stream_udp
stream_user
stream_file
- http_inspect
- flow
- parser
- file_api
file
+ file_api
+ mime
+ http_inspect
+ ${PIGLET_LIBRARIES}
+ ips_options
+ parser
+ search_engines
+ flow
control
filter
detection
stream/file/libstream_file.a \
file_api/libfile_api.a \
file_api/libs/libfile.a \
+mime/libmime.a \
service_inspectors/http_inspect/libhttp_inspect.a \
+ $(pig_list) \
ips_options/libips_options.a \
parser/libparser.a \
search_engines/libsearch_engines.a \
FileMemPool* file_mempool = NULL;
File_Capture_Stats file_capture_stats;
- /*
- * Verify file capture information and file context information matched
- * This is used for debug purpose
- */
+ #ifdef DEBUG_MSGS
+ // verify file capture information and file context information matched
-static void verify_file_capture_info(
- FileContext* context, FileCaptureInfo* fileInfo)
+void FileCapture::verifiy(FileContext* context)
{
- /* file capture length should be one of two possible values */
- if (context->processed_bytes)
- {
- if ((fileInfo->file_size != context->processed_bytes) &&
- (fileInfo->file_size + context->current_data_len
- != context->processed_bytes))
- {
- FILE_DEBUG_MSGS("File capture size failed w.r.t processed size!\n");
- }
- }
- else
- {
- if ((fileInfo->file_size != context->file_size) &&
- (fileInfo->file_size + context->current_data_len
- != context->file_size))
- {
- FILE_DEBUG_MSGS("File capture size failed w.r.t final file size!\n");
- }
- }
-}
-
-static void verifiy_file_capture(
- FileContext* context, FileCaptureInfo* fileInfo)
-{
- SHA256CONTEXT sha_ctx;
+ SHA256_CTX sha_ctx;
uint8_t* buff;
int size;
- FileCaptureInfo* file_mem = fileInfo;
+ FileCaptureBlock* file_mem = head;
uint8_t sha256[SHA256_HASH_SIZE + 1];
int i;
extern FileStats file_stats;
- #define FILE_DEBUG_MSGS(msg) DEBUG_WRAP(DebugMessage(DEBUG_FILE, msg); )
+ #define FILE_DEBUG_MSGS(msg) DebugMessage(DEBUG_FILE, msg)
-void printFileContext(FileContext* context);
-
void print_file_stats();
-/*
- * Print out file statistics
- */
-void print_file_stats(int exiting);
-
#endif
}
// check for mime flush point
- if (file_api->process_mime_paf_data(&(pfdata->mime_info), ch))
+ if (process_mime_paf_data(&(pfdata->mime_info), ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: Mime Boundary found."
- " Flushing data!\n"); );
+ DebugMessage(DEBUG_IMAP, "IMAP PAF: Mime Boundary found."
+ " Flushing data!\n");
return true;
}
NHttpEnums::MethodId method_id = NHttpEnums::METH__NOTPRESENT;
int32_t status_code_num = NHttpEnums::STAT_NOTPRESENT;
int64_t file_depth_remaining[2] = { NHttpEnums::STAT_NOTPRESENT, NHttpEnums::STAT_NOTPRESENT };
- MimeState* mime_state = nullptr; // SRC_CLIENT only
+ int64_t detect_depth_remaining[2] = { NHttpEnums::STAT_NOTPRESENT,
+ NHttpEnums::STAT_NOTPRESENT };
+ MimeSession* mime_state = nullptr; // SRC_CLIENT only
// number of user data octets seen so far (regular body or chunks)
int64_t body_octets[2] = { NHttpEnums::STAT_NOTPRESENT, NHttpEnums::STAT_NOTPRESENT };
session_data->file_depth_remaining[source_id] = 0;
}
}
- else
+ else if (session_data->mime_state != nullptr)
{
- session_data->mime_state->process_mime_data(flow, data.start, data.start + fp_length,
- true, file_position);
- file_api->process_mime_data(flow, file_data.start, file_data.start + fp_length,
- session_data->mime_state, true, file_position);
++ session_data->mime_state->process_mime_data(flow, file_data.start,
++ file_data.start + fp_length, true, file_position);
session_data->file_depth_remaining[source_id] -= fp_length;
if (session_data->file_depth_remaining[source_id] == 0)
session_data->section_type[source_id] = SEC__NOTCOMPUTE;
}
- if ((session_data->file_depth_remaining[source_id] = file_api->get_max_file_depth()) < 0)
+ // Common activities of preparing for upcoming regular body or chunked body
+ void NHttpMsgHeader::prepare_body()
+ {
+ session_data->body_octets[source_id] = 0;
+ const int64_t& depth = (source_id == SRC_CLIENT) ? params->request_depth :
+ params->response_depth;
+ session_data->detect_depth_remaining[source_id] = (depth != -1) ? depth : INT64_MAX;
+ setup_file_processing();
+ setup_decompression();
+ update_depth();
+ session_data->infractions[source_id].reset();
+ session_data->events[source_id].reset();
+ }
+
+ void NHttpMsgHeader::setup_file_processing()
+ {
+ // FIXIT-M Bidirectional file processing is problematic so we don't do it. When the library
+ // fully supports it remove the outer if statement that prevents it from being done.
