{
- rd = (ServiceRPCData*)snort_calloc(sizeof(ServiceRPCData));
- data_add(args.asd, rd, &snort_free);
- rd->state = (dir == APP_ID_FROM_INITIATOR) ? RPC_STATE_CALL : RPC_STATE_REPLY;
+ rd = new ServiceRPCData((dir == APP_ID_FROM_INITIATOR) ? RPC_STATE_CALL : RPC_STATE_REPLY);
+ data_add(args.asd, rd);
rd->xid = 0xFFFFFFFF;
}
rd = (ServiceRPCData*)data_get(args.asd);
if (!rd)
{
- rd = (ServiceRPCData*)snort_calloc(sizeof(ServiceRPCData));
- data_add(args.asd, rd, &snort_free);
- rd->state = RPC_STATE_CALL;
+ rd = new ServiceRPCData(RPC_STATE_CALL);
+ data_add(args.asd, rd);
for (ret=0; ret<APP_ID_APPID_SESSION_DIRECTION_MAX; ret++)
{
rd->tcpstate[ret] = RPC_TCP_STATE_FRAG;
class AppIdSession;
class ServiceDiscovery;
-struct ServiceRPCData;
+class ServiceRPCData;
class RpcServiceDetector : public ServiceDetector
{
RSHELL_STATE_STDERR_DONE
};
-struct ServiceRSHELLData
+class ServiceRSHELLData : public AppIdFlowData
{
+public:
+ explicit ServiceRSHELLData(RSHELLState state) : state(state)
+ { }
+ ~ServiceRSHELLData() override;
+
+ ServiceRSHELLData* parent = nullptr;
+ ServiceRSHELLData* child = nullptr;
RSHELLState state;
- ServiceRSHELLData* parent;
- ServiceRSHELLData* child;
};
RshellServiceDetector::RshellServiceDetector(ServiceDiscovery* sd)
}
-static void rshell_free_state(void* data)
+ServiceRSHELLData::~ServiceRSHELLData()
{
- ServiceRSHELLData* rd = (ServiceRSHELLData*)data;
-
- if (rd)
+ if (parent)
{
- if (rd->parent)
- {
- rd->parent->child = nullptr;
- rd->parent->parent = nullptr;
- }
- if (rd->child)
- {
- rd->child->parent = nullptr;
- rd->child->child = nullptr;
- }
- snort_free(rd);
+ parent->child = nullptr;
+ parent->parent = nullptr;
+ }
+ if (child)
+ {
+ child->parent = nullptr;
+ child->child = nullptr;
}
}
int RshellServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- int i = 0;
- uint32_t port = 0;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
ServiceRSHELLData* rd = (ServiceRSHELLData*)data_get(args.asd);
if (!rd)
{
- if (!size)
- goto inprocess;
- rd = (ServiceRSHELLData*)snort_calloc(sizeof(ServiceRSHELLData));
- data_add(args.asd, rd, &rshell_free_state);
- rd->state = RSHELL_STATE_PORT;
+ if (!args.size)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
+ rd = new ServiceRSHELLData(RSHELL_STATE_PORT);
+ data_add(args.asd, rd);
}
- // cppcheck-suppress nullPointerRedundantCheck
APPID_LOG(args.pkt, TRACE_DEBUG_LEVEL, "RSHELL state %d\n",rd->state);
- switch (rd->state) // cppcheck-suppress nullPointerRedundantCheck
+ int i = 0;
+ uint32_t port = 0;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+
+ switch (rd->state)
{
case RSHELL_STATE_PORT:
if (args.dir != APP_ID_FROM_INITIATOR)
if (pf)
{
- ServiceRSHELLData* tmp_rd = (ServiceRSHELLData*)snort_calloc(
- sizeof(ServiceRSHELLData));
- tmp_rd->state = RSHELL_STATE_STDERR_CONNECT_SYN;
+ ServiceRSHELLData* tmp_rd = new ServiceRSHELLData(RSHELL_STATE_STDERR_CONNECT_SYN);
tmp_rd->parent = rd;
pf->client_disco_state = APPID_DISCO_STATE_FINISHED;
- data_add(*pf, tmp_rd, &rshell_free_state);
+ data_add(*pf, tmp_rd);
