Merge pull request #709 in SNORT/snort3 from appid_service_ssl_mem_leak to master

Squashed commit of the following:

commit b3d4cd751ea4eebccaad578bbe6b7fb11349e47d
Author: davis mcpherson <davmcphe.cisco.com>
Date:   Mon Nov 21 11:12:22 2016 -0500

    check length field for ptr fields in SIPMsg struct and only access pointer if length > 0

commit 66fdd94c199fe4bb7e34eeaf105e831b9e87dc6e
Author: davis mcpherson <davmcphe.cisco.com>
Date:   Thu Nov 17 10:38:34 2016 -0500

    initialize service element objects when instantiated to ensure no access of uninitialized memory
    make detector types an enum, set detector type properly for pattern & port service elements
    use memcpy instead of strndup to copy http header from event message
    initialize tcp/udp port service vectors to APP_ID_NONE, use c++11 member variable initialization syntax

diff --git a/src/network_inspectors/appid/appid_config.cc b/src/network_inspectors/appid/appid_config.cc
index 6bc0ab315da4a2d082fdf1d70d902f9c8538f0f6..5fa28a22b428171bda1481c50fb1a9feca9f66d2 100644 (file)
--- a/src/network_inspectors/appid/appid_config.cc
+++ b/src/network_inspectors/appid/appid_config.cc
@@ -67,7 +67,25 @@ AppIdModuleConfig::~AppIdModuleConfig()
 AppIdConfig::AppIdConfig( AppIdModuleConfig* config )
      : mod_config( config ), app_info_mgr(AppInfoManager::get_instance())
 {
+    for( unsigned i = 0; i < MAX_ZONES; i++ )
+        net_list_by_zone[ i ] = nullptr;
 
+    for( unsigned i = 0; i < 65535; i++ )
+    {
+        tcp_port_only[ i ] = APP_ID_NONE;
+        udp_port_only[ i ] = APP_ID_NONE;
+    }
+
+    for( unsigned i = 0; i < 255; i++ )
+        ip_protocol[ i ] = APP_ID_NONE;
+
+    for( unsigned i = 0; i < APP_ID_PORT_ARRAY_SIZE; i++ )
+    {
+        tcp_port_exclusions_src[ i ] = nullptr;
+        udp_port_exclusions_src[ i ] = nullptr;
+        tcp_port_exclusions_dst[ i ] = nullptr;
+        udp_port_exclusions_dst[ i ] = nullptr;
+    }
 }
 
 AppIdConfig::~AppIdConfig()
@@ -385,13 +403,12 @@ void AppIdConfig::configure_analysis_networks(char* toklist[], uint32_t flag)
     }
 }
 
-int AppIdConfig::add_port_exclusion(SF_LIST* port_exclusions[], const ip::snort_in6_addr* ip,
+int AppIdConfig::add_port_exclusion(AppIdPortExclusions& port_exclusions, const ip::snort_in6_addr* ip,
     const ip::snort_in6_addr* netmask, int family, uint16_t port)
 {
-    PortExclusion* port_ex;
     SF_LIST* pe_list;
 
-    port_ex = (PortExclusion*)snort_calloc(sizeof(PortExclusion));
+    PortExclusion* port_ex = (PortExclusion*)snort_calloc(sizeof(PortExclusion));
     port_ex->ip = *ip;
     if (family == AF_INET)
     {
@@ -424,7 +441,6 @@ void AppIdConfig::process_port_exclusion(char* toklist[])
     char* p;
     RNAIpAddrSet* ias;
     RNAIpv6AddrSet* ias6;
-    SF_LIST** port_exclusions;
     IpProtocol proto;
     unsigned long dir;
     unsigned long port;
@@ -522,18 +538,17 @@ void AppIdConfig::process_port_exclusion(char* toklist[])
     if (dir & 1)
     {
         if (proto == IpProtocol::TCP)
-            port_exclusions = tcp_port_exclusions_src;
+            add_port_exclusion(tcp_port_exclusions_src, &ip, &netmask, family, (uint16_t)port);
         else
-            port_exclusions = udp_port_exclusions_src;
-        add_port_exclusion(port_exclusions, &ip, &netmask, family, (uint16_t)port);
+            add_port_exclusion(udp_port_exclusions_src, &ip, &netmask, family, (uint16_t)port);
     }
+
     if (dir & 2)
     {
         if (proto == IpProtocol::TCP)
-            port_exclusions = tcp_port_exclusions_dst;
+            add_port_exclusion(tcp_port_exclusions_dst, &ip, &netmask, family, (uint16_t)port);
         else
-            port_exclusions = udp_port_exclusions_dst;
-        add_port_exclusion(port_exclusions, &ip, &netmask, family, (uint16_t)port);
+            add_port_exclusion(udp_port_exclusions_dst, &ip, &netmask, family, (uint16_t)port);
     }
 }
 
