Merge pull request #1923 in SNORT/snort3 from ~SATHIRKA/snort3:static_host_cache_wild...

Squashed commit of the following:

commit be3ab6abccce12eb3bf39f71929778ed596527d1
Author: Sreeja Athirkandathil Narayanan <sathirka@cisco.com>
Date:   Tue Jan 7 11:21:36 2020 -0500

    appid: Adding support for wildcard ports in static host port cache

diff --git a/src/network_inspectors/appid/appid_discovery.cc b/src/network_inspectors/appid/appid_discovery.cc
index 7799d998756bf92c6cb20fb843d5a4f4551ec32e..b744fc1328b3ad8c29163598bfc5c4800d0ca105 100644 (file)
--- a/src/network_inspectors/appid/appid_discovery.cc
+++ b/src/network_inspectors/appid/appid_discovery.cc
@@ -721,7 +721,7 @@ bool AppIdDiscovery::do_host_port_based_discovery(Packet* p, AppIdSession& asd,
     HostPortVal* hv = nullptr;
 
     if (check_static and
-        (hv = HostPortCache::find(ip, port, protocol)))
+        (hv = HostPortCache::find(ip, port, protocol, *(asd.ctxt))))
     {
         asd.scan_flags |= SCAN_HOST_PORT_FLAG;
         switch (hv->type)

diff --git a/src/network_inspectors/appid/host_port_app_cache.cc b/src/network_inspectors/appid/host_port_app_cache.cc
index d7568b4b8979d8cb9330f23451c802892320f23d..1bbbf8fd58cc1f41d45ec1eefcb293735deb5ebc 100644 (file)
--- a/src/network_inspectors/appid/host_port_app_cache.cc
+++ b/src/network_inspectors/appid/host_port_app_cache.cc
@@ -24,6 +24,9 @@
 #endif
 
 #include "host_port_app_cache.h"
+#include "managers/inspector_manager.h"
+#include "appid_inspector.h"
+#include "appid_config.h"
 
 #include <map>
 #include <cstring>
@@ -75,12 +78,12 @@ void HostPortCache::terminate()
     }
 }
 
-HostPortVal* HostPortCache::find(const SfIp* ip, uint16_t port, IpProtocol protocol)
+HostPortVal* HostPortCache::find(const SfIp* ip, uint16_t port, IpProtocol protocol, AppIdContext& ctxt)
 {
     HostPortKey hk;
 
     hk.ip = *ip;
-    hk.port = port;
+    hk.port = (ctxt.config->allow_port_wildcard_host_cache)? 0 : port;
     hk.proto = protocol;
 
     std::map<HostPortKey, HostPortVal>::iterator it;
@@ -98,7 +101,9 @@ bool HostPortCache::add(const SfIp* ip, uint16_t port, IpProtocol proto, unsigne
     HostPortVal hv;
 
     hk.ip = *ip;
-    hk.port = port;
+    AppIdInspector* inspector = (AppIdInspector*) InspectorManager::get_inspector(MOD_NAME, true);
+    AppIdContext* ctxt = inspector->get_ctxt();
+    hk.port = (ctxt->config->allow_port_wildcard_host_cache)? 0 : port;
     hk.proto = proto;
 
     hv.appId = appId;

diff --git a/src/network_inspectors/appid/host_port_app_cache.h b/src/network_inspectors/appid/host_port_app_cache.h
index 4b27e0c7ff0353a421e54b0831a520bd06b667ec..69ef5b9b413cd471bd9f7f21c7d2552a436dba67 100644 (file)
--- a/src/network_inspectors/appid/host_port_app_cache.h
+++ b/src/network_inspectors/appid/host_port_app_cache.h
@@ -24,6 +24,7 @@
 
 #include "application_ids.h"
 #include "protocols/protocol_ids.h"
+#include "appid_config.h"
 
 namespace snort
 {
@@ -41,7 +42,7 @@ class HostPortCache
 public:
     static void initialize();
     static void terminate();
-    static HostPortVal* find(const snort::SfIp*, uint16_t port, IpProtocol);
+    static HostPortVal* find(const snort::SfIp*, uint16_t port, IpProtocol, AppIdContext&);
     static bool add(const snort::SfIp*, uint16_t port, IpProtocol, unsigned type, AppId);
     static void dump();
 };

diff --git a/src/network_inspectors/appid/test/appid_discovery_test.cc b/src/network_inspectors/appid/test/appid_discovery_test.cc
index 00132f8699407bf9c55b6dc0dc48a251a1df4c13..2942123d626b683f9c99c637f11db51193f2d493 100644 (file)
--- a/src/network_inspectors/appid/test/appid_discovery_test.cc
+++ b/src/network_inspectors/appid/test/appid_discovery_test.cc
@@ -247,7 +247,7 @@ bool ClientDiscovery::do_client_discovery(AppIdSession&, Packet*,
 }
 
 // Stubs for misc items
-HostPortVal* HostPortCache::find(const SfIp*, uint16_t, IpProtocol)
+HostPortVal* HostPortCache::find(const SfIp*, uint16_t, IpProtocol, AppIdContext&)
 {
     return nullptr;
 }