+ if (session_data->file_depth_remaining[1-source_id] == 0)
+ {
++ if ((session_data->file_depth_remaining[source_id] = FileService::get_max_file_depth) < 0)
+ {
+ session_data->file_depth_remaining[source_id] = 0;
+ }
+ if (source_id == SRC_CLIENT)
+ {
+ // FIXIT-L Cannot use new because file_api insists on freeing the mime_state using
+ // free().
+ session_data->mime_state = (MimeState*) new_calloc(1, sizeof(MimeState));
+ file_api->set_mime_log_config_defauts(&mime_conf);
+ session_data->mime_state->log_config = &mime_conf;
+ file_api->set_mime_decode_config_defauts(&decode_conf);
+ session_data->mime_state->decode_conf = &decode_conf;
+ file_api->set_log_buffers(&session_data->mime_state->log_state,
+ session_data->mime_state->log_config);
+ }
+ }
+ }
+
+ void NHttpMsgHeader::setup_decompression()
+ {
+ }
+
void update_flow() override;
private:
// Dummy configurations to support MIME processing
- MAIL_LogConfig mime_conf;
+ MailLogConfig mime_conf;
DecodeConfig decode_conf;
+
+ void prepare_body();
+ void setup_file_processing();
+ void setup_decompression();
};
#endif
{
if (pop_ssn->state == STATE_DATA)
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
//ptr = POP_HandleData(p, ptr, end);
- FilePosition position = file_api->get_file_position(p);
- ptr = file_api->process_mime_data(p->flow, ptr, end, &(pop_ssn->mime_ssn), 0,
- position);
+ FilePosition position = get_file_position(p);
+ ptr = pop_ssn->mime_ssn->process_mime_data(p->flow, ptr, end, 0, position);
continue;
}
POP_GetEOL(ptr, end, &eol, &eolm);
{
// FIXIT: This will currently flush on MIME boundary, and one line later at end of PDU
- if (file_api->check_data_end(&(pfdata->end_state), ch))
+ if (check_data_end(&(pfdata->end_state), ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "End of Multi-line response found\n"); );
+ DebugMessage(DEBUG_POP, "End of Multi-line response found\n");
pfdata->end_of_data = true;
pfdata->pop_state = POP_PAF_SINGLE_LINE_STATE;
reset_data_states(pfdata);
// if this is a data command, search for MIME ending
if (mime_data)
{
- if (file_api->process_mime_paf_data(&(pfdata->data_info), ch))
+ if (process_mime_paf_data(&(pfdata->data_info), ch))
{
- DEBUG_WRAP(DebugMessage(DEBUG_POP, "Mime Boundary found. Flushing data!\n"); );
+ DebugMessage(DEBUG_POP, "Mime Boundary found. Flushing data!\n");
pfdata->cmd_continued = true;
return true;
}
break;
case STATE_DATA:
case STATE_BDATA:
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); );
+ DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
- position = file_api->get_file_position(p);
- ptr = file_api->process_mime_data(p->flow, ptr, end, &(smtp_ssn->mime_ssn), 1,
- position);
+ position = get_file_position(p);
+ ptr = smtp_ssn->mime_ssn->process_mime_data(p->flow, ptr, end, 1, position);
//ptr = SMTP_HandleData(p, ptr, end, &(smtp_ssn->mime_ssn));
break;
case STATE_XEXCH50:
* * Process data boundary and flush each file based on boundary*/
static inline bool process_data(SmtpPafData* pfdata, uint8_t data)
{
- if (flush_based_length(pfdata)|| file_api->check_data_end(&(pfdata->data_end_state), data))
+ if (flush_based_length(pfdata)|| check_data_end(&(pfdata->data_end_state), data))
{
- DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "End of data\n"); );
+ DebugMessage(DEBUG_SMTP, "End of data\n");
/*Clean up states*/
pfdata->smtp_state = SMTP_PAF_CMD_STATE;
pfdata->end_of_data = true;
projects / thirdparty / snort3.git / commitdiff
