#include <string>
#include <unistd.h>
-#include "appid_api.h"
-#include "appid_config.h"
-#include "appid_inspector.h"
-#include "appid_peg_counts.h"
#include "log/unified2.h"
#include "main/snort_config.h"
#include "target_based/snort_protocols.h"
#include "utils/util_cstring.h"
+#include "appid_api.h"
+#include "appid_config.h"
+#include "appid_inspector.h"
+#include "appid_peg_counts.h"
using namespace snort;
-static AppInfoTable app_info_table;
-static AppInfoTable app_info_service_table;
-static AppInfoTable app_info_client_table;
-static AppInfoTable app_info_payload_table;
-static AppInfoNameTable app_info_name_table;
-static AppId next_custom_appid = SF_APPID_DYNAMIC_MIN;
-static AppInfoTable custom_app_info_table;
-
#define MAX_TABLE_LINE_LEN 1024
static const char* CONF_SEPARATORS = "\t\n\r";
static const int MIN_MAX_TP_FLOW_DEPTH = 1;
snort_free(app_name_key);
}
-static bool is_existing_entry(AppInfoTableEntry* entry)
+bool AppInfoManager::is_existing_entry(AppInfoTableEntry* entry)
{
AppInfoNameTable::iterator app;
return app != app_info_name_table.end();
}
-static AppInfoTableEntry* find_app_info_by_name(const char* app_name)
+AppInfoTableEntry* AppInfoManager::find_app_info_by_name(const char* app_name)
{
AppInfoTableEntry* entry = nullptr;
AppInfoNameTable::iterator app;
return entry;
}
-static bool add_entry_to_app_info_name_table(const char* app_name, AppInfoTableEntry* entry)
+bool AppInfoManager::add_entry_to_app_info_name_table(const char* app_name, AppInfoTableEntry* entry)
{
bool added = true;
return added;
}
-static AppId get_static_app_info_entry(AppId appid)
+AppId AppInfoManager::get_static_app_info_entry(AppId appid)
{
if (appid > 0 && appid < SF_APPID_BUILDIN_MAX)
return appid;
ParseWarning(WARN_PLUGINS, "appid: no entry in %s for %d", APP_MAPPING_FILE, appId);
}
-void AppInfoManager::load_appid_config(OdpContext& odp_ctxt, const char* path)
+void AppInfoManager::load_odp_config(OdpContext& odp_ctxt, const char* path)
{
char buf[MAX_TABLE_LINE_LEN];
unsigned line = 0;
return snort_protocol_id;
}
-void AppInfoManager::init_appid_info_table(AppIdConfig* config,
+void AppInfoManager::init_appid_info_table(AppIdConfig& config,
SnortConfig* sc, OdpContext& odp_ctxt)
{
- if ( !config->app_detector_dir )
+ if ( !config.app_detector_dir )
{
return; // no lua detectors, no rule support, already warned
}
char filepath[PATH_MAX];
- snprintf(filepath, sizeof(filepath), "%s/odp/%s", config->app_detector_dir,
+ snprintf(filepath, sizeof(filepath), "%s/odp/%s", config.app_detector_dir,
APP_MAPPING_FILE);
FILE* tableFile = fopen(filepath, "r");
}
fclose(tableFile);
- snprintf(filepath, sizeof(filepath), "%s/odp/%s", config->app_detector_dir,
+ snprintf(filepath, sizeof(filepath), "%s/odp/%s", config.app_detector_dir,
APP_CONFIG_FILE);
- load_appid_config (odp_ctxt, filepath);
- snprintf(filepath, sizeof(filepath), "%s/custom/%s", config->app_detector_dir,
+ load_odp_config(odp_ctxt, filepath);
+ snprintf(filepath, sizeof(filepath), "%s/custom/%s", config.app_detector_dir,
USR_CONFIG_FILE);
if (access (filepath, F_OK))
- snprintf(filepath, sizeof(filepath), "%s/../%s", config->app_detector_dir,
+ snprintf(filepath, sizeof(filepath), "%s/../%s", config.app_detector_dir,
USR_CONFIG_FILE);
- load_appid_config (odp_ctxt, filepath);
+ load_odp_config(odp_ctxt, filepath);
}
}
class AppInfoManager
{
public:
- static inline AppInfoManager& get_instance()
- {
- static AppInfoManager instance;
- return instance;
- }
-
AppInfoTableEntry* get_app_info_entry(AppId);
AppInfoTableEntry* add_dynamic_app_entry(const char* app_name);
AppId get_appid_by_service_id(uint32_t);
return entry ? entry->priority : 0;
}
- void init_appid_info_table(AppIdConfig*, snort::SnortConfig*, OdpContext& odp_ctxt);
+ void init_appid_info_table(AppIdConfig&, snort::SnortConfig*, OdpContext& odp_ctxt);
void cleanup_appid_info_table();
void dump_app_info_table();
SnortProtocolId add_appid_protocol_reference(const char* protocol, snort::SnortConfig*);
private:
- inline AppInfoManager() = default;
- void load_appid_config(OdpContext&, const char* path);
+ void load_odp_config(OdpContext&, const char* path);
AppInfoTableEntry* get_app_info_entry(AppId appId, const AppInfoTable&);
+ bool is_existing_entry(AppInfoTableEntry* entry);
+ AppInfoTableEntry* find_app_info_by_name(const char* app_name);
+ bool add_entry_to_app_info_name_table(const char* app_name, AppInfoTableEntry* entry);
+ AppId get_static_app_info_entry(AppId appid);
+
+ AppInfoTable app_info_table;
+ AppInfoTable app_info_service_table;
+ AppInfoTable app_info_client_table;
+ AppInfoTable app_info_payload_table;
+ AppInfoNameTable app_info_name_table;
+ AppId next_custom_appid = SF_APPID_DYNAMIC_MIN;
+ AppInfoTable custom_app_info_table;
};
#endif
return (asd && asd->common.flow_type == APPID_FLOW_TYPE_NORMAL) ? asd : nullptr;
}
-const char* AppIdApi::get_application_name(AppId app_id)
+const char* AppIdApi::get_application_name(AppId app_id, AppIdContext& ctxt)
{
- return AppInfoManager::get_instance().get_app_name(app_id);
+ return ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(app_id);
}
const char* AppIdApi::get_application_name(const Flow& flow, bool from_client)
{
const char* app_name = nullptr;
- AppId appid = APP_ID_NONE;
AppIdSession* asd = get_appid_session(flow);
if (asd)
{
- appid = asd->pick_payload_app_id();
+ AppId appid = asd->pick_payload_app_id();
if (appid <= APP_ID_NONE)
appid = asd->pick_misc_app_id();
if (!appid and from_client)
if (!appid)
appid = asd->pick_client_app_id();
}
+ if (appid > APP_ID_NONE && appid < SF_APPID_MAX)
+ app_name = asd->ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(appid);
+
}
- if (appid > APP_ID_NONE && appid < SF_APPID_MAX)
- app_name = AppInfoManager::get_instance().get_app_name(appid);
return app_name;
}
-AppId AppIdApi::get_application_id(const char* appName)
+AppId AppIdApi::get_application_id(const char* appName, AppIdContext& ctxt)
{
- return AppInfoManager::get_instance().get_appid_by_name(appName);
+ return ctxt.get_odp_ctxt().get_app_info_mgr().get_appid_by_name(appName);
}
#define APPID_HA_FLAGS_APP ( 1 << 0 )
asd = new AppIdSession(proto, ip, port, *inspector);
flow.set_flow_data(asd);
- asd->service.set_id(appHA->appId[1]);
+ asd->service.set_id(appHA->appId[1], asd->ctxt.get_odp_ctxt());
if (asd->service.get_id() == APP_ID_FTP_CONTROL)
{
asd->set_session_flags(APPID_SESSION_CLIENT_DETECTED |
asd->set_session_flags(APPID_SESSION_HTTP_SESSION);
asd->set_tp_app_id(appHA->appId[0]);
- asd->service.set_id(appHA->appId[1]);
+ asd->service.set_id(appHA->appId[1], asd->ctxt.get_odp_ctxt());
asd->client_inferred_service_id = appHA->appId[2];
asd->service.set_port_service_id(appHA->appId[3]);
asd->payload.set_id(appHA->appId[4]);
enum class IpProtocol : uint8_t;
+class AppIdContext;
class AppIdSession;
namespace snort
SO_PRIVATE AppIdApi() = default;
AppIdSession* get_appid_session(const Flow& flow);
- const char* get_application_name(AppId app_id);
+ const char* get_application_name(AppId app_id, AppIdContext& ctxt);
const char* get_application_name(const Flow& flow, bool from_client);
- AppId get_application_id(const char* appName);
+ AppId get_application_id(const char* appName, AppIdContext& ctxt);
uint32_t produce_ha_state(const Flow& flow, uint8_t* buf);
uint32_t consume_ha_state(Flow& flow, const uint8_t* buf, uint8_t length, IpProtocol,
SfIp*, uint16_t initiatorPort);
#include "pub_sub/appid_events.h"
#include "app_info_table.h"
+#include "appid_config.h"
#include "appid_module.h"
#include "appid_peg_counts.h"
#include "appid_types.h"
public:
ServiceAppDescriptor() = default;
- void set_id(AppId app_id) override
+ void set_id(AppId app_id, OdpContext& odp_ctxt)
{
if (get_id() != app_id)
{
ApplicationDescriptor::set_id(app_id);
- AppInfoManager* app_info_mgr = &AppInfoManager::get_instance();
- deferred = app_info_mgr->get_app_info_flags(app_id, APPINFO_FLAG_DEFER);
+ deferred = odp_ctxt.get_app_info_mgr().get_app_info_flags(app_id, APPINFO_FLAG_DEFER);
}
}
private:
AppId port_service_id = APP_ID_NONE;
bool deferred = false;
+ using ApplicationDescriptor::set_id;
};
class ClientAppDescriptor : public ApplicationDescriptor
}
// FIXIT-M: RELOAD - move initialization back to AppIdContext class constructor
-AppInfoManager& AppIdContext::app_info_mgr = AppInfoManager::get_instance();
std::array<AppId, APP_ID_PORT_ARRAY_SIZE> AppIdContext::tcp_port_only = {APP_ID_NONE};
std::array<AppId, APP_ID_PORT_ARRAY_SIZE> AppIdContext::udp_port_only = {APP_ID_NONE};
std::array<AppId, 256> AppIdContext::ip_protocol = {APP_ID_NONE};
-// FIXIT-M: RELOAD - Move app info table cleanup back to AppId config destructor - cleanup()
void AppIdContext::pterm()
{
- AppIdContext::app_info_mgr.cleanup_appid_info_table();
+ assert(odp_ctxt);
+ odp_ctxt->get_app_info_mgr().cleanup_appid_info_table();
delete odp_ctxt;
}
{
// do not reload ODP on reload_config()
if (!odp_ctxt)
- odp_ctxt = new OdpContext();
+ odp_ctxt = new OdpContext(config, sc);
// FIXIT-M: RELOAD - Get rid of "once" flag
// Handle the if condition in AppIdContext::init_appid
static bool once = false;
if (!once)
{
- AppIdContext::app_info_mgr.init_appid_info_table(config, sc, *odp_ctxt);
HttpPatternMatchers* http_matchers = HttpPatternMatchers::get_instance();
AppIdDiscovery::initialize_plugins();
LuaDetectorManager::initialize(*this, 1);
// do not reload third party on reload_config()
if (!tp_appid_ctxt)
- tp_appid_ctxt = TPLibHandler::create_tp_appid_ctxt(*config, *odp_ctxt);
+ tp_appid_ctxt = TPLibHandler::create_tp_appid_ctxt(config, *odp_ctxt);
map_app_names_to_snort_ids(sc);
return true;
void AppIdContext::create_tp_appid_ctxt()
{
- tp_appid_ctxt = TPLibHandler::create_tp_appid_ctxt(*config, *odp_ctxt);
+ tp_appid_ctxt = TPLibHandler::create_tp_appid_ctxt(config, *odp_ctxt);
}
