Merge pull request #2387 in SNORT/snort3 from ~THOPETER/snort3:h2i_finish to master

Squashed commit of the following:

commit ad37a366a1f2414c0cefee09292cd349dfce9ada
Author: Tom Peters <thopeter@cisco.com>
Date:   Wed Aug 5 16:56:38 2020 -0400

    http_inspect: finish() after partial inspection

diff --git a/src/service_inspectors/http2_inspect/http2_stream_splitter.cc b/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
index 348c7ccbd29e887edda77838b23fb7fca8a5d335..b567b26c36cc0d5940469951aedf68bd6b92e5ee 100644 (file)
--- a/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
+++ b/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
@@ -184,7 +184,6 @@ const StreamBuffer Http2StreamSplitter::reassemble(Flow* flow, unsigned total, u
     return implement_reassemble(session_data, total, offset, data, len, flags, source_id);
 }
 
-// Eventually we will need to address unexpected connection closes
 bool Http2StreamSplitter::finish(Flow* flow)
 {
     Profile profile(Http2Module::get_profile_stats());
@@ -203,16 +202,39 @@ bool Http2StreamSplitter::finish(Flow* flow)
         }
         else
         {
-            printf("Finish from flow data %" PRIu64 " direction %d\n", session_data->seq_num,
-                source_id);
+            printf("HTTP/2 finish from flow data %" PRIu64 " direction %d\n",
+                session_data->seq_num, source_id);
             fflush(stdout);
         }
     }
 #endif
 
+    // Loop through all nonzero streams and call NHI finish()
     bool need_reassemble = false;
+    for (const Http2FlowData::StreamInfo& stream_info : session_data->streams)
+    {
+        if ((stream_info.id == 0)                                                 ||
+            (stream_info.stream->get_state(source_id) == STATE_CLOSED)            ||
+            (stream_info.stream->get_hi_flow_data() == nullptr)                   ||
+            (stream_info.stream->get_hi_flow_data()->get_type_expected(source_id)
+                != HttpEnums::SEC_BODY_H2))
+        {
+            continue;
+        }
 
-    // Loop through all streams and call NHI finish()
+        session_data->stream_in_hi = stream_info.id;
+        if (session_data->hi_ss[source_id]->finish(flow))
+        {
+            assert(stream_info.id == session_data->current_stream[source_id]);
+            need_reassemble = true;
+#ifdef REG_TEST
+            if (HttpTestManager::use_test_input(HttpTestManager::IN_HTTP2))
+                HttpTestManager::get_test_input_source()->flush(0);
+#endif
+        }
+        session_data->stream_in_hi = NO_STREAM_ID;
+
+    }
 
     return need_reassemble;
 }

diff --git a/src/service_inspectors/http_inspect/http_stream_splitter_finish.cc b/src/service_inspectors/http_inspect/http_stream_splitter_finish.cc
index e26451dbb05a8b27d70de56766ca853cfb8e6579..073bf844c6a8c5eca36446f241f014a358057008 100644 (file)
--- a/src/service_inspectors/http_inspect/http_stream_splitter_finish.cc
+++ b/src/service_inspectors/http_inspect/http_stream_splitter_finish.cc
@@ -73,8 +73,9 @@ bool HttpStreamSplitter::finish(Flow* flow)
     // up to process because it is about to go to reassemble(). But we don't support partial start
     // lines.
     if ((session_data->section_type[source_id] == SEC__NOT_COMPUTE) &&
-        (session_data->cutter[source_id] != nullptr)               &&
-        (session_data->cutter[source_id]->get_octets_seen() > 0))
+        (session_data->cutter[source_id] != nullptr)                &&
+        (session_data->cutter[source_id]->get_octets_seen() >
+            session_data->partial_raw_bytes[source_id]))
     {
         if ((session_data->type_expected[source_id] == SEC_REQUEST) ||
             (session_data->type_expected[source_id] == SEC_STATUS))
@@ -116,7 +117,8 @@ bool HttpStreamSplitter::finish(Flow* flow)
     if ((session_data->section_type[source_id] == SEC__NOT_COMPUTE) &&
         (session_data->file_depth_remaining[source_id] > 0)        &&
         (session_data->cutter[source_id] != nullptr)               &&
-        (session_data->cutter[source_id]->get_octets_seen() == 0))
+        (session_data->cutter[source_id]->get_octets_seen() ==
+            session_data->partial_raw_bytes[source_id]))
     {
         Packet* packet = DetectionEngine::get_current_packet();
         if (!session_data->mime_state[source_id])

diff --git a/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc b/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
index 8176e43c92c5ef4a3118613e526fa2b0a841eef1..ca845478b731db4824e43cf6a1c9b2d082e26193 100644 (file)
--- a/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
+++ b/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
@@ -106,7 +106,8 @@ StreamSplitter::Status HttpStreamSplitter::status_value(StreamSplitter::Status r
         http2 ? HttpTestManager::IN_HTTP2 : HttpTestManager::IN_HTTP;
     if (HttpTestManager::use_test_output(type))
     {
-        fprintf(HttpTestManager::get_output_file(), "scan() returning status %d\n", ret_val);
+        fprintf(HttpTestManager::get_output_file(), "%sscan() returning status %d\n",
+            http2 ? "HTTP/2 ": "", ret_val);
         fflush(HttpTestManager::get_output_file());
     }
     if (HttpTestManager::use_test_input(type))