Pull request #3659: flow: added an event to allow post processing of new expected...

Merge in SNORT/snort3 from ~RDEMPSTE/snort3:expected_flows to master

Squashed commit of the following:

commit 0e0addce6885fcd71a01c1a81e632542ac4ac128
Author: Ron Dempster (rdempste) <rdempste@cisco.com>
Date:   Thu Oct 13 10:50:22 2022 -0400

    flow: added an event to allow post processing of new expected flows

diff --git a/src/flow/expect_cache.cc b/src/flow/expect_cache.cc
index 831e1b56ddea96f19621477047a3f108b4550314..27f82053573177e1a5ba3f9f52f0fcb555e73265 100644 (file)
--- a/src/flow/expect_cache.cc
+++ b/src/flow/expect_cache.cc
@@ -86,6 +86,15 @@ void ExpectFlow::reset_expect_flows()
         packet_expect_flows->clear();
 }
 
+void ExpectFlow::handle_expected_flows(const Packet* p)
+{
+    if (p->flow && packet_expect_flows && !packet_expect_flows->empty())
+    {
+        ExpectedFlowsEvent event(*packet_expect_flows, *p);
+        DataBus::publish(EXPECT_EVENT_TYPE_HANDLE_FLOWS, event);
+    }
+}
+
 FlowData* ExpectFlow::get_flow_data(unsigned id)
 {
     for (FlowData* p = data; p; p = p->next)

diff --git a/src/flow/expect_cache.h b/src/flow/expect_cache.h
index 5a5fadee875560752df39d824ee5647e5cf46305..df125d9abe5879938f30363f2c44460bda942989 100644 (file)
--- a/src/flow/expect_cache.h
+++ b/src/flow/expect_cache.h
@@ -83,6 +83,7 @@ struct SO_PUBLIC ExpectFlow
     snort::FlowData* get_flow_data(unsigned);
     static std::vector<ExpectFlow*>* get_expect_flows();
     static void reset_expect_flows();
+    static void handle_expected_flows(const snort::Packet*);
 };
 }
 
@@ -108,7 +109,7 @@ public:
     unsigned long get_realized() { return realized; }
     unsigned long get_prunes() { return prunes; }
     unsigned long get_overflows() { return overflows; }
-    void reset_stats() 
+    void reset_stats()
     {
         expects = 0;
         realized = 0;

diff --git a/src/managers/inspector_manager.cc b/src/managers/inspector_manager.cc
index 7562041b4713a28b8f093a61ec2a88779e67c772..4106a9ce09c95dec83549572c356679473146a01 100644 (file)
--- a/src/managers/inspector_manager.cc
+++ b/src/managers/inspector_manager.cc
@@ -31,6 +31,7 @@
 #include "detection/detect.h"
 #include "detection/detection_engine.h"
 #include "detection/fp_utils.h"
+#include "flow/expect_cache.h"
 #include "flow/flow.h"
 #include "flow/session.h"
 #include "log/messages.h"
@@ -2063,6 +2064,9 @@ void InspectorManager::execute(Packet* p)
         internal_execute<true>(p);
     else
         internal_execute<false>(p);
+
+    if ( p->flow && ( !p->is_cooked() or p->is_defrag() ) )
+        ExpectFlow::handle_expected_flows(p);
 }
 
 template<bool T>

diff --git a/src/managers/test/get_inspector_stubs.h b/src/managers/test/get_inspector_stubs.h
index 5d81ab2fe98f790db96fe0f9ef438de17b480a08..3be184ba1c29773cb73410747524756f28b049de 100644 (file)
--- a/src/managers/test/get_inspector_stubs.h
+++ b/src/managers/test/get_inspector_stubs.h
@@ -18,6 +18,7 @@
 // stubs.h author Ron Dempster <rdempste@cisco.com>
 
 #include "detection/detection_engine.h"
+#include "flow/expect_cache.h"
 #include "main/policy.h"
 #include "main/snort.h"
 #include "main/snort_config.h"
@@ -77,6 +78,7 @@ void Module::reset_stats() { }
 DataBus::DataBus() { }
 DataBus::~DataBus() { }
 Module* ModuleManager::get_module(const char*) { return nullptr; }
+void ExpectFlow::handle_expected_flows(const Packet*) { }
 
 NetworkPolicy* get_default_network_policy(const SnortConfig*) { return nullptr; }
 void set_network_policy(NetworkPolicy*) { }

diff --git a/src/pub_sub/expect_events.h b/src/pub_sub/expect_events.h
index 20520eee7f24bce3b35cdc65c59c11e53e45579a..d24d4367e4e7bf91b99a6984abb3ca3c01ac2c12 100644 (file)
--- a/src/pub_sub/expect_events.h
+++ b/src/pub_sub/expect_events.h
@@ -24,6 +24,7 @@
 // by data bus subscribers
 
 #include <list>
+#include <vector>
 
 #include "framework/data_bus.h"
 
@@ -62,4 +63,24 @@ private:
     const snort::FlowData* flow_data;
 };
 
+#define EXPECT_EVENT_TYPE_HANDLE_FLOWS "expect.handle_flows"
+
+class ExpectedFlowsEvent : public snort::DataEvent
+{
+public:
+    ExpectedFlowsEvent(std::vector<snort::ExpectFlow*>& expected_flows, const snort::Packet& p)
+        : expected_flows(expected_flows), pkt(p)
+    { }
+
+    std::vector<snort::ExpectFlow*>& get_expected_flows()
+    { return expected_flows; }
+
+    const snort::Packet* get_packet() const override
+    { return &pkt; }
+
+private:
+    std::vector<snort::ExpectFlow*>& expected_flows;
+    const snort::Packet& pkt;
+};
+
 #endif