AppId AppIdContext::get_port_service_id(IpProtocol proto, uint16_t port)
void AppIdContext::show()
{
- if (!config->tp_appid_path.empty())
- LogMessage(" 3rd Party Dir: %s\n", config->tp_appid_path.c_str());
+ if (!config.tp_appid_path.empty())
+ LogMessage(" 3rd Party Dir: %s\n", config.tp_appid_path.c_str());
}
void AppIdContext::display_port_config()
}
}
+OdpContext::OdpContext(AppIdConfig& config, SnortConfig* sc)
+{
+ app_info_mgr.init_appid_info_table(config, sc, *this);
+}
#include "tp_appid_module_api.h"
#include "application_ids.h"
+#include "app_info_table.h"
#include "host_port_app_cache.h"
#include "length_app_cache.h"
bool allow_port_wildcard_host_cache = false;
bool recheck_for_portservice_appid = false;
+ OdpContext(AppIdConfig&, snort::SnortConfig*);
+
HostPortVal* host_port_cache_find(const snort::SfIp* ip, uint16_t port, IpProtocol proto)
{
return host_port_cache.find(ip, port, proto, *this);
return length_cache.add(key, val);
}
+ AppInfoManager& get_app_info_mgr()
+ {
+ return app_info_mgr;
+ }
+
private:
HostPortCache host_port_cache;
LengthCache length_cache;
+ AppInfoManager app_info_mgr;
};
class AppIdContext
{
public:
- AppIdContext(AppIdConfig* config) : config(config)
+ AppIdContext(AppIdConfig& config) : config(config)
{ }
~AppIdContext() { }
OdpContext& get_odp_ctxt() const
- { return *odp_ctxt; }
+ {
+ assert(odp_ctxt);
+ return *odp_ctxt;
+ }
ThirdPartyAppIdContext* get_tp_appid_ctxt() const
{ return tp_appid_ctxt; }
static std::array<AppId, APP_ID_PORT_ARRAY_SIZE> udp_port_only; // port-only UDP services
static std::array<AppId, 256> ip_protocol; // non-TCP / UDP protocol services
- AppIdConfig* config = nullptr;
+ AppIdConfig& config;
private:
void display_port_config();
- // FIXIT-M: RELOAD - Remove static, once app_info_mgr cleanup is
- // removed from AppIdContext::pterm
- static AppInfoManager& app_info_mgr;
static OdpContext* odp_ctxt;
static ThirdPartyAppIdContext* tp_appid_ctxt;
};
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
//--------------------------------------------------------------------------
-// client_detector.cc author davis mcpherson
+// appid_detector.cc author davis mcpherson
#ifdef HAVE_CONFIG_H
#include "config.h"
#include "appid_detector.h"
+#include "managers/inspector_manager.h"
#include "protocols/packet.h"
#include "app_info_table.h"
#include "appid_config.h"
#include "appid_http_session.h"
+#include "appid_inspector.h"
#include "lua_detector_api.h"
using namespace snort;
handler->register_udp_pattern(this, pat.pattern, pat.length, pat.index, pat.nocase);
if (!appid_registry.empty())
+ {
+ // FIXIT-M: RELOAD - to support ODP reload, store ODP context in AppIdDetector
+ AppIdInspector* inspector = (AppIdInspector*) InspectorManager::get_inspector(MOD_NAME, true);
+ AppIdContext& ctxt = inspector->get_ctxt();
for (auto& id : appid_registry)
- register_appid(id.appId, id.additionalInfo);
+ register_appid(id.appId, id.additionalInfo, ctxt.get_odp_ctxt());
+ }
if (!service_ports.empty())
for (auto& port: service_ports)
AppidSessionDirection dir;
AppIdSession& asd;
snort::Packet* pkt;
- const AppIdContext* ctxt = nullptr;
+ const AppIdContext& ctxt;
AppidChangeBits& change_bits;
};
virtual void do_custom_init() = 0;
virtual void release_thread_resources() = 0;
virtual int validate(AppIdDiscoveryArgs&) = 0;
- virtual void register_appid(AppId, unsigned extractsInfo) = 0;
+ virtual void register_appid(AppId, unsigned extractsInfo, OdpContext& odp_ctxt) = 0;
virtual void* data_get(AppIdSession&);
virtual int data_add(AppIdSession&, void*, AppIdFreeFCN);
if ( appidDebug->is_enabled() )
appidDebug->activate(p->flow, asd,
- inspector.get_ctxt()->config->log_all_sessions);
+ inspector.get_ctxt().config.log_all_sessions);
if ( is_packet_ignored(asd, p, direction) )
return false;
{
asd->set_session_flags(APPID_SESSION_IGNORE_FLOW_LOGGED);
- const char *app_name = AppInfoManager::get_instance().get_app_name(asd->service.get_id());
+ const char *app_name = asd->ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(asd->service.get_id());
LogMessage("AppIdDbg %s Ignoring connection with service %s (%d)\n",
appidDebug->get_debug_session(), app_name ? app_name : "unknown", asd->service.get_id());
}
// FIXIT-L: DECRYPT_DEBUG - Move set_proxied and first_decrypted_packet_debug to ssl-module
// after ssl-module's decryption capability is implemented
#ifdef REG_TEST
- uint32_t fdpd = inspector.get_ctxt()->config->first_decrypted_packet_debug;
+ uint32_t fdpd = inspector.get_ctxt().config.first_decrypted_packet_debug;
if (fdpd and (fdpd == asd->session_packet_count))
{
p->flow->set_proxied();
return;
}
- AppId id = asd.ctxt->get_port_service_id(protocol, p->ptrs.sp);
+ AppId id = asd.ctxt.get_port_service_id(protocol, p->ptrs.sp);
if (id > APP_ID_NONE)
{
asd.service.set_port_service_id(id);
if (appidDebug->is_active())
{
const char *app_name =
- AppInfoManager::get_instance().get_app_name(asd.service.get_port_service_id());
+ asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(asd.service.get_port_service_id());
LogMessage("AppIdDbg %s Port service %s (%d) from port\n",
appidDebug->get_debug_session(), app_name ? app_name : "unknown",
asd.service.get_port_service_id());
if (!(asd.scan_flags & SCAN_HOST_PORT_FLAG))
check_static = true;
- if ((asd.session_packet_count % asd.ctxt->get_odp_ctxt().host_port_app_cache_lookup_interval == 0) and
- (asd.session_packet_count <= asd.ctxt->get_odp_ctxt().host_port_app_cache_lookup_range) and
- asd.ctxt->get_odp_ctxt().is_host_port_app_cache_runtime )
+ if ((asd.session_packet_count % asd.ctxt.get_odp_ctxt().host_port_app_cache_lookup_interval == 0) and
+ (asd.session_packet_count <= asd.ctxt.get_odp_ctxt().host_port_app_cache_lookup_range) and
+ asd.ctxt.get_odp_ctxt().is_host_port_app_cache_runtime )
check_dynamic = true;
if (!(check_static || check_dynamic))
HostPortVal* hv = nullptr;
if (check_static and
- (hv = asd.ctxt->get_odp_ctxt().host_port_cache_find(ip, port, protocol)))
+ (hv = asd.ctxt.get_odp_ctxt().host_port_cache_find(ip, port, protocol)))
{
asd.scan_flags |= SCAN_HOST_PORT_FLAG;
switch (hv->type)
asd.payload.set_id(hv->appId);
break;
default:
- asd.service.set_id(hv->appId);
+ asd.service.set_id(hv->appId, asd.ctxt.get_odp_ctxt());
asd.sync_with_snort_protocol_id(hv->appId, p);
asd.service_disco_state = APPID_DISCO_STATE_FINISHED;
asd.client_disco_state = APPID_DISCO_STATE_FINISHED;
auto ht = host_cache.find(*ip);
if (ht)
{
- AppId appid = ht->get_appid(port, protocol, true, asd.ctxt->get_odp_ctxt().allow_port_wildcard_host_cache);
+ AppId appid = ht->get_appid(port, protocol, true, asd.ctxt.get_odp_ctxt().allow_port_wildcard_host_cache);
if (appid > APP_ID_NONE)
{
// FIXIT-L: Make this more generic to support service and payload IDs
{
bool is_payload_client_misc_none = (payload_id <= APP_ID_NONE and client_id <= APP_ID_NONE and misc_id <= APP_ID_NONE);
bool is_appid_none = is_payload_client_misc_none and (service_id <= APP_ID_NONE or service_id == APP_ID_UNKNOWN_UI or
- (asd.ctxt->get_odp_ctxt().recheck_for_portservice_appid and service_id == asd.service.get_port_service_id()));
- bool is_ssl_none = asd.ctxt->get_odp_ctxt().check_host_cache_unknown_ssl and asd.get_session_flags(APPID_SESSION_SSL_SESSION) and
+ (asd.ctxt.get_odp_ctxt().recheck_for_portservice_appid and service_id == asd.service.get_port_service_id()));
+ bool is_ssl_none = asd.ctxt.get_odp_ctxt().check_host_cache_unknown_ssl and asd.get_session_flags(APPID_SESSION_SSL_SESSION) and
(not(asd.tsession and asd.tsession->get_tls_host() and asd.tsession->get_tls_cname()));
- if (is_appid_none or is_ssl_none or asd.ctxt->get_odp_ctxt().check_host_port_app_cache)
+ if (is_appid_none or is_ssl_none or asd.ctxt.get_odp_ctxt().check_host_port_app_cache)
return true;
return false;
}
{
if ( !asd.get_session_flags(APPID_SESSION_PORT_SERVICE_DONE) )
{
- AppId id = asd.ctxt->get_protocol_service_id(protocol);
+ AppId id = asd.ctxt.get_protocol_service_id(protocol);
if (id > APP_ID_NONE)
{
asd.service.set_port_service_id(id);
asd.service_disco_state = APPID_DISCO_STATE_FINISHED;
if (appidDebug->is_active())
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(asd.service.get_port_service_id());
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(asd.service.get_port_service_id());
LogMessage("AppIdDbg %s Protocol service %s (%d) from protocol\n",
appidDebug->get_debug_session(), app_name ? app_name : "unknown", asd.service.get_port_service_id());
}
if (tp_appid_ctxt)
{
// Skip third-party inspection for sessions using old config
- if ((asd.tpsession and asd.tpsession->get_ctxt() == tp_appid_ctxt) || !asd.tpsession)
+ if ((asd.tpsession and &(asd.tpsession->get_ctxt()) == tp_appid_ctxt) || !asd.tpsession)
is_discovery_done = do_tp_discovery(*tp_appid_ctxt, asd, protocol, p,
direction, change_bits);
}
asd.length_sequence.sequence_cnt++;
asd.length_sequence.sequence[index].direction = direction;
asd.length_sequence.sequence[index].length = p->dsize;
- AppId id = asd.ctxt->get_odp_ctxt().length_cache_find(asd.length_sequence);
+ AppId id = asd.ctxt.get_odp_ctxt().length_cache_find(asd.length_sequence);
if (id > APP_ID_NONE)
{
service_id = id;
asd.service.set_port_service_id(id);
if (appidDebug->is_active())
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(id);
LogMessage("AppIdDbg %s Port service %s (%d) from length\n",
appidDebug->get_debug_session(), app_name ? app_name : "unknown", id);
}
// Set the field that the Firewall queries to see if we have a search engine
if (asd.search_support_type == UNKNOWN_SEARCH_ENGINE && payload_id > APP_ID_NONE)
{
- uint flags = AppInfoManager::get_instance().get_app_info_flags(payload_id,
+ uint flags = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_flags(payload_id,
APPINFO_FLAG_SEARCH_ENGINE | APPINFO_FLAG_SUPPORTED_SEARCH);
asd.search_support_type =
(flags & APPINFO_FLAG_SEARCH_ENGINE) ?