@@ -711,7 +726,7 @@ static void free_config_items(AppidConfigElement* ci)
     }
 }
 
-static void free_port_exclusion_list( SF_LIST** pe_list )
+static void free_port_exclusion_list( AppIdPortExclusions& pe_list )
 {
     for ( unsigned i = 0; i < APP_ID_PORT_ARRAY_SIZE; i++ )
     {
@@ -744,7 +759,6 @@ void AppIdConfig::cleanup()
     free_port_exclusion_list(udp_port_exclusions_src);
     free_port_exclusion_list(udp_port_exclusions_dst);
 
-    memset(net_list_by_zone, 0, sizeof(net_list_by_zone));
     sflist_static_free_all(&client_app_args, (void (*)(void*))free_config_items);
 }
 

diff --git a/src/network_inspectors/appid/appid_config.h b/src/network_inspectors/appid/appid_config.h
index ab015ecc934e83d4f03e9086f53b607bb72bd36a..aa288698da58befa80d538e036fabb750d789f82 100644 (file)
--- a/src/network_inspectors/appid/appid_config.h
+++ b/src/network_inspectors/appid/appid_config.h
@@ -66,6 +66,12 @@ struct AppidConfigElement
 
 struct AppIdSessionLogFilter
 {
+    AppIdSessionLogFilter()
+    {
+        sip.clear();
+        dip.clear();
+    }
+
     sfip_t sip;
     bool sip_flag = false;
     sfip_t dip;
@@ -120,6 +126,8 @@ enum RnaFwConfigState
     RNA_FW_CONFIG_STATE_PENDING,
 };
 
+typedef std::array<SF_LIST*, APP_ID_PORT_ARRAY_SIZE> AppIdPortExclusions;
+
 class AppIdConfig
 {
 public:
@@ -137,22 +145,22 @@ public:
     unsigned net_list_count = 0;
     NetworkSet* net_list_list = nullptr;
     NetworkSet* net_list = nullptr;
-    NetworkSet* net_list_by_zone[MAX_ZONES] = { nullptr };
-    std::array<AppId, 65535> tcp_port_only;     ///< Service IDs for port-only TCP services
-    std::array<AppId, 65535> udp_port_only;     ///< Service IDs for port-only UDP services
-    AppId ip_protocol[255] = { 0 };         ///< Service IDs for non-TCP / UDP protocol services
+    std::array<NetworkSet*, MAX_ZONES> net_list_by_zone;
+    std::array<AppId, APP_ID_PORT_ARRAY_SIZE> tcp_port_only;     ///< Service IDs for port-only TCP services
+    std::array<AppId, APP_ID_PORT_ARRAY_SIZE> udp_port_only;     ///< Service IDs for port-only UDP services
+    std::array<AppId, 255> ip_protocol;         ///< Service IDs for non-TCP / UDP protocol services
     SF_LIST client_app_args;                ///< List of Client App arguments
     // for each potential port, an sflist of PortExclusion structs
-    SF_LIST* tcp_port_exclusions_src[APP_ID_PORT_ARRAY_SIZE] = { nullptr };
-    SF_LIST* udp_port_exclusions_src[APP_ID_PORT_ARRAY_SIZE] = { nullptr };
-    SF_LIST* tcp_port_exclusions_dst[APP_ID_PORT_ARRAY_SIZE] = { nullptr };
-    SF_LIST* udp_port_exclusions_dst[APP_ID_PORT_ARRAY_SIZE] = { nullptr };
-    AppIdModuleConfig* mod_config;
+    AppIdPortExclusions tcp_port_exclusions_src;
+    AppIdPortExclusions udp_port_exclusions_src;
+    AppIdPortExclusions tcp_port_exclusions_dst;
+    AppIdPortExclusions udp_port_exclusions_dst;
+    AppIdModuleConfig* mod_config = nullptr;
 
