Merge pull request #127 in SNORT/snort3 from crc/obfu to master

Squashed commit of the following:

commit fe3281566d1987bfd9cdbacc97e614ece01c0399
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue Nov 10 07:55:56 2015 -0500

    rehome OHI only foo

commit d4baae181bbb9067d27be9ee72928e35eae67dc7
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue Nov 10 07:33:09 2015 -0500

    do not build obfuscation until needed

diff --git a/src/detection/detect.cc b/src/detection/detect.cc
index c079dc4a4a6a6a2739f1766fd0186e2222e293e2..a720231728d072e61426ca781c3905e7f06f4828 100644 (file)
--- a/src/detection/detect.cc
+++ b/src/detection/detect.cc
@@ -127,6 +127,7 @@ void snort_inspect(Packet* p)
     }
     else
     {
+#ifdef BUILD_OBFUSCATION
         /* Not a completely ideal place for this since any entries added on
          * the packet callback trail will get obliterated - right now there
          * isn't anything adding entries there.  Really need it here for
@@ -136,6 +137,7 @@ void snort_inspect(Packet* p)
          * overflow if we don't reset it.  Putting it here does have the
          * advantage of fewer entries per logging cycle */
         obApi->resetObfuscationEntries();
+#endif
 
         do_detect = do_detect_content = 1;
 

diff --git a/src/detection/detection_util.h b/src/detection/detection_util.h
index 42708a362b79908fad66d6215e014f3924fcd063..556e30d38fe1a06ccf48b4e0b023c2851794d1e3 100644 (file)
--- a/src/detection/detection_util.h
+++ b/src/detection/detection_util.h
@@ -35,32 +35,6 @@
 
 #define DECODE_BLEN 65535
 
-// FIXIT-L this is now used only by http_inspect and should be relocated accordingly
-enum HTTP_BUFFER
-{
-    HTTP_BUFFER_NONE,
-    HTTP_BUFFER_CLIENT_BODY,
-    HTTP_BUFFER_COOKIE,
-    HTTP_BUFFER_HEADER,
-    HTTP_BUFFER_METHOD,
-    HTTP_BUFFER_RAW_COOKIE,
-    HTTP_BUFFER_RAW_HEADER,
-    HTTP_BUFFER_RAW_URI,
-    HTTP_BUFFER_STAT_CODE,
-    HTTP_BUFFER_STAT_MSG,
-    HTTP_BUFFER_URI,
-    HTTP_BUFFER_MAX
-};
-
-// FIXIT-L this is now used only by http_inspect
-// and should be relocated accordingly
-struct HttpBuffer
-{
-    const uint8_t* buf;
-    unsigned length;
-    uint32_t encode_type;
-};
-
 struct DataPointer
 {
     uint8_t* data;

diff --git a/src/log/CMakeLists.txt b/src/log/CMakeLists.txt
index eb653591033db4fb7372dbe0e659a6b805bbdecf..b358cb996c8e877a6277f94041f32966e38045a6 100644 (file)
--- a/src/log/CMakeLists.txt
+++ b/src/log/CMakeLists.txt
@@ -2,7 +2,7 @@
 
 set (LOG_INCLUDES
     messages.h
-    obfuscation.h
+#   obfuscation.h
     text_log.h
 )
 
@@ -13,7 +13,7 @@ add_library ( log STATIC
     log_text.cc
     log_text.h
     messages.cc
-    obfuscation.cc
+#   obfuscation.cc
     text_log.cc
 )
 

diff --git a/src/log/Makefile.am b/src/log/Makefile.am
index 6f019b3741283fa4f549d14f8a1529efc552be17..0ae868b4396a6dcd72c4dc726571abdcf28a9fb9 100644 (file)
--- a/src/log/Makefile.am
+++ b/src/log/Makefile.am
@@ -5,7 +5,6 @@ x_includedir = $(pkgincludedir)/log
 
 x_include_HEADERS = \
 messages.h \
-obfuscation.h \
 text_log.h
 
 liblog_a_SOURCES = \
@@ -14,9 +13,12 @@ log.h \
 log_text.cc \
 log_text.h \
 messages.cc \
-obfuscation.cc \
 text_log.cc
 
+EXTRA_DIST = \
+obfuscation.h \
+obfuscation.cc
+
 #liblog_a_CXXFLAGS = $(AM_CXXFLAGS) -fvisibility=default
 
 AM_CXXFLAGS = @AM_CXXFLAGS@

diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index 886c80d71d7935bf83000a4bdf93c7c96940927b..92f546d8fbc7db728377d3550284d831a922a4f8 100644 (file)
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -1380,6 +1380,7 @@ void LogDiv(TextLog* log)
     TextLog_Print(log, "%s\n", SEPARATOR);
 }
 
+#ifdef BUILD_OBFUSCATION
 static int LogObfuscatedData(TextLog* log, Packet* p)
 {
     uint8_t* payload = NULL;
@@ -1416,6 +1417,7 @@ static int LogObfuscatedData(TextLog* log, Packet* p)
     free(payload);
     return 0;
 }
+#endif
 
