Merge pull request #1226 in SNORT/snort3 from dev_appid_navl to master

Squashed commit of the following:

commit 9fb9da9f0f9cedf4db316c343141d5a569eb984b
Author: Devendra Dahiphale <ddahipha@cisco.com>
Date:   Mon May 21 17:19:37 2018 -0400

    appid: clean-up code for performance and implement is_tp_processing_done()

diff --git a/src/network_inspectors/appid/appid_config.h b/src/network_inspectors/appid/appid_config.h
index 54156b0709ee6030af8ed9398f740b528e09a80c..2eace7c89e8019ab3c0c0944488c592bca9d43f4 100644 (file)
--- a/src/network_inspectors/appid/appid_config.h
+++ b/src/network_inspectors/appid/appid_config.h
@@ -89,6 +89,7 @@ public:
     uint32_t rtmp_max_packets = 15;
     uint32_t max_tp_flow_depth = 5;
     uint32_t tp_allow_probes = 0;
+    uint32_t http_response_version_enabled = 0;
 };
 
 typedef std::array<SF_LIST*, APP_ID_PORT_ARRAY_SIZE> AppIdPortExclusions;

diff --git a/src/network_inspectors/appid/appid_session.cc b/src/network_inspectors/appid/appid_session.cc
index 5a1ca69ef2a2fdf3ef11e5c42be6ed44e223c8e2..7ccbf2728acc06028d3a63699729e4644bfa1322 100644 (file)
--- a/src/network_inspectors/appid/appid_session.cc
+++ b/src/network_inspectors/appid/appid_session.cc
@@ -891,13 +891,10 @@ bool AppIdSession::is_tp_appid_done() const
 #ifdef ENABLE_APPID_THIRD_PARTY
     if (config->have_tp())
     {
-        unsigned state;
-
-        if (tpsession)
-            state = tpsession->get_state();
-        else
-            state = TP_STATE_INIT;
+        if (!tpsession)
+            return false;
 
+        unsigned state = tpsession->get_state();
         return (state  == TP_STATE_CLASSIFIED || state == TP_STATE_TERMINATED
                || state == TP_STATE_HA);
     }
@@ -906,6 +903,21 @@ bool AppIdSession::is_tp_appid_done() const
     return true;
 }
 
+bool AppIdSession::is_tp_processing_done() const
+{
+
+#ifdef ENABLE_APPID_THIRD_PARTY
+    if (config->have_tp() &&
+        !get_session_flags(APPID_SESSION_NO_TPI) &&
+        (!is_tp_appid_done() ||
+        get_session_flags(APPID_SESSION_APP_REINSPECT | APPID_SESSION_APP_REINSPECT_SSL)))
+        return false;
+#endif
+
+    return true;
+}
+
+
 bool AppIdSession::is_tp_appid_available() const
 {
 #ifdef ENABLE_APPID_THIRD_PARTY

diff --git a/src/network_inspectors/appid/appid_session.h b/src/network_inspectors/appid/appid_session.h
index 35b628ad27535355a9599b7f1e2eb1b50036844f..cff4c4444bc9f3c87454b42cbeb0ad60807f2e16 100644 (file)
--- a/src/network_inspectors/appid/appid_session.h
+++ b/src/network_inspectors/appid/appid_session.h
@@ -304,6 +304,7 @@ public:
     AppIdDnsSession* get_dns_session();
 
     bool is_tp_appid_done() const;
+    bool is_tp_processing_done() const;
     bool is_tp_appid_available() const;
 
 private:

diff --git a/src/network_inspectors/appid/tp_appid_utils.cc b/src/network_inspectors/appid/tp_appid_utils.cc
index 3b2fe0b818f0ee4fb09fff9519e153d8f78601a1..e05cc502de11aa4d833e27e8e2646b73600167d4 100644 (file)
--- a/src/network_inspectors/appid/tp_appid_utils.cc
+++ b/src/network_inspectors/appid/tp_appid_utils.cc
@@ -587,18 +587,6 @@ bool do_tp_discovery(AppIdSession& asd, IpProtocol protocol,
     if ( !asd.config->have_tp() )
         return true;
 
