*/
// nhttp_api.cc author Tom Peters <thopeter@cisco.com>
-#include <assert.h>
#include <string.h>
#include <sys/types.h>
const char* NHttpApi::nhttp_my_name = "nhttp_inspect";
const char* NHttpApi::nhttp_help = "the new HTTP inspector!";
-void NHttpApi::nhttp_init()
-{
- NHttpFlowData::init();
-}
-
Inspector* NHttpApi::nhttp_ctor(Module* mod)
{
- const NHttpModule* nhttpMod = (NHttpModule*) mod;
- return new NHttpInspect(nhttpMod->get_test_input(), nhttpMod->get_test_output());
+ const NHttpModule* const nhttp_mod = (NHttpModule*) mod;
+ return new NHttpInspect(nhttp_mod->get_test_input(), nhttp_mod->get_test_output());
}
-static const char* buffers[] =
+static const char* legacy_buffers[] =
{
"http_client_body",
"http_cookie",
},
IT_SERVICE,
(uint16_t)PktType::TCP,
- buffers,
+ legacy_buffers,
"http",
NHttpApi::nhttp_init,
NHttpApi::nhttp_term,
static void nhttp_mod_dtor(Module* m) { delete m; };
static const char* nhttp_my_name;
static const char* nhttp_help;
- static void nhttp_init();
+ static void nhttp_init() { NHttpFlowData::init(); };
static void nhttp_term() {};
static Inspector* nhttp_ctor(Module* mod);
static void nhttp_dtor(Inspector* p) { delete p; };
if ((length == STAT_NOTPRESENT) || (length == STAT_NOTCOMPUTE) || (length == STAT_NOSOURCE)) {
return;
}
- int out_count = fprintf(output, "%s, length = %d, ", name, length);
+ const int out_count = fprintf(output, "%s, length = %d, ", name, length);
if (length <= 0) {
fprintf(output, "\n");
return;
}
- int32_t print_length = (length <= 1200) ? length : 1200; // Limit the amount of data printed
+ const int32_t print_length = (length <= 1200) ? length : 1200; // Limit the amount of data printed
for (int k=0; k < print_length; k++) {
if ((start[k] >= 0x20) && (start[k] <= 0x7E)) fprintf(output, "%c", (char)start[k]);
else if (start[k] == 0xD) fprintf(output, "~");
if (int_vals && (print_length%8 == 0)) {
fprintf(output, "\nInteger values =");
for (int j=0; j < print_length; j+=8) {
+ // FIXIT-L rewrite to eliminate doubtful cast
fprintf(output, " %" PRIu64 , *((const uint64_t*)(start+j)));
}
}
fprintf(output, "\n");
}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Field(int32_t length_, const uint8_t* start_) : length(length_), start(start_) {};
explicit Field(int32_t length_) : length(length_) { assert(length<=0); };
Field() = default;
- void print(FILE *output, const char* name, bool int_vals = false) const;
+ void print(FILE* output, const char* name, bool int_vals = false) const;
};
#endif
#include <stdio.h>
#include "stream/stream_api.h"
+#include "detection/detection_util.h"
+
#include "nhttp_enum.h"
#include "nhttp_msg_request.h"
#include "nhttp_msg_status.h"
*/
// nhttp_module.cc author Tom Peters <thopeter@cisco.com>
-#include <assert.h>
#include <string.h>
#include <sys/types.h>
#include "snort.h"
-#include "nhttp_enum.h"
#include "nhttp_module.h"
const Parameter NHttpModule::nhttp_params[] =
else {
return false;
}
-
return true;
}
#define NHTTP_MODULE_H
#include "framework/module.h"
+#include "nhttp_enum.h"
#define NHTTP_HELP "new HTTP inspector"
{
public:
NHttpModule() : Module("nhttp_inspect", NHTTP_HELP, nhttp_params) {};
- bool begin(const char*, int, SnortConfig*);
- bool end(const char*, int, SnortConfig*) { return true; };
- bool set(const char*, Value&, SnortConfig*);
- unsigned get_gid() const { return NHttpEnums::NHTTP_GID; };
- const RuleMap* get_rules() const { return nhttp_events; };
+ bool begin(const char*, int, SnortConfig*) override;
+ bool end(const char*, int, SnortConfig*) override { return true; };
+ bool set(const char*, Value&, SnortConfig*) override;
+ unsigned get_gid() const override { return NHttpEnums::NHTTP_GID; };
+ const RuleMap* get_rules() const override { return nhttp_events; };
bool get_test_input() const { return test_input; };
bool get_test_output() const { return test_output; };
#include <stdio.h>
#include "snort.h"
+#include "detection/detection_util.h"
+
#include "nhttp_enum.h"
#include "nhttp_msg_body.h"
public:
NHttpMsgBody(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
NHttpEnums::SourceId source_id_, bool buf_owner);
- void analyze();
- void print_section(FILE *output);
