more detect buffer cleanup

diff --git a/ChangeLog b/ChangeLog
index 0850cc328de32dbf4832e090c231fa103a62c71f..bdbe385c26604f2fe140b19a3ffbf34224a2ebf8 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+92
+-- fixed fast_pattern only auto configuration
+-- more detection buffer cleanup
+
 91
 -- eliminated more RULE_OPTION_TYPE_*
 -- converted remaining rule options over to use cursor
@@ -5,7 +9,6 @@
 -- finally eliminated doe_ptr and friends ... yay!
 -- merged ips_option_base64_{data,decode}.cc
 -- fast_pattern_only (previously fast_pattern:only) is gone
-   (delete the option, Snort will figure it out)
 
 90
 -- added InspectApi.buffers and Inspector::getbuf()

diff --git a/src/detection/detect.cc b/src/detection/detect.cc
index e7715b8bf6c1654d6c3257265240e7c4b9653a1e..3393dc1209e75d1f443f51b1b6c3f6acdc2aa72b 100644 (file)
--- a/src/detection/detect.cc
+++ b/src/detection/detect.cc
@@ -139,7 +139,6 @@ void snort_inspect(Packet* p)
         /*
         **  Reset the appropriate application-layer protocol fields
         */
-        ClearHttpBuffers();
         p->alt_dsize = 0;
         DetectReset();
 

diff --git a/src/detection/detection_util.cc b/src/detection/detection_util.cc
index a3bcb32b5100638a1af312aed109eacde5bafb84..6f9888de746637d255312a8f3da258f0720007f1 100644 (file)
--- a/src/detection/detection_util.cc
+++ b/src/detection/detection_util.cc
@@ -30,8 +30,8 @@
 THREAD_LOCAL uint32_t http_mask;
 THREAD_LOCAL HttpBuffer http_buffer[HTTP_BUFFER_MAX];
 
-THREAD_LOCAL DataPointer file_data_ptr;
-THREAD_LOCAL DataBuffer DecodeBuffer;
+THREAD_LOCAL DataPointer g_alt_data;
+THREAD_LOCAL DataPointer g_file_data;
 
 const char* http_buffer_name[HTTP_BUFFER_MAX] =
 {

diff --git a/src/detection/detection_util.h b/src/detection/detection_util.h
index f3ee9f92047f5a5101d2c6f66a9c0f888f66d8f5..1b84e178c538064650a2b5a09d6b7b350a1586b8 100644 (file)
--- a/src/detection/detection_util.h
+++ b/src/detection/detection_util.h
@@ -37,13 +37,9 @@
 #include "detect.h"
 #include "snort.h"
 #include "snort_debug.h"
-#include "treenodes.h"
 
-#ifndef DECODE_BLEN
 #define DECODE_BLEN 65535
 
-#define MAX_URI 8192
-
 enum HTTP_BUFFER
 {
     HTTP_BUFFER_NONE,
@@ -59,39 +55,32 @@ enum HTTP_BUFFER
     HTTP_BUFFER_URI,
     HTTP_BUFFER_MAX
 };
-#endif
-
-enum DetectFlagType
-{
-    FLAG_ALT_DECODE         = 0x0001,
-    FLAG_DETECT_ALL         = 0xffff
-};
 
 struct HttpBuffer
 {
     const uint8_t* buf;
-    uint16_t length;
+    unsigned length;
     uint32_t encode_type;
 };
 
 struct DataPointer
 {
     uint8_t *data;
-    uint16_t len;
+    unsigned len;
 };
 
 struct DataBuffer
 {
     uint8_t data[DECODE_BLEN];
-    uint16_t len;
+    unsigned len;
 };
 
 extern THREAD_LOCAL uint32_t http_mask;
 extern THREAD_LOCAL HttpBuffer http_buffer[HTTP_BUFFER_MAX];
 extern const char* http_buffer_name[HTTP_BUFFER_MAX];
 
-extern THREAD_LOCAL DataPointer file_data_ptr;
-extern THREAD_LOCAL DataBuffer DecodeBuffer;
+extern THREAD_LOCAL DataPointer g_alt_data;
+extern THREAD_LOCAL DataPointer g_file_data;
 
 static inline void ClearHttpBuffers (void)
 {
@@ -135,10 +124,16 @@ static inline void SetHttpBuffer (HTTP_BUFFER b, const uint8_t* buf, unsigned le
 
