file name changed

diff --git a/src/ips_options/ips_base64.cc b/src/ips_options/ips_base64.cc
index 2fce6b795a1e0576e8bbd33502022b7218726a9e..8d5a69dd888dca5122186ea69101602e72418746 100644 (file)
--- a/src/ips_options/ips_base64.cc
+++ b/src/ips_options/ips_base64.cc
@@ -34,7 +34,7 @@
 #include "parser/parser.h"
 #include "time/profiler.h"
 #include "utils/util.h"
-#include "mime/sf_base64decode.h"
+#include "mime/decode_b64.h"
 #include "utils/util_unfold.h"
 #include "utils/snort_bounds.h"
 #include "detection/detection_defines.h"

diff --git a/src/mime/CMakeLists.txt b/src/mime/CMakeLists.txt
index 0254ec7f4ade51be7f7e1f2a752de148418a5a27..7318c0ad37f114cb849a9fdf9a2bb711d4f54dc6 100644 (file)
--- a/src/mime/CMakeLists.txt
+++ b/src/mime/CMakeLists.txt
@@ -11,12 +11,19 @@ add_library ( mime STATIC
     file_mime_paf.cc 
     file_mime_process.h 
     file_mime_process.cc 
-    sf_email_attach_decode.cc 
-    sf_email_attach_decode.h
-    sf_base64decode.cc 
-    sf_base64decode.h
-    uu_decode.cc
-    uu_decode.h
+    decode_base.h.cc 
+    decode_base.h
+    decode_b64.cc
+    decode_b64.h
+    decode_bit.cc
+    decode_bit.h
+    decode_buffer.cc
+    decode_buffer.h
+    decode_qp.cc
+    decode_qp.h
+    decode_uu.cc
+    decode_uu.h
+    
 )
 
 target_link_libraries(mime file_api)

diff --git a/src/mime/Makefile.am b/src/mime/Makefile.am
index aa279a11741163d4cadffc7e099239adccf26b72..b55cd8fb7d47ffd0e90b9c668376f0f2a55fc01e 100644 (file)
--- a/src/mime/Makefile.am
+++ b/src/mime/Makefile.am
@@ -7,8 +7,7 @@ file_mime_log.h file_mime_log.cc \
 file_mime_paf.h file_mime_paf.cc \
 file_mime_process.h file_mime_process.cc \
 file_mime_config.cc file_mime_config.h \
-sf_base64decode.cc sf_base64decode.h \
-sf_email_attach_decode.cc sf_email_attach_decode.h \
+decode_base.cc decode_base.h \
 decode_b64.cc decode_b4.h \
 decode_bit.cc decode_bit.h \
 decode_qp.cc decode_qp.h \

diff --git a/src/mime/decode_b64.cc b/src/mime/decode_b64.cc
index ba1d1cdba3da13650bc710419a441b1ea40d4ffd..ca33cd2d96ea3c24832c48a4a0069250d358656a 100644 (file)
--- a/src/mime/decode_b64.cc
+++ b/src/mime/decode_b64.cc
@@ -18,8 +18,8 @@
 //--------------------------------------------------------------------------
 // Author: Bhagyashree Bantwal <bbantwal@sourcefire.com>
 
-#include "sf_email_attach_decode.h"
-#include "sf_base64decode.h"
+#include <mime/decode_base.h>
+
 #include "decode_b64.h"
 