if (appidDebug->is_active())
{
const char* typeString;
- const char *app_name = AppInfoManager::get_instance().get_app_name(payload_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(payload_id);
switch ( asd.search_support_type )
{
case NOT_A_SEARCH_ENGINE: typeString = "NOT_A_SEARCH_ENGINE"; break;
int num_found = 0;
cmd.cur_ptype = (HttpFieldIds)i;
AppId ret = http_matchers->scan_chp(cmd, &version, &user, &num_found, this,
- *asd.ctxt);
+ asd.ctxt);
total_found += num_found;
if (!ret || num_found < ptype_req_counts[i])
{
if (asd.service.get_id() == APP_ID_NONE)
{
- asd.service.set_id(APP_ID_HTTP);
+ asd.service.set_id(APP_ID_HTTP, asd.ctxt.get_odp_ctxt());
asd.set_session_flags(APPID_SESSION_SERVICE_DETECTED | APPID_SESSION_HTTP_SESSION);
asd.service_disco_state = APPID_DISCO_STATE_FINISHED;
}
if (service_id > APP_ID_NONE and service_id != APP_ID_HTTP and
asd.service.get_id() != service_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(service_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(service_id);
LogMessage("AppIdDbg %s User Agent is service %s (%d)\n",
appidDebug->get_debug_session(), app_name ? app_name : "unknown", service_id);
}
if (client_id > APP_ID_NONE and client_id != APP_ID_HTTP and
asd.client.get_id() != client_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(client_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(client_id);
LogMessage("AppIdDbg %s User Agent is client %s (%d)\n",
appidDebug->get_debug_session(), app_name ? app_name : "unknown", client_id);
}
if (appidDebug->is_active() && payload_id > APP_ID_NONE &&
asd.payload.get_id() != payload_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(payload_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(payload_id);
LogMessage("AppIdDbg %s VIA is payload %s (%d)\n", appidDebug->get_debug_session(),
app_name ? app_name : "unknown",
payload_id);
if (appidDebug->is_active() && client_id > APP_ID_NONE && client_id !=
APP_ID_HTTP && asd.client.get_id() != client_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(appId);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(appId);
LogMessage("AppIdDbg %s X is client %s (%d)\n", appidDebug->get_debug_session(),
app_name ? app_name : "unknown", appId);
}
if (appidDebug->is_active() && service_id > APP_ID_NONE && service_id !=
APP_ID_HTTP && asd.service.get_id() != service_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(appId);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(appId);
LogMessage("AppIdDbg %s X service %s (%d)\n", appidDebug->get_debug_session(),
app_name ? app_name : "unknown", appId);
}
if (appidDebug->is_active() && payload_id > APP_ID_NONE
&& asd.payload.get_id() != payload_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(payload_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(payload_id);
LogMessage("AppIdDbg %s Content-Type is payload %s (%d)\n",
appidDebug->get_debug_session(),
app_name ? app_name : "unknown",
const char* urlStr = url ? url->c_str() : nullptr;
if ( http_matchers->get_appid_from_url(my_host, urlStr, &version,
refStr, &client_id, &service_id, &payload_id,
- &referredPayloadAppId, false) )
+ &referredPayloadAppId, false, asd.ctxt.get_odp_ctxt()) )
{
// do not overwrite a previously-set client or service
if (asd.client.get_id() <= APP_ID_NONE)
if (appidDebug->is_active() && client_id > APP_ID_NONE && client_id !=
APP_ID_HTTP && asd.client.get_id() != client_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(client_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(client_id);
LogMessage("AppIdDbg %s URL is client %s (%d)\n",
appidDebug->get_debug_session(),
app_name ? app_name : "unknown",
if (appidDebug->is_active() && service_id > APP_ID_NONE && service_id !=
APP_ID_HTTP && asd.service.get_id() != service_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(service_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(service_id);
LogMessage("AppIdDbg %s URL is service %s (%d)\n",
appidDebug->get_debug_session(),
app_name ? app_name : "unknown",
if (appidDebug->is_active() && payload_id > APP_ID_NONE &&
asd.payload.get_id() != payload_id)
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(payload_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(payload_id);
LogMessage("AppIdDbg %s URL is payload %s (%d)\n", appidDebug->get_debug_session(),
app_name ? app_name : "unknown",
payload_id);
AppId tp_payload_app_id = asd.get_tp_payload_app_id();
if (tp_payload_app_id > APP_ID_NONE)
{
- entry = asd.app_info_mgr->get_app_info_entry(tp_payload_app_id);
+ entry = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(tp_payload_app_id);
// only move tpPayloadAppId to client if client app id is valid
if (entry && entry->clientId > APP_ID_NONE)
{
}
else if (asd.payload.get_id() > APP_ID_NONE)
{
- entry = asd.app_info_mgr->get_app_info_entry(asd.payload.get_id());
+ entry = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(asd.payload.get_id());
// only move payload_app_id to client if it has a ClientAppid
if (entry && entry->clientId > APP_ID_NONE)
{
AppId service_id, client_id, payload_id, misc_id;
const char* service_app_name, * client_app_name, * payload_app_name, * misc_name;
session->get_application_ids(service_id, client_id, payload_id, misc_id);
- service_app_name = appid_api.get_application_name(service_id);
- client_app_name = appid_api.get_application_name(client_id);
- payload_app_name = appid_api.get_application_name(payload_id);
- misc_name = appid_api.get_application_name(misc_id);
+ service_app_name = appid_api.get_application_name(service_id, session->ctxt);
+ client_app_name = appid_api.get_application_name(client_id, session->ctxt);
+ payload_app_name = appid_api.get_application_name(payload_id, session->ctxt);
+ misc_name = appid_api.get_application_name(misc_id, session->ctxt);
if (PacketTracer::is_active())
{
AppIdInspector::AppIdInspector(AppIdModule& mod)
{
config = mod.get_data();
+ assert(config);
}
AppIdInspector::~AppIdInspector()
{
- delete ctxt;
+ if (ctxt)
+ delete ctxt;
delete config;
}
-AppIdContext* AppIdInspector::get_ctxt()
+AppIdContext& AppIdInspector::get_ctxt() const
{
- return ctxt;
+ assert(ctxt);
+ return *ctxt;
}
bool AppIdInspector::configure(SnortConfig* sc)
{
assert(!ctxt);
- ctxt = new AppIdContext(const_cast<AppIdConfig*>(config));
+ ctxt = new AppIdContext(const_cast<AppIdConfig&>(*config));
my_seh = SipEventHandler::create();
my_seh->subscribe(sc);
LuaDetectorManager::initialize(*ctxt);
AppIdServiceState::initialize(config->memcap);
appidDebug = new AppIdDebug();
- if (ctxt->config and ctxt->config->log_all_sessions)
+ if (ctxt->config.log_all_sessions)
appidDebug->set_enabled(true);
}
void tinit() override;
void tterm() override;
void eval(snort::Packet*) override;
- AppIdContext* get_ctxt();
+ AppIdContext& get_ctxt() const;
SipEventHandler& get_sip_event_handler()
{
Swapper::set_reload_in_progress(true);
LogMessage(".. reloading third-party\n");
AppIdInspector* inspector = (AppIdInspector*) InspectorManager::get_inspector(MOD_NAME, true);
- AppIdContext* ctxt = inspector->get_ctxt();
- ctxt->create_tp_appid_ctxt();
+ AppIdContext& ctxt = inspector->get_ctxt();
+ ctxt.create_tp_appid_ctxt();
Swapper::set_reload_in_progress(false);
LogMessage("== reload third-party complete\n");
}
common.flow_type = APPID_FLOW_TYPE_NORMAL;
common.initiator_ip = *ip;
common.initiator_port = port;
- app_info_mgr = &AppInfoManager::get_instance();
length_sequence.proto = IpProtocol::PROTO_NOT_SET;
length_sequence.sequence_cnt = 0;
{
if (!in_expected_cache)
{
- if (ctxt->config->stats_logging_enabled)
+ if (ctxt.config.stats_logging_enabled)
AppIdStatistics::get_stats_manager()->update(*this);
// fail any service detection that is in process for this flow
if (tpsession)
{
- if (tpsession->get_ctxt() == tp_appid_thread_ctxt)
+ if (&(tpsession->get_ctxt()) == tp_appid_thread_ctxt)
tpsession->delete_with_ctxt();
else
delete tpsession;
break;
}
- AppInfoTableEntry* entry = app_info_mgr->get_app_info_entry(newAppId);
+ AppInfoTableEntry* entry = ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(newAppId);
if (entry)
{
SnortProtocolId tmp_snort_protocol_id = entry->snort_protocol_id;
if (client.get_id() == APP_ID_NONE or client.get_id() == APP_ID_SSL_CLIENT)
set_client_appid_data(client_id, change_bits);
set_payload_appid_data(payload_id, change_bits);
- setSSLSquelch(p, ret, (ret == 1 ? payload_id : client_id));
+ setSSLSquelch(p, ret, (ret == 1 ? payload_id : client_id), ctxt.get_odp_ctxt());
}
scan_flags &= ~SCAN_SSL_HOST_FLAG;
}
if (client.get_id() == APP_ID_NONE or client.get_id() == APP_ID_SSL_CLIENT)
set_client_appid_data(client_id, change_bits);
set_payload_appid_data(payload_id, change_bits);
- setSSLSquelch(p, ret, (ret == 1 ? payload_id : client_id));
+ setSSLSquelch(p, ret, (ret == 1 ? payload_id : client_id), ctxt.get_odp_ctxt());
}
scan_flags &= ~SCAN_SSL_CERTIFICATE_FLAG;
}
{
set_client_appid_data(client_id, change_bits);
set_payload_appid_data(payload_id, change_bits);
- setSSLSquelch(p, ret, (ret == 1 ? payload_id : client_id));
+ setSSLSquelch(p, ret, (ret == 1 ? payload_id : client_id), ctxt.get_odp_ctxt());
}
tsession->set_tls_org_unit(nullptr, 0);
}
const char* referer = hsession->get_cfield(REQ_REFERER_FID);
if (((http_matchers->get_appid_from_url(nullptr, url, &version,
referer, &client_id, &service_id, &payload_id,
- &referred_payload_id, true)) ||
+ &referred_payload_id, true, ctxt.get_odp_ctxt())) ||
(http_matchers->get_appid_from_url(nullptr, url, &version,
referer, &client_id, &service_id, &payload_id,
- &referred_payload_id, false))))
+ &referred_payload_id, false, ctxt.get_odp_ctxt()))))
{
/* do not overwrite a previously-set client or service */
if (client.get_id() <= APP_ID_NONE)
if (id != cur_id)
{
if (cur_id)
