* false: ignore this file
*/
bool FileFlows::file_process(const uint8_t* file_data, int data_size,
- FilePosition position, bool upload, bool suspend_block_verdict)
+ FilePosition position, bool upload)
{
FileContext* context;
FileDirection direction = upload ? FILE_UPLOAD:FILE_DOWNLOAD;
// This is used when there is only one file per session
bool file_process(const uint8_t* file_data, int data_size,
- FilePosition position, bool upload, bool suspend_block_verdict);
+ FilePosition position, bool upload);
// This is used for each file context. Support multiple files per session
bool file_process(FileContext* context, const uint8_t* file_data, int data_size,
if (!decode_depth)
return decoded_bytes;
// exceeded depth before (decode_bytes_read has been updated)
- else if (decode_depth < decode_bytes_read - decoded_bytes)
+ else if (decode_depth < (int64_t)decode_bytes_read - decoded_bytes)
return 0;
// lower than depth
- else if (decode_depth > decode_bytes_read)
+ else if (decode_depth > (int64_t)decode_bytes_read)
return decoded_bytes;
// cut off
else
- return (decode_depth + decoded_bytes - decode_bytes_read);
+ return (decode_depth + (int64_t )decoded_bytes - decode_bytes_read);
}
int DataDecode::get_decoded_data(uint8_t** buf, uint32_t* size)
*buf = decodePtr;
else
return 0;
+
+ return (*size);
}
#define MAX_DEPTH 65536
DecodeResult QPDecode::decode_data(const uint8_t* start, const uint8_t* end)
{
uint32_t act_encode_size = 0, act_decode_size = 0, bytes_read = 0;
- uint32_t i = 0;
if (!buffer->check_restore_buffer())
{
DecodeResult UUDecode::decode_data(const uint8_t* start, const uint8_t* end)
{
uint32_t act_encode_size = 0, act_decode_size = 0, bytes_read = 0;
- uint32_t i = 0;
if (!buffer->check_restore_buffer())
{
{
int log_avail = 0;
uint8_t* log_buf;
- uint32_t logged;
int ret = 0;
if (length <= 0)
return -1;
log_avail = log_depth - hdrs_logged;
- logged = hdrs_logged;
log_buf = (uint8_t*)emailHdrs;
if (log_avail <= 0)
state_flags &= ~MIME_FLAG_DATA_HEADER_CONT;
}
- int ret = handle_header_line(config, ptr, eol, max_header_name_len);
+ int ret = handle_header_line(ptr, eol, max_header_name_len);
if (ret < 0)
return NULL;
else if (ret > 0)
{
if (decode_state->decode_data(attach_start, attach_end) == DECODE_FAIL )
{
- decode_alert(decode_state);
+ decode_alert();
}
}
}
{
/* if we're normalizing and not ignoring data copy data end marker
* and dot to alt buffer */
- if (normalize_data(config, start, end) < 0)
+ if (normalize_data(start, end) < 0)
return NULL;
reset_mime_state();
return NULL;
}
- if (normalize_data(config, start, end) < 0)
+ if (normalize_data(start, end) < 0)
return NULL;
/* now we shouldn't have to worry about copying any data to the alt buffer
* * only mime headers if we find them and only if we're ignoring data */
/*Process file type/file signature*/
FileFlows* file_flows = FileFlows::get_file_flows(flow);
- if (file_flows && file_flows->file_process(buffer, buf_size, position, upload, false)
+ if (file_flows && file_flows->file_process(buffer, buf_size, position, upload)
&& (isFileStart(position)) && log_state)
{
log_state->set_file_name_from_log(flow);
void set_data_state(int);
MailLogState* get_log_state();
+protected:
+ MimeDecode* decode_state = NULL;
+
private:
int data_state = STATE_DATA_INIT;
int state_flags = 0;
- MimeDecode* decode_state = NULL;
MimeDataPafInfo mime_boundary;
DecodeConfig* decode_conf = NULL;
MailLogConfig* log_config = NULL;
// SMTP, IMAP, POP might have different implementation for this
void* config = NULL;
- virtual int handle_header_line(void* conf, const uint8_t* ptr, const uint8_t* eol,
- int max_header_len)
- { return 0; }
- virtual int normalize_data(void* conf, const uint8_t* ptr, const uint8_t* data_end)
- { return 0; }
- virtual void decode_alert(MimeDecode* decode_state)
- { }
- virtual void reset_state(void* ssn)
- { }
- virtual bool is_end_of_data(void* ssn)
- { return false; }
+ virtual int handle_header_line(const uint8_t*, const uint8_t*, int) { return 0; }