 #include "utils/snort_bounds.h"
@@ -93,3 +93,119 @@ B64Decode::~B64Decode()
    if (buffer)
        delete buffer;
 }
+
+uint8_t sf_decode64tab[256] =
+{
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,62,100,100,100, 63,
+    52, 53, 54, 55, 56, 57, 58, 59, 60, 61,100,100,100, 99,100,100,
+    100,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
+    15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,100,100,100,100,100,
+    100, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
+    41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
+    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100
+};
+
+/* base64decode assumes the input data terminates with '=' and/or at the end of the input buffer
+ * at inbuf_size.  If extra characters exist within inbuf before inbuf_size is reached, it will
+ * happily decode what it can and skip over what it can't.  This is consistent with other decoders
+ * out there.  So, either terminate the string, set inbuf_size correctly, or at least be sure the
+ * data is valid up until the point you care about.  Note base64 data does NOT have to end with
+ * '=' and won't if the number of bytes of input data is evenly divisible by 3.
+*/
+int sf_base64decode(uint8_t* inbuf, uint32_t inbuf_size, uint8_t* outbuf, uint32_t outbuf_size,
+    uint32_t* bytes_written)
+{
+    uint8_t* cursor, * endofinbuf;
+    uint8_t* outbuf_ptr;
+    uint8_t base64data[4], * base64data_ptr; /* temporary holder for current base64 chunk */
+    uint8_t tableval_a, tableval_b, tableval_c, tableval_d;
+
+    uint32_t n;
+    uint32_t max_base64_chars; /* The max number of decoded base64 chars that fit into outbuf */
+
+    int error = 0;
+
+    /* This algorithm will waste up to 4 bytes but we really don't care.
+       At the end we're going to copy the exact number of bytes requested. */
+    max_base64_chars = (outbuf_size / 3) * 4 + 4; /* 4 base64 bytes gives 3 data bytes, plus
+                                                    an extra 4 to take care of any rounding */
+
+    base64data_ptr = base64data;
+    endofinbuf = inbuf + inbuf_size;
+
+    /* Strip non-base64 chars from inbuf and decode */
+    n = 0;
+    *bytes_written = 0;
+    cursor = inbuf;
+    outbuf_ptr = outbuf;
+    while ((cursor < endofinbuf) && (n < max_base64_chars))
+    {
+        if (sf_decode64tab[*cursor] != 100)
+        {
+            *base64data_ptr++ = *cursor;
+            n++; /* Number of base64 bytes we've stored */
+            if (!(n % 4))
+            {
+                /* We have four databytes upon which to operate */
+
+                if ((base64data[0] == '=') || (base64data[1] == '='))
+                {
+                    /* Error in input data */
+                    error = 1;
+                    break;
+                }
+
+                /* retrieve values from lookup table */
+                tableval_a = sf_decode64tab[base64data[0]];
+                tableval_b = sf_decode64tab[base64data[1]];
+                tableval_c = sf_decode64tab[base64data[2]];
+                tableval_d = sf_decode64tab[base64data[3]];
+
+                if (*bytes_written < outbuf_size)
+                {
+                    *outbuf_ptr++ = (tableval_a << 2) | (tableval_b >> 4);
+                    (*bytes_written)++;
+                }
+
+                if ((base64data[2] != '=') && (*bytes_written < outbuf_size))
+                {
+                    *outbuf_ptr++ = (tableval_b << 4) | (tableval_c >> 2);
+                    (*bytes_written)++;
+                }
+                else
+                {
+                    break;
+                }
+
+                if ((base64data[3] != '=') && (*bytes_written < outbuf_size))
+                {
+                    *outbuf_ptr++ = (tableval_c << 6) | tableval_d;
+                    (*bytes_written)++;
+                }
+                else
+                {
+                    break;
+                }
+
+                /* Reset our decode pointer for the next group of four */
+                base64data_ptr = base64data;
+            }
+        }
+        cursor++;
+    }
+
+    if (error)
+        return(-1);
+    else
+        return(0);
+}
+

diff --git a/src/mime/decode_b64.h b/src/mime/decode_b64.h
index b71b7a2b53369afbfa0c8dd31712a1f03e73f58e..7bcd16b3d301895682f26a061e9fa61cd617165e 100644 (file)
--- a/src/mime/decode_b64.h
+++ b/src/mime/decode_b64.h
@@ -27,6 +27,7 @@
 
 #include "main/snort_types.h"
 #include "decode_buffer.h"
+#include "decode_base.h"
 
 class B64Decode:public DataDecode
 {
@@ -43,5 +44,12 @@ private:
     DecodeBuffer* buffer = nullptr;
 };
 