 private:
     void read_port_detectors(const char* files);
     void configure_analysis_networks(char* toklist[], uint32_t flag);
-    int add_port_exclusion(SF_LIST* port_exclusions[], const ip::snort_in6_addr* ip,
+    int add_port_exclusion(AppIdPortExclusions& port_exclusions, const ip::snort_in6_addr* ip,
         const ip::snort_in6_addr* netmask, int family, uint16_t port);
     void process_port_exclusion(char* toklist[]);
     void process_config_directive(char* toklist[], int /* reload */);

diff --git a/src/network_inspectors/appid/appid_http_event_handler.cc b/src/network_inspectors/appid/appid_http_event_handler.cc
index cf8cd8bd065816e7f84aa966351dc2a418b8fc62..62911736cf49528b8051544ec564f59ff9be25c9 100644 (file)
--- a/src/network_inspectors/appid/appid_http_event_handler.cc
+++ b/src/network_inspectors/appid/appid_http_event_handler.cc
@@ -38,7 +38,9 @@ static void replace_header_data(char **data, uint16_t &datalen, const uint8_t *h
     if(*data)
         snort_free(*data);
     
-    *data = snort_strndup((char*)header_start, header_length);
+    *data = (char*)snort_alloc(header_length + 1);
+    memcpy(*data, header_start, header_length);
+    *(*data + header_length) = '\0';
     datalen = header_length;
 }
 
@@ -94,8 +96,7 @@ void HttpEventHandler::handle(DataEvent& event, Flow* flow)
         if(header_length > 0)
         {
             replace_header_data(&session->hsession->useragent,
-                session->hsession->useragent_buflen, header_start,
-                header_length);
+                session->hsession->useragent_buflen, header_start, header_length);
             session->scan_flags |= SCAN_HTTP_USER_AGENT_FLAG;
         }
 

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index acc212bc6c5c0783c93125696ced9e087c3f0c57..6346d11769f7052791001eae900a7d06fb17dd7a 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -188,7 +188,6 @@ AppIdSession::~AppIdSession()
        }
 
        delete_shared_data();
-
     free_flow_data();
 }
 
@@ -1882,8 +1881,8 @@ static inline int PENetworkMatch(const sfip_t* pktAddr, const PortExclusion* pe)
 
 static inline int check_port_exclusion(const Packet* pkt, bool reversed)
 {
-    SF_LIST** src_port_exclusions;
-    SF_LIST** dst_port_exclusions;
+    AppIdPortExclusions* src_port_exclusions;
+    AppIdPortExclusions* dst_port_exclusions;
     SF_LIST* pe_list;
     PortExclusion* pe;
     const sfip_t* s_ip;
@@ -1891,20 +1890,20 @@ static inline int check_port_exclusion(const Packet* pkt, bool reversed)
 
     if ( pkt->is_tcp() )
     {
-        src_port_exclusions = config->tcp_port_exclusions_src;
-        dst_port_exclusions = config->tcp_port_exclusions_dst;
+        src_port_exclusions = &config->tcp_port_exclusions_src;
+        dst_port_exclusions = &config->tcp_port_exclusions_dst;
     }
     else if ( pkt->is_udp() )
     {
-        src_port_exclusions = config->udp_port_exclusions_src;
-        dst_port_exclusions = config->udp_port_exclusions_dst;
+        src_port_exclusions = &config->udp_port_exclusions_src;
+        dst_port_exclusions = &config->udp_port_exclusions_dst;
     }
     else
         return 0;
 
     /* check the source port */
     uint16_t port = reversed ? pkt->ptrs.dp : pkt->ptrs.sp;
-    if ( port && (pe_list = src_port_exclusions[port]) != nullptr )
+    if ( port && (pe_list = (*src_port_exclusions)[port]) != nullptr )
     {
         s_ip = reversed ? pkt->ptrs.ip_api.get_dst() : pkt->ptrs.ip_api.get_src();
 
@@ -1922,7 +1921,7 @@ static inline int check_port_exclusion(const Packet* pkt, bool reversed)
 