- if (app_info_mgr->get_priority(cur_id) > app_info_mgr->get_priority(id))
+ if (ctxt.get_odp_ctxt().get_app_info_mgr().get_priority(cur_id) > ctxt.get_odp_ctxt().get_app_info_mgr().get_priority(id))
return;
client.set_id(id);
if (id <= APP_ID_NONE)
return;
- if (app_info_mgr->get_priority(payload.get_id()) > app_info_mgr->get_priority(id))
+ if (ctxt.get_odp_ctxt().get_app_info_mgr().get_priority(payload.get_id()) > ctxt.get_odp_ctxt().get_app_info_mgr().get_priority(id))
return;
payload.set_id(id);
payload.set_version(version, change_bits);
bool AppIdSession::is_tp_appid_done() const
{
- if (ctxt->get_tp_appid_ctxt())
+ if (ctxt.get_tp_appid_ctxt())
{
if (!tpsession)
return false;
bool AppIdSession::is_tp_appid_available() const
{
- if (ctxt->get_tp_appid_ctxt())
+ if (ctxt.get_tp_appid_ctxt())
{
if (!tpsession)
return false;
if (tp_app_id != app_id)
{
tp_app_id = app_id;
- AppInfoTableEntry* entry = app_info_mgr->get_app_info_entry(tp_app_id);
+ AppInfoTableEntry* entry = ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(tp_app_id);
if (entry)
{
tp_app_id_deferred = (entry->flags & APPINFO_FLAG_DEFER) ? true : false;
if (tp_payload_app_id != app_id)
{
tp_payload_app_id = app_id;
- AppInfoTableEntry* entry = app_info_mgr->get_app_info_entry(tp_payload_app_id);
+ AppInfoTableEntry* entry = ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(tp_payload_app_id);
if (entry)
{
tp_payload_app_id_deferred = (entry->flags & APPINFO_FLAG_DEFER_PAYLOAD) ? true : false;
uint32_t session_id = 0;
snort::Flow* flow = nullptr;
- AppIdContext* ctxt;
+ AppIdContext& ctxt;
std::unordered_map<unsigned, AppIdFlowData*> flow_data;
- AppInfoManager* app_info_mgr = nullptr;
CommonAppIdData common;
uint16_t session_packet_count = 0;
if (tp_app_id != app_id)
{
tp_app_id = app_id;
- tp_app_id_deferred = app_info_mgr->get_app_info_flags(tp_app_id, APPINFO_FLAG_DEFER);
+ tp_app_id_deferred = ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_flags
+ (tp_app_id, APPINFO_FLAG_DEFER);
}
}
if (tp_payload_app_id != app_id)
{
tp_payload_app_id = app_id;
- tp_payload_app_id_deferred = app_info_mgr->get_app_info_flags(tp_payload_app_id, APPINFO_FLAG_DEFER_PAYLOAD);
+ tp_payload_app_id_deferred = ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_flags
+ (tp_payload_app_id, APPINFO_FLAG_DEFER_PAYLOAD);
}
}
return true;
}
- if (asd->ctxt->get_odp_ctxt().check_host_port_app_cache)
+ if (asd->ctxt.get_odp_ctxt().check_host_port_app_cache)
return true;
return false;
struct AppIdStatRecord
{
- uint32_t app_id;
+ char* app_name = nullptr;
uint64_t initiatorBytes;
uint64_t responderBytes;
};
static void delete_record(void* record)
{
+ snort_free(((AppIdStatRecord*)record)->app_name);
snort_free(record);
}
for (node = fwAvlFirst(bucket->appsTree); node != nullptr; node = fwAvlNext(node))
{
- const char* app_name;
- bool cooked_client = false;
- AppId app_id;
- char tmpBuff[MAX_EVENT_APPNAME_LEN];
struct AppIdStatRecord* record;
record = (struct AppIdStatRecord*)node->data;
- app_id = (AppId)record->app_id;
-
- if ( app_id >= 2000000000 )
- {
- cooked_client = true;
- app_id -= 2000000000;
- }
-
- AppInfoTableEntry* entry
- = AppInfoManager::get_instance().get_app_info_entry(app_id);
-
- if ( entry )
- {
- app_name = entry->app_name;
- if (cooked_client)
- {
- snprintf(tmpBuff, MAX_EVENT_APPNAME_LEN, "_cl_%s", app_name);
- tmpBuff[MAX_EVENT_APPNAME_LEN-1] = 0;
- app_name = tmpBuff;
- }
- }
- else if ( app_id == APP_ID_UNKNOWN || app_id == APP_ID_UNKNOWN_UI )
- app_name = "__unknown";
- else if ( app_id == APP_ID_NONE )
- app_name = "__none";
- else
- {
- if (cooked_client)
- snprintf(tmpBuff, MAX_EVENT_APPNAME_LEN, "_err_cl_%d",app_id);
- else
- snprintf(tmpBuff, MAX_EVENT_APPNAME_LEN, "_err_%d",app_id);
-
- tmpBuff[MAX_EVENT_APPNAME_LEN - 1] = 0;
- app_name = tmpBuff;
- }
// FIXIT-M %lu won't do time_t on 32-bit systems
TextLog_Print(log, "%lu,%s," STDu64 "," STDu64 "\n",
- packet_time(), app_name, record->initiatorBytes, record->responderBytes);
+ packet_time(), record->app_name, record->initiatorBytes, record->responderBytes);
}
}
fwAvlDeleteTree(bucket->appsTree, delete_record);
AppIdStatRecord* record = (AppIdStatRecord*)(fwAvlLookup(app_id, bucket->appsTree));
if ( !record )
{
+ char tmp_buff[MAX_EVENT_APPNAME_LEN];
+ bool cooked_client = false;
+
record = (AppIdStatRecord*)(snort_calloc(sizeof(struct AppIdStatRecord)));
+
+ if ( app_id >= 2000000000 )
+ cooked_client = true;
+
+ AppInfoTableEntry* entry
+ = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(app_id);
+
+ if ( entry )
+ {
+ if (cooked_client)
+ {
+ snprintf(tmp_buff, MAX_EVENT_APPNAME_LEN, "_cl_%s", entry->app_name);
+ tmp_buff[MAX_EVENT_APPNAME_LEN-1] = 0;
+ record->app_name = snort_strdup(tmp_buff);
+ }
+ else
+ record->app_name = snort_strdup(entry->app_name);
+ }
+ else if ( app_id == APP_ID_UNKNOWN || app_id == APP_ID_UNKNOWN_UI )
+ record->app_name = snort_strdup("__unknown");
+ else if ( app_id == APP_ID_NONE )
+ record->app_name = snort_strdup("__none");
+ else
+ {
+ if (cooked_client)
+ snprintf(tmp_buff, MAX_EVENT_APPNAME_LEN, "_err_cl_%d",app_id);
+ else
+ snprintf(tmp_buff, MAX_EVENT_APPNAME_LEN, "_err_%d",app_id);
+
+ tmp_buff[MAX_EVENT_APPNAME_LEN - 1] = 0;
+ record->app_name = snort_strdup(tmp_buff);
+ }
+
if (fwAvlInsert(app_id, record, bucket->appsTree) == 0)
{
- record->app_id = app_id;
bucket->appRecordCnt += 1;
}
else
client = true;
}
-void ClientDetector::register_appid(AppId appId, unsigned extractsInfo)
+void ClientDetector::register_appid(AppId appId, unsigned extractsInfo, OdpContext& odp_ctxt)
{
- AppInfoTableEntry* pEntry = AppInfoManager::get_instance().get_app_info_entry(appId);
+ AppInfoTableEntry* pEntry = odp_ctxt.get_app_info_mgr().get_app_info_entry(appId);
if (!pEntry)
{
- if ( AppInfoManager::get_instance().configured() )
+ if ( odp_ctxt.get_app_info_mgr().configured() )
{
ParseWarning(WARN_RULES,
"appid: no entry for %d in appMapping.data; no rule support for this ID.",
void do_custom_init() override { }
void release_thread_resources() override { }
- void register_appid(AppId, unsigned extractsInfo) override;
+ void register_appid(AppId, unsigned extractsInfo, OdpContext& odp_ctxt) override;
};
#endif
{
// Third party has positively identified appId; Dig deeper only if our
// detector identifies additional information
- entry = asd.app_info_mgr->get_app_info_entry(tp_app_id);
+ entry = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(tp_app_id);
if ( entry && entry->client_detector
&& ( ( entry->flags & ( APPINFO_FLAG_CLIENT_ADDITIONAL |
APPINFO_FLAG_CLIENT_USER ) )
!asd.get_session_flags(APPID_SESSION_NO_TPI) and
asd.is_tp_appid_available() )
{
- entry = asd.app_info_mgr->get_app_info_entry(tp_app_id);
+ entry = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(tp_app_id);
if ( !( entry && entry->client_detector
&& entry->client_detector == asd.client_detector
&& (entry->flags & (APPINFO_FLAG_CLIENT_ADDITIONAL | APPINFO_FLAG_CLIENT_USER) ) ) )
goto udp_done;
}
if ((rval = dns_validate_header(args.dir, (const DNSHeader*)args.data,
- args.ctxt->get_odp_ctxt().dns_host_reporting, args.asd)) != APPID_SUCCESS)
+ args.ctxt.get_odp_ctxt().dns_host_reporting, args.asd)) != APPID_SUCCESS)
{
if (rval == APPID_REVERSED)
{
// To get here, we missed the initial query, got a
// response, and now we've got another query.
rval = validate_packet(args.data, args.size, args.dir,
- args.ctxt->get_odp_ctxt().dns_host_reporting, args.asd);
+ args.ctxt.get_odp_ctxt().dns_host_reporting, args.asd);
if (rval == APPID_SUCCESS)
goto inprocess;
}
// To get here, we missed the initial query, but now we've got
// a response.
rval = validate_packet(args.data, args.size, args.dir,
- args.ctxt->get_odp_ctxt().dns_host_reporting, args.asd);
+ args.ctxt.get_odp_ctxt().dns_host_reporting, args.asd);
if (rval == APPID_SUCCESS)
{
args.asd.set_session_flags(APPID_SESSION_UDP_REVERSED);
}
rval = validate_packet(args.data, args.size, args.dir,
- args.ctxt->get_odp_ctxt().dns_host_reporting, args.asd);
+ args.ctxt.get_odp_ctxt().dns_host_reporting, args.asd);
if ((rval == APPID_SUCCESS) && (args.dir == APP_ID_FROM_INITIATOR))
goto inprocess;
uint16_t size = args.size - sizeof(DNSTCPHeader);
uint16_t tmp = ntohs(hdr->length);
if (tmp < sizeof(DNSHeader) || dns_validate_header(args.dir, (const DNSHeader*)data,
- args.ctxt->get_odp_ctxt().dns_host_reporting, args.asd))
+ args.ctxt.get_odp_ctxt().dns_host_reporting, args.asd))
{
if (args.dir == APP_ID_FROM_INITIATOR)
goto not_compatible;
if (tmp > size)
goto not_compatible;
rval = validate_packet(data, size, args.dir,
- args.ctxt->get_odp_ctxt().dns_host_reporting, args.asd);
+ args.ctxt.get_odp_ctxt().dns_host_reporting, args.asd);
if (rval != APPID_SUCCESS)
goto tcp_done;
#include "detector_pattern.h"
-#include "app_info_table.h"
#include "log/messages.h"
+#include "managers/inspector_manager.h"
#include "protocols/packet.h"
#include "search_engines/search_tool.h"
+#include "app_info_table.h"
+#include "appid_inspector.h"
+
using namespace snort;
static PatternServiceDetector* service_pattern_detector;
pattern->offset = pNode->offset;
pattern->next = ps->pattern;
ps->pattern = pattern;
- AppInfoManager::get_instance().set_app_info_active(ps->id);
+
+ // FIXIT-M: Tp support ODP reload, store ODP context in PatternService
+ AppIdInspector* inspector = (AppIdInspector*) InspectorManager::get_inspector(MOD_NAME, true);
+ AppIdContext& ctxt = inspector->get_ctxt();
+
+ ctxt.get_odp_ctxt().get_app_info_mgr().set_app_info_active(ps->id);
}
}
{
fp->client.set_id(asd.client.get_id());
fp->payload.set_id(asd.payload.get_id());
- fp->service.set_id(APP_ID_RTP);
+ fp->service.set_id(APP_ID_RTP, asd.ctxt.get_odp_ctxt());
// FIXIT-H : snort 2.9.x updated the flag to APPID_SESSION_EXPECTED_EVALUATE.
