Merge pull request #52 in SNORT/snort3 from nhttp19 to master

Squashed commit of the following:

commit f9451d42bc6ad29c895b55180550f49ddbe48081
Author: Tom Peters <thopeter@cisco.com>
Date:   Tue Sep 29 10:51:52 2015 -0400

    File processing fix

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc b/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc
index fcba4bd99bd40e9f98af16056a31cbca3c6ca351..25ff98e18723adb9d03b4bb5e7d791976380b343 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc
@@ -308,6 +308,7 @@ ScanResult NHttpChunkCutter::cut(const uint8_t* buffer, uint32_t length,
             }
             else if (buffer[k] == '\n')
             {
+                // FIXIT-L better to keep parsing chunks after bare LF (several changes needed)?
                 infractions += INF_CHUNK_BARE_LF;
                 events.create_event(EVENT_BROKEN_CHUNK);
                 curr_state = CHUNK_BAD;

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
index 6d524f8a69f95a553b70ce2a61f3b737aab57b1f..0da4b071393e76a81d10e28fbd31f24403d232d9 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
@@ -110,6 +110,10 @@ void NHttpFlowData::show(FILE* out_file) const
     fprintf(out_file, "Status code: %d\n", status_code_num);
     fprintf(out_file, "Type expected: %d/%d\n", type_expected[0], type_expected[1]);
     fprintf(out_file, "Data length: %" PRIi64 "/%" PRIi64 "\n", data_length[0], data_length[1]);
+    fprintf(out_file, "Detect depth remaining: %" PRIi64 "/%" PRIi64 "\n",
+        detect_depth_remaining[0], detect_depth_remaining[1]);
+    fprintf(out_file, "File depth remaining: %" PRIi64 "/%" PRIi64 "\n", file_depth_remaining[0],
+        file_depth_remaining[1]);
     fprintf(out_file, "Body octets: %" PRIi64 "/%" PRIi64 "\n", body_octets[0], body_octets[1]);
     fprintf(out_file, "Pipelining: front %d back %d overflow %d underflow %d\n", pipeline_front,
         pipeline_back, pipeline_overflow, pipeline_underflow);

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
index 3441949ddca56915920493d4ad97b332506e75da..7ab49b75fa374d5dc2411bbdde2f6d426976c32f 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
@@ -124,7 +124,7 @@ void NHttpMsgHeader::setup_file_processing()
 {
     // FIXIT-M Bidirectional file processing is problematic so we don't do it. When the library
     // fully supports it remove the outer if statement that prevents it from being done.
-    if (session_data->file_depth_remaining[1-source_id] == 0)
+    if (session_data->file_depth_remaining[1-source_id] <= 0)
     {
         if ((session_data->file_depth_remaining[source_id] = FileService::get_max_file_depth()) < 0)
         {
@@ -143,6 +143,10 @@ void NHttpMsgHeader::setup_file_processing()
                 session_data->file_depth_remaining[source_id] = 0;
         }
     }
+    else
+    {
+        session_data->file_depth_remaining[source_id] = 0;
+    }
 }
 
 void NHttpMsgHeader::setup_decompression()