Merge pull request #2274 in SNORT/snort3 from ~PRBHALER/snort3:xff to master

Squashed commit of the following:

commit 9c8ca841e2f622eb74e04eef40fbf0d80d864cdd
Author: Pranav Bhalerao <prbhaler@cisco.com>
Date:   Fri Jul 10 13:10:58 2020 -0400

    pub_sub: Added a method in HttpEvent to retrieve true client-ip address from HTTP header based on priority.

diff --git a/src/pub_sub/http_events.cc b/src/pub_sub/http_events.cc
index 8e23eb9763a18b1348ffa51a00421809d4ab2c61..04ff17045ee29aaaf43f4e924fed511576956fdd 100644 (file)
--- a/src/pub_sub/http_events.cc
+++ b/src/pub_sub/http_events.cc
@@ -92,6 +92,21 @@ const uint8_t* HttpEvent::get_server(int32_t& length)
         length);
 }
 
+const uint8_t* HttpEvent::get_trueip_addr(int32_t& length)
+{
+    const Field& field = http_msg_header->get_true_ip_addr();
+    if (field.length() > 0)
+    {
+        length = field.length();
+        return field.start();
+    }
+    else
+    {
+        length = 0;
+        return nullptr;
+    }
+}
+
 const uint8_t* HttpEvent::get_uri(int32_t& length)
 {
     return get_header(HttpEnums::HTTP_BUFFER_URI, 0, length);

diff --git a/src/pub_sub/http_events.h b/src/pub_sub/http_events.h
index 7f6ecca62714d10611fe151b5bb8c47ae69fdb4f..e5038d5b999b8b8a6b4ad42cd1369d5bd53655da 100644 (file)
--- a/src/pub_sub/http_events.h
+++ b/src/pub_sub/http_events.h
@@ -46,6 +46,7 @@ public:
     const uint8_t* get_location(int32_t &length);
     const uint8_t* get_referer(int32_t &length);
     const uint8_t* get_server(int32_t &length);
+    const uint8_t* get_trueip_addr(int32_t& length);
     const uint8_t* get_uri(int32_t &length);
     const uint8_t* get_user_agent(int32_t &length);
     const uint8_t* get_via(int32_t &length);

diff --git a/src/pub_sub/test/pub_sub_http_event_test.cc b/src/pub_sub/test/pub_sub_http_event_test.cc
index 7d20bc7a0db07dc8233126ac45603359136d2978..fac9e4b3738f70c3783d4be988d8816c6106350f 100644 (file)
--- a/src/pub_sub/test/pub_sub_http_event_test.cc
+++ b/src/pub_sub/test/pub_sub_http_event_test.cc
@@ -25,6 +25,7 @@
 
 #include "pub_sub/http_events.h"
 #include "service_inspectors/http_inspect/http_common.h"
+#include "service_inspectors/http_inspect/http_msg_header.h"
 #include "service_inspectors/http_inspect/http_msg_section.h"
 #include "service_inspectors/http_inspect/http_field.h"
 
@@ -36,14 +37,33 @@ using namespace snort;
 using namespace HttpCommon;
 
 // Stubs to make the code link
+void Field::set(const Field& input)
+{
+    strt = input.strt;
+    len = input.len;
+}
+
 const Field Field::FIELD_NULL { STAT_NO_SOURCE };
 const Field& HttpMsgSection::get_classic_buffer(unsigned, uint64_t, uint64_t)
 { return Field::FIELD_NULL; }
+const Field& HttpMsgHeader::get_true_ip_addr()
+{
+    Field *out = (Field*)mock().getData("output").getObjectPointer();
+    return (*out);
+}
 
 TEST_GROUP(pub_sub_http_event_test)
 {
-};
+    void setup() override
+    {
+        mock().setDataObject("output", "Field", nullptr);
+    }
 
+    void teardown() override
+    {
+        mock().clear();
+    }
+};
 
 TEST(pub_sub_http_event_test, http_traffic)
 {
@@ -61,6 +81,32 @@ TEST(pub_sub_http_event_test, http2_traffic)
     CHECK(event.get_http2_stream_id() == stream_id);
 }
 
+TEST(pub_sub_http_event_test, no_true_ip_addr)
+{
+    const uint8_t* header_start;
+    int32_t header_length;
+    Field input(0, nullptr);
+    mock().setDataObject("output", "Field", &input);
+    HttpEvent event(nullptr, false, 0);
+    header_start = event.get_trueip_addr(header_length);
+    CHECK(header_length == 0);
+    CHECK(header_start == nullptr);
+    mock().checkExpectations();
+}
+
+TEST(pub_sub_http_event_test, true_ip_addr)
+{
+    const uint8_t* header_start;
+    int32_t header_length;
+    Field input(7, (const uint8_t*) "1.1.1.1");
+    mock().setDataObject("output", "Field", &input);
+    HttpEvent event(nullptr, false, 0);
+    header_start = event.get_trueip_addr(header_length);
+    CHECK(header_length == 7);
+    CHECK(memcmp(header_start, "1.1.1.1", 7) == 0);
+    mock().checkExpectations();
+}
+
 int main(int argc, char** argv)
 {
     return CommandLineTestRunner::RunAllTests(argc, argv);