if (pf->add_flow_data_id((uint16_t)port, this))
{
pf->service_disco_state = APPID_DISCO_STATE_FINISHED;
#include "service_detector.h"
class ServiceDiscovery;
-struct ServiceRSHELLData;
+class ServiceRSHELLData;
class RshellServiceDetector : public ServiceDetector
{
RSYNC_STATE_DONE
};
-struct ServiceRSYNCData
+class ServiceRSYNCData : public AppIdFlowData
{
- RSYNCState state;
+public:
+ ~ServiceRSYNCData() override = default;
+
+ RSYNCState state = RSYNC_STATE_BANNER;
};
RsyncServiceDetector::RsyncServiceDetector(ServiceDiscovery* sd)
int RsyncServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceRSYNCData* rd;
- int i;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
- if (!size)
- goto inprocess;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- rd = (ServiceRSYNCData*)data_get(args.asd);
+ ServiceRSYNCData* rd = (ServiceRSYNCData*)data_get(args.asd);
if (!rd)
{
- rd = (ServiceRSYNCData*)snort_calloc(sizeof(ServiceRSYNCData));
- data_add(args.asd, rd, &snort_free);
- rd->state = RSYNC_STATE_BANNER;
+ rd = new ServiceRSYNCData;
+ data_add(args.asd, rd);
}
+ int i;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+
switch (rd->state)
{
case RSYNC_STATE_BANNER:
goto fail;
}
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
server". */
};
-struct ServiceRTMPData
+class ServiceRTMPData : public AppIdFlowData
{
- RTMPState client_state;
- RTMPState server_state;
- uint16_t client_bytes_left;
- uint16_t server_bytes_left;
- char* swfUrl;
- char* pageUrl;
+public:
+ ~ServiceRTMPData() override;
+
+ char* swfUrl = nullptr;
+ char* pageUrl = nullptr;
+ RTMPState client_state = {};
+ RTMPState server_state = {};
+ uint16_t client_bytes_left = 0;
+ uint16_t server_bytes_left = 0;
};
RtmpServiceDetector::RtmpServiceDetector(ServiceDiscovery* sd)
handler->register_detector(name, this, proto);
}
-static void rtmp_free(void* ss) /* AppIdFreeFCN */
+ServiceRTMPData::~ServiceRTMPData()
{
- ServiceRTMPData* ss_tmp = (ServiceRTMPData*)ss;
- snort_free(ss_tmp->swfUrl);
- snort_free(ss_tmp->pageUrl);
- snort_free(ss_tmp);
+ snort_free(swfUrl);
+ snort_free(pageUrl);
}
static int parse_rtmp_chunk_basic_header(const uint8_t** data_inout, uint16_t* size_inout,
int RtmpServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceRTMPData* ss;
-
if (!args.size)
- goto inprocess;
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- ss = (ServiceRTMPData*)data_get(args.asd);
+ ServiceRTMPData* ss = (ServiceRTMPData*)data_get(args.asd);
if (!ss)
{
- ss = (ServiceRTMPData*)snort_calloc(sizeof(ServiceRTMPData));
- data_add(args.asd, ss, &rtmp_free);
+ ss = new ServiceRTMPData;
+ data_add(args.asd, ss);
}
/* Client -> Server */
goto fail;
}
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
SNMP_STATE_ERROR
};
-struct ServiceSNMPData
+class ServiceSNMPData : public AppIdFlowData
{
+public:
+ explicit ServiceSNMPData(SNMPState state) : state(state)
+ { }
+ ~ServiceSNMPData() override = default;
+
SNMPState state;
};
int SnmpServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceSNMPData* sd = nullptr;
