Squashed commit of the following:

commit 4a1634abbe8a08ad62384edf76d6c71549f00a93
Author: Tom Peters <thopeter@cisco.com>
Date:   Thu Jun 18 17:30:00 2015 -0400

    first step toward flow depth

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc b/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc
index afc48b2b37d152badb36a1c4c98966c53d8bbe19..4e68d139f9ea2757df0728cd85e7f2a918207c27 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc
@@ -22,7 +22,7 @@
 using namespace NHttpEnums;
 
 ScanResult NHttpStartCutter::cut(const uint8_t* buffer, uint32_t length,
-    NHttpInfractions& infractions, NHttpEventGen& events)
+    NHttpInfractions& infractions, NHttpEventGen& events, uint32_t, uint32_t)
 {
     for (uint32_t k = 0; k < length; k++)
     {
@@ -120,7 +120,7 @@ NHttpStartCutter::ValidationResult NHttpStatusCutter::validate(uint8_t octet)
 }
 
 ScanResult NHttpHeaderCutter::cut(const uint8_t* buffer, uint32_t length,
-    NHttpInfractions& infractions, NHttpEventGen& events)
+    NHttpInfractions& infractions, NHttpEventGen& events, uint32_t, uint32_t)
 {
     // Header separators: leading \r\n, leading \n, nonleading \r\n\r\n, nonleading \n\r\n,
     // nonleading \r\n\n, and nonleading \n\n. The separator itself becomes num_excess which is
@@ -172,13 +172,14 @@ ScanResult NHttpHeaderCutter::cut(const uint8_t* buffer, uint32_t length,
     return SCAN_NOTFOUND;
 }
 
-ScanResult NHttpBodyCutter::cut(const uint8_t*, uint32_t, NHttpInfractions&, NHttpEventGen&)
+ScanResult NHttpBodyCutter::cut(const uint8_t*, uint32_t, NHttpInfractions&, NHttpEventGen&,
+    uint32_t flow_target, uint32_t flow_max)
 {
     assert(remaining > 0);
 
-    // The normal body section size is about 16K. But if there are only 24K or less remaining we
-    // take the whole thing rather than leave a small final section.
-    if (remaining <= FINAL_BLOCK_SIZE)
+    // The normal body section size is flow_target. But if there are only flow_max or less
+    // remaining we take the whole thing rather than leave a small final section.
+    if (remaining <= flow_max)
     {
         num_flush = remaining;
         remaining = 0;
@@ -187,14 +188,14 @@ ScanResult NHttpBodyCutter::cut(const uint8_t*, uint32_t, NHttpInfractions&, NHt
     else
     {
         // FIXIT-M need to implement random increments
-        num_flush = DATA_BLOCK_SIZE;
+        num_flush = flow_target;
         remaining -= num_flush;
         return SCAN_FOUND_PIECE;
     }
 }
 
 ScanResult NHttpChunkCutter::cut(const uint8_t* buffer, uint32_t length,
-    NHttpInfractions& infractions, NHttpEventGen& events)
+    NHttpInfractions& infractions, NHttpEventGen& events, uint32_t flow_target, uint32_t)
 {
     if (new_section)
     {
@@ -325,14 +326,14 @@ ScanResult NHttpChunkCutter::cut(const uint8_t* buffer, uint32_t length,
         case CHUNK_DATA:
           {
             uint32_t skip_amount = (length-k <= expected) ? length-k : expected;
-            skip_amount = (skip_amount <= DATA_BLOCK_SIZE-data_seen) ? skip_amount :
-                DATA_BLOCK_SIZE-data_seen;
+            skip_amount = (skip_amount <= flow_target-data_seen) ? skip_amount :
+                flow_target-data_seen;
             k += skip_amount - 1;
             if ((expected -= skip_amount) == 0)
             {
                 curr_state = CHUNK_DCRLF1;
             }
-            if ((data_seen += skip_amount) == DATA_BLOCK_SIZE)
+            if ((data_seen += skip_amount) == flow_target)
             {
                 // FIXIT-M need to randomize slice point
                 data_seen = 0;
@@ -368,10 +369,10 @@ ScanResult NHttpChunkCutter::cut(const uint8_t* buffer, uint32_t length,
             break;
         case CHUNK_BAD:
             uint32_t skip_amount = length-k;
-            skip_amount = (skip_amount <= DATA_BLOCK_SIZE-data_seen) ? skip_amount :
-                DATA_BLOCK_SIZE-data_seen;
+            skip_amount = (skip_amount <= flow_target-data_seen) ? skip_amount :
+                flow_target-data_seen;
             k += skip_amount - 1;
-            if ((data_seen += skip_amount) == DATA_BLOCK_SIZE)
+            if ((data_seen += skip_amount) == flow_target)
             {
                 // FIXIT-M need to randomize slice point
                 data_seen = 0;