     /* check the dest port */
     port = reversed ? pkt->ptrs.sp : pkt->ptrs.dp;
-    if ( port && (pe_list=dst_port_exclusions[port]) != nullptr )
+    if ( port && (pe_list = (*dst_port_exclusions)[port]) != nullptr )
     {
         s_ip = reversed ? pkt->ptrs.ip_api.get_src() : pkt->ptrs.ip_api.get_dst();
 
@@ -2698,7 +2697,7 @@ void AppIdSession::free_dns_session_data()
 
 void AppIdSession::free_tls_session_data()
 {
-    if (tsession )
+    if ( tsession )
     {
         if (tsession->tls_host)
             snort_free(tsession->tls_host);
@@ -2768,7 +2767,6 @@ void AppIdSession::delete_shared_data()
     free_http_session_data();
     free_tls_session_data();
     free_dns_session_data();
-    tsession = nullptr;
 
     snort_free(firewallEarlyData);
     firewallEarlyData = nullptr;
@@ -3078,16 +3076,19 @@ void AppIdSession::clear_app_id_data()
     serviceAppId = APP_ID_UNKNOWN;
     tp_payload_app_id = APP_ID_UNKNOWN;
     tp_app_id = APP_ID_UNKNOWN;
+
     if (payload_version)
     {
         snort_free(payload_version);
         payload_version = nullptr;
     }
+
     if (serviceVendor)
     {
         snort_free(serviceVendor);
         serviceVendor = nullptr;
     }
+
     if (serviceVersion)
     {
         snort_free(serviceVersion);

diff --git a/src/network_inspectors/appid/appid_session.h b/src/network_inspectors/appid/appid_session.h
index bd7587362c344e644047ac6bba0e9628f002a60c..09c19257dc4329f3076c54c52d2dbf7d608a3dbb 100644 (file)
--- a/src/network_inspectors/appid/appid_session.h
+++ b/src/network_inspectors/appid/appid_session.h
@@ -244,7 +244,6 @@ public:
 
     AppIdConfig* config = nullptr;
     CommonAppIdData common;
-    //AppIdSession* next = nullptr;
     Flow* flow = nullptr;
     AppIdFlowData* flowData = nullptr;
     AppInfoManager* app_info_mgr = nullptr;

diff --git a/src/network_inspectors/appid/detector_plugins/detector_http.cc b/src/network_inspectors/appid/detector_plugins/detector_http.cc
index 0643877f757ab83a7c2b05bc1812eba8f421943a..038349d5b9ab53a2ec4917bd8262ac72708315e8 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_http.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_http.cc
@@ -2382,29 +2382,23 @@ AppId get_appid_from_url(char* host, char* url, char** version, char* referer, A
 void get_server_vendor_version(const uint8_t* data, int len, char** version, char** vendor,
     RNAServiceSubtype** subtype)
 {
-    const uint8_t* subname;
-    const uint8_t* subver;
-    int subname_len;
-    int subver_len;
-    const uint8_t* paren;
-    const uint8_t* ver;
-    const uint8_t* p;
-    const uint8_t* end = data + len;
-    RNAServiceSubtype* sub;
-    int vendor_len;
-    int version_len;
-    char* tmp;
+    int vendor_len = len;
 
-    ver = (const uint8_t*)memchr(data, '/', len);
+    const uint8_t* ver = (const uint8_t*)memchr(data, '/', len);
     if (ver)
     {
-        version_len = 0;
+        RNAServiceSubtype* sub;
+        int version_len = 0;
+        int subver_len;
+        const uint8_t* subname = nullptr;
+        int subname_len = 0;
+        const uint8_t* subver = nullptr;
+        const uint8_t* paren = nullptr;
+        const uint8_t* p;
+        const uint8_t* end = data + len;
         vendor_len = ver - data;
         ver++;
-        subname = nullptr;
-        subname_len = 0;
-        subver = nullptr;
-        paren = nullptr;
+
         for (p=ver; *p && p < end; p++)
         {
             if (*p == '(')
@@ -2429,7 +2423,7 @@ void get_server_vendor_version(const uint8_t* data, int len, char** version, cha
                     if (subname && subname_len > 0 && subver && *subname)
                     {
                         sub = (RNAServiceSubtype*)snort_calloc(sizeof(RNAServiceSubtype));
-                        tmp = (char*)snort_calloc(subname_len + 1);
+                        char* tmp = (char*)snort_calloc(subname_len + 1);
                         memcpy(tmp, subname, subname_len);
                         tmp[subname_len] = 0;
                         sub->service = tmp;
@@ -2460,7 +2454,7 @@ void get_server_vendor_version(const uint8_t* data, int len, char** version, cha
         if (subname && subname_len > 0 && subver && *subname)
         {
             sub = (RNAServiceSubtype*)snort_calloc(sizeof(RNAServiceSubtype));
-            tmp = (char*)snort_calloc(subname_len + 1);
+            char* tmp = (char*)snort_calloc(subname_len + 1);
             memcpy(tmp, subname, subname_len);
             tmp[subname_len] = 0;
             sub->service = tmp;
@@ -2485,10 +2479,6 @@ void get_server_vendor_version(const uint8_t* data, int len, char** version, cha
         memcpy(*version, ver, version_len);
         *(*version + version_len) = '\0';
     }
-    else
-    {
-        vendor_len = len;
-    }
 