- ServiceSNMPData* tmp_sd = nullptr;
+ if (!args.size)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
+
+ ServiceSNMPData* sd = (ServiceSNMPData*)data_get(args.asd);
+ if (!sd)
+ {
+ sd = new ServiceSNMPData(SNMP_STATE_CONNECTION);
+ data_add(args.asd, sd);
+ }
+
uint8_t pdu = 0;
uint8_t version = 0;
const char* version_str = nullptr;
const uint8_t* data = args.data;
uint16_t size = args.size;
- if (!size)
- goto inprocess;
-
- sd = (ServiceSNMPData*)data_get(args.asd);
- if (!sd)
- {
- sd = (ServiceSNMPData*)snort_calloc(sizeof(ServiceSNMPData));
- data_add(args.asd, sd, &snort_free);
- sd->state = SNMP_STATE_CONNECTION;
- }
-
if (snmp_verify_packet(&data, data+size, &pdu, &version))
{
APPID_LOG(args.pkt, TRACE_DEBUG_LEVEL, "SNMP payload verify failed\n");
if (pf)
{
- tmp_sd = (ServiceSNMPData*)snort_calloc(sizeof(ServiceSNMPData));
- tmp_sd->state = SNMP_STATE_RESPONSE;
- data_add(*pf, tmp_sd, &snort_free);
+ ServiceSNMPData* tmp_sd = new ServiceSNMPData(SNMP_STATE_RESPONSE);
+ data_add(*pf, tmp_sd);
if (pf->add_flow_data_id(args.pkt->ptrs.dp, this))
{
pf->set_session_flags(APPID_SESSION_SERVICE_DETECTED);
goto bail;
}
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
SSL_STATE_HEADER,
};
-struct ServiceSSLData
+class ServiceSSLData : public AppIdFlowData
{
- SSLState state;
- int pos;
- int length;
- int tot_length;
+public:
+ ~ServiceSSLData() override;
+
+ SSLState state = SSL_STATE_INITIATE;
+ int pos = 0;
+ int length = 0;
+ int tot_length = 0;
/* From client: */
SSLV3ClientHelloData client_hello;
/* From server: */
- SSLV3ServerCertData server_cert;
- int in_certs; // Currently collecting certificates?
- int certs_curr_len; // Current amount of collected certificate data.
- uint8_t* cached_data;
- uint16_t cached_len;
+ SSLV3ServerCertData server_cert = {};
+ int in_certs = 0; // Currently collecting certificates?
+ int certs_curr_len = 0; // Current amount of collected certificate data.
+ uint8_t* cached_data = nullptr;
+ uint16_t cached_len = 0;
};
#pragma pack(1)
len = 0;
}
-static void ssl_free(void* ss)
+ServiceSSLData::~ServiceSSLData()
{
- ServiceSSLData* ss_tmp = (ServiceSSLData*)ss;
- ss_tmp->client_hello.clear();
- ss_tmp->server_cert.clear();
- ssl_cache_free(ss_tmp->cached_data, ss_tmp->cached_len);
- snort_free(ss_tmp);
+ client_hello.clear();
+ server_cert.clear();
+ ssl_cache_free(cached_data, cached_len);
}
static void parse_client_initiation(const uint8_t* data, uint16_t size, ServiceSSLData* ss)
int SslServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceSSLData* ss;
+ if (!args.size)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
+
+ ServiceSSLData* ss = (ServiceSSLData*)data_get(args.asd);
+ if (!ss)
+ {
+ ss = new ServiceSSLData;
+ data_add(args.asd, ss);
+ }
+
const ServiceSSLPCTHdr* pct;
const ServiceSSLV2Hdr* hdr2;
const ServiceSSLV3Hdr* hdr3;
uint16_t size = args.size;
uint8_t* reallocated_data = nullptr;
- if (!size)
- goto inprocess;
-
- ss = (ServiceSSLData*)data_get(args.asd);
- if (!ss)
- {
- ss = (ServiceSSLData*)snort_calloc(sizeof(ServiceSSLData));