 #define IsLimitedDetect(pktPtr) (pktPtr->packet_flags & PKT_HTTP_DECODE)
 
-static inline void setFileDataPtr(uint8_t *ptr, uint16_t decode_size)
+static inline void set_alt_data(uint8_t* p, unsigned n)
 {
-    file_data_ptr.data = ptr;
-    file_data_ptr.len = decode_size;
+    g_alt_data.data = p;
+    g_alt_data.len = n;
+}
+
+static inline void set_file_data(uint8_t* p, unsigned n)
+{
+    g_file_data.data = p;
+    g_file_data.len = n;
 }
 
 void EventTrace_Init(void);
@@ -151,16 +146,11 @@ static inline int EventTrace_IsEnabled (void)
     return ( snort_conf->event_trace_max > 0 );
 }
 
-static inline void SetAltDecode(uint16_t altLen)
-{
-    DecodeBuffer.len = altLen;
-}
-
 static inline void DetectReset()
 {
-    file_data_ptr.data  = NULL;
-    file_data_ptr.len = 0;
-    DecodeBuffer.len = 0;
+    g_alt_data.len = 0;
+    g_file_data.len = 0;
+    ClearHttpBuffers();
 }
 
 int IsGzipData(Flow*);  // FIXIT these from HI

diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc
index e48670dc78e5152d37b3dac5965edc1c16e4215d..86399a98a309d3069b863bb5b0b88bb1f8de1b9b 100644 (file)
--- a/src/detection/fpdetect.cc
+++ b/src/detection/fpdetect.cc
@@ -1080,11 +1080,11 @@ static inline int fpEvalHeaderSW(PORT_GROUP *port_group, Packet *p,
 
             if ( so && so->get_pattern_count() > 0 )
             {
-                if ( DecodeBuffer.len )
+                if(g_alt_data.len)
                 {
                     start_state = 0;
-                    so->search(DecodeBuffer.data, DecodeBuffer.len,
-                            rule_tree_match, omd, &start_state);
+                    so->search(g_alt_data.data, g_alt_data.len,
+                        rule_tree_match, omd, &start_state);
 #ifdef PPM_MGR
                     /* Bail if we spent too much time already */
                     if (PPM_PACKET_ABORT_FLAG())
@@ -1092,11 +1092,10 @@ static inline int fpEvalHeaderSW(PORT_GROUP *port_group, Packet *p,
 #endif
                 }
 
-                /* Adding this extra search on file data since we no more use DecodeBuffer to decode now*/
-                if(file_data_ptr.len)
+                if(g_file_data.len)
                 {
                     start_state = 0;
-                    so->search(file_data_ptr.data, file_data_ptr.len,
+                    so->search(g_file_data.data, g_file_data.len,
                         rule_tree_match, omd, &start_state);
 #ifdef PPM_MGR
                     /* Bail if we spent too much time already */

diff --git a/src/file_api/file_mime_process.cc b/src/file_api/file_mime_process.cc
index 7832c67bacd0410b912aafb702d50f961a85aa6f..c5d2b1498d5ed624e16150bd9f8aa6a5981e1d62 100644 (file)
--- a/src/file_api/file_mime_process.cc
+++ b/src/file_api/file_mime_process.cc
@@ -941,7 +941,7 @@ const uint8_t * process_mime_data(void *packet, const uint8_t *start, const uint
     }
      */
 
-    setFileDataPtr((uint8_t*)start, (uint16_t)(data_end - start));
+    set_file_data((uint8_t*)start, (data_end - start));
 
     if ((mime_ssn->data_state == STATE_DATA_HEADER) ||
             (mime_ssn->data_state == STATE_DATA_UNKNOWN))
@@ -977,7 +977,7 @@ const uint8_t * process_mime_data(void *packet, const uint8_t *start, const uint
             int detection_size = getDetectionSize(conf->b64_depth, conf->qp_depth,
                     conf->uu_depth, conf->bitenc_depth, (Email_DecodeState *)(mime_ssn->decode_state) );
 