// Check if it is needed here as well.
{
fp2->client.set_id(asd.client.get_id());
fp2->payload.set_id(asd.payload.get_id());
- fp2->service.set_id(APP_ID_RTCP);
+ fp2->service.set_id(APP_ID_RTCP, asd.ctxt.get_odp_ctxt());
// FIXIT-H : same comment as above
//initialize_expected_session(asd, fp2, APPID_SESSION_EXPECTED_EVALUATE);
bool HttpPatternMatchers::get_appid_from_url(char* host, const char* url, char** version,
const char* referer, AppId* ClientAppId, AppId* serviceAppId, AppId* payloadAppId,
- AppId* referredPayloadAppId, bool from_rtmp)
+ AppId* referredPayloadAppId, bool from_rtmp, OdpContext& odp_ctxt)
{
char* temp_host = nullptr;
tMlmpPattern patterns[3];
/* if referred_id feature id disabled, referer will be null */
if ( referer and (referer[0] != '\0') and (!payload_found or
- AppInfoManager::get_instance().get_app_info_flags(data->payload_id,
+ odp_ctxt.get_app_info_mgr().get_app_info_flags(data->payload_id,
APPINFO_FLAG_REFERRED)) )
{
const char* referer_start = referer;
}
class AppIdHttpSession;
class AppIdContext;
+class OdpContext;
enum httpPatternType
{
AppId scan_header_x_working_with(const char*, uint32_t, char**);
int get_appid_by_pattern(const char*, unsigned, char**);
bool get_appid_from_url(char*, const char*, char**, const char*, AppId*, AppId*,
- AppId*, AppId*, bool);
+ AppId*, AppId*, bool, OdpContext&);
AppId get_appid_by_content_type(const char*, int);
void get_server_vendor_version(const char*, int, char**, char**, snort::AppIdServiceSubtype**);
void identify_user_agent(const char*, int, AppId&, AppId&, char**);
// Stubs for inspectors
unsigned AppIdSession::inspector_id = 0;
+AppIdConfig stub_config;
+AppIdContext stub_ctxt(stub_config);
AppIdSession::AppIdSession(IpProtocol, const SfIp*, uint16_t, AppIdInspector& inspector)
- : snort::FlowData(inspector_id, (snort::Inspector*)&inspector) { }
+ : snort::FlowData(inspector_id, (snort::Inspector*)&inspector), ctxt(stub_ctxt) { }
AppIdSession::~AppIdSession() = default;
AppIdHttpSession::AppIdHttpSession(AppIdSession& asd)
: asd(asd)
return true;
}
+OdpContext::OdpContext(AppIdConfig&, snort::SnortConfig*)
+{ }
+
#endif
static const char* my_chp_data = (const char*)"chp_data";
static int total_found;
static AppIdConfig config;
-static AppIdContext ctxt(&config);
-static OdpContext odpctxt;
+static AppIdContext ctxt(config);
+static OdpContext odpctxt(config, nullptr);
OdpContext* AppIdContext::odp_ctxt = &odpctxt;
static AppId service_id = APP_ID_NONE;
static AppId client_id = APP_ID_NONE;
hk.ip = *ip;
AppIdInspector* inspector = (AppIdInspector*) InspectorManager::get_inspector(MOD_NAME, true);
- AppIdContext* ctxt = inspector->get_ctxt();
- hk.port = (ctxt->get_odp_ctxt().allow_port_wildcard_host_cache)? 0 : port;
+ AppIdContext& ctxt = inspector->get_ctxt();
+ hk.port = (ctxt.get_odp_ctxt().allow_port_wildcard_host_cache)? 0 : port;
hk.proto = proto;
hv.appId = appId;
EvalStatus eval(Cursor&, Packet*) override;
private:
- bool match_id_against_rule(int32_t id);
+ bool match_id_against_rule(OdpContext& odp_ctxt, int32_t id);
set<string> appid_table;
};
return ( appid_table == ((const AppIdIpsOption&)ips).appid_table );
}
-bool AppIdIpsOption::match_id_against_rule(int32_t id)
+bool AppIdIpsOption::match_id_against_rule(OdpContext& odp_ctxt, int32_t id)
{
- const char *app_name_key = AppInfoManager::get_instance().get_app_name_key(id);
+ const char *app_name_key = odp_ctxt.get_app_info_mgr().get_app_name_key(id);
if ( nullptr != app_name_key )
{
string app_name(app_name_key);
app_ids[PAYLOAD], app_ids[MISC]);
for ( unsigned i = 0; i < NUM_ID_TYPES; i++ )
- if ( (app_ids[i] > APP_ID_NONE) && match_id_against_rule(app_ids[i]) )
+ if ( (app_ids[i] > APP_ID_NONE) and
+ match_id_against_rule(session->ctxt.get_odp_ctxt(), app_ids[i]) )
return MATCH;
return NO_MATCH;
AppId appId = lua_tonumber(L, ++index);
if ( ad->is_client() )
- ad->register_appid(appId, APPINFO_FLAG_CLIENT_ADDITIONAL);
+ ad->register_appid(appId, APPINFO_FLAG_CLIENT_ADDITIONAL, ud->get_odp_ctxt());
else
- ad->register_appid(appId, APPINFO_FLAG_SERVICE_ADDITIONAL);
+ ad->register_appid(appId, APPINFO_FLAG_SERVICE_ADDITIONAL, ud->get_odp_ctxt());
- AppInfoManager::get_instance().set_app_info_active(appId);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(appId);
lua_pushnumber(L, 0);
return 1;
/*Phase2 - discuss AppIdServiceSubtype will be maintained on lua side therefore the last
parameter on the following call is nullptr. Subtype is not displayed on DC at present. */
unsigned int retValue = ud->sd->add_service(*lsd->ldp.change_bits, *lsd->ldp.asd, lsd->ldp.pkt,
- lsd->ldp.dir, AppInfoManager::get_instance().get_appid_by_service_id(service_id),
+ lsd->ldp.dir, ud->get_odp_ctxt().get_app_info_mgr().get_appid_by_service_id(service_id),
vendor, version, nullptr);
lua_pushnumber(L, retValue);
unsigned int productId = lua_tonumber(L, 4);
const char* version = lua_tostring(L, 5);
ud->cd->add_app(*lsd->ldp.pkt, *lsd->ldp.asd, lsd->ldp.dir,
- AppInfoManager::get_instance().get_appid_by_service_id(service_id),
- AppInfoManager::get_instance().get_appid_by_client_id(productId), version,
+ ud->get_odp_ctxt().get_app_info_mgr().get_appid_by_service_id(service_id),
+ ud->get_odp_ctxt().get_app_info_mgr().get_appid_by_client_id(productId), version,
*lsd->ldp.change_bits);
lua_pushnumber(L, 0);
const char* userName = lua_tostring(L, 2);
unsigned int service_id = lua_tonumber(L, 3);
ud->cd->add_user(*lsd->ldp.asd, userName,
- AppInfoManager::get_instance().get_appid_by_service_id(service_id), true);
+ ud->get_odp_ctxt().get_app_info_mgr().get_appid_by_service_id(service_id), true);
lua_pushnumber(L, 0);
return 1;
}
unsigned int payloadId = lua_tonumber(L, 2);
ud->cd->add_payload(*lsd->ldp.asd,
- AppInfoManager::get_instance().get_appid_by_payload_id(payloadId));
+ ud->get_odp_ctxt().get_app_info_mgr().get_appid_by_payload_id(payloadId));
lua_pushnumber(L, 0);
return 1;
}
DHPSequence seq = (DHPSequence)lua_tointeger(L, ++index);
- AppInfoManager& aim = AppInfoManager::get_instance();
+ AppInfoManager& aim = ud->get_odp_ctxt().get_app_info_mgr();
uint32_t service_id = aim.get_appid_by_service_id((uint32_t)lua_tointeger(L, ++index));
uint32_t client_id = aim.get_appid_by_client_id((uint32_t)lua_tointeger(L, ++index));
/*uint32_t client_app_type =*/ lua_tointeger(L, ++index);
return 0;
}
- AppInfoManager::get_instance().set_app_info_active(app_id);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(app_id);
return 0;
}
return 0;
}
- AppInfoManager::get_instance().set_app_info_active(app_id);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(app_id);
return 0;
}
detector.pattern_size = strlen((char*)pattern);
detector.app_id = appId;
HttpPatternMatchers::get_instance()->insert_content_type_pattern(detector);
- AppInfoManager::get_instance().set_app_info_active(appId);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(appId);
return 0;
}
if (init(L))
{
// in control thread, update app info table. app info table is shared across all threads
- AppInfoTableEntry* entry = AppInfoManager::get_instance().get_app_info_entry(app_id);
+ AppInfoTableEntry* entry = ud.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(app_id);
if (entry)
{
if (entry->flags & flag)
return ret;
}
-void check_detector_callback(const Packet& p, AppIdSession& asd, AppidSessionDirection dir, AppId app_id, AppidChangeBits& change_bits, AppInfoTableEntry* entry)
+void check_detector_callback(const Packet& p, AppIdSession& asd, AppidSessionDirection dir,
+ AppId app_id, AppidChangeBits& change_bits, AppInfoTableEntry* entry)
{
if (!entry)
- entry = AppInfoManager::get_instance().get_app_info_entry(app_id);
+ entry = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(app_id);
if (!entry)
return;
}
static int add_chp_pattern_action(AppId appIdInstance, int isKeyPattern, HttpFieldIds patternType,
- size_t patternSize, char* patternData, ActionType actionType, char* optionalActionData)
+ size_t patternSize, char* patternData, ActionType actionType, char* optionalActionData,
+ AppInfoManager& app_info_mgr)
{
//find the CHP App for this
auto chp_entry = CHP_glossary->find(appIdInstance);
}
CHPApp* chpapp = chp_entry->second;
- AppInfoManager& app_info_mgr = AppInfoManager::get_instance();