     if (vendor_len >= MAX_VERSION_SIZE)
         vendor_len = MAX_VERSION_SIZE - 1;

diff --git a/src/network_inspectors/appid/lua_detector_api.cc b/src/network_inspectors/appid/lua_detector_api.cc
index a9a0f6e132055cd6cd3faaecf827fa983f2e2373..34dcff1004dcf8a97adac16df889d11266894f88 100644 (file)
--- a/src/network_inspectors/appid/lua_detector_api.cc
+++ b/src/network_inspectors/appid/lua_detector_api.cc
@@ -129,6 +129,7 @@ int check_service_element(Detector* detector)
     if ( !detector->server.pServiceElement )
     {
         detector->server.pServiceElement = new RNAServiceElement;
+        detector->server.pServiceElement->init();
         detector->server.pServiceElement->name = detector->server.serviceModule.name;
     }
 

diff --git a/src/network_inspectors/appid/service_plugins/service_api.h b/src/network_inspectors/appid/service_plugins/service_api.h
index 2d35d335c68ca3945082020953796b3d89322b80..30a8fde17fc2ae6a56b96f78cdf0dce23a6afb44 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_api.h
+++ b/src/network_inspectors/appid/service_plugins/service_api.h
@@ -96,17 +96,37 @@ struct RNAServiceElement
 {
     RNAServiceElement* next;
     RNAServiceValidationFCN validate;
-    // Value of userdata pointer and validate pointer forms key for comparison.
     Detector* userdata;
-
-    /**type of detector - pattern based, Sourcefire (validator) or User (Validator). */
     unsigned detectorType;
-
-    /**Number of resources registered */
     unsigned ref_count;
     unsigned current_ref_count;
     int provides_user;
     const char* name;
+
+    void init()
+    {
+        next = nullptr;
+        name = nullptr;
+        validate = nullptr;
+        userdata = nullptr;
+        provides_user = 0;
+        detectorType = DETECTOR_TYPE_NOT_SET;
+        ref_count = 0;
+        current_ref_count = 0;
+    }
+
+    void init(const char* service_name, RNAServiceValidationFCN fcn, Detector* ud,
+        int has_user, unsigned type)
+    {
+        next = nullptr;
+        name = service_name;
+        validate = fcn;
+        userdata = ud;
+        provides_user = has_user;
+        detectorType = type;
+        ref_count = 0;
+        current_ref_count = 0;
+    }
 };
 
 typedef void* (*ServiceFlowdataGet)(AppIdSession*, unsigned);

diff --git a/src/network_inspectors/appid/service_plugins/service_base.cc b/src/network_inspectors/appid/service_plugins/service_base.cc
index 7a20ad6dea59e7bca746f35b2830a5cc479b77cd..30bce6970e2838122f01cef3241720b54808eacf 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_base.cc
+++ b/src/network_inspectors/appid/service_plugins/service_base.cc
@@ -464,13 +464,9 @@ static void ServiceRegisterPattern(RNAServiceValidationFCN fcn, IpProtocol proto
     if (!li)
     {
         li = new RNAServiceElement;
+        li->init(name, fcn, userdata, provides_user, DETECTOR_TYPE_PATTERN);
         li->next = *list;
         *list = li;
-        li->validate = fcn;
-        li->userdata = userdata;
-        li->detectorType = UINT_MAX;
-        li->provides_user = provides_user;
-        li->name = name;
     }
 