-            setFileDataPtr(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, (uint16_t)detection_size);
+            set_file_data(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, detection_size);
             /*Process file type/file signature*/
             if (file_api->file_process(p,(uint8_t *)((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr,
                     (uint16_t)((Email_DecodeState *)(mime_ssn->decode_state))->decoded_bytes, position, upload, false)
@@ -1016,11 +1016,11 @@ const uint8_t * process_mime_data(void *packet, const uint8_t *start, const uint
             DecodeConfig *conf= mime_ssn->decode_conf;
             int detection_size = getDetectionSize(conf->b64_depth, conf->qp_depth,
                     conf->uu_depth, conf->bitenc_depth, (Email_DecodeState *)(mime_ssn->decode_state) );
-            setFileDataPtr(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, (uint16_t)detection_size);
+            set_file_data(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, detection_size);
         }
         else
         {
-            setFileDataPtr(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, 0);
+            set_file_data(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, 0);
         }
         if ((data_end_marker != end)||(mime_ssn->state_flags & MIME_FLAG_MIME_END))
         {

diff --git a/src/framework/cursor.cc b/src/framework/cursor.cc
index 82bf271f2c152a4ca18e569888865277bb63c25d..3288590a39cbe7957620687e6bb65b9ba71b2541 100644 (file)
--- a/src/framework/cursor.cc
+++ b/src/framework/cursor.cc
@@ -35,9 +35,9 @@ Cursor::Cursor(const Cursor& rhs)
 
 void Cursor::reset(Packet* p)
 {
-    if ( DecodeBuffer.len )
+    if ( g_alt_data.len )
     {
-        set("pkt_data", (uint8_t *)DecodeBuffer.data, DecodeBuffer.len);
+        set("pkt_data", g_alt_data.data, g_alt_data.len);
     }
     else if( IsLimitedDetect(p) )
     {

diff --git a/src/ips_options/ips_file_data.cc b/src/ips_options/ips_file_data.cc
index 80c35bd2ef49b1e2312d213bc101dd665979321b..6d65e412eca1eaf3b942504bdfea8c5c79d2bafa 100644 (file)
--- a/src/ips_options/ips_file_data.cc
+++ b/src/ips_options/ips_file_data.cc
@@ -81,8 +81,8 @@ int FileDataOption::eval(Cursor& c, Packet*)
     PROFILE_VARS;
     PREPROC_PROFILE_START(fileDataPerfStats);
 
-    data = file_data_ptr.data;
-    len = file_data_ptr.len;
+    data = g_file_data.data;
+    len = g_file_data.len;
 
     if ( (data == NULL)|| (len == 0) )
     {

diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index 3d2c2611073b6e144136aa607abfd343c75d53f7..85234632af89b6ce2189c261b323e51d65ec634f 100644 (file)
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -1762,12 +1762,12 @@ void LogIPPkt(TextLog* log, int type, Packet * p)
             if(!IsJSNormData(p->flow))
             {
                 TextLog_Print(log, "%s\n", "Normalized JavaScript for this packet");
-                LogCharData(log, (char *)file_data_ptr.data, file_data_ptr.len);
+                LogCharData(log, (char *)g_file_data.data, g_file_data.len);
             }
             else if(!IsGzipData(p->flow))
             {
                 TextLog_Print(log, "%s\n", "Decompressed Data for this packet");
-                LogCharData(log, (char *)file_data_ptr.data, file_data_ptr.len);
+                LogCharData(log, (char *)g_file_data.data, g_file_data.len);
             }
         }
         else
@@ -1776,12 +1776,12 @@ void LogIPPkt(TextLog* log, int type, Packet * p)
             if(!IsJSNormData(p->flow))
             {
                 TextLog_Print(log, "%s\n", "Normalized JavaScript for this packet");
-                LogNetData(log, file_data_ptr.data, file_data_ptr.len, NULL);
+                LogNetData(log, g_file_data.data, g_file_data.len, NULL);
             }
             else if(!IsGzipData(p->flow))
             {
                 TextLog_Print(log, "%s\n", "Decompressed Data for this packet");
-                LogNetData(log, file_data_ptr.data, file_data_ptr.len, NULL);
+                LogNetData(log, g_file_data.data, g_file_data.len, NULL);
             }
         }
     }

diff --git a/src/service_inspectors/ftp_telnet/ftp.cc b/src/service_inspectors/ftp_telnet/ftp.cc
index 51ef27ebc93a65e8508473cbe70761be8498128c..0fb8af39659335d2f82ccd2177fbb29fc5d7baef 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftp.cc
+++ b/src/service_inspectors/ftp_telnet/ftp.cc
@@ -94,7 +94,7 @@ static void FTPDataProcess(Packet *p, FTP_DATA_SESSION *data_ssn)
 {
     int status;
 