+// FIXIT-L: inbuf should probably be const uint8_t*
+SO_PUBLIC int sf_base64decode(
+    uint8_t* inbuf, uint32_t inbuf_size,
+    uint8_t* outbuf, uint32_t outbuf_size,
+    uint32_t* bytes_written
+);
+
 #endif
 

diff --git a/src/mime/sf_email_attach_decode.cc b/src/mime/decode_base.cc
similarity index 98%
rename from src/mime/sf_email_attach_decode.cc
rename to src/mime/decode_base.cc
index 3b6f3161ea287b19a2712d6b93be04df4072414c..0ee4bd6adf9f0b616a64b0afd53df91822983bf6 100644 (file)
--- a/src/mime/sf_email_attach_decode.cc
+++ b/src/mime/decode_base.cc
@@ -18,8 +18,7 @@
 //--------------------------------------------------------------------------
 // Author: Bhagyashree Bantwal <bbantwal@sourcefire.com>
 
-#include "sf_email_attach_decode.h"
-
+#include <mime/decode_base.h>
 #include "utils/snort_bounds.h"
 #include "utils/util.h"
 

diff --git a/src/mime/sf_email_attach_decode.h b/src/mime/decode_base.h
similarity index 100%
rename from src/mime/sf_email_attach_decode.h
rename to src/mime/decode_base.h

diff --git a/src/mime/decode_bit.cc b/src/mime/decode_bit.cc
index 3abeddd415f1f552a11ecc62ae9abdd3b1b88105..e727e4b4df0b36c76867d7ddfca365ad8662ed7c 100644 (file)
--- a/src/mime/decode_bit.cc
+++ b/src/mime/decode_bit.cc
@@ -18,7 +18,7 @@
 //--------------------------------------------------------------------------
 // Author: Bhagyashree Bantwal <bbantwal@sourcefire.com>
 
-#include "sf_email_attach_decode.h"
+#include <mime/decode_base.h>
 #include "decode_bit.h"
 
 #include "utils/snort_bounds.h"

diff --git a/src/mime/decode_qp.cc b/src/mime/decode_qp.cc
index 0076f0fb2e30dfaaa45d811e0e3dbe54ea5beff5..6a80e99644c9609cfdb8e251bb04829455ec5268 100644 (file)
--- a/src/mime/decode_qp.cc
+++ b/src/mime/decode_qp.cc
@@ -18,7 +18,7 @@
 //--------------------------------------------------------------------------
 // Author: Bhagyashree Bantwal <bbantwal@sourcefire.com>
 
-#include "sf_email_attach_decode.h"
+#include <mime/decode_base.h>
 #include "decode_qp.h"
 
 #include "utils/snort_bounds.h"

diff --git a/src/mime/decode_uu.cc b/src/mime/decode_uu.cc
index 1b2633d5389765526e1dfcff7d3aebb849464b08..8c9fb8303f481360435914f83594901930a2287d 100644 (file)
--- a/src/mime/decode_uu.cc
+++ b/src/mime/decode_uu.cc
@@ -18,7 +18,7 @@
 //--------------------------------------------------------------------------
 // Author: Bhagyashree Bantwal <bbantwal@sourcefire.com>
 
-#include "sf_email_attach_decode.h"
+#include <mime/decode_base.h>
 #include "decode_uu.h"
 
 #include "utils/snort_bounds.h"

diff --git a/src/mime/decode_uu.h b/src/mime/decode_uu.h
index f4e445f9deb2c27ed1edf3d76b6ac701eb47630b..0560ddc790ae86d085e0db2a910a03a74ebb2fb1 100644 (file)
--- a/src/mime/decode_uu.h
+++ b/src/mime/decode_uu.h
@@ -23,7 +23,7 @@
 
 // UU decoder
 
-#include "sf_email_attach_decode.h"
+#include "decode_base.h"
 #include "decode_buffer.h"
 
 class UUDecode:public DataDecode

diff --git a/src/mime/file_mime_decode.cc b/src/mime/file_mime_decode.cc
index 8c1bbc79426fc84fe7d42031a25031dc75a4a53b..db26f7a27d5dcd4c74d7b4471d154a37cb69cef2 100644 (file)
--- a/src/mime/file_mime_decode.cc
+++ b/src/mime/file_mime_decode.cc
@@ -20,7 +20,6 @@
 
 #include <mime/decode_uu.h>
 #include "file_mime_decode.h"
-#include "sf_base64decode.h"
 #include "decode_b64.h"
 #include "decode_bit.h"
 #include "decode_qp.h"

diff --git a/src/mime/file_mime_decode.h b/src/mime/file_mime_decode.h
index 429c5a24ab85f33c55597f47ea23d8b99d58bd80..562928a75cf7a5cc0b30ae8f47257a066ef8eeb4 100644 (file)
--- a/src/mime/file_mime_decode.h
+++ b/src/mime/file_mime_decode.h
@@ -25,7 +25,7 @@
 
 #include <stdlib.h>
 
-#include "sf_email_attach_decode.h"
+#include "decode_base.h"
 #include "file_mime_config.h"
 
 #include "main/snort_types.h"

diff --git a/src/mime/file_mime_paf.h b/src/mime/file_mime_paf.h
index 5f8deff71c7e791e983f2275232d9cfdae2ef98d..a23b4b128e4c8195e094e73c28b7637a14bea008 100644 (file)
--- a/src/mime/file_mime_paf.h
+++ b/src/mime/file_mime_paf.h
@@ -26,8 +26,9 @@
 // and file name will be extracted from MIME header
 
 #include <pcre.h>
+
+#include "decode_base.h"
 #include "file_mime_config.h"
-#include "sf_email_attach_decode.h"
 #include "file_api/file_api.h"
 
 

diff --git a/src/mime/sf_base64decode.cc b/src/mime/sf_base64decode.cc
deleted file mode 100644 (file)
index 4c5f1e3..0000000
--- a/src/mime/sf_base64decode.cc
+++ /dev/null
@@ -1,137 +0,0 @@
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 1998-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation.  You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-//--------------------------------------------------------------------------
-// Writen by Patrick Mullen <pmullen@sourcefire.com>
-
-#include "sf_base64decode.h"
-
-uint8_t sf_decode64tab[256] =
-{
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,62,100,100,100, 63,
-    52, 53, 54, 55, 56, 57, 58, 59, 60, 61,100,100,100, 99,100,100,
-    100,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
-    15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,100,100,100,100,100,
-    100, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
-    41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,
-    100,100,100,100,100,100,100,100,100,100,100,100,100,100,100,100
-};
-
-/* base64decode assumes the input data terminates with '=' and/or at the end of the input buffer
- * at inbuf_size.  If extra characters exist within inbuf before inbuf_size is reached, it will
- * happily decode what it can and skip over what it can't.  This is consistent with other decoders
- * out there.  So, either terminate the string, set inbuf_size correctly, or at least be sure the
- * data is valid up until the point you care about.  Note base64 data does NOT have to end with
- * '=' and won't if the number of bytes of input data is evenly divisible by 3.
-*/
-int sf_base64decode(uint8_t* inbuf, uint32_t inbuf_size, uint8_t* outbuf, uint32_t outbuf_size,
-    uint32_t* bytes_written)
-{
-    uint8_t* cursor, * endofinbuf;
-    uint8_t* outbuf_ptr;
-    uint8_t base64data[4], * base64data_ptr; /* temporary holder for current base64 chunk */
-    uint8_t tableval_a, tableval_b, tableval_c, tableval_d;
-
-    uint32_t n;
-    uint32_t max_base64_chars; /* The max number of decoded base64 chars that fit into outbuf */
-
-    int error = 0;
-
-    /* This algorithm will waste up to 4 bytes but we really don't care.
-       At the end we're going to copy the exact number of bytes requested. */
-    max_base64_chars = (outbuf_size / 3) * 4 + 4; /* 4 base64 bytes gives 3 data bytes, plus
-                                                    an extra 4 to take care of any rounding */
-
-    base64data_ptr = base64data;
-    endofinbuf = inbuf + inbuf_size;
-
-    /* Strip non-base64 chars from inbuf and decode */
-    n = 0;
-    *bytes_written = 0;
-    cursor = inbuf;
-    outbuf_ptr = outbuf;
-    while ((cursor < endofinbuf) && (n < max_base64_chars))
-    {
-        if (sf_decode64tab[*cursor] != 100)
-        {
-            *base64data_ptr++ = *cursor;
-            n++; /* Number of base64 bytes we've stored */
-            if (!(n % 4))
-            {
-                /* We have four databytes upon which to operate */
-
-                if ((base64data[0] == '=') || (base64data[1] == '='))
-                {
-                    /* Error in input data */
-                    error = 1;
-                    break;
-                }
-
-                /* retrieve values from lookup table */
-                tableval_a = sf_decode64tab[base64data[0]];
-                tableval_b = sf_decode64tab[base64data[1]];
-                tableval_c = sf_decode64tab[base64data[2]];
-                tableval_d = sf_decode64tab[base64data[3]];
-
-                if (*bytes_written < outbuf_size)
-                {
-                    *outbuf_ptr++ = (tableval_a << 2) | (tableval_b >> 4);
-                    (*bytes_written)++;
-                }
-
-                if ((base64data[2] != '=') && (*bytes_written < outbuf_size))
-                {
-                    *outbuf_ptr++ = (tableval_b << 4) | (tableval_c >> 2);
-                    (*bytes_written)++;
-                }
-                else
-                {
-                    break;
-                }
-
-                if ((base64data[3] != '=') && (*bytes_written < outbuf_size))
-                {
-                    *outbuf_ptr++ = (tableval_c << 6) | tableval_d;
-                    (*bytes_written)++;
-                }
-                else
-                {
-                    break;
-                }
-
-                /* Reset our decode pointer for the next group of four */
-                base64data_ptr = base64data;
-            }
-        }
-        cursor++;
-    }
-
-    if (error)
-        return(-1);
-    else
-        return(0);
-}
-