- data_add(args.asd, ss, &ssl_free);
- ss->state = SSL_STATE_INITIATE;
- ss->cached_data = nullptr;
- ss->cached_len = 0;
- }
-
if (ss->cached_len and ss->cached_data and (args.dir == APP_ID_FROM_RESPONDER))
{
reallocated_data = (uint8_t*)snort_calloc(ss->cached_len + size, sizeof(uint8_t));
TELNET_CMD_IAC
};
-struct ServiceTelnetData
+class ServiceTelnetData : public AppIdFlowData
{
- unsigned count;
+public:
+ ~ServiceTelnetData() override = default;
+
+ unsigned count = 0;
};
TelnetServiceDetector::TelnetServiceDetector(ServiceDiscovery* sd)
int TelnetServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceTelnetData* td;
- const uint8_t* end;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
- if (!size)
- goto inprocess;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- td = (ServiceTelnetData*)data_get(args.asd);
+ ServiceTelnetData* td = (ServiceTelnetData*)data_get(args.asd);
if (!td)
{
- td = (ServiceTelnetData*)snort_calloc(sizeof(ServiceTelnetData));
- data_add(args.asd, td, &snort_free);
+ td = new ServiceTelnetData;
+ data_add(args.asd, td);
}
+ const uint8_t* end;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+
for (end=(data+size); data<end; data++)
{
/* Currently we only look for the first packet to contain
goto fail;
}
}
-inprocess:
+
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
TFTP_STATE_ERROR
};
-struct ServiceTFTPData
+class ServiceTFTPData : public AppIdFlowData
{
+public:
+ explicit ServiceTFTPData(TFTPState state) : state(state)
+ { }
+ ~ServiceTFTPData() override = default;
+
TFTPState state;
- unsigned count;
- int last;
- uint16_t block;
+ unsigned count = 0;
+ int last = 0;
+ uint16_t block= 0;
};
#pragma pack(1)
int TftpServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceTFTPData* td = nullptr;
- ServiceTFTPData* tmp_td = nullptr;
+ if (!args.size)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
+
+ ServiceTFTPData* td = (ServiceTFTPData*)data_get(args.asd);
+ if (!td)
+ {
+ td = new ServiceTFTPData(TFTP_STATE_CONNECTION);
+ data_add(args.asd, td);
+ }
+ APPID_LOG(args.pkt, TRACE_DEBUG_LEVEL, "TFTP state %d\n", td->state);
+
int mode = 0;
uint16_t block = 0;
uint16_t tmp = 0;
const uint8_t* data = args.data;
uint16_t size = args.size;
- if (!size)
- goto inprocess;
-
- td = (ServiceTFTPData*)data_get(args.asd);
- if (!td)
- {
- td = (ServiceTFTPData*)snort_calloc(sizeof(ServiceTFTPData));
- data_add(args.asd, td, &snort_free);
- td->state = TFTP_STATE_CONNECTION;
- }
- APPID_LOG(args.pkt, TRACE_DEBUG_LEVEL, "TFTP state %d\n", td->state);
-
if (td->state == TFTP_STATE_CONNECTION && args.dir == APP_ID_FROM_RESPONDER)
goto fail;
if ((td->state == TFTP_STATE_TRANSFER || td->state == TFTP_STATE_DATA) &&
if (strcasecmp((const char*)data, "netascii") && strcasecmp((const char*)data, "octet"))
goto bail;
-
- tmp_td = (ServiceTFTPData*)snort_calloc(sizeof(ServiceTFTPData));
- tmp_td->state = TFTP_STATE_TRANSFER;
- dip = args.pkt->ptrs.ip_api.get_dst();
- sip = args.pkt->ptrs.ip_api.get_src();
- pf = AppIdSession::create_future_session(args.pkt,