if (isKeyPattern)
{
}
return add_chp_pattern_action(appIdInstance, key_pattern, ptype, psize, pattern,
- action, action_data);
+ action, action_data, ud->get_odp_ctxt().get_app_info_mgr());
}
static int detector_create_chp_multi_application(lua_State* L)
}
return add_chp_pattern_action(appIdInstance, key_pattern, ptype, psize, pattern,
- action, action_data);
+ action, action_data, ud->get_odp_ctxt().get_app_info_mgr());
}
static int detector_port_only_service(lua_State* L)
else if (protocol == 17)
AppIdContext::udp_port_only[port] = appId;
- AppInfoManager::get_instance().set_app_info_active(appId);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(appId);
return 0;
}
query_pattern = (uint8_t*)snort_strdup(tmp_string);
uint32_t appId = lua_tointeger(L, ++index);
- AppInfoManager& app_info_manager = AppInfoManager::get_instance();
+ AppInfoManager& app_info_manager = ud->get_odp_ctxt().get_app_info_mgr();
DetectorAppUrlPattern* pattern =
(DetectorAppUrlPattern*)snort_calloc(sizeof(DetectorAppUrlPattern));
pattern->userData.service_id = app_info_manager.get_appid_by_service_id(service_id);
pattern->patterns.scheme.patternSize = (int)schemePatternSize;
HttpPatternMatchers::get_instance()->insert_rtmp_url_pattern(pattern);
- AppInfoManager& app_info_manager = AppInfoManager::get_instance();
+ AppInfoManager& app_info_manager = ud->get_odp_ctxt().get_app_info_mgr();
app_info_manager.set_app_info_active(pattern->userData.service_id);
app_info_manager.set_app_info_active(pattern->userData.client_id);
app_info_manager.set_app_info_active(pattern->userData.payload_id);
SipUdpClientDetector::sipUaPatternAdd(client_app, clientVersion, uaPattern);
- AppInfoManager::get_instance().set_app_info_active(client_app);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(client_app);
return 0;
}
if (control)
{
- AppInfoTableEntry* entry = AppInfoManager::get_instance().add_dynamic_app_entry(tmp_string);
+ AppInfoTableEntry* entry = ud->get_odp_ctxt().get_app_info_mgr().add_dynamic_app_entry(tmp_string);
appId = entry->appId;
AppIdPegCounts::add_app_peg_info(tmp_string, appId);
}
else
- appId = AppInfoManager::get_instance().get_appid_by_name(tmp_string);
+ appId = ud->get_odp_ctxt().get_app_info_mgr().get_appid_by_name(tmp_string);
lua_pushnumber(L, appId);
return 1; /*number of results */
payload_id, APP_ID_NONE) )
{
HttpPatternMatchers::get_instance()->insert_http_pattern(pat_type, pattern);
- AppInfoManager& app_info_manager = AppInfoManager::get_instance();
+ AppInfoManager& app_info_manager = ud->get_odp_ctxt().get_app_info_mgr();
app_info_manager.set_app_info_active(service_id);
app_info_manager.set_app_info_active(client_id);
app_info_manager.set_app_info_active(payload_id);
pattern->patterns.scheme.patternSize = (int)schemePatternSize;
HttpPatternMatchers::get_instance()->insert_app_url_pattern(pattern);
- AppInfoManager& app_info_manager = AppInfoManager::get_instance();
+ AppInfoManager& app_info_manager = ud->get_odp_ctxt().get_app_info_mgr();
app_info_manager.set_app_info_active(service_id);
app_info_manager.set_app_info_active(clientAppId);
app_info_manager.set_app_info_active(payload_id);
pPattern->detectorName = snort_strdup(ud->get_detector()->get_name().c_str());
PatternClientDetector::insert_client_port_pattern(pPattern);
- AppInfoManager::get_instance().set_app_info_active(appId);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(appId);
return 0;
}
pPattern->offset = position;
pPattern->detectorName = snort_strdup(ud->get_detector()->get_name().c_str());
PatternServiceDetector::insert_service_port_pattern(pPattern);
- AppInfoManager::get_instance().set_app_info_active(appId);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(appId);
return 0;
}
}
SipUdpClientDetector::sipServerPatternAdd(client_app, clientVersion, uaPattern);
- AppInfoManager::get_instance().set_app_info_active(client_app);
+ ud->get_odp_ctxt().get_app_info_mgr().set_app_info_active(client_app);
return 0;
}
AppId app_id_to_snort = lua_tointeger(L, 10);
if (app_id_to_snort > APP_ID_NONE)
{
- AppInfoTableEntry* entry = AppInfoManager::get_instance().get_app_info_entry(
+ AppInfoTableEntry* entry = ud->get_odp_ctxt().get_app_info_mgr().get_app_info_entry(
app_id_to_snort);
if (!entry)
return 0;
APPID_EARLY_SESSION_FLAG_FW_RULE);
if (fp)
{
- fp->service.set_id(service_id);
+ fp->service.set_id(service_id, ud->get_odp_ctxt());
fp->client.set_id(client_id);
fp->payload.set_id(payload_id);
fp->set_session_flags(APPID_SESSION_SERVICE_DETECTED | APPID_SESSION_NOT_A_SERVICE |
lua_pop(L, 1);
}
-static lua_State* create_lua_state(const AppIdConfig* config, int is_control)
+static lua_State* create_lua_state(const AppIdConfig& config, int is_control)
{
auto L = luaL_newstate();
{
snprintf(new_lua_path, sizeof(new_lua_path) - 1,
"%s;%s/odp/libs/?.lua;%s/custom/libs/?.lua",
- cur_lua_path, config->app_detector_dir, config->app_detector_dir);
+ cur_lua_path, config.app_detector_dir, config.app_detector_dir);
}
else
{
snprintf(new_lua_path, sizeof(new_lua_path) - 1, "%s/odp/libs/?.lua;%s/custom/libs/?.lua",
- config->app_detector_dir, config->app_detector_dir);
+ config.app_detector_dir, config.app_detector_dir);
}
lua_pop(L, 1);
lua_detector_mgr->initialize_lua_detectors();
lua_detector_mgr->activate_lua_detectors();
- if (ctxt.config->debug)
+ if (ctxt.config.debug)
lua_detector_mgr->list_lua_detectors();
}
void LuaDetectorManager::initialize_lua_detectors()
{
char path[PATH_MAX];
- const char* dir = ctxt.config->app_detector_dir;
+ const char* dir = ctxt.config.app_detector_dir;
if ( !dir )
return;
client = false;
}
-void ServiceDetector::register_appid(AppId appId, unsigned extractsInfo)
+void ServiceDetector::register_appid(AppId appId, unsigned extractsInfo, OdpContext& odp_ctxt)
{
- AppInfoTableEntry* pEntry = AppInfoManager::get_instance().get_app_info_entry(appId);
+ AppInfoTableEntry* pEntry = odp_ctxt.get_app_info_mgr().get_app_info_entry(appId);
if (!pEntry)
{
- if ( AppInfoManager::get_instance().configured() )
+ if ( odp_ctxt.get_app_info_mgr().configured() )
{
ParseWarning(WARN_RULES,
"appid: no entry for %d in appMapping.data; no rule support for this ID.",
asd.service.set_vendor(vendor);
asd.service.set_version(version, change_bits);
asd.set_service_detected();
- asd.service.set_id(appId);
+ asd.service.set_id(appId, asd.ctxt.get_odp_ctxt());
if (asd.get_session_flags(APPID_SESSION_IGNORE_HOST))
return APPID_SUCCESS;
void do_custom_init() override { }
void release_thread_resources() override { }
- void register_appid(AppId, unsigned extractsInfo) override;
+ void register_appid(AppId, unsigned extractsInfo, OdpContext& odp_ctxt) override;
int service_inprocess(AppIdSession&, const snort::Packet*, AppidSessionDirection dir);
{
// Third party has positively identified appId; Dig deeper only if our
// detector identifies additional information or flow is UDP reversed.
- AppInfoTableEntry* entry = asd.app_info_mgr->get_app_info_entry(tp_app_id);
+ AppInfoTableEntry* entry = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(tp_app_id);
if ( entry && entry->service_detector &&
( ( entry->flags & APPINFO_FLAG_SERVICE_ADDITIONAL ) ||
( ( entry->flags & APPINFO_FLAG_SERVICE_UDP_REVERSED ) &&
!asd.get_session_flags(APPID_SESSION_NO_TPI) and
asd.is_tp_appid_available() )
{
- AppInfoTableEntry* entry = asd.app_info_mgr->get_app_info_entry(tp_app_id);
+ AppInfoTableEntry* entry = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_entry(tp_app_id);
if ( entry && entry->service_detector &&
!(entry->flags & APPINFO_FLAG_SERVICE_ADDITIONAL) )
{
// job of it than we do, so stay out of its way, and don't
// waste time (but we will still get the Snort callbacks
// for any of our own future flows). Shut down our detectors.
- asd.service.set_id(APP_ID_SIP);
+ asd.service.set_id(APP_ID_SIP, asd.ctxt.get_odp_ctxt());
asd.stop_rna_service_inspection(p, direction);
asd.service_disco_state = APPID_DISCO_STATE_FINISHED;
}
{
// No need for anybody to keep wasting time once we've
// found RTP - Shut down our detectors.
- asd.service.set_id(tp_app_id);
+ asd.service.set_id(tp_app_id, asd.ctxt.get_odp_ctxt());
asd.stop_rna_service_inspection(p, direction);
asd.service_disco_state = APPID_DISCO_STATE_FINISHED;
// - Shut down TP.
