Merge pull request #1254 in SNORT/snort3 from appid_unknown3 to master

Squashed commit of the following:

commit 544e89030053a04dabdda61e1450eb3b45e8fbf0
Author: Silviu Minut <sminut@cisco.com>
Date:   Fri Jun 8 00:06:18 2018 -0400

    appid: fix broken appid_api_test.cc

commit ed4b625f846006702c31afc768fd4892ad75dbbb
Author: Silviu Minut <sminut@cisco.com>
Date:   Thu May 31 15:46:37 2018 -0400

    appid: port appid unknown fixes from snort2

    appid: attempt to fix bug when payload is set to UNKNOWN too early, even though navl would get it on the next packet.

    appid: make the code compatible with the latest version of snort2.

diff --git a/src/network_inspectors/appid/appid_api.cc b/src/network_inspectors/appid/appid_api.cc
index 09d3a410131d3fe4af2aa98367905509acb030a3..b97a1b11b289d4b9e676df175b3d96238e9c827a 100644 (file)
--- a/src/network_inspectors/appid/appid_api.cc
+++ b/src/network_inspectors/appid/appid_api.cc
@@ -241,13 +241,11 @@ bool AppIdApi::is_appid_available(Flow& flow)
 {
     if ( AppIdSession* asd = get_appid_session(flow) )
     {
-        if (asd->get_session_flags(APPID_SESSION_NO_TPI))
-            return true;
-        // FIXIT-M: If a third-party module is not available then this
-        //          should probably check if an appId has been discovered
-        //          by the local AppId module.
-        return asd->is_tp_appid_available();
-    }
+        return ( (asd->service.get_id() != APP_ID_NONE ||
+                  asd->payload.get_id() != APP_ID_NONE) &&
+                 (asd->is_tp_appid_available() ||
+                  asd->get_session_flags(APPID_SESSION_NO_TPI)) );
+    }   
 
     return false;
 }

diff --git a/src/network_inspectors/appid/appid_discovery.cc b/src/network_inspectors/appid/appid_discovery.cc
index d8ec1d7ca9cef13afed3fb3a09f7f2db85c5628e..d5b291e535fb3ac654558f1a8374b4251addc233 100644 (file)
--- a/src/network_inspectors/appid/appid_discovery.cc
+++ b/src/network_inspectors/appid/appid_discovery.cc
@@ -141,7 +141,7 @@ void AppIdDiscovery::do_application_discovery(Packet* p, AppIdInspector& inspect
     AppidSessionDirection direction = APP_ID_FROM_INITIATOR;
     AppIdSession* asd = (AppIdSession*)p->flow->get_flow_data(AppIdSession::inspector_id);
 
-    if (!do_pre_discovery(p, &asd, inspector, protocol, direction)) return;
+    if ( !do_pre_discovery(p, &asd, inspector, protocol, direction) ) return;
 
     bool is_discovery_done = do_discovery(p, *asd, protocol, direction);
 
@@ -607,6 +607,8 @@ static void lookup_appid_by_host_port(AppIdSession& asd, Packet* p, IpProtocol p
             if (asd.tpsession)
                 asd.tpsession->reset();
 #endif
+            if ( asd.payload.get_id() == APP_ID_NONE)
+                asd.payload.set_id(APP_ID_UNKNOWN);
         }
     }
 }

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index 9282d05bca1f31ff72ae051b808eac9c968851be..26bbe1dd2d27bdf9f468c1cda1f5f7bdbb92f226 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -670,6 +670,11 @@ void AppIdSession::stop_rna_service_inspection(Packet* p, AppidSessionDirection
     }
 
     service_disco_state = APPID_DISCO_STATE_FINISHED;
+
+    if ( (is_tp_appid_available() || get_session_flags(APPID_SESSION_NO_TPI) )
+        and payload.get_id() == APP_ID_NONE )
+        payload.set_id(APP_ID_UNKNOWN);
+
     set_session_flags(APPID_SESSION_SERVICE_DETECTED);
     clear_session_flags(APPID_SESSION_CONTINUE);
 }
@@ -909,9 +914,9 @@ bool AppIdSession::is_tp_processing_done() const
 {
 #ifdef ENABLE_APPID_THIRD_PARTY
     if ( TPLibHandler::have_tp() &&
-        !get_session_flags(APPID_SESSION_NO_TPI) &&
-        (!is_tp_appid_done() ||
-         get_session_flags(APPID_SESSION_APP_REINSPECT | APPID_SESSION_APP_REINSPECT_SSL)))
+         !get_session_flags(APPID_SESSION_NO_TPI) &&
+         (!is_tp_appid_done() ||
+          get_session_flags(APPID_SESSION_APP_REINSPECT | APPID_SESSION_APP_REINSPECT_SSL)))
         return false;
 #endif
 
@@ -936,5 +941,5 @@ bool AppIdSession::is_tp_appid_available() const
     }
 #endif
 