     if ( !(*patterns) )
@@ -649,13 +645,9 @@ int ServiceAddPort(const RNAServiceValidationPort* pp, RNAServiceValidationModul
     if (!li)
     {
         li = new RNAServiceElement;
+        li->init(svm->name, pp->validate, userdata, svm->provides_user, DETECTOR_TYPE_PORT);
         li->next = *list;
         *list = li;
-        li->validate = pp->validate;
-        li->provides_user = svm->provides_user;
-        li->userdata = userdata;
-        li->detectorType = UINT_MAX;
-        li->name = svm->name;
     }
 
     if (pp->proto == IpProtocol::TCP && pp->port == 21 && !ftp_service)

diff --git a/src/network_inspectors/appid/service_plugins/service_mdns.cc b/src/network_inspectors/appid/service_plugins/service_mdns.cc
index 03726fb4c4fb24e329a038ea30bb4618fb73f74b..28144785d3197ae8e06126b8961e17a29eb23ec9 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_mdns.cc
+++ b/src/network_inspectors/appid/service_plugins/service_mdns.cc
@@ -192,6 +192,8 @@ static int ReferencePointer(const char* start_ptr, const char** resp_endptr,   i
     const char* temp_start_ptr;
     temp_start_ptr  = start_ptr+index;
 
+    // FIXIT-M - This code needs review to ensure it works correctly with the new semantics of the
+    //           index returned by the SearchTool find_all pattern matching function
     mdnsMatchListFind(start_ptr, size - data_size + index, resp_endptr, &pattern_length);
     /* Contains reference pointer */
     while ((index < data_size) && !(*resp_endptr) && ((uint8_t )temp_start_ptr[index]  >>

diff --git a/src/network_inspectors/appid/service_plugins/service_ssl.cc b/src/network_inspectors/appid/service_plugins/service_ssl.cc
index bd35d5be78b56b586358f2e59f31b8a2bc7d64d7..b79e58d7f1c470bdcce5c710c043aac44f297602 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_ssl.cc
+++ b/src/network_inspectors/appid/service_plugins/service_ssl.cc
@@ -894,6 +894,7 @@ success:
             goto fail;
         }
     }
+
     asd->set_session_flags(APPID_SESSION_SSL_SESSION);
     if (ss->host_name || ss->common_name || ss->org_name)
     {
@@ -1032,8 +1033,7 @@ static int ssl_scan_patterns(SearchTool* matcher, const uint8_t* pattern, size_t
     while (mp)
     {
         //only patterns that match start of payload, or patterns starting with '.' or patterns
-        // folowing '.' in payload
-        //are considered a match.
+        // folowing '.' in payload are considered a match.
         if (mp->index == 0 || *mp->mpattern->pattern == '.' || pattern[mp->index-1] == '.')
         {
             if (!best_match || mp->mpattern->pattern_size > best_match->pattern_size)

diff --git a/src/network_inspectors/appid/service_state.h b/src/network_inspectors/appid/service_state.h
index 101fb006ab3c7b1f249c4c5a0fdf365da34cbf56..f00c7d4c9ddb3d2d5d763d32559aa6a24cda95a4 100644 (file)
--- a/src/network_inspectors/appid/service_state.h
+++ b/src/network_inspectors/appid/service_state.h
@@ -43,13 +43,17 @@ enum SERVICE_ID_STATE
                             //  obviously delay detection under some scenarios.
 };
 
-#define DETECTOR_TYPE_PASSIVE   0
-#define DETECTOR_TYPE_DECODER   0
-#define DETECTOR_TYPE_NETFLOW   1
-#define DETECTOR_TYPE_PORT      2
-#define DETECTOR_TYPE_DERIVED   3
-#define DETECTOR_TYPE_CONFLICT  4
-#define DETECTOR_TYPE_PATTERN   5
+enum DetectorType
+{
+    DETECTOR_TYPE_PASSIVE =  0,
+    DETECTOR_TYPE_DECODER =  0,
+    DETECTOR_TYPE_NETFLOW,
+    DETECTOR_TYPE_PORT,
+    DETECTOR_TYPE_DERIVED,
+    DETECTOR_TYPE_CONFLICT,
+    DETECTOR_TYPE_PATTERN,
+    DETECTOR_TYPE_NOT_SET
+};
 
 struct ServiceMatch
 {

diff --git a/src/network_inspectors/appid/test/appid_http_event_test.cc b/src/network_inspectors/appid/test/appid_http_event_test.cc
index f5061f25180a19e343c3473282012efaa0b62d1c..9af6cbadc06264b7febb5ee5b42666b3453657e6 100644 (file)
--- a/src/network_inspectors/appid/test/appid_http_event_test.cc
+++ b/src/network_inspectors/appid/test/appid_http_event_test.cc
@@ -86,6 +86,7 @@ FakeHttpMsgHeader *fake_msg_header = nullptr;
 
