]> git.ipfire.org Git - thirdparty/snort3.git/commit
Pull request #3588: Add stateful signature evaluation
authorSteve Chew (stechew) <stechew@cisco.com>
Wed, 19 Oct 2022 16:20:12 +0000 (16:20 +0000)
committerSteve Chew (stechew) <stechew@cisco.com>
Wed, 19 Oct 2022 16:20:12 +0000 (16:20 +0000)
commit59f9b5ff1588dfdb99562cd6b4754b4822ab37fd
tree75fddac1689f2da47a477feb18a4566fb3067866
parentc5093e2c781e0c15def30edee8987386c67708c9
Pull request #3588: Add stateful signature evaluation

Merge in SNORT/snort3 from ~OSHUMEIK/snort3:stateful_signature_evaluation to master

Squashed commit of the following:

commit 8477617f494ffebae8c95ad6456c7ce3b630b34b
Author: Oleksii Shumeiko <oshumeik@cisco.com>
Date:   Mon Apr 18 19:27:53 2022 +0300

    detection: add stateful signature evaluation

    If an IPS option sets the cursor beyond the current buffer size,
    an evaluation state will be stored on the flow.
    Rule evaluation will resume later, when enough data from the buffer become available.

    Key updates/features:
    * buffers supported: pkt_data, file_data, js_data
    * a rule fired on the current packet doesn't create continuations
    * continuations are droppped on config reload
    * a few peg counters added
    * rule variables are transferred to the continuation
    * rule latency supported

    Continuation tracks stream source for the following buffers:
    pkt_data -- TCP payload data with respect to flow direction
    js_data -- JavaScript text combined within the same HTTP request/response
    file_data -- file's data within the same file (context)

    Now a leaf node can have children, which are flowbit setters moved to the very end.

    If an inspector sends PDU with data prepended from previous PDUs,
    Continuations will be dropped, because data chunks cannot be concatenated.
    Currently, http_inspect http2_inspect can present accumulated data
    in file_data and js_data buffers.
46 files changed:
doc/user/concepts.txt
src/detection/detect_trace.h
src/detection/detection_continuation.h [new file with mode: 0644]
src/detection/detection_engine.cc
src/detection/detection_engine.h
src/detection/detection_module.cc
src/detection/detection_options.cc
src/detection/detection_options.h
src/detection/dev_notes.txt
src/detection/fp_create.cc
src/detection/fp_detect.cc
src/detection/fp_utils.cc
src/detection/fp_utils.h
src/detection/ips_context.h
src/flow/flow.cc
src/flow/flow.h
src/framework/base_api.h
src/framework/cursor.cc
src/framework/cursor.h
src/framework/inspector.h
src/ips_options/ips_file_data.cc
src/latency/rule_latency.cc
src/latency/rule_latency.h
src/main/test/distill_verdict_stubs.h
src/mime/file_mime_process.cc
src/service_inspectors/dce_rpc/dce_smb2_file.cc
src/service_inspectors/dce_rpc/dce_smb_utils.cc
src/service_inspectors/ftp_telnet/ftp_data.cc
src/service_inspectors/http_inspect/http_field.cc
src/service_inspectors/http_inspect/http_field.h
src/service_inspectors/http_inspect/http_inspect.cc
src/service_inspectors/http_inspect/http_js_norm.cc
src/service_inspectors/http_inspect/http_msg_body.cc
src/service_inspectors/http_inspect/http_msg_header.cc
src/service_inspectors/http_inspect/ips_http_buffer.cc
src/service_inspectors/imap/imap.cc
src/service_inspectors/smtp/smtp.cc
src/stream/file/file_session.cc
src/utils/grouped_list.h [new file with mode: 0644]
src/utils/js_normalizer.h
src/utils/js_tokenizer.h
src/utils/js_tokenizer.l
src/utils/stats.cc
src/utils/stats.h
src/utils/test/CMakeLists.txt
src/utils/test/grouped_list_test.cc [new file with mode: 0644]