- void gen_events();
- void update_flow();
- void legacy_clients();
+ void analyze() override;
+ void print_section(FILE *output) override;
+ void gen_events() override;
+ void update_flow() override;
+ void legacy_clients() override;
protected:
int64_t data_length;
public:
NHttpMsgChunk(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
NHttpEnums::SourceId source_id_, bool buf_owner);
- void print_section(FILE *output);
- void gen_events();
- void update_flow();
+ void print_section(FILE *output) override;
+ void gen_events() override;
+ void update_flow() override;
};
#endif
class NHttpMsgHeadShared: public NHttpMsgSection {
public:
- void analyze();
- void gen_events();
+ void analyze() override;
+ void gen_events() override;
int32_t get_num_headers() const { return num_headers; };
const Field& get_headers() const { return msg_text; };
NHttpEnums::SourceId source_id_, bool buf_owner) :
NHttpMsgSection(buffer, buf_size, session_data_, source_id_, buf_owner) {};
- // Header normalization strategies. There should be one of these for every different way we can process
+ // Header normalization strategies. There should be one defined for every different way we can process
// a header field value.
static const HeaderNormalizer NORMALIZER_NIL;
static const HeaderNormalizer NORMALIZER_BASIC;
#include <stdio.h>
#include "snort.h"
+#include "detection/detection_util.h"
+
#include "nhttp_enum.h"
#include "nhttp_msg_request.h"
#include "nhttp_msg_header.h"
public:
NHttpMsgHeader(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
NHttpEnums::SourceId source_id_, bool buf_owner);
- void print_section(FILE *output);
- void gen_events();
- void update_flow();
- NHttpEnums::ProcessResult worth_detection();
- void legacy_clients();
+ void print_section(FILE *output) override;
+ void gen_events() override;
+ void update_flow() override;
+ NHttpEnums::ProcessResult worth_detection() override;
+ void legacy_clients() override;
};
#endif
#include <stdio.h>
#include "snort.h"
+#include "detection/detection_util.h"
+
#include "nhttp_enum.h"
#include "nhttp_msg_request.h"
#include "nhttp_msg_header.h"
NHttpMsgRequest(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
NHttpEnums::SourceId source_id_, bool buf_owner);
~NHttpMsgRequest() { delete uri; };
- void print_section(FILE *output);
- void gen_events();
- void update_flow();
- void legacy_clients();
+ void print_section(FILE *output) override;
+ void gen_events() override;
+ void update_flow() override;
+ void legacy_clients() override;
const Field& get_method() { return method; };
const Field& get_uri();
const Field& get_uri_norm_legacy();
private:
static const StrCode method_list[];
- void parse_start_line();
+ void parse_start_line() override;
void derive_method_id();
Field method;
#include <stdio.h>
#include "snort.h"
+#include "detection/detection_util.h"
+
#include "nhttp_enum.h"
#include "nhttp_transaction.h"
#include "nhttp_msg_section.h"
using namespace NHttpEnums;
NHttpMsgSection::NHttpMsgSection(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
- SourceId source_id_, bool buf_owner) :
+ SourceId source_id_, bool buf_owner) :
msg_text(buf_size, buffer),
session_data(session_data_),
source_id(source_id_),
}
void NHttpMsgSection::create_event(EventSid sid) {
- const uint32_t NHTTP_GID = 119;
SnortEventqAdd(NHTTP_GID, (uint32_t)sid);
events_generated |= (1 << (sid-1));
}
void NHttpMsgSection::legacy_request() {
- NHttpMsgRequest* request = transaction->get_request();
+ NHttpMsgRequest* const request = transaction->get_request();
if (request == nullptr) return;
if (request->get_method().length > 0) {
SetHttpBuffer(HTTP_BUFFER_METHOD, request->get_method().start, (unsigned)request->get_method().length);
}
void NHttpMsgSection::legacy_status() {
- NHttpMsgStatus* status = transaction->get_status();
+ NHttpMsgStatus* const status = transaction->get_status();
if (status == nullptr) return;
if (status->get_status_code().length > 0) {
SetHttpBuffer(HTTP_BUFFER_STAT_CODE, status->get_status_code().start, (unsigned)status->get_status_code().length);
}
void NHttpMsgSection::legacy_header(bool use_trailer) {
- NHttpMsgHeadShared* header = use_trailer ?