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_cutter.h b/src/service_inspectors/nhttp_inspect/nhttp_cutter.h
index f8d31c412b672f88dd0a5a17ffe46a4eeef39db9..ae284f67db84fef988cb4c839e7941050b34d888 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_cutter.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_cutter.h
@@ -35,7 +35,8 @@ class NHttpCutter
 public:
     virtual ~NHttpCutter() = default;
     virtual NHttpEnums::ScanResult cut(const uint8_t* buffer, uint32_t length,
-        NHttpInfractions& infractions, NHttpEventGen& events) = 0;
+        NHttpInfractions& infractions, NHttpEventGen& events, uint32_t flow_target,
+        uint32_t flow_max) = 0;
     uint32_t get_num_flush() const { return num_flush; }
     uint32_t get_octets_seen() const { return octets_seen; }
     virtual uint32_t get_num_excess() const { return 0; }
@@ -55,7 +56,7 @@ class NHttpStartCutter : public NHttpCutter
 {
 public:
     NHttpEnums::ScanResult cut(const uint8_t* buffer, uint32_t length,
-        NHttpInfractions& infractions, NHttpEventGen& events) override;
+        NHttpInfractions& infractions, NHttpEventGen& events, uint32_t, uint32_t) override;
     uint32_t get_num_excess() const override { return (num_flush > 0) ? num_crlf : 0; }
 
 protected:
@@ -85,7 +86,7 @@ class NHttpHeaderCutter : public NHttpCutter
 {
 public:
     NHttpEnums::ScanResult cut(const uint8_t* buffer, uint32_t length,
-        NHttpInfractions& infractions, NHttpEventGen& events) override;
+        NHttpInfractions& infractions, NHttpEventGen& events, uint32_t, uint32_t) override;
     uint32_t get_num_excess() const override { return (num_flush > 0) ? num_crlf : 0; }
     uint32_t get_num_head_lines() const override { return num_head_lines; }
 
@@ -99,8 +100,8 @@ class NHttpBodyCutter : public NHttpCutter
 public:
     explicit NHttpBodyCutter(int64_t expected_length) : remaining(expected_length)
         { assert(remaining > 0); }
-    NHttpEnums::ScanResult cut(const uint8_t*, uint32_t, NHttpInfractions&, NHttpEventGen&)
-        override;
+    NHttpEnums::ScanResult cut(const uint8_t*, uint32_t, NHttpInfractions&, NHttpEventGen&,
+        uint32_t flow_target, uint32_t flow_max) override;
 
 private:
     int64_t remaining;
@@ -110,7 +111,8 @@ class NHttpChunkCutter : public NHttpCutter
 {
 public:
     NHttpEnums::ScanResult cut(const uint8_t* buffer, uint32_t length,
-        NHttpInfractions& infractions, NHttpEventGen& events) override;
+        NHttpInfractions& infractions, NHttpEventGen& events, uint32_t flow_target, uint32_t)
+        override;
     bool get_is_broken_chunk() const { return curr_state == NHttpEnums::CHUNK_BAD; }
     uint32_t get_num_good_chunks() const { return num_good_chunks; }
 

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
index 82a50585e1fd00b862b4e28f5c68da575341fadb..569598d0a3cc84b430905fbd576f424331e22721 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
@@ -70,6 +70,8 @@ void NHttpFlowData::half_reset(SourceId source_id)
     }
     data_length[source_id] = STAT_NOTPRESENT;
     body_octets[source_id] = STAT_NOTPRESENT;
+    section_size_target[source_id] = 0;
+    section_size_max[source_id] = 0;
     infractions[source_id].reset();
     events[source_id].reset();
 }

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h
index 99f0617d5bbaa220160c9ed2d0366c33241fa94a..69e4d6fbf9ab353f686b490d10d557c1015e0b01 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h
@@ -59,21 +59,21 @@ private:
 
     // 0 element refers to client request, 1 element refers to server response
 
-    // StreamSplitter internal data - scan()
+    // *** StreamSplitter internal data - scan()
     NHttpCutter* cutter[2] = { nullptr, nullptr };
 
-    // StreamSplitter internal data - reassemble()
+    // *** StreamSplitter internal data - reassemble()
     uint8_t* section_buffer[2] = { nullptr, nullptr };
     uint32_t chunk_offset[2] = { 0, 0 };
     NHttpEnums::ChunkState chunk_state[2] = { NHttpEnums::CHUNK_NUMBER, NHttpEnums::CHUNK_NUMBER };
     uint32_t chunk_expected_length[2] = { 0, 0 };
 