-    setFileDataPtr((uint8_t *)p->data, (uint16_t)p->dsize);
+    set_file_data((uint8_t *)p->data, p->dsize);
 
     status = file_api->file_process(p, (uint8_t *)p->data,
         (uint16_t)p->dsize, data_ssn->position, data_ssn->direction, false);

diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc
index 366d8a4fad3108df28b538336fcc4ded48f03a3b..a036d1777347ed1bd86360978e55783b445ecbf6 100644 (file)
--- a/src/service_inspectors/ftp_telnet/pp_ftp.cc
+++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc
@@ -62,6 +62,8 @@
 
 #include "ipv6_port.h"
 
+static THREAD_LOCAL DataBuffer DecodeBuffer;
+
 /*
  * Used to keep track of pipelined commands and the last one
  * that resulted in a

diff --git a/src/service_inspectors/ftp_telnet/pp_telnet.cc b/src/service_inspectors/ftp_telnet/pp_telnet.cc
index 68aa7261ed85a96e68fad18d935ee09910152e18..ec0a9bb8280213e591e9449294d44701a9e3d743 100644 (file)
--- a/src/service_inspectors/ftp_telnet/pp_telnet.cc
+++ b/src/service_inspectors/ftp_telnet/pp_telnet.cc
@@ -66,6 +66,8 @@
  */
 #define CONSECUTIVE_8BIT_THRESHOLD 3
 
+static THREAD_LOCAL DataBuffer DecodeBuffer;
+
 /*
  * Function: normalize_telnet(Packet *)
  *
@@ -419,11 +421,7 @@ int normalize_telnet(
         }
     }
 
-    SetAltDecode((uint16_t)(write_ptr - start));
+    set_alt_data(DecodeBuffer.data, (uint16_t)(write_ptr - start));
 
-    /* DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET,
-        "Converted buffer after telnet normalization:\n");
-    LogNetData(DecodeBuffer.data, DecodeBuffer.len, NULL););
-    */
     return ret;
 }

diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc
index 0df997ae0040b518e26490faf5a0f3579d984c46..2b9ce3c89b42d451f271b7f05931fdbdb67ed624 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_main.cc
+++ b/src/service_inspectors/http_inspect/hi_main.cc
@@ -1012,7 +1012,7 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet *p)
                      detect_data_size = 0;
                  }
 
-                 setFileDataPtr((uint8_t *)session->server.response.body, (uint16_t)detect_data_size);
+                 set_file_data((uint8_t *)session->server.response.body, detect_data_size);
 
                  if (PacketHasPAFPayload(p)
                      && file_api->file_process(p,(uint8_t *)session->server.response.body, (uint16_t)session->server.response.body_size,
@@ -1142,7 +1142,7 @@ int IsGzipData(Flow* flow)
     if(hsd == NULL)
         return -1;
 
-    if((hsd->log_flags & HTTP_LOG_GZIP_DATA) && (file_data_ptr.len > 0 ))
+    if((hsd->log_flags & HTTP_LOG_GZIP_DATA) && (g_file_data.len > 0 ))
         return 0;
     else
         return -1;
@@ -1153,8 +1153,8 @@ int GetHttpGzipData(Flow* flow, uint8_t **buf, uint32_t *len, uint32_t *type)
 {
     if(!IsGzipData(flow))
     {
-        *buf = file_data_ptr.data;
-        *len = file_data_ptr.len;
+        *buf = g_file_data.data;
+        *len = g_file_data.len;
         *type = EVENT_INFO_GZIP_DATA;
         return 1;
     }
@@ -1175,7 +1175,7 @@ int IsJSNormData(Flow* flow)
     if(hsd == NULL)
         return -1;
 