}
AppIdDnsSession* dsession = asd.get_dns_session();
- if (asd.service.get_id() == APP_ID_DNS && asd.ctxt->get_odp_ctxt().dns_host_reporting
+ if (asd.service.get_id() == APP_ID_DNS && asd.ctxt.get_odp_ctxt().dns_host_reporting
&& dsession->get_host())
{
AppId client_id = APP_ID_NONE;
asd.set_service_detected();
asd.clear_session_flags(APPID_SESSION_CONTINUE);
- asd.service.set_id(APP_ID_NONE);
+ asd.service.set_id(APP_ID_NONE, asd.ctxt.get_odp_ctxt());
if ( asd.get_session_flags(APPID_SESSION_IGNORE_HOST | APPID_SESSION_UDP_REVERSED) )
return APPID_SUCCESS;
if ( !asd.service_detector && !asd.service_candidates.empty() )
return APPID_SUCCESS;
- asd.service.set_id(APP_ID_NONE);
+ asd.service.set_id(APP_ID_NONE, asd.ctxt.get_odp_ctxt());
asd.set_service_detected();
asd.clear_session_flags(APPID_SESSION_CONTINUE);
uint64_t encrypted_flags = asd.get_session_flags(APPID_SESSION_ENCRYPTED | APPID_SESSION_DECRYPTED);
if (encrypted_flags == APPID_SESSION_ENCRYPTED)
{
- fp->service.set_id(APP_ID_FTPSDATA);
+ fp->service.set_id(APP_ID_FTPSDATA, asd.ctxt.get_odp_ctxt());
}
else
{
encrypted_flags = 0; // reset (APPID_SESSION_ENCRYPTED | APPID_SESSION_DECRYPTED) bits
- fp->service.set_id(APP_ID_FTP_DATA);
+ fp->service.set_id(APP_ID_FTP_DATA, asd.ctxt.get_odp_ctxt());
}
initialize_expected_session(asd, *fp, APPID_SESSION_IGNORE_ID_FLAGS | encrypted_flags, dir);
ret_val = validate_reply(args.data, args.size);
if (ret_val == 1)
{
- if (args.ctxt->get_odp_ctxt().mdns_user_reporting)
+ if (args.ctxt.get_odp_ctxt().mdns_user_reporting)
{
analyze_user(args.asd, args.pkt, args.size);
destroy_match_list();
}
/* Give up if it's taking us too long to figure out this thing. */
- if (args.asd.session_packet_count >= args.asd.ctxt->get_odp_ctxt().rtmp_max_packets)
+ if (args.asd.session_packet_count >= args.asd.ctxt.get_odp_ctxt().rtmp_max_packets)
{
goto fail;
}
if ( ss->pageUrl )
{
if ( !hsession->get_field(REQ_REFERER_FID) &&
- !args.asd.ctxt->get_odp_ctxt().referred_appId_disabled )
+ !args.asd.ctxt.get_odp_ctxt().referred_appId_disabled )
hsession->set_field(REQ_REFERER_FID, new std::string(ss->pageUrl), args.change_bits);
snort_free(ss->pageUrl);
{
args.asd.set_session_flags(APPID_SESSION_SERVICE_DETECTED | APPID_SESSION_NOT_A_SERVICE);
args.asd.clear_session_flags(APPID_SESSION_CONTINUE);
- args.asd.service.set_id(APP_ID_SNMP);
+ args.asd.service.set_id(APP_ID_SNMP, args.asd.ctxt.get_odp_ctxt());
break;
}
sd->state = SNMP_STATE_RESPONSE;
ssl_patterns_free(&service_ssl_config.DetectorSSLCnamePatternList);
}
-bool setSSLSquelch(Packet* p, int type, AppId appId)
+bool setSSLSquelch(Packet* p, int type, AppId appId, OdpContext& odp_ctxt)
{
- if (!AppInfoManager::get_instance().get_app_info_flags(appId, APPINFO_FLAG_SSL_SQUELCH))
+ if (!odp_ctxt.get_app_info_mgr().get_app_info_flags(appId, APPINFO_FLAG_SSL_SQUELCH))
return false;
const SfIp* dip = p->ptrs.ip_api.get_dst();
#include "service_detector.h"
+class OdpContext;
class ServiceDiscovery;
class SslServiceDetector : public ServiceDetector
int ssl_add_cert_pattern(uint8_t*, size_t, uint8_t, AppId);
int ssl_add_cname_pattern(uint8_t*, size_t, uint8_t, AppId);
void ssl_detector_free_patterns();
-bool setSSLSquelch(snort::Packet*, int type, AppId);
+bool setSSLSquelch(snort::Packet*, int type, AppId, OdpContext&);
#endif
TEST(appid_api, get_application_name)
{
- const char* app_name = appid_api.get_application_name(1066);
+ AppIdConfig config;
+ AppIdContext ctxt(config);
+ const char* app_name = appid_api.get_application_name(1066, ctxt);
STRCMP_EQUAL(app_name, test_app_name);
}
TEST(appid_api, get_application_id)
{
- AppId id = appid_api.get_application_id(test_app_name);
+ AppIdConfig config;
+ AppIdContext ctxt(config);
+ AppId id = appid_api.get_application_id(test_app_name, ctxt);
CHECK_EQUAL(id, 1492);
}
AppIdInspector() = default;
};
+AppIdConfig::~AppIdConfig() { }
+
+AppIdConfig stub_config;
+AppIdContext stub_ctxt(stub_config);
AppIdSession::AppIdSession(IpProtocol, const SfIp*, uint16_t, AppIdInspector&)
- : FlowData(0) { }
+ : FlowData(0), ctxt(stub_ctxt) { }
AppIdSession::~AppIdSession() = default;
// Utility functions
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+snort::Inspector* snort::InspectorManager::get_inspector(char const*, bool, snort::SnortConfig*) { }
void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
void AppIdHttpSession::set_http_change_bits(AppidChangeBits&, HttpFieldIds) {}
void do_custom_init() override { }
int validate(AppIdDiscoveryArgs&) override { return 0; }
- void register_appid(AppId, unsigned) override { }
+ void register_appid(AppId, unsigned, OdpContext&) override { }
void release_thread_resources() override { }
};
ProfileStats* AppIdModule::get_profile() const { return nullptr; }
// Stubs for config
-AppIdConfig::~AppIdConfig() {}
static AppIdConfig app_config;
-static AppIdContext app_ctxt(&app_config);
-static OdpContext odpctxt;
-OdpContext* AppIdContext::odp_ctxt = &odpctxt;
+static AppIdContext app_ctxt(app_config);
AppId AppIdContext::get_port_service_id(IpProtocol, uint16_t)
{
return APP_ID_NONE;
}
// Stubs for AppIdInspector
-AppIdInspector::AppIdInspector(AppIdModule&) {}
+AppIdInspector::AppIdInspector(AppIdModule&) { ctxt = &stub_ctxt; }
AppIdInspector::~AppIdInspector() = default;
void AppIdInspector::eval(Packet*) { }
bool AppIdInspector::configure(SnortConfig*) { return true; }
void AppIdInspector::show(SnortConfig*) { }
void AppIdInspector::tinit() { }
void AppIdInspector::tterm() { }
-AppIdContext* AppIdInspector::get_ctxt()
+AppIdContext& AppIdInspector::get_ctxt() const
{
- app_ctxt.config = &app_config;
- return &app_ctxt;
+ assert(ctxt);
+ return *ctxt;
}
// Stubs for AppInfoManager
Flow* flow = new Flow;
flow->set_flow_data(asd);
p.flow = flow;
- asd->ctxt = &app_ctxt;
asd->common.initiator_port = 21;
asd->common.initiator_ip.set("1.2.3.4");
asd->set_session_flags(APPID_SESSION_IGNORE_FLOW);
Flow* flow = new Flow;
flow->set_flow_data(asd);
p.flow = flow;
- asd->ctxt = &app_ctxt;
asd->common.initiator_port = 21;
asd->common.initiator_ip.set("1.2.3.4");
flow->set_flow_data(asd);
p.flow = flow;
p.ptrs.tcph = nullptr;
- asd->ctxt = &app_ctxt;
asd->common.initiator_port = 21;
asd->common.initiator_ip.set("1.2.3.4");
asd->misc_app_id = APP_ID_NONE;
asd->payload.set_id(APP_ID_NONE);
asd->client.set_id(APP_ID_CURL);
- asd->service.set_id(APP_ID_FTP);
+ asd->service.set_id(APP_ID_FTP, app_ctxt.get_odp_ctxt());
AppIdDiscovery::do_application_discovery(&p, ins, nullptr);
asd->misc_app_id = APP_ID_NONE;
asd->payload.set_id(APP_ID_NONE);
asd->client.set_id(APP_ID_NONE);
- asd->service.set_id(APP_ID_DNS);
+ asd->service.set_id(APP_ID_DNS, app_ctxt.get_odp_ctxt());
AppIdDiscovery::do_application_discovery(&p, ins, nullptr);
// Detect event for DNS service
#include <CppUTest/CommandLineTestRunner.h>
#include <CppUTest/TestHarness.h>
+snort::Inspector* snort::InspectorManager::get_inspector(char const*, bool, snort::SnortConfig*) { return nullptr; }
+
void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
void AppIdHttpSession::set_http_change_bits(AppidChangeBits&, HttpFieldIds) {}
#include "service_inspectors/http_inspect/http_msg_header.h"
#include "tp_appid_module_api.h"
#include "tp_appid_session_api.h"
+#include "appid_config.h"
#include "appid_http_session.h"
#include "appid_module.h"
}
bool HttpPatternMatchers::get_appid_from_url(char*, const char*, char**,
- const char*, AppId*, AppId*, AppId*, AppId* referredPayloadAppId, bool)
+ const char*, AppId*, AppId*, AppId*, AppId* referredPayloadAppId, bool, OdpContext&)
{
*referredPayloadAppId = APP_ID_FACEBOOK;
return true;
}
+static AppIdConfig stub_config;
+static AppIdContext stub_ctxt(stub_config);
+static OdpContext stub_odp_ctxt(stub_config, nullptr);
+OdpContext* AppIdContext::odp_ctxt = &stub_odp_ctxt;
+
// AppIdSession mock functions
AppIdSession::AppIdSession(IpProtocol, const SfIp*, uint16_t, AppIdInspector& inspector)
- : FlowData(inspector_id, &inspector)
+ : FlowData(inspector_id, &inspector), ctxt(stub_ctxt)
{
}
MemoryContext::MemoryContext(MemoryTracker&) { }
MemoryContext::~MemoryContext() { }
+OdpContext::OdpContext(AppIdConfig&, snort::SnortConfig*) { }
+AppIdConfig::~AppIdConfig() { }
+
unsigned AppIdSession::inspector_id = 0;
THREAD_LOCAL AppIdDebug* appidDebug = nullptr;
// Testing set_referred_payload_app_id_data
AppidChangeBits change_bits;
AppIdPegCounts::init_pegs();
- session.service.set_id(APP_ID_HTTP);
+ AppIdConfig config;
+ OdpContext odp_ctxt(config, nullptr);
+ session.service.set_id(APP_ID_HTTP, odp_ctxt);
session.scan_flags |= SCAN_HTTP_HOST_URL_FLAG;
hsession.set_skip_simple_detect(false);
hsession.set_field( (HttpFieldIds)2, new std::string("referer"), change_bits );
#ifndef APPID_MOCK_INSPECTOR_H
#define APPID_MOCK_INSPECTOR_H
+#include "appid_inspector.h"
+
typedef uint64_t Trace;
class Value;
PegCount* AppIdModule::get_counts() const { return nullptr; }
snort::ProfileStats* AppIdModule::get_profile() const { return nullptr; }
-class AppIdInspector : public snort::Inspector
-{
-public:
- AppIdInspector(AppIdModule& ) { }
- ~AppIdInspector() override = default;
- void eval(snort::Packet*) override { }
- bool configure(snort::SnortConfig*) override { return true; }
- void show(snort::SnortConfig*) override { }
- void tinit() override { }
- void tterm() override { }
-};
+AppIdInspector::AppIdInspector(AppIdModule& ) { }
+AppIdInspector::~AppIdInspector() { }
+void AppIdInspector::eval(snort::Packet*) { }
+bool AppIdInspector::configure(snort::SnortConfig*) { return true; }
+void AppIdInspector::show(snort::SnortConfig*) { }
+void AppIdInspector::tinit() { }
+void AppIdInspector::tterm() { }