-    return false;
+    return true;
 }

diff --git a/src/network_inspectors/appid/service_plugins/service_discovery.cc b/src/network_inspectors/appid/service_plugins/service_discovery.cc
index 289af8d1fdbefdebad4936fb8c14c38ab64f6611..6931da89d22461aef9c2135dbf4c3887c1afec5b 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_discovery.cc
+++ b/src/network_inspectors/appid/service_plugins/service_discovery.cc
@@ -596,6 +596,11 @@ bool ServiceDiscovery::do_service_discovery(AppIdSession& asd, Packet* p, AppidS
             {
                 asd.set_session_flags(APPID_SESSION_SERVICE_DETECTED);
                 asd.service_disco_state = APPID_DISCO_STATE_FINISHED;
+
+                if ( (asd.is_tp_appid_available() ||
+                      asd.get_session_flags(APPID_SESSION_NO_TPI))
+                     && asd.payload.get_id() == APP_ID_NONE )
+                    asd.payload.set_id(APP_ID_UNKNOWN);
             }
         }
         else if (asd.is_tp_appid_available())
@@ -681,7 +686,15 @@ bool ServiceDiscovery::do_service_discovery(AppIdSession& asd, Packet* p, AppidS
         //to stop executing validator after service has been detected by RNA.
         if (asd.get_session_flags(APPID_SESSION_SERVICE_DETECTED |
             APPID_SESSION_CONTINUE) == APPID_SESSION_SERVICE_DETECTED)
+        {
             asd.service_disco_state = APPID_DISCO_STATE_FINISHED;
+            if ( (asd.is_tp_appid_available() ||
+                  asd.get_session_flags(APPID_SESSION_NO_TPI)) &&
+                 asd.payload.get_id() == APP_ID_NONE )
+            {
+                asd.payload.set_id(APP_ID_UNKNOWN);
+            }
+        }
 
         AppIdDnsSession* dsession = asd.get_dns_session();
         if (asd.service.get_id() == APP_ID_DNS && asd.config->mod_config->dns_host_reporting

diff --git a/src/network_inspectors/appid/test/appid_api_test.cc b/src/network_inspectors/appid/test/appid_api_test.cc
index 82f96d2dcdcca637896c97700a91756d49028847..260486e45ecb531bdb5085d825da98c103bca96a 100644 (file)
--- a/src/network_inspectors/appid/test/appid_api_test.cc
+++ b/src/network_inspectors/appid/test/appid_api_test.cc
@@ -311,7 +311,7 @@ TEST(appid_api, is_appid_available)
 {
     bool val;
     val = appid_api.is_appid_available(*flow);
-    CHECK_FALSE(val);
+    CHECK_TRUE(val);
     mock_session->set_session_flags(APPID_SESSION_NO_TPI);
     val = appid_api.is_appid_available(*flow);
     CHECK_TRUE(val);

diff --git a/src/network_inspectors/appid/test/appid_mock_session.h b/src/network_inspectors/appid/test/appid_mock_session.h
index f3a0d1d5f196f67327bdd88bc0b0e932216228e3..880b9885cafe907966e5fd778b13f5975e93f1c4 100644 (file)
--- a/src/network_inspectors/appid/test/appid_mock_session.h
+++ b/src/network_inspectors/appid/test/appid_mock_session.h
@@ -248,7 +248,7 @@ bool AppIdSession::is_tp_appid_done() const
 
 bool AppIdSession::is_tp_appid_available() const
 {
-    return false;
+    return true;
 }
 
 #endif

diff --git a/src/network_inspectors/appid/tp_appid_utils.cc b/src/network_inspectors/appid/tp_appid_utils.cc
index cd4a5bb6bcbfd61df6b39d855b13e1c5bf5a3188..b25a9cb87dcbd891d561b29dbf369559d0d6ccb2 100644 (file)
--- a/src/network_inspectors/appid/tp_appid_utils.cc
+++ b/src/network_inspectors/appid/tp_appid_utils.cc
@@ -570,7 +570,8 @@ static inline void check_terminate_tp_module(AppIdSession& asd, uint16_t tpPktCo
     {
         if (asd.get_tp_app_id() == APP_ID_NONE)
             asd.set_tp_app_id(APP_ID_UNKNOWN);
-        if (asd.payload.get_id() == APP_ID_NONE)
+
+        if ( asd.service_disco_state == APPID_DISCO_STATE_FINISHED && asd.payload.get_id() == APP_ID_NONE )
             asd.payload.set_id(APP_ID_UNKNOWN);
 
         if (asd.tpsession)
@@ -582,7 +583,7 @@ bool do_tp_discovery(AppIdSession& asd, IpProtocol protocol,
     Packet* p, AppidSessionDirection& direction)
 {
     if ( !TPLibHandler::have_tp() )
-       return true;
+        return true;
 
     AppId tp_app_id = asd.get_tp_app_id();