 /*--------------------------------------------------------------------
  * Function: LogIPPkt(TextLog*, int, Packet *)
@@ -1508,11 +1510,13 @@ void LogIPPkt(TextLog* log, Packet* p)
 
 void LogPayload(TextLog* log, Packet* p)
 {
+#ifdef BUILD_OBFUSCATION
     if ((p->dsize > 0) && obApi->payloadObfuscationRequired(p)
         && (LogObfuscatedData(log, p) == 0))
     {
         return;
     }
+#endif
 
     /* dump the application layer data */
     if (SnortConfig::output_app_data() && !SnortConfig::verbose_byte_dump())

diff --git a/src/log/obfuscation.h b/src/log/obfuscation.h
index bd8873dd24bb41a040e633cbcecf2a4866c81944..1b5bae805854394a4ce097862b5d665f4dccc156 100644 (file)
--- a/src/log/obfuscation.h
+++ b/src/log/obfuscation.h
@@ -20,6 +20,13 @@
 #ifndef OBFUSCATION_H
 #define OBFUSCATION_H
 
+// BUILD_OBFUSCATION is not defined because nothing creates obfuscation
+// entries.  when sdf is ported, BUILD_OBFUSCATION should be deleted so the
+// full code is built.  at that time the api should be turned into an
+// obfuscator class and the test code should be replaced with actual unit
+// tests.  #ifdef BUILD_OBFUSCATION is used in detect.cc, log_text.cc, and
+// unified2.cc.
+
 extern "C" {
 #include <daq.h>
 }

diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc
index 1e0b28ef4446966ae43c59d292f00aa748dab3f6..8e98e4b857e6d9c89844f04c7e1100b032aebe73 100644 (file)
--- a/src/loggers/unified2.cc
+++ b/src/loggers/unified2.cc
@@ -131,8 +131,10 @@ static void Unified2Write(uint8_t*, uint32_t, Unified2Config*);
 static void _AlertIP4_v2(Packet*, const char*, Unified2Config*, Event*);
 static void _AlertIP6_v2(Packet*, const char*, Unified2Config*, Event*);
 
+#ifdef BUILD_OBFUSCATION
 static ObRet Unified2LogObfuscationCallback(const DAQ_PktHdr_t* pkth,
     const uint8_t* packet_data, ob_size_t length, ob_char_t ob_char, void* userdata);
+#endif
 
 static void AlertExtraData(Flow*, void* data, LogFunction* log_funcs, uint32_t max_count, uint32_t
     xtradata_mask, uint32_t event_id, uint32_t event_second);
@@ -558,6 +560,7 @@ static void _Unified2LogPacketAlert(
         logheader.event_second = 0;
     }
 
+#ifdef BUILD_OBFUSCATION
     if ( p and p->pkth and obApi->payloadObfuscationRequired(p) )
     {
         Unified2LogCallbackData unifiedData;
@@ -576,6 +579,7 @@ static void _Unified2LogPacketAlert(
             return;
         }
     }
+#endif
 
     if ( p and p->pkth )
     {
@@ -632,6 +636,7 @@ static void _Unified2LogPacketAlert(
     Unified2Write(write_pkt_buffer, write_len, config);
 }
 
+#ifdef BUILD_OBFUSCATION
 static ObRet Unified2LogObfuscationCallback(const DAQ_PktHdr_t* pkth,
     const uint8_t* packet_data, ob_size_t length,
     ob_char_t ob_char, void* userdata)
@@ -720,6 +725,7 @@ static ObRet Unified2LogObfuscationCallback(const DAQ_PktHdr_t* pkth,
 
     return OB_RET_SUCCESS;
 }
+#endif
 
 /******************************************************************************
  * Function: Unified2Write()

diff --git a/src/service_inspectors/http_inspect/hi_main.h b/src/service_inspectors/http_inspect/hi_main.h
index 2c50bf9781dc96ca6c0574b0198eb427bebf6164..f76684c867adbbf37a212ec0acc2f056f4dedd07 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_main.h
+++ b/src/service_inspectors/http_inspect/hi_main.h
@@ -50,6 +50,29 @@
 #define DEFLATE_WBITS      15
 #define GZIP_WBITS         31
 
+enum HTTP_BUFFER
+{
+    HTTP_BUFFER_NONE,
+    HTTP_BUFFER_CLIENT_BODY,
+    HTTP_BUFFER_COOKIE,
+    HTTP_BUFFER_HEADER,
+    HTTP_BUFFER_METHOD,
+    HTTP_BUFFER_RAW_COOKIE,
+    HTTP_BUFFER_RAW_HEADER,
+    HTTP_BUFFER_RAW_URI,
+    HTTP_BUFFER_STAT_CODE,
+    HTTP_BUFFER_STAT_MSG,
+    HTTP_BUFFER_URI,
+    HTTP_BUFFER_MAX
+};
+
+struct HttpBuffer
+{
+    const uint8_t* buf;
+    unsigned length;
+    uint32_t encode_type;
+};
+
 extern SO_PUBLIC THREAD_LOCAL uint32_t http_mask;
 extern SO_PUBLIC THREAD_LOCAL HttpBuffer http_buffer[HTTP_BUFFER_MAX];
 extern THREAD_LOCAL DataBuffer HttpDecodeBuf;