+ virtual int normalize_data(const uint8_t* , const uint8_t* ) { return 0; }
+ virtual void decode_alert() {}
+ virtual void reset_state(Flow* ) {}
+ virtual bool is_end_of_data(Flow* ) { return false; }
void reset_mime_state();
void setup_decode(const char* data, int size, bool cnt_xf);
return;
status = file_flows->file_process(file_data, data_length,
- data_ssn->position, data_ssn->direction, false);
+ data_ssn->position, data_ssn->direction);
/* Filename needs to be set AFTER the first call to file_process( ) */
if (data_ssn->filename && !(data_ssn->packet_flags & FTPDATA_FLG_FILENAME_SET))
{
FileFlows* file_flows = FileFlows::get_file_flows(p->flow);
file_flows->file_process((uint8_t*)p->data, p->dsize,
- getFilePoistion(p), true, false);
+ getFilePoistion(p), true);
}
}
return iRet;
if (file_flows && file_flows->file_process(
(uint8_t*)session->client.request.post_raw,
(uint16_t)session->client.request.post_raw_size,
- getFilePoistion(p), true, false))
+ getFilePoistion(p), true))
{
setFileName(p);
}
{
FileFlows* file_flows = FileFlows::get_file_flows(p->flow);
file_flows->file_process((uint8_t*)p->data, p->dsize,
- getFilePoistion(p),
- true, false);
+ getFilePoistion(p), true);
}
}
&& file_flows && file_flows->file_process(
(uint8_t*)session->server.response.body,
(uint16_t)session->server.response.body_size,
- getFilePoistion(p), false, false))
+ getFilePoistion(p), false))
{
setFileName(p);
}
THREAD_LOCAL const IMAPSearch* imap_current_search = NULL;
THREAD_LOCAL IMAPSearchInfo imap_search_info;
-static void POP_ResetState(void*);
-
ImapFlowData::ImapFlowData() : FlowData(flow_id)
{ memset(&session, 0, sizeof(session)); }
delete imap_resp_search_mpse;
}
-static void IMAP_ResetState(void* ssn)
+static void IMAP_ResetState(Flow* ssn)
{
- IMAPData* imap_ssn = get_session_data((Flow*)ssn);
+ IMAPData* imap_ssn = get_session_data(ssn);
imap_ssn->state = STATE_COMMAND;
imap_ssn->state_flags = 0;
imap_ssn->body_read = imap_ssn->body_len = 0;
}
}
-void ImapMime::decode_alert(MimeDecode* ds)
+void ImapMime::decode_alert()
{
- MimeDecode* decode_state = (MimeDecode*)ds;
switch ( decode_state->get_decode_type() )
{
case DECODE_B64:
}
}
-void ImapMime::reset_state(void* ssn)
+void ImapMime::reset_state(Flow* ssn)
{
IMAP_ResetState(ssn);
}
-bool ImapMime::is_end_of_data(void* session)
+bool ImapMime::is_end_of_data(Flow* session)
{
return imap_is_data_end(session);
}
{
using MimeSession::MimeSession;
private:
- void decode_alert(MimeDecode* decode_state) override;
- void reset_state(void* ssn) override;
- bool is_end_of_data(void* ssn) override;
+ void decode_alert() override;
+ void reset_state(Flow* ssn) override;
+ bool is_end_of_data(Flow* ssn) override;
};
struct IMAPData
}
}
-bool imap_is_data_end(void* session)
+bool imap_is_data_end(Flow* ssn)
{
- Flow* ssn = (Flow*)session;
ImapPafData* s = get_state(ssn, true);
return s->end_of_data;
}
};
// Function: Check if IMAP data end is reached
-bool imap_is_data_end(void* ssn);
+bool imap_is_data_end(Flow* ssn);
#endif
FileFlows* file_flows = FileFlows::get_file_flows(flow);
if (file_flows->file_process(file_data.start, fp_length,
- file_position, false, false))
+ file_position, false))
{
session_data->file_depth_remaining[source_id] -= fp_length;
if (source_id == SRC_SERVER)
{
FileFlows* file_flows = FileFlows::get_file_flows(flow);
- file_flows->file_process(nullptr, 0, SNORT_FILE_END, false, false);
+ file_flows->file_process(nullptr, 0, SNORT_FILE_END, false);
}
else
{
THREAD_LOCAL POPSearchInfo pop_search_info;
static void snort_pop(POP_PROTO_CONF* GlobalConf, Packet* p);
-static void POP_ResetState(void*);
+static void POP_ResetState(Flow*);
PopFlowData::PopFlowData() : FlowData(flow_id)
{ memset(&session, 0, sizeof(session)); }
delete pop_resp_search_mpse;
}
-static void POP_ResetState(void* ssn)
+static void POP_ResetState(Flow* ssn)
{
- POPData* pop_ssn = get_session_data((Flow*)ssn);
+ POPData* pop_ssn = get_session_data(ssn);
pop_ssn->state = STATE_COMMAND;
pop_ssn->prev_response = 0;
pop_ssn->state_flags = 0;
}
}
-void PopMime::decode_alert(MimeDecode* ds)
+void PopMime::decode_alert()
{
- MimeDecode* decode_state = (MimeDecode*)ds;
switch ( decode_state->get_decode_type() )
{
case DECODE_B64:
}
}
-void PopMime::reset_state(void* ssn)
+void PopMime::reset_state(Flow* ssn)
{
POP_ResetState(ssn);
}
-bool PopMime::is_end_of_data(void* session)
+bool PopMime::is_end_of_data(Flow* session)
{
return pop_is_data_end(session);
}
{
using MimeSession::MimeSession;
private:
- void decode_alert(MimeDecode* decode_state) override;
- void reset_state(void* ssn) override;
- bool is_end_of_data(void* ssn) override;
+ void decode_alert() override;
+ void reset_state(Flow* ssn) override;
+ bool is_end_of_data(Flow* ssn) override;
};
struct POPData
}
}
-bool pop_is_data_end(void* session)
+bool pop_is_data_end(Flow* ssn)
{
- Flow* ssn = (Flow*)session;
PopPafData* s = get_state(ssn, false);
return s->end_of_data;
}
};
// Function: Callback to check if POP data end is reached
-bool pop_is_data_end(void* ssn);
+bool pop_is_data_end(Flow* ssn);
#endif
THREAD_LOCAL SMTPSearchInfo smtp_search_info;
static void snort_smtp(SMTP_PROTO_CONF* GlobalConf, Packet* p);
-static void SMTP_ResetState(void*);
-void SMTP_DecodeAlert(void* ds);
+static void SMTP_ResetState(Flow*);
SmtpFlowData::SmtpFlowData() : FlowData(flow_id)
{ memset(&session, 0, sizeof(session)); }
}
}
-static void SMTP_ResetState(void* ssn)
+static void SMTP_ResetState(Flow* ssn)
{
- SMTPData* smtp_ssn = get_session_data((Flow*)ssn);
+ SMTPData* smtp_ssn = get_session_data(ssn);
smtp_ssn->state = STATE_COMMAND;
smtp_ssn->state_flags = 0;
}
config->xtra_ehdrs_id = stream.reg_xtra_data_cb(SMTP_GetEmailHdrs);
}
-int SmtpMime::handle_header_line(void* conf, const uint8_t* ptr, const uint8_t* eol,
+int SmtpMime::handle_header_line(const uint8_t* ptr, const uint8_t* eol,
int max_header_len)
{
int ret;
return 0;
}
-int SmtpMime::normalize_data(void* conf, const uint8_t* ptr, const uint8_t* data_end)
+int SmtpMime::normalize_data(const uint8_t* ptr, const uint8_t* data_end)
{
/* if we're ignoring data and not already normalizing, copy everything
* up to here into alt buffer so detection engine doesn't have
return 0;
}
-void SmtpMime::decode_alert(MimeDecode* ds)
+void SmtpMime::decode_alert()
{
- MimeDecode* decode_state = (MimeDecode*)ds;
switch ( decode_state->get_decode_type() )
{
case DECODE_B64:
}
}
-void SmtpMime::reset_state(void* ssn)
+void SmtpMime::reset_state(Flow* ssn)
{
SMTP_ResetState(ssn);
}
-bool SmtpMime::is_end_of_data(void* session)
+bool SmtpMime::is_end_of_data(Flow* session)
{
return smtp_is_data_end(session);
}
using MimeSession::MimeSession;
SMTP_PROTO_CONF* config;
private:
- int handle_header_line(void* conf, const uint8_t* ptr, const uint8_t* eol,
+ int handle_header_line(const uint8_t* ptr, const uint8_t* eol,
int max_header_len) override;
- int normalize_data(void* conf, const uint8_t* ptr, const uint8_t* data_end) override;
- void decode_alert(MimeDecode* decode_state) override;
- void reset_state(void* ssn) override;
- bool is_end_of_data(void* ssn) override;
+ int normalize_data(const uint8_t* ptr, const uint8_t* data_end) override;
+ void decode_alert() override;
+ void reset_state(Flow* ssn) override;
+ bool is_end_of_data(Flow* ssn) override;
};
struct SMTPData
}
}
-bool smtp_is_data_end(void* session)
+bool smtp_is_data_end(Flow* ssn)
{
- Flow* ssn = (Flow*)session;
SmtpPafData* s = get_state(ssn, true);
return s->end_of_data;
}
};
// Function: Check if IMAP data end is reached
-bool smtp_is_data_end(void* ssn);
+bool smtp_is_data_end(Flow* ssn);
#endif
FileFlows* file_flows = FileFlows::get_file_flows(p->flow);
if (file_flows)
- file_flows->file_process((uint8_t*)p->data, p->dsize, position(p), c->upload, false);
+ file_flows->file_process((uint8_t*)p->data, p->dsize, position(p), c->upload);
set_file_data((uint8_t*)p->data, p->dsize);
MODULE_PROFILE_END(file_ssn_stats);