Merge pull request #1956 in SNORT/snort3 from ~THOPETER/snort3:h2i_fast_pattern to...

Squashed commit of the following:

commit 5d2bd437978f0b7fa782ce887622c338dca14024
Author: Tom Peters <thopeter@cisco.com>
Date:   Wed Jan 15 12:46:04 2020 -0500

    http2_inspect: fast pattern support

diff --git a/src/service_inspectors/http2_inspect/http2_inspect.cc b/src/service_inspectors/http2_inspect/http2_inspect.cc
index 44f6102d2ee45156183bb7fc8423097fcc0fd363..9b5b0b06d10eecad86e98937308f1d554e71a86b 100644 (file)
--- a/src/service_inspectors/http2_inspect/http2_inspect.cc
+++ b/src/service_inspectors/http2_inspect/http2_inspect.cc
@@ -27,6 +27,7 @@
 #include "protocols/packet.h"
 #include "service_inspectors/http_inspect/http_common.h"
 #include "service_inspectors/http_inspect/http_field.h"
+#include "service_inspectors/http_inspect/http_inspect.h"
 #include "service_inspectors/http_inspect/http_test_manager.h"
 #include "stream/stream.h"
 
@@ -92,11 +93,17 @@ bool Http2Inspect::get_buf(unsigned id, Packet* p, InspectionBuffer& b)
     return true;
 }
 
-bool Http2Inspect::get_fp_buf(InspectionBuffer::Type /*ibt*/, Packet* /*p*/,
-    InspectionBuffer& /*b*/)
+bool Http2Inspect::get_fp_buf(InspectionBuffer::Type ibt, Packet* p, InspectionBuffer& b)
 {
-    // No fast pattern buffers have been defined for HTTP/2
-    return false;
+    // All current HTTP/2 fast pattern buffers are inherited from http_inspect. Just pass the
+    // request on.
+    Http2FlowData* const session_data =
+        (Http2FlowData*)p->flow->get_flow_data(Http2FlowData::inspector_id);
+
+    if ((session_data == nullptr) || (session_data->hi == nullptr))
+        return false;
+
+    return session_data->hi->get_fp_buf(ibt, p, b);
 }
 
 void Http2Inspect::eval(Packet* p)

diff --git a/src/service_inspectors/http2_inspect/http2_stream_splitter.cc b/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
index 6344c101460023de54adf58041bd5c8c3ed3768c..5a150cc437990797cb01a576529edb98aa90ac4b 100644 (file)
--- a/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
+++ b/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
@@ -39,7 +39,6 @@ using namespace snort;
 using namespace HttpCommon;
 using namespace Http2Enums;
 
-// Mindless scan() that just flushes whatever it is given
 StreamSplitter::Status Http2StreamSplitter::scan(Packet* pkt, const uint8_t* data, uint32_t length,
     uint32_t, uint32_t* flush_offset)
 {