- dip, 0, sip, args.pkt->ptrs.sp, args.asd.protocol,
- args.asd.config.snort_proto_ids[PROTO_INDEX_TFTP], args.asd.get_odp_ctxt());
-
- if (pf)
{
- data_add(*pf, tmp_td, &snort_free);
- if (pf->add_flow_data_id(args.pkt->ptrs.dp, this))
+ ServiceTFTPData* tmp_td = new ServiceTFTPData(TFTP_STATE_TRANSFER);
+ dip = args.pkt->ptrs.ip_api.get_dst();
+ sip = args.pkt->ptrs.ip_api.get_src();
+ pf = AppIdSession::create_future_session(args.pkt,
+ dip, 0, sip, args.pkt->ptrs.sp, args.asd.protocol,
+ args.asd.config.snort_proto_ids[PROTO_INDEX_TFTP], args.asd.get_odp_ctxt());
+
+ if (pf)
{
- pf->set_session_flags(APPID_SESSION_SERVICE_DETECTED);
- pf->clear_session_flags(APPID_SESSION_CONTINUE);
- tmp_td->state = TFTP_STATE_ERROR;
- return APPID_ENOMEM;
+ data_add(*pf, tmp_td);
+ if (pf->add_flow_data_id(args.pkt->ptrs.dp, this))
+ {
+ pf->set_session_flags(APPID_SESSION_SERVICE_DETECTED);
+ pf->clear_session_flags(APPID_SESSION_CONTINUE);
+ tmp_td->state = TFTP_STATE_ERROR;
+ return APPID_ENOMEM;
+ }
+ args.asd.initialize_future_session(*pf, APPID_SESSION_EXPECTED_EVALUATE);
+ pf->set_initiator_ip(*sip);
+ pf->service_disco_state = APPID_DISCO_STATE_STATEFUL;
+ pf->scan_flags |= SCAN_HOST_PORT_FLAG;
+ }
+ else
+ {
+ delete tmp_td;
+ goto inprocess; /* Assume that the flow already exists
+ as in a retransmit situation */
}
- args.asd.initialize_future_session(*pf, APPID_SESSION_EXPECTED_EVALUATE);
- pf->set_initiator_ip(*sip);
- pf->service_disco_state = APPID_DISCO_STATE_STATEFUL;
- pf->scan_flags |= SCAN_HOST_PORT_FLAG;
- }
- else
- {
- snort_free(tmp_td);
- goto inprocess; /* Assume that the flow already exists
- as in a retransmit situation */
}
break;
case TFTP_STATE_TRANSFER:
};
}
-struct ServiceTIMBUKTUData
+class ServiceTIMBUKTUData : public AppIdFlowData
{
- TIMBUKTUState state;
- unsigned stringlen;
- unsigned pos;
+public:
+ ~ServiceTIMBUKTUData() override = default;
+
+ TIMBUKTUState state = TIMBUKTU_STATE_BANNER;
+ unsigned stringlen = 0;
+ unsigned pos = 0;
};
#pragma pack(1)
int TimbuktuServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceTIMBUKTUData* ss;
- const uint8_t* data = args.data;
- uint16_t offset=0;
-
- if (!args.size)
- goto inprocess;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- ss = (ServiceTIMBUKTUData*)data_get(args.asd);
+ ServiceTIMBUKTUData* ss = (ServiceTIMBUKTUData*)data_get(args.asd);
if (!ss)
{
- ss = (ServiceTIMBUKTUData*)snort_calloc(sizeof(ServiceTIMBUKTUData));
- data_add(args.asd, ss, &snort_free);
- ss->state = TIMBUKTU_STATE_BANNER;
+ ss = new ServiceTIMBUKTUData;
+ data_add(args.asd, ss);
}
- offset = 0;
+ const uint8_t* data = args.data;
+ uint16_t offset = 0;
while (offset < args.size)
{
switch (ss->state)
offset++;
}
-inprocess:
service_inprocess(args.asd, args.pkt, args.dir);
return APPID_INPROCESS;
#define TNS_TYPE_CONTROL 14
#define TNS_TYPE_MAX 19
-namespace
+enum TNSSvcState
{
-enum TNSState
-{
- TNS_STATE_MESSAGE_LEN,
- TNS_STATE_MESSAGE_CHECKSUM,
- TNS_STATE_MESSAGE,
- TNS_STATE_MESSAGE_RES,
- TNS_STATE_MESSAGE_HD_CHECKSUM,
