Merge pull request #2239 in SNORT/snort3 from ~ANTOROZC/snort3:vkovalen_no_sni to...

Squashed commit of the following:

commit 034c71cccbba39b7d746acc2858241d9cc7ed51a
Author: Viktoriia Kovalenko <vkovalen@cisco.com>
Date:   Fri May 29 15:20:08 2020 +0300

    appid: set appid_tlshost_bit when we set tls_cname

diff --git a/src/network_inspectors/appid/appid_api.cc b/src/network_inspectors/appid/appid_api.cc
index 13b51a12b80fab1517dfd6d5cf20f2e2f34f531b..514aa5aa2d27f86c8429594b7c9335ea37ac7927 100644 (file)
--- a/src/network_inspectors/appid/appid_api.cc
+++ b/src/network_inspectors/appid/appid_api.cc
@@ -236,7 +236,7 @@ bool AppIdApi::ssl_app_group_id_lookup(Flow* flow, const char* server_name, cons
         {
             ssl_matchers.scan_cname((const uint8_t*)common_name, strlen(common_name), client_id,
                 payload_id);
-            asd->tsession->set_tls_cname(common_name, strlen(common_name));
+            asd->tsession->set_tls_cname(common_name, strlen(common_name), change_bits);
             asd->scan_flags |= SCAN_SSL_CERTIFICATE_FLAG;
             asd->scan_flags |= SCAN_DO_NOT_OVERRIDE_COMMON_NAME_FLAG;
         }

diff --git a/src/network_inspectors/appid/appid_session.h b/src/network_inspectors/appid/appid_session.h
index f836d5604bd24bf656b3768f1b3045bf8d152ac1..de19faba5ed8ec42ef8a8a58f52570af9ae247a8 100644 (file)
--- a/src/network_inspectors/appid/appid_session.h
+++ b/src/network_inspectors/appid/appid_session.h
@@ -153,7 +153,7 @@ struct TlsSession
         change_bits.set(APPID_TLSHOST_BIT);
     }
 
-    void set_tls_cname(const char* new_tls_cname, uint32_t len)
+    void set_tls_cname(const char* new_tls_cname, uint32_t len, AppidChangeBits& change_bits)
     {
         if (tls_cname)
             snort_free(tls_cname);
@@ -164,6 +164,8 @@ struct TlsSession
         }
         tls_cname = len? snort::snort_strndup(new_tls_cname,len) :
             const_cast<char*>(new_tls_cname);
+        if (tls_host == nullptr)
+            change_bits.set(APPID_TLSHOST_BIT);
     }
 
     void set_tls_org_unit(const char* new_tls_org_unit, uint32_t len)

diff --git a/src/network_inspectors/appid/appid_session_api.cc b/src/network_inspectors/appid/appid_session_api.cc
index 572aba5660d9b0ea19e03a5824d9a3368b61a894..a2e498207bc1c92433e19be996b35a604be20a67 100644 (file)
--- a/src/network_inspectors/appid/appid_session_api.cc
+++ b/src/network_inspectors/appid/appid_session_api.cc
@@ -242,7 +242,10 @@ short AppIdSessionApi::get_service_port()
 char* AppIdSessionApi::get_tls_host()
 {
     if (asd->tsession)
-        return asd->tsession->get_tls_host();
+        if (asd->tsession->get_tls_host())
+            return asd->tsession->get_tls_host();
+        else
+            return asd->tsession->get_tls_cname();
 
     return nullptr;
 }

diff --git a/src/network_inspectors/appid/service_plugins/service_ssl.cc b/src/network_inspectors/appid/service_plugins/service_ssl.cc
index 6e2b97dcad1611795c3715e9783672565808394a..b5ce748845aed09d098c6c023b29ec643e9a8a99 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_ssl.cc
+++ b/src/network_inspectors/appid/service_plugins/service_ssl.cc
@@ -728,7 +728,7 @@ success:
         /* TLS Common Name */
         if (ss->common_name)
         {
-            args.asd.tsession->set_tls_cname(ss->common_name, 0);
+            args.asd.tsession->set_tls_cname(ss->common_name, 0, args.change_bits);
             args.asd.scan_flags |= SCAN_SSL_CERTIFICATE_FLAG;
         }
         /* TLS Org Unit */

diff --git a/src/network_inspectors/appid/test/appid_api_test.cc b/src/network_inspectors/appid/test/appid_api_test.cc
index f6aac46e2f7e8f30797021957086c0f73883fa80..3a621915dd4bd45e1559085aed3f8b53abca22ec 100644 (file)
--- a/src/network_inspectors/appid/test/appid_api_test.cc
+++ b/src/network_inspectors/appid/test/appid_api_test.cc
@@ -248,7 +248,7 @@ TEST(appid_api, ssl_app_group_id_lookup)
 
     AppidChangeBits change_bits;
     mock_session->tsession->set_tls_host("www.cisco.com", 13, change_bits);
-    mock_session->tsession->set_tls_cname("www.cisco.com", 13);
+    mock_session->tsession->set_tls_cname("www.cisco.com", 13, change_bits);
     mock_session->tsession->set_tls_org_unit("Cisco", 5);
     STRCMP_EQUAL(mock_session->tsession->get_tls_host(), "www.cisco.com");
     STRCMP_EQUAL(mock_session->tsession->get_tls_cname(), "www.cisco.com");
@@ -272,7 +272,7 @@ TEST(appid_api, ssl_app_group_id_lookup)
     STRCMP_EQUAL(mock_session->tsession->get_tls_host(), nullptr);
     STRCMP_EQUAL(mock_session->tsession->get_tls_cname(), APPID_UT_TLS_HOST);
     STRCMP_EQUAL(mock_session->tsession->get_tls_org_unit(), "Google");
-    STRCMP_EQUAL("Published change_bits == 000000000110", test_log);
+    STRCMP_EQUAL("Published change_bits == 000001000110", test_log);
     mock().checkExpectations();
 }
 

diff --git a/src/network_inspectors/appid/tp_appid_utils.cc b/src/network_inspectors/appid/tp_appid_utils.cc
index 03d961e450f4e3aa0d3725c2c6ef9390d242efd3..4c98f05ac854a4b8b6fdf887caf08e9f5152be99 100644 (file)
--- a/src/network_inspectors/appid/tp_appid_utils.cc
+++ b/src/network_inspectors/appid/tp_appid_utils.cc
@@ -461,7 +461,7 @@ static inline void process_ssl(AppIdSession& asd,
         asd.tsession->get_tls_cname() == nullptr and
         (field = attribute_data.tls_cname()) != nullptr)
     {
-        asd.tsession->set_tls_cname(field->c_str(), field->size());
+        asd.tsession->set_tls_cname(field->c_str(), field->size(), change_bits);
         if (reinspect_ssl_appid)
             asd.scan_flags |= SCAN_SSL_CERTIFICATE_FLAG;
     }