Merge pull request #1253 in SNORT/snort3 from appid_hi_disable to master

Squashed commit of the following:

commit 6eaf6c76a313da43797647ce7da186b9149bf427
Author: Shravan Rangaraju <shrarang@cisco.com>
Date:   Mon Jun 4 18:36:28 2018 -0400

    appid: fix unit test

commit d694ad138044a70cf1bee66a3f264a0a9e004554
Author: Shravan Rangaraju <shrarang@cisco.com>
Date:   Mon Jun 4 18:22:34 2018 -0400

    appid: do not subscribe to HTTP inspector events if third party AppId is enabled

diff --git a/src/network_inspectors/appid/appid_http_event_handler.cc b/src/network_inspectors/appid/appid_http_event_handler.cc
index 34b2c0f60b300e9003382256ac0d8195858b0a3f..73247541bdfa130c3e5fb4885c6ebbd9e91f69dc 100644 (file)
--- a/src/network_inspectors/appid/appid_http_event_handler.cc
+++ b/src/network_inspectors/appid/appid_http_event_handler.cc
@@ -30,6 +30,7 @@
 #include <cassert>
 
 #include "app_info_table.h"
+#include "appid_debug.h"
 #include "appid_http_session.h"
 #include "appid_session.h"
 #include "utils/util.h"
@@ -48,6 +49,10 @@ void HttpEventHandler::handle(DataEvent& event, Flow* flow)
     if (!asd)
         return;
 
+    if (appidDebug->is_active())
+        LogMessage("AppIdDbg %s Processing HTTP metadata from HTTP Inspector\n",
+            appidDebug->get_debug_session());
+
     direction = event_type == REQUEST_EVENT ? APP_ID_FROM_INITIATOR : APP_ID_FROM_RESPONDER;
 
     AppIdHttpSession* hsession = asd->get_http_session();
@@ -123,10 +128,8 @@ void HttpEventHandler::handle(DataEvent& event, Flow* flow)
     hsession->process_http_packet(direction);
     if (asd->service.get_id() == APP_ID_HTTP)
     {
-        asd->set_session_flags(APPID_SESSION_SERVICE_DETECTED | APPID_SESSION_HTTP_SESSION);
         asd->set_application_ids(asd->pick_service_app_id(), asd->pick_client_app_id(),
             asd->pick_payload_app_id(), asd->pick_misc_app_id());
-        asd->service_disco_state = APPID_DISCO_STATE_FINISHED;
     }
 }
 

diff --git a/src/network_inspectors/appid/appid_http_session.cc b/src/network_inspectors/appid/appid_http_session.cc
index 72cc4062b069bf5c745cddcc83bc0a054a1807ca..bdd62fcd593729473713d323f28ef500d63b2929 100644 (file)
--- a/src/network_inspectors/appid/appid_http_session.cc
+++ b/src/network_inspectors/appid/appid_http_session.cc
@@ -436,7 +436,11 @@ int AppIdHttpSession::process_http_packet(AppidSessionDirection direction)
     }
 
     if (asd.service.get_id() == APP_ID_NONE)
+    {
         asd.service.set_id(APP_ID_HTTP);
+        asd.set_session_flags(APPID_SESSION_SERVICE_DETECTED | APPID_SESSION_HTTP_SESSION);
+        asd.service_disco_state = APPID_DISCO_STATE_FINISHED;
+    }
 
     if (appidDebug->is_active())
         LogMessage("AppIdDbg %s chp_finished %d chp_hold_flow %d\n",

diff --git a/src/network_inspectors/appid/appid_inspector.cc b/src/network_inspectors/appid/appid_inspector.cc
index d669eb0cda24d67282a12925c56778886648859e..4e6ba55e72876ec3e50355f4b9d1086a43ae33b8 100644 (file)
--- a/src/network_inspectors/appid/appid_inspector.cc
+++ b/src/network_inspectors/appid/appid_inspector.cc
@@ -111,16 +111,22 @@ bool AppIdInspector::configure(SnortConfig* sc)
 
     active_config = new AppIdConfig(const_cast<AppIdModuleConfig*>(config));
 
-    DataBus::subscribe(HTTP_REQUEST_HEADER_EVENT_KEY, new HttpEventHandler(
-        HttpEventHandler::REQUEST_EVENT));
-
-    DataBus::subscribe(HTTP_RESPONSE_HEADER_EVENT_KEY, new HttpEventHandler(
-        HttpEventHandler::RESPONSE_EVENT));
-
     my_seh = SipEventHandler::create();
     my_seh->subscribe();
 
     active_config->init_appid(sc);
+
+#ifdef ENABLE_APPID_THIRD_PARTY
+    if (!TPLibHandler::have_tp())
+#endif
+    {
+        DataBus::subscribe(HTTP_REQUEST_HEADER_EVENT_KEY, new HttpEventHandler(
+            HttpEventHandler::REQUEST_EVENT));
+
+        DataBus::subscribe(HTTP_RESPONSE_HEADER_EVENT_KEY, new HttpEventHandler(
+            HttpEventHandler::RESPONSE_EVENT));
+    }
+
     return true;
 
     // FIXIT-M some of this stuff may be needed in some fashion...

diff --git a/src/network_inspectors/appid/test/appid_http_event_test.cc b/src/network_inspectors/appid/test/appid_http_event_test.cc
index e62da1b8b106f57ea02f335b927efb72c557c430..6ffebcfcfab1c6fb7564755d3c5659190dcb8162 100644 (file)
--- a/src/network_inspectors/appid/test/appid_http_event_test.cc
+++ b/src/network_inspectors/appid/test/appid_http_event_test.cc
@@ -41,6 +41,10 @@
 #include <CppUTest/TestHarness.h>
 #include <CppUTestExt/MockSupport.h>
 
+// Stubs for AppIdDebug
+THREAD_LOCAL AppIdDebug* appidDebug = nullptr;
+void AppIdDebug::activate(const Flow*, const AppIdSession*, bool) { active = true; }
+
 using namespace snort;
 
 namespace snort
@@ -182,6 +186,8 @@ TEST_GROUP(appid_http_event)
         flow = new Flow;
         mock_session = new AppIdSession(IpProtocol::TCP, nullptr, 1492, appid_inspector);
         flow->set_flow_data(mock_session);
+        appidDebug = new AppIdDebug();
+        appidDebug->activate(nullptr, nullptr, 0);
     }
 
     void teardown() override
@@ -190,6 +196,7 @@ TEST_GROUP(appid_http_event)
         delete mock_session;
         delete flow;
         mock().clear();
+        delete appidDebug;
         MemoryLeakWarningPlugin::turnOnNewDeleteOverloads();
     }
 };