+ NHttpMsgHeadShared* const header = use_trailer ?
(NHttpMsgHeadShared*)transaction->get_trailer(source_id) :
(NHttpMsgHeadShared*)transaction->get_header(source_id);
if (header == nullptr) return;
#ifndef NHTTP_MSG_SECTION_H
#define NHTTP_MSG_SECTION_H
-#include "detection/detection_util.h"
#include "nhttp_scratch_pad.h"
#include "nhttp_field.h"
#include "nhttp_flow_data.h"
NHttpEnums::MethodId get_method_id() const { return method_id; };
protected:
- NHttpMsgSection(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
+ NHttpMsgSection(const uint8_t* buffer, const uint16_t buf_size, NHttpFlowData* session_data_,
NHttpEnums::SourceId source_id_, bool buf_owner);
// Convenience methods
- void print_message_title(FILE *output, const char *title) const;
- void print_message_wrapup(FILE *output) const;
+ void print_message_title(FILE* output, const char* title) const;
+ void print_message_wrapup(FILE* output) const;
void create_event(NHttpEnums::EventSid sid);
void legacy_request();
void legacy_status();
const bool tcp_close;
ScratchPad scratch_pad;
- // This is where all the derived values, extracted message parts, and normalized values are.
- // These are all scalars, buffer pointers, and buffer sizes. The actual buffers are in message buffer (raw pieces)
- // or the scratch_pad (normalized pieces).
uint64_t infractions;
uint64_t events_generated = 0;
NHttpEnums::VersionId version_id;
class NHttpMsgStart: public NHttpMsgSection {
public:
- void analyze();
- void gen_events();
- NHttpEnums::ProcessResult worth_detection();
+ void analyze() override;
+ void gen_events() override;
+ NHttpEnums::ProcessResult worth_detection() override;
protected:
NHttpMsgStart(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
#include <stdio.h>
#include "snort.h"
+#include "detection/detection_util.h"
+
#include "nhttp_enum.h"
#include "nhttp_msg_status.h"
#include "nhttp_msg_header.h"
public:
NHttpMsgStatus(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
NHttpEnums::SourceId source_id_, bool buf_owner);
- void analyze();
- void print_section(FILE *output);
- void gen_events();
- void update_flow();
- void legacy_clients();
+ void analyze() override;
+ void print_section(FILE *output) override;
+ void gen_events() override;
+ void update_flow() override;
+ void legacy_clients() override;
const Field& get_status_code() { return status_code; };
const Field& get_reason_phrase() { return reason_phrase; };
private:
- void parse_start_line();
+ void parse_start_line() override;
void derive_status_code_num();
Field status_code;
#include <stdio.h>
#include "snort.h"
+#include "detection/detection_util.h"
+
#include "nhttp_enum.h"
#include "nhttp_msg_trailer.h"
public:
NHttpMsgTrailer(const uint8_t *buffer, const uint16_t buf_size, NHttpFlowData *session_data_,
NHttpEnums::SourceId source_id_, bool buf_owner);
- void print_section(FILE *output);
- void gen_events();
- void update_flow();
- NHttpEnums::ProcessResult worth_detection();
- void legacy_clients();
+ void print_section(FILE *output) override;
+ void gen_events() override;
+ void update_flow() override;
+ NHttpEnums::ProcessResult worth_detection() override;
+ void legacy_clients() override;
};
#endif
// Request section: put the old transaction in the pipeline and replace it with a new transaction. If the pipeline
// overflows or underflows we stop using it and just delete the old transaction.
if (session_data->section_type[source_id] == SEC_REQUEST) {
- // When pipelining is not occurring the response should already have taken this tranaction and left nullptr.
+ // When pipelining is not occurring the response should already have taken this transaction and left nullptr.
if (session_data->transaction[SRC_CLIENT] != nullptr) {
if ((session_data->pipeline_overflow) || (session_data->pipeline_underflow)) {
delete session_data->transaction[SRC_CLIENT];
private:
static const StrCode scheme_list[];
- Field uri;
+ const Field uri;
const NHttpEnums::MethodId method_id;
Field scheme;
projects / thirdparty / snort3.git / commitdiff