-    if((hsd->log_flags & HTTP_LOG_JSNORM_DATA) && (file_data_ptr.len > 0 ))
+    if((hsd->log_flags & HTTP_LOG_JSNORM_DATA) && (g_file_data.len > 0 ))
         return 0;
     else
         return -1;
@@ -1186,8 +1186,8 @@ int GetHttpJSNormData(Flow* flow, uint8_t **buf, uint32_t *len, uint32_t *type)
 {
     if(!IsJSNormData(flow))
     {
-        *buf = file_data_ptr.data;
-        *len = file_data_ptr.len;
+        *buf = g_file_data.data;
+        *len = g_file_data.len;
         *type = EVENT_INFO_JSNORM_DATA;
         return 1;
     }

diff --git a/src/service_inspectors/http_inspect/hi_norm.h b/src/service_inspectors/http_inspect/hi_norm.h
index 1cc6b5f685751fa70337d2bc204534cf06947097..0f04372ae6ed8ad25727b202483e67e57d0a7232 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_norm.h
+++ b/src/service_inspectors/http_inspect/hi_norm.h
@@ -41,6 +41,8 @@
 #include "hi_ui_config.h"
 #include "hi_si.h"
 
+#define MAX_URI 8192
+
 int hi_normalization(HI_SESSION *session, int iInspectMode, HttpsessionData *hsd);
 int hi_norm_uri(HI_SESSION *session, u_char *uribuf,int *uribuf_size,
                 const u_char *uri, int uri_size, uint16_t *encodeType);

diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc
index 805d6d1c2eefd0bed85b8ad505ec3da3416d80fc..4554970429d7e19ba03f6c104337addfc03efd72 100644 (file)
--- a/src/service_inspectors/rpc_decode/rpc_decode.cc
+++ b/src/service_inspectors/rpc_decode/rpc_decode.cc
@@ -67,6 +67,8 @@
 #define RPC_FRAG_HDR_SIZE  sizeof(uint32_t)
 #define RPC_FRAG_LEN(ptr)  (ntohl(*((uint32_t *)ptr)) & 0x7FFFFFFF)
 
+static THREAD_LOCAL DataBuffer DecodeBuffer;
+
 using namespace std;
 
 struct RpcDecodeConfig
@@ -477,7 +479,7 @@ static RpcStatus RpcPrepRaw(const uint8_t *data, uint32_t fraglen, Packet*)
         return RPC_STATUS__ERROR;
     }
 
-    SetAltDecode((uint16_t)(RPC_FRAG_HDR_SIZE + fraglen));
+    set_alt_data(DecodeBuffer.data, (RPC_FRAG_HDR_SIZE + fraglen));
 
     return RPC_STATUS__SUCCESS;
 }
@@ -506,7 +508,7 @@ static RpcStatus RpcPrepFrag(RpcSsnData *rsdata, Packet*)
         return RPC_STATUS__ERROR;
     }
 
-    SetAltDecode((uint16_t)RpcBufLen(&rsdata->frag));
+    set_alt_data(DecodeBuffer.data, RpcBufLen(&rsdata->frag));
 
     if (RpcBufLen(&rsdata->frag) > RPC_MAX_BUF_SIZE)
         RpcBufClean(&rsdata->frag);
@@ -530,7 +532,7 @@ static RpcStatus RpcPrepSeg(RpcSsnData *rsdata, Packet*)
         return RPC_STATUS__ERROR;
     }
 
-    SetAltDecode((uint16_t)RpcBufLen(&rsdata->seg));
+    set_alt_data(DecodeBuffer.data, RpcBufLen(&rsdata->seg));
 
     if (RpcBufLen(&rsdata->seg) > RPC_MAX_BUF_SIZE)
     {
@@ -976,7 +978,7 @@ static int ConvertRPC(RpcDecodeConfig *rconfig, RpcSsnData *rsdata, Packet *p)
                //LogNetData(data, decoded_len, NULL);
                );
 
-    SetAltDecode((uint16_t)decoded_len);
+    set_alt_data(DecodeBuffer.data, decoded_len);
 
     return 0;
 }