 AppIdSession::AppIdSession(IpProtocol, const sfip_t*, uint16_t) : FlowData(flow_id, nullptr)
 {
+    hsession = nullptr;
 }
 
 AppIdSession::~AppIdSession()
@@ -94,29 +95,29 @@ AppIdSession::~AppIdSession()
         return;
 
     if(hsession->content_type)
-        free(hsession->content_type);
+        snort_free(hsession->content_type);
     if(hsession->cookie)
-        free(hsession->cookie);
+        snort_free(hsession->cookie);
     if(hsession->host)
-        free(hsession->host);
+        snort_free(hsession->host);
     if(hsession->location)
-        free(hsession->location);
+        snort_free(hsession->location);
     if(hsession->referer)
-        free(hsession->referer);
+        snort_free(hsession->referer);
     if(hsession->response_code)
         free(hsession->response_code);
     if(hsession->server)
-        free(hsession->server);
+        snort_free(hsession->server);
     if(hsession->uri)
-        free(hsession->uri);
+        snort_free(hsession->uri);
     if(hsession->url)
         snort_free(hsession->url);
     if(hsession->useragent)
-        free(hsession->useragent);
+        snort_free(hsession->useragent);
     if(hsession->via)
-        free(hsession->via);
+        snort_free(hsession->via);
     if(hsession->x_working_with)
-        free(hsession->x_working_with);
+        snort_free(hsession->x_working_with);
 
     snort_free(hsession);
 }
@@ -297,17 +298,17 @@ TEST(appid_http_event, handle_null_msg_header)
     mock().checkExpectations();
 }
 
-#define CONTENT_TYPE "html/text"
-#define COOKIE "this is my request cookie content"
-#define HOST "www.google.com"
-#define LOCATION "abc.yahoo.com"
-#define URI "/path/to/index.html"
-#define USERAGENT "Mozilla/5.0 (Macintosh; Intel Mac OS X)"
-#define REFERER "http://www.yahoo.com/search"
+const char* CONTENT_TYPE = "html/text";
+const char* COOKIE = "this is my request cookie content";
+const char* HOST = "www.google.com";
+const char* LOCATION = "abc.yahoo.com";
+const char* URI = "/path/to/index.html";
+const char* USERAGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X)";
+const char* REFERER = "http://www.yahoo.com/search";
+const char* SERVER = "Apache";
+const char* X_WORKING_WITH = "working with string";
+const char* VIA = "via string";
 #define RESPONSE_CODE 301
-#define SERVER "Apache"
-#define X_WORKING_WITH "working with string"
-#define VIA "via string"
 
 struct TestData
 {

diff --git a/src/pub_sub/sip_events.cc b/src/pub_sub/sip_events.cc
index cd7829fb53418e901692d71644800adc50a7f5ff..4ed375267f54b709685a597da76a86bf2e635668 100644 (file)
--- a/src/pub_sub/sip_events.cc
+++ b/src/pub_sub/sip_events.cc
@@ -30,16 +30,16 @@ SipEvent::SipEvent(const Packet* p, const SIPMsg* msg, const SIP_DialogData* dia
     this->msg = msg;
     this->dialog = dialog;
 
-    if( msg->from )
+    if( msg->fromLen )
         from = string(msg->from, msg->fromLen);
 
-    if( msg->userName )
+    if( msg->userNameLen )
         user_name = string(msg->userName, msg->userNameLen);
 
-    if( msg->userAgent )
+    if( msg->userAgentLen )
         user_agent = string(msg->userAgent, msg->userAgentLen);
 
-    if( msg->server )
+    if( msg->serverLen )
         server = string(msg->server, msg->serverLen);
 }