+AppIdContext& AppIdInspector::get_ctxt() const { return *ctxt; }
AppIdModule appid_mod;
AppIdInspector appid_inspector( appid_mod );
}
};
+AppIdConfig::~AppIdConfig() { }
+OdpContext::OdpContext(AppIdConfig&, snort::SnortConfig*) { }
+
+static AppIdConfig stub_config;
+static AppIdContext stub_ctxt(stub_config);
+static OdpContext stub_odp_ctxt(stub_config, nullptr);
+OdpContext* AppIdContext::odp_ctxt = &stub_odp_ctxt;
AppIdSession::AppIdSession(IpProtocol proto, const SfIp*, uint16_t, AppIdInspector& inspector)
- : FlowData(inspector_id, &inspector), protocol(proto)
+ : FlowData(inspector_id, &inspector), ctxt(stub_ctxt), protocol(proto)
{
common.flow_type = APPID_FLOW_TYPE_NORMAL;
service_port = APPID_UT_SERVICE_PORT;
dsession = new MockAppIdDnsSession;
tp_app_id = APPID_UT_ID;
- service.set_id(APPID_UT_ID + 1);
+ service.set_id(APPID_UT_ID + 1, ctxt.get_odp_ctxt());
client_inferred_service_id = APPID_UT_ID + 2;
service.set_port_service_id(APPID_UT_ID + 3);
payload.set_id(APPID_UT_ID + 4);
#include <CppUTest/TestHarness.h>
void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+
void BootpServiceDetector::AppIdFreeDhcpData(DHCPData* data)
{
delete data;
AppIdSession* mock_session = nullptr;
AppIdSessionApi* appid_session_api = nullptr;
-static OdpContext odpctxt;
-OdpContext* AppIdContext::odp_ctxt = &odpctxt;
+static AppIdConfig config;
+static OdpContext odpctxt(config, nullptr);
TEST_GROUP(appid_session_api)
{
// 4th if in is_appid_inspecting_session
mock_session->set_tp_app_id(APP_ID_NONE);
- mock_session->ctxt->get_odp_ctxt().check_host_port_app_cache = true;
+ mock_session->ctxt.get_odp_ctxt().check_host_port_app_cache = true;
val = appid_session_api->is_appid_inspecting_session();
CHECK_TRUE(val);
}
{
mock_init_appid_pegs();
mock_session = new AppIdSession(IpProtocol::TCP, nullptr, 1492, appid_inspector);
- AppIdConfig *config = new AppIdConfig();
- mock_session->ctxt = new AppIdContext(config);
int rc = CommandLineTestRunner::RunAllTests(argc, argv);
mock_cleanup_appid_pegs();
return rc;
void AppIdDebug::activate(const Flow*, const AppIdSession*, bool) { active = true; }
void ApplicationDescriptor::set_id(const Packet&, AppIdSession&, AppidSessionDirection, AppId, AppidChangeBits&) { }
+AppIdConfig::~AppIdConfig() { }
+AppIdConfig stub_config;
+AppIdContext stub_ctxt(stub_config);
AppIdSession::AppIdSession(IpProtocol, const SfIp*, uint16_t, AppIdInspector&)
- : FlowData(0) {}
+ : FlowData(0), ctxt(stub_ctxt) {}
AppIdSession::~AppIdSession() = default;
AppIdDiscovery::AppIdDiscovery() {}
AppIdDiscovery::~AppIdDiscovery() {}
static TPLibHandler* tph = nullptr;
static AppIdConfig config;
-static AppIdContext ctxt(&config);
-static OdpContext odpctxt;
-OdpContext* AppIdContext::odp_ctxt = &odpctxt;
+static AppIdContext ctxt(config);
+static OdpContext stub_odp_ctxt(config, nullptr);
+OdpContext* AppIdContext::odp_ctxt = &stub_odp_ctxt;
ThirdPartyAppIdContext* AppIdContext::tp_appid_ctxt = nullptr;
AppIdConfig::~AppIdConfig() { }
+OdpContext::OdpContext(AppIdConfig&, snort::SnortConfig*) { }
TEST_GROUP(tp_lib_handler)
{
{
SO_PUBLIC ThirdPartyAppIdContextImpl* tp_appid_create_ctxt(ThirdPartyConfig& config)
{
- return new ThirdPartyAppIdContextImpl(3,"foobar", config);
+ return new ThirdPartyAppIdContextImpl(THIRD_PARTY_APPID_API_VERSION,"foobar", config);
}
SO_PUBLIC ThirdPartyAppIdSessionImpl* tp_appid_create_session(ThirdPartyAppIdContext& ctxt)
#include <string>
#include "tp_appid_types.h"
-#define THIRD_PARTY_APP_ID_API_VERSION 3
+#define THIRD_PARTY_APPID_API_VERSION 4
class ThirdPartyConfig
{
virtual void set_attr(TPSessionAttr) = 0;
virtual unsigned get_attr(TPSessionAttr) = 0;
virtual AppId get_appid(int& conf) { conf=confidence; return appid; }
- virtual const ThirdPartyAppIdContext* get_ctxt() const
- { return &ctxt; }
+ virtual const ThirdPartyAppIdContext& get_ctxt() const
+ { return ctxt; }
protected:
AppId appid;
!asd.get_session_flags(APPID_SESSION_NO_TPI) and asd.is_tp_appid_done() and p->dsize;
}
-static inline int check_ssl_appid_for_reinspect(AppId app_id)
+static inline int check_ssl_appid_for_reinspect(AppId app_id, OdpContext& odp_ctxt)
{
if (app_id <= SF_APPID_MAX &&
(app_id == APP_ID_SSL ||
- AppInfoManager::get_instance().get_app_info_flags(app_id,
- APPINFO_FLAG_SSL_INSPECT)))
+ odp_ctxt.get_app_info_mgr().get_app_info_flags(app_id,
+ APPINFO_FLAG_SSL_INSPECT)))
return 1;
else
return 0;
LogMessage("AppIdDbg %s HTTP response upgrade is %s\n",
appidDebug->get_debug_session(),field->c_str());
- if (asd.ctxt->get_odp_ctxt().http2_detection_enabled)
+ if (asd.ctxt.get_odp_ctxt().http2_detection_enabled)
{
const std::string* rc = hsession->get_field(MISC_RESP_CODE_FID);
if ( rc && *rc == "101" )
}
}
- if ( !asd.ctxt->get_odp_ctxt().referred_appId_disabled &&
+ if ( !asd.ctxt.get_odp_ctxt().referred_appId_disabled &&
!hsession->get_field(REQ_REFERER_FID) )
{
if ( ( field=attribute_data.http_request_referer(own) ) != nullptr )
}
if ( hsession->get_field(MISC_URL_FID) || (confidence == 100 &&
- asd.session_packet_count > asd.ctxt->get_odp_ctxt().rtmp_max_packets) )
+ asd.session_packet_count > asd.ctxt.get_odp_ctxt().rtmp_max_packets) )
{
const std::string* url;
if ( ( url = hsession->get_field(MISC_URL_FID) ) != nullptr )
const char* referer = hsession->get_cfield(REQ_REFERER_FID);
if ( ( ( http_matchers->get_appid_from_url(nullptr, url->c_str(),
nullptr, referer, &client_id, &service_id,
- &payload_id, &referred_payload_app_id, 1) )
+ &payload_id, &referred_payload_app_id, true, asd.ctxt.get_odp_ctxt()) )
||
( http_matchers->get_appid_from_url(nullptr, url->c_str(),
nullptr, referer, &client_id, &service_id,
- &payload_id, &referred_payload_app_id, 0) ) ) == 1 )
+ &payload_id, &referred_payload_app_id, false, asd.ctxt.get_odp_ctxt()) ) ) == 1 )
{
// do not overwrite a previously-set client or service
if ( client_id <= APP_ID_NONE )
if (!asd.client.get_id())
asd.set_client_appid_data(APP_ID_SSL_CLIENT, change_bits);
- reinspect_ssl_appid = check_ssl_appid_for_reinspect(tmpAppId);
+ reinspect_ssl_appid = check_ssl_appid_for_reinspect(tmpAppId, asd.ctxt.get_odp_ctxt());
if ((field=attribute_data.tls_host(false)) != nullptr)
{
ThirdPartyAppIDAttributeData& attribute_data)
{
const string* field=0;
- if (!asd.ctxt->get_odp_ctxt().ftp_userid_disabled &&
+ if (!asd.ctxt.get_odp_ctxt().ftp_userid_disabled &&
(field=attribute_data.ftp_command_user()) != nullptr)
{
asd.client.update_user(APP_ID_FTP_CONTROL, field->c_str());
{
AppIdHttpSession* hsession = asd.get_http_session();
- if ((tpPktCount >= asd.ctxt->get_odp_ctxt().max_tp_flow_depth) ||
+ if ((tpPktCount >= asd.ctxt.get_odp_ctxt().max_tp_flow_depth) ||
(asd.get_session_flags(APPID_SESSION_HTTP_SESSION | APPID_SESSION_APP_REINSPECT) ==
(APPID_SESSION_HTTP_SESSION | APPID_SESSION_APP_REINSPECT) &&
hsession->get_field(REQ_URI_FID) &&
/*** Start of third-party processing. ***/
bool isTpAppidDiscoveryDone = false;
- if (p->dsize || asd.ctxt->get_odp_ctxt().tp_allow_probes)
+ if (p->dsize || asd.ctxt.get_odp_ctxt().tp_allow_probes)
{
//restart inspection by 3rd party
if (!asd.tp_reinspect_by_initiator && (direction == APP_ID_FROM_INITIATOR) &&
if (!asd.is_tp_processing_done())
{
if (protocol != IpProtocol::TCP || (p->packet_flags & PKT_STREAM_ORDER_OK)
- || asd.ctxt->get_odp_ctxt().tp_allow_probes)
+ || asd.ctxt.get_odp_ctxt().tp_allow_probes)
{
int tp_confidence;
ThirdPartyAppIDAttributeData tp_attribute_data;
if (appidDebug->is_active())
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(tp_app_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(tp_app_id);
LogMessage("AppIdDbg %s 3rd party returned %s (%d)\n",
appidDebug->get_debug_session(),
app_name ? app_name : "unknown",
asd.is_http2 = true;
}
// if the third-party appId must be treated as a client, do it now
- unsigned app_info_flags = asd.app_info_mgr->get_app_info_flags(tp_app_id,
+ unsigned app_info_flags = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_info_flags(tp_app_id,
APPINFO_FLAG_TP_CLIENT | APPINFO_FLAG_IGNORE | APPINFO_FLAG_SSL_SQUELCH);
if ( app_info_flags & APPINFO_FLAG_TP_CLIENT )
asd.get_session_flags(APPID_SESSION_SSL_SESSION) and
!(asd.scan_flags & SCAN_SSL_HOST_FLAG))
{
- setSSLSquelch(p, 1, tp_app_id);
+ setSSLSquelch(p, 1, tp_app_id, asd.ctxt.get_odp_ctxt());
}
if ( app_info_flags & APPINFO_FLAG_IGNORE )
asd.service.set_port_service_id(portAppId);
if (appidDebug->is_active())
{
- const char *service_name = AppInfoManager::get_instance().get_app_name(tp_app_id);
- const char *port_service_name = AppInfoManager::get_instance().get_app_name(asd.service.get_port_service_id());
+ const char *service_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(tp_app_id);
+ const char *port_service_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(asd.service.get_port_service_id());
LogMessage("AppIdDbg %s SSL is service %s (%d), portServiceAppId %s (%d)\n",
appidDebug->get_debug_session(),
service_name ? service_name : "unknown", tp_app_id,
tp_app_id = portAppId;
if (appidDebug->is_active())
{
- const char *app_name = AppInfoManager::get_instance().get_app_name(tp_app_id);
+ const char *app_name = asd.ctxt.get_odp_ctxt().get_app_info_mgr().get_app_name(tp_app_id);
LogMessage("AppIdDbg %s SSL is %s (%d)\n", appidDebug->get_debug_session(),
app_name ? app_name : "unknown", tp_app_id);
}
return nullptr;
}
- if ( (tp_appid_ctxt->api_version() != THIRD_PARTY_APP_ID_API_VERSION)
+ if ( (tp_appid_ctxt->api_version() != THIRD_PARTY_APPID_API_VERSION)
|| (tp_appid_ctxt->module_name().empty()) )
{
ErrorMessage("Ignoring incomplete 3rd party AppID module (%s, %u, %s)!\n",
projects / thirdparty / snort3.git / commitdiff