-    // StreamSplitter internal data - scan() => reassemble()
+    // *** StreamSplitter internal data - scan() => reassemble()
     uint32_t num_excess[2] = { 0, 0 };
     bool is_broken_chunk[2] = { false, false };
     uint32_t num_good_chunks[2] = { 0, 0 };
 
-    // StreamSplitter => Inspector (facts about the most recent message section)
+    // *** StreamSplitter => Inspector (facts about the most recent message section)
     NHttpEnums::SectionType section_type[2] = { NHttpEnums::SEC__NOTCOMPUTE,
                                                 NHttpEnums::SEC__NOTCOMPUTE };
     bool tcp_close[2] = { false, false };
@@ -82,13 +82,14 @@ private:
     int32_t num_head_lines[2] = { NHttpEnums::STAT_NOTPRESENT, NHttpEnums::STAT_NOTPRESENT };
     uint32_t flush_size[2] = { 0, 0 };
 
-    // Inspector => StreamSplitter (facts about the message section that is coming next)
+    // *** Inspector => StreamSplitter (facts about the message section that is coming next)
     NHttpEnums::SectionType type_expected[2] = { NHttpEnums::SEC_REQUEST, NHttpEnums::SEC_STATUS };
-
     // length of the data from Content-Length field
     int64_t data_length[2] = { NHttpEnums::STAT_NOTPRESENT, NHttpEnums::STAT_NOTPRESENT };
+    uint32_t section_size_target[2] = { 0, 0 };
+    uint32_t section_size_max[2] = { 0, 0 };
 
-    // Inspector's internal data about the current message
+    // *** Inspector's internal data about the current message
     NHttpEnums::VersionId version_id[2] = { NHttpEnums::VERS__NOTPRESENT,
                                             NHttpEnums::VERS__NOTPRESENT };
     NHttpEnums::MethodId method_id = NHttpEnums::METH__NOTPRESENT;

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
index 428c030adcd9b1a105d894b83fadeb42024f406e..5b7bdcbd85833ce2517a42f3e7aabfbbe52ea7ab 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
@@ -68,6 +68,8 @@ void NHttpMsgBody::update_flow()
     {
         // More body coming
         session_data->body_octets[source_id] = body_octets;
+        session_data->section_size_target[source_id] = DATA_BLOCK_SIZE;
+        session_data->section_size_max[source_id] = FINAL_BLOCK_SIZE;
         session_data->infractions[source_id] = infractions;
         session_data->events[source_id] = events;
     }

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
index 6489fa6dc8afa9e2f64a3cffbc05d936c8aee850..8bb9ed1fb9205deb8042170394b7de89d52400fb 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
@@ -56,6 +56,7 @@ void NHttpMsgChunk::update_flow()
     else
     {
         session_data->body_octets[source_id] = body_octets;
+        session_data->section_size_target[source_id] = DATA_BLOCK_SIZE;
         session_data->infractions[source_id] = infractions;
         session_data->events[source_id] = events;
     }

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
index 267efd5529d0836fe8aef630bd0a85f63f197f92..f28e1998367aea16229e4048aaf0d4786103353f 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
@@ -82,6 +82,7 @@ void NHttpMsgHeader::update_flow()
         // Chunked body
         session_data->type_expected[source_id] = SEC_CHUNK;
         session_data->body_octets[source_id] = 0;
+        session_data->section_size_target[source_id] = DATA_BLOCK_SIZE;
         session_data->infractions[source_id].reset();
         session_data->events[source_id].reset();
     }
@@ -93,6 +94,8 @@ void NHttpMsgHeader::update_flow()
         session_data->data_length[source_id] = *(int64_t*)get_header_value_norm(
             HEAD_CONTENT_LENGTH).start;
         session_data->body_octets[source_id] = 0;
+        session_data->section_size_target[source_id] = DATA_BLOCK_SIZE;
+        session_data->section_size_max[source_id] = FINAL_BLOCK_SIZE;
         session_data->infractions[source_id].reset();
         session_data->events[source_id].reset();
     }

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
index 92e513079c9cb69ed912313f78d10b248524ab8a..95f4a09eb8949f2e5c1eb32b0195826644c4b535 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
@@ -208,7 +208,8 @@ StreamSplitter::Status NHttpStreamSplitter::scan(Flow* flow, const uint8_t* data
     }
     const uint32_t max_length = MAX_OCTETS - cutter->get_octets_seen();
     const ScanResult cut_result = cutter->cut(data, (length <= max_length) ? length :
-        max_length, session_data->infractions[source_id], session_data->events[source_id]);
+        max_length, session_data->infractions[source_id], session_data->events[source_id],
+        session_data->section_size_target[source_id], session_data->section_size_max[source_id]);
     switch (cut_result)
     {
     case SCAN_NOTFOUND: