convert add session alert and check session alerted functionality into session virtua...

diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc
index a2ed460f74fbba665b4c9324adbe9dd60352e687..900272399e41ffcf117572313cf744166c690295 100644 (file)
--- a/src/detection/fpdetect.cc
+++ b/src/detection/fpdetect.cc
@@ -851,7 +851,6 @@ static inline int fpFinalSelectEvent(OTNX_MATCH_DATA *o, Packet *p)
 **          1 if flagged
 **
 */
-// FIXIT-H this should include frags now that they are in session
 static inline int fpAddSessionAlert(Packet *p, OptTreeNode *otn)
 {
     if ( !p->flow )
@@ -882,7 +881,6 @@ static inline int fpAddSessionAlert(Packet *p, OptTreeNode *otn)
 **          1 if alert previously generated
 **
 */
-// FIXIT-H this should include frags now that they are in session
 static inline int fpSessionAlerted(Packet *p, OptTreeNode *otn)
 {
     SigInfo *si = &otn->sigInfo;
@@ -1080,7 +1078,7 @@ static inline int fpEvalHeaderSW(PORT_GROUP *port_group, Packet *p,
              **  payload, in case any of the rules have the
              **  'rawbytes' option.
              */
-            // FIXIT-H alt buf and file data should be obtained from 
+            // FIXIT-M alt buf and file data should be obtained from 
             // inspector gadget as an extension of above
             so = port_group->pgPms[PM_TYPE__CONTENT];
 

diff --git a/src/flow/session.h b/src/flow/session.h
index c737a25030bd7121f98b7bee36de74db40c7737c..71245c8c437287818158e93694dbc3d63f2d16e3 100644 (file)
--- a/src/flow/session.h
+++ b/src/flow/session.h
@@ -36,10 +36,14 @@ public:
     virtual bool setup(Packet*) { return true; };
     virtual void update_direction(char /*dir*/, const sfip_t*, uint16_t /*port*/) { };
     virtual int process(Packet*) { return 0; };
+
     virtual void restart(Packet*) { };
     virtual void clear() = 0;
     virtual void cleanup() { clear(); };
 
+    virtual bool add_alert(Packet*, uint32_t /*gid*/, uint32_t /*sid*/) { return false; };
+    virtual bool check_alerted(Packet*, uint32_t /*gid*/, uint32_t /*sid*/) { return false; };
+
 protected:
     Session(Flow* f) { flow = f; };
 

diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index 8b91138e2bead8fdeda846a9bd0b4c198b01ad24..ec1c77a11f5f218cfe3c7b625a65054bd7e2f641 100644 (file)
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -2213,6 +2213,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     ft->frag_pkts = 0;
     ft->frag_time.tv_sec = p->pkth->ts.tv_sec;
     ft->frag_time.tv_usec = p->pkth->ts.tv_usec;
+    ft->alert_count = 0;
     ft->ip_options_len = 0;
     ft->ip_options_data = NULL;
     ft->copied_ip_options_len = 0;

diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc
index d8e91a7593b899eb92163336e5726def75cad48e..ef96d1746ec9e808d2ba3011a09c1b4747ca3b2a 100644 (file)
--- a/src/stream/ip/ip_session.cc
+++ b/src/stream/ip/ip_session.cc
@@ -182,3 +182,37 @@ int IpSession::process(Packet* p)
     return 0;
 }
 
+bool IpSession::add_alert(Packet*, uint32_t gid, uint32_t sid)
+{
+    FragTracker* ft = &tracker;
+
+    /* Only track a certain number of alerts per session */
+    if ( ft->alert_count >= MAX_FRAG_ALERTS )
+        return false;
+
+    ft->alert_gid[ft->alert_count] = gid;
+    ft->alert_sid[ft->alert_count] = sid;
+    ft->alert_count++;
+
+    return true;
+}
+
+bool IpSession::check_alerted(Packet* p, uint32_t gid, uint32_t sid)
+{
+    FragTracker* ft = &tracker;
+
+    for ( unsigned i = 0; i < ft->alert_count; i++ )
+    {
+        /*  If this is a rebuilt packet and we've seen this alert before, return
+         *  that we have previously alerted on a non-rebuilt packet.
+         */
+        if ( (p->packet_flags & PKT_REBUILT_FRAG)
+                && ft->alert_gid[i] == gid && ft->alert_sid[i] == sid )
+        {
+            return true;
+        }
+    }
+
+    return false;
+}
+

diff --git a/src/stream/ip/ip_session.h b/src/stream/ip/ip_session.h
index a98d63394abaf606f81424c1d9d206596bfab585..00efbb4ac8819b94b024615ccfd4306afbc0fbc0 100644 (file)
--- a/src/stream/ip/ip_session.h
+++ b/src/stream/ip/ip_session.h
@@ -29,6 +29,9 @@
 struct Fragment;
 struct FragEngine;
 
+/* Only track a certain number of alerts per session */
+#define MAX_FRAG_ALERTS 8
+
 /* tracker for a fragmented packet set */
 struct FragTracker
 {
@@ -54,6 +57,10 @@ struct FragTracker
     Fragment *fraglist_tail; /* tail ptr for easy appending */
     int fraglist_count;       /* handy dandy counter */
 
+    uint32_t alert_gid[MAX_FRAG_ALERTS]; /* flag alerts seen in a frag list  */
+    uint32_t alert_sid[MAX_FRAG_ALERTS]; /* flag alerts seen in a frag list  */
+    uint8_t  alert_count;                /* count alerts seen in a frag list */
+
     uint8_t ip_options_len;  /* length of ip options for this set of frags */
     uint8_t *ip_options_data; /* ip options from offset 0 packet */
     uint8_t copied_ip_options_len;  /* length of 'copied' ip options */
@@ -78,6 +85,9 @@ public:
     int process(Packet*) override;
     void clear() override;
 
+    bool add_alert(Packet*, uint32_t gid, uint32_t sid) override;
+    bool check_alerted(Packet*, uint32_t gid, uint32_t sid) override;
+
 public:
     FragTracker tracker;
 };

diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc
index fe01fa217922724e22594e99ef3b7eee777c8e7b..bdbd6dcf6468223d98ab21b868608b7efc76a827 100644 (file)
--- a/src/stream/stream_api.cc
+++ b/src/stream/stream_api.cc
@@ -780,33 +780,24 @@ int Stream::response_flush_stream(Packet *p)
     return 0;
 }
 
-int Stream::add_session_alert(
+// return true if added
+bool Stream::add_session_alert(
     Flow *flow, Packet *p, uint32_t gid, uint32_t sid)
 {
     if ( !flow )
-        return 0;
-
-    /* Don't need to do this for other protos because they don't
-       do any reassembly. */
-    if ( p->type() != PktType::TCP )
-        return 0;
+        return false;
 
-    return Stream5AddSessionAlertTcp(flow, p, gid, sid);
+    return flow->session->add_alert(p, gid, sid);
 }
 
-/* return non-zero if gid/sid have already been seen */
-int Stream::check_session_alerted(
+// return true if gid/sid have already been seen
+bool Stream::check_session_alerted(
     Flow *flow, Packet *p, uint32_t gid, uint32_t sid)
 {
     if ( !flow )
-        return 0;
-
-    /* Don't need to do this for other protos because they don't
-       do any reassembly. */
-    if ( p->type() != PktType::TCP )
-        return 0;
+        return false;
 
-    return Stream5CheckSessionAlertTcp(flow, p, gid, sid);
+    return flow->session->check_alerted(p, gid, sid);
 }
 
 int Stream::update_session_alert(

diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h
index fde7277b959400357eaf289d7000c955be8dc015..252e71417ea4f1933dc5886b309e18b4d143cd56 100644 (file)
--- a/src/stream/stream_api.h
+++ b/src/stream/stream_api.h
@@ -148,17 +148,13 @@ public:
      */
     static int traverse_stream_segments(Packet*, StreamSegmentIterator, void* userdata);  // PKT
 
-    /* Add session alert
+    /* Add session alert - true if added
      */
-    static int add_session_alert(Flow*, Packet*, uint32_t gid, uint32_t sid);
+    static bool add_session_alert(Flow*, Packet*, uint32_t gid, uint32_t sid);
 
-    /* Check session alert
-     *
-     * Returns
-     *     0 if not previously alerted
-     *     !0 if previously alerted
+    /* Check session alert - true if previously alerted
      */
-    static int check_session_alerted(Flow*, Packet *p, uint32_t gid, uint32_t sid);
+    static bool check_session_alerted(Flow*, Packet *p, uint32_t gid, uint32_t sid);
 
     /* Set Extra Data Logging
      *

diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index c93f6fb38f39757382fa646c6d972411e0c8961d..900ca1813f8800dafb412e6197c4e9b8e4f57884 100644 (file)
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -6317,7 +6317,7 @@ int Stream5AddSessionAlertTcp(
 
     st->alert_count++;
 
-    return 0;
+    return 1;
 }
 
 int Stream5CheckSessionAlertTcp(Flow *lwssn, Packet *p, uint32_t gid, uint32_t sid)
@@ -6810,6 +6810,16 @@ midstream_pickup_allowed:
     return 0;
 }
 
+bool TcpSession::add_alert(Packet* p, uint32_t gid, uint32_t sid)
+{
+    return Stream5AddSessionAlertTcp(p->flow, p, gid, sid) != 0;
+}
+
+bool TcpSession::check_alerted(Packet* p, uint32_t gid, uint32_t sid)
+{
+    return Stream5CheckSessionAlertTcp(p->flow, p, gid, sid) != 0;
+}
+
 //-------------------------------------------------------------------------
 // tcp module stuff
 //-------------------------------------------------------------------------

diff --git a/src/stream/tcp/tcp_session.h b/src/stream/tcp/tcp_session.h
index 1a5d56fe61ffb5d7aa8637f599b2d4b83b6aed7d..7ba01d39e0034466bf9b54740a7578a8eb24f967 100644 (file)
--- a/src/stream/tcp/tcp_session.h
+++ b/src/stream/tcp/tcp_session.h
@@ -206,6 +206,9 @@ public:
     void reset();
     void restart(Packet*) override;
 
+    bool add_alert(Packet*, uint32_t gid, uint32_t sid) override;
+    bool check_alerted(Packet*, uint32_t gid, uint32_t sid) override;
+
 public:
     StreamTracker client;
     StreamTracker server;