-    //restart inspection by 3rd party
-    if (!asd.tp_reinspect_by_initiator && (direction == APP_ID_FROM_INITIATOR) &&
-        check_reinspect(p, asd))
-    {
-        asd.tp_reinspect_by_initiator = true;
-        asd.set_session_flags(APPID_SESSION_APP_REINSPECT);
-        if (appidDebug->is_active())
-            LogMessage("AppIdDbg %s 3rd party allow reinspect http\n",
-                appidDebug->get_debug_session());
-        asd.reset_session_data();
-    }
-
     if (asd.tp_app_id == APP_ID_SSH && asd.payload.get_id() != APP_ID_SFTP &&
         asd.session_packet_count >= MIN_SFTP_PACKET_COUNT &&
         asd.session_packet_count < MAX_SFTP_PACKET_COUNT)
@@ -611,21 +599,22 @@ bool do_tp_discovery(AppIdSession& asd, IpProtocol protocol,
         }
     }
 
-    Profile tpPerfStats_profile_context(tpPerfStats);
-
     /*** Start of third-party processing. ***/
-    if ( asd.config->have_tp()
-        && !asd.get_session_flags(APPID_SESSION_NO_TPI)
-        && (!asd.is_tp_appid_done()
-        || asd.get_session_flags(APPID_SESSION_APP_REINSPECT
-        | APPID_SESSION_APP_REINSPECT_SSL)))
+    Profile tpPerfStats_profile_context(tpPerfStats);
+    if (p->dsize || asd.config->mod_config->tp_allow_probes)
     {
-        // First SSL decrypted packet is now being inspected. Reset the flag so that SSL decrypted
-        // traffic gets processed like regular traffic from next packet onwards
-        if (asd.get_session_flags(APPID_SESSION_APP_REINSPECT_SSL))
-            asd.clear_session_flags(APPID_SESSION_APP_REINSPECT_SSL);
+        //restart inspection by 3rd party
+        if (!asd.tp_reinspect_by_initiator && (direction == APP_ID_FROM_INITIATOR) && check_reinspect(p, asd))
+        {
+            asd.tp_reinspect_by_initiator = true;
+            asd.set_session_flags(APPID_SESSION_APP_REINSPECT);
+            if (appidDebug->is_active())
+                LogMessage("AppIdDbg %s 3rd party allow reinspect http\n",
+                    appidDebug->get_debug_session());
+            asd.reset_session_data();
+        }
 
-        if (p->dsize || asd.config->mod_config->tp_allow_probes)
+        if (!asd.is_tp_processing_done())
         {
             if (protocol != IpProtocol::TCP || (p->packet_flags & PKT_STREAM_ORDER_OK)
                 || asd.config->mod_config->tp_allow_probes)
@@ -646,6 +635,12 @@ bool do_tp_discovery(AppIdSession& asd, IpProtocol protocol,
                 asd.tp_app_id=asd.tpsession->get_appid(tp_confidence);
 
                 isTpAppidDiscoveryDone = true;
+
+                // First SSL decrypted packet is now being inspected. Reset the flag so that SSL decrypted
+                // traffic gets processed like regular traffic from next packet onwards
+                if (asd.get_session_flags(APPID_SESSION_APP_REINSPECT_SSL))
+                    asd.clear_session_flags(APPID_SESSION_APP_REINSPECT_SSL);
+
                 if (asd.tpsession->get_state() == TP_STATE_CLASSIFIED)
                     asd.clear_session_flags(APPID_SESSION_APP_REINSPECT);
 
@@ -812,14 +807,15 @@ bool do_tp_discovery(AppIdSession& asd, IpProtocol protocol,
                 }
             }
         }
+        if ( asd.tp_reinspect_by_initiator && check_reinspect(p, asd) )
+        {
+            if(isTpAppidDiscoveryDone)
+                asd.clear_session_flags(APPID_SESSION_APP_REINSPECT);
+            if (direction == APP_ID_FROM_RESPONDER)
+                asd.tp_reinspect_by_initiator = false;     //toggle at OK response
+        }
     }
 
-    if ( asd.tp_reinspect_by_initiator && check_reinspect(p, asd) )
-    {
-        asd.clear_session_flags(APPID_SESSION_APP_REINSPECT);
-        if (direction == APP_ID_FROM_RESPONDER)
-            asd.tp_reinspect_by_initiator = false;     //toggle at OK response