diff --git a/src/mime/sf_base64decode.h b/src/mime/sf_base64decode.h
deleted file mode 100644 (file)
index 2ca798d..0000000
--- a/src/mime/sf_base64decode.h
+++ /dev/null
@@ -1,36 +0,0 @@
-//--------------------------------------------------------------------------
-// Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
-// Copyright (C) 1998-2013 Sourcefire, Inc.
-//
-// This program is free software; you can redistribute it and/or modify it
-// under the terms of the GNU General Public License Version 2 as published
-// by the Free Software Foundation.  You may not use, modify or distribute
-// this program under any other version of the GNU General Public License.
-//
-// This program is distributed in the hope that it will be useful, but
-// WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-// General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
-//--------------------------------------------------------------------------
-// sf_base64decode.h author Patrick Mullen <pmullen@sourcefire.com>
-
-#ifndef SF_BASE64DECODE_H
-#define SF_BASE64DECODE_H
-
-// A Base-64 decoder
-
-#include "main/snort_types.h"
-
-// FIXIT-L: inbuf should probably be const uint8_t*
-SO_PUBLIC int sf_base64decode(
-    uint8_t* inbuf, uint32_t inbuf_size,
-    uint8_t* outbuf, uint32_t outbuf_size,
-    uint32_t* bytes_written
-);
-
-#endif
-

diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc
index c184b174e0e36fcde848d5a85a1ba05cb6da4cf8..9522f1d57a75f05b6ff8a12fdb4fe5d13dd20900 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_main.cc
+++ b/src/service_inspectors/http_inspect/hi_main.cc
@@ -65,7 +65,7 @@
 #include "utils/util.h"
 #include "utils/util_utf.h"
 #include "utils/sfsnprintfappend.h"
-#include "mime/sf_email_attach_decode.h"
+#include <mime/decode_base.h>
 #include "stream/stream_api.h"
 #include "time/profiler.h"
 #include "loggers/unified2_common.h"

diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc
index 02b4d387300ebf6d383352917b04c7cf71140395..26f1f2f258c432b48f148ae98a0ddb2bf2cb3882 100644 (file)
--- a/src/service_inspectors/http_inspect/http_inspect.cc
+++ b/src/service_inspectors/http_inspect/http_inspect.cc
@@ -53,7 +53,7 @@
 #include "target_based/snort_protocols.h"
 #include "file_api/file_api.h"
 #include "utils/kmap.h"
-#include "mime/sf_email_attach_decode.h"
+#include <mime/decode_base.h>
 #include "utils/util.h"
 #include "utils/xmalloc.h"
 #include "framework/inspector.h"