- TNS_STATE_MESSAGE_ACCEPT,
- TNS_STATE_MESSAGE_DATA
+ SVC_MSG_LEN = 0,
+ SVC_MSG_CHECKSUM,
+ SVC_MSG,
+ SVC_MSG_RES,
+ SVC_MSG_HD_CHECKSUM,
+ SVC_MSG_ACCEPT,
+ SVC_MSG_DATA
};
-}
#define ACCEPT_VERSION_OFFSET 8
-struct ServiceTNSData
+class ServiceTNSData : public AppIdFlowData
{
- TNSState state;
- unsigned stringlen;
- unsigned pos;
- unsigned message;
+public:
+ ~ServiceTNSData() override = default;
+
+ const char* version = nullptr;
+ TNSSvcState state = SVC_MSG_LEN;
+ unsigned stringlen = 0;
+ unsigned pos = 0;
+ unsigned message = 0;
union
{
uint16_t len;
uint8_t raw_len[2];
- } l;
- const char* version;
+ } l = {};
};
#pragma pack(1)
int TnsServiceDetector::validate(AppIdDiscoveryArgs& args)
{
- ServiceTNSData* ss;
- uint16_t offset;
- const uint8_t* data = args.data;
- uint16_t size = args.size;
-
- if (!size)
- goto inprocess;
- if (args.dir != APP_ID_FROM_RESPONDER)
- goto inprocess;
+ if (!args.size || args.dir != APP_ID_FROM_RESPONDER)
+ {
+ service_inprocess(args.asd, args.pkt, args.dir);
+ return APPID_INPROCESS;
+ }
- ss = (ServiceTNSData*)data_get(args.asd);
+ ServiceTNSData* ss = (ServiceTNSData*)data_get(args.asd);
if (!ss)
{
- ss = (ServiceTNSData*)snort_calloc(sizeof(ServiceTNSData));
- data_add(args.asd, ss, &snort_free);
- ss->state = TNS_STATE_MESSAGE_LEN;
+ ss = new ServiceTNSData();
+ data_add(args.asd, ss);
}
- offset = 0;
+ const uint8_t* data = args.data;
+ uint16_t size = args.size;
+ uint16_t offset = 0;
while (offset < size)
{
+ // For some reason, coverity cannot follow the state machine. It does state transitions that are not possible
+ // This makes the coverity overrun exceptions necessary
switch (ss->state)
{
- case TNS_STATE_MESSAGE_LEN:
+ case SVC_MSG_LEN:
+ // coverity[overrun]
ss->l.raw_len[ss->pos++] = data[offset];
if (ss->pos >= offsetof(ServiceTNSMsg, checksum))
{
}
else if (ss->stringlen < 2)
goto fail;
- else
- {
- ss->state = TNS_STATE_MESSAGE_CHECKSUM;
- }
+ ss->state = SVC_MSG_CHECKSUM;
}
break;
- case TNS_STATE_MESSAGE_CHECKSUM:
+ case SVC_MSG_CHECKSUM:
if (data[offset] != 0)
goto fail;
ss->pos++;
if (ss->pos >= offsetof(ServiceTNSMsg, msg))
- {
- ss->state = TNS_STATE_MESSAGE;
- }
+ ss->state = SVC_MSG;
break;
- case TNS_STATE_MESSAGE:
+ case SVC_MSG:
ss->message = data[offset];
if (ss->message < TNS_TYPE_CONNECT || ss->message > TNS_TYPE_MAX)
goto fail;
ss->pos++;
- ss->state = TNS_STATE_MESSAGE_RES;
+ ss->state = SVC_MSG_RES;
break;
- case TNS_STATE_MESSAGE_RES:
+ case SVC_MSG_RES:
ss->pos++;
- ss->state = TNS_STATE_MESSAGE_HD_CHECKSUM;
+ ss->state = SVC_MSG_HD_CHECKSUM;
break;
- case TNS_STATE_MESSAGE_HD_CHECKSUM:
+ case SVC_MSG_HD_CHECKSUM:
ss->pos++;
if (ss->pos >= offsetof(ServiceTNSMsg, data))
{
switch (ss->message)
{
case TNS_TYPE_ACCEPT:
- ss->state = TNS_STATE_MESSAGE_ACCEPT;
+ ss->state = SVC_MSG_ACCEPT;
break;
case TNS_TYPE_ACK:
case TNS_TYPE_REFUSE:
else
goto fail;
}
- ss->state = TNS_STATE_MESSAGE_DATA;
+ ss->state = SVC_MSG_DATA;
break;
case TNS_TYPE_RESEND:
if (ss->pos == ss->stringlen)
{
if (offset == (size - 1))
{
- ss->state = TNS_STATE_MESSAGE_LEN;
+ ss->state = SVC_MSG_LEN;
ss->pos = 0;
goto inprocess;
}
}
break;
- case TNS_STATE_MESSAGE_ACCEPT:
- if (ss->pos >= (ACCEPT_VERSION_OFFSET + 2))
- break;
+ case SVC_MSG_ACCEPT:
+ // coverity[overrun]
ss->l.raw_len[ss->pos - ACCEPT_VERSION_OFFSET] = data[offset];
ss->pos++;
if (ss->pos == (ACCEPT_VERSION_OFFSET + 2))
default:
break;
}
- ss->state = TNS_STATE_MESSAGE_DATA;
+ ss->state = SVC_MSG_DATA;
}
break;
- case TNS_STATE_MESSAGE_DATA:
+ case SVC_MSG_DATA:
ss->pos++;
if (ss->pos == ss->stringlen)
{
FpSMBData* smb_data = nullptr;
int AppIdDetector::initialize(AppIdInspector&){return 0;}
-int AppIdDetector::data_add(AppIdSession&, void*, AppIdFreeFCN){return 0;}
-void* AppIdDetector::data_get(const AppIdSession&) {return nullptr;}
+int AppIdDetector::data_add(AppIdSession&, AppIdFlowData*){return 0;}
+AppIdFlowData* AppIdDetector::data_get(const AppIdSession&) {return nullptr;}
void AppIdDetector::add_user(AppIdSession&, const char*, AppId, bool, AppidChangeBits&){}
void AppIdDetector::add_payload(AppIdSession&, AppId){}
void AppIdDetector::add_app(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppId, const char*, AppidChangeBits&){}
int, unsigned){}
int AppIdDiscovery::add_service_port(AppIdDetector*, const ServiceDetectorPort&){return 0;}
void ApplicationDescriptor::set_id(const snort::Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&){}
-int AppIdSession::add_flow_data(void*, unsigned, AppIdFreeFCN) { return 0; }
+int AppIdSession::add_flow_data(void*, unsigned) { return 0; }
int dcerpc_validate(const uint8_t*, int){return 0; }
AppIdDiscovery::~AppIdDiscovery() { }
void show_stats(PegCount*, const PegInfo*, unsigned, const char*) { }
return nullptr;
}
-HostAppIdsVal* HostPortCache::find_on_first_pkt(const SfIp*, uint16_t, IpProtocol, const OdpContext&)
+const HostAppIdsVal* HostPortCache::find_on_first_pkt(const SfIp*, uint16_t, IpProtocol, const OdpContext&)
{
return nullptr;
}
return 0;
}
-FlowStash::~FlowStash() = default;
+bool FlowStash::get(const std::string &, StashGenericObject*&) { return false; }
#endif
delete tsession;
}
-void* AppIdSession::get_flow_data(unsigned) const
+AppIdFlowData* AppIdSession::get_flow_data(unsigned) const
{
return nullptr;
}
-int AppIdSession::add_flow_data(void*, unsigned, AppIdFreeFCN)
+int AppIdSession::add_flow_data(AppIdFlowData*, unsigned)
{
return 0;
}
// The cache should now be ip6:3007, ip4:3008, ip6:3009.
// Check that the order in the cache is correct.
- Queue_t::iterator it = ServiceCache.newest();
- std::vector<ServiceDiscoveryState*>::iterator vit = --ssvec.end();
- for( size_t i=0; i<max_entries; i++, --it, --vit )
+ auto it = ServiceCache.end();
+ auto vit = ssvec.cend();
+ do
{
- Map_t::iterator mit = *it;
- CHECK_TRUE( mit->second == *vit );
- }
+ --it;
+ --vit;
+ CHECK_TRUE( vit != ssvec.begin() );
+ CHECK_TRUE( (*it)->second == *vit );
+ } while( it != ServiceCache.oldest() );
// Now get e.g. the oldest from the cache and check that it got touched:
it = ServiceCache.oldest();
projects / thirdparty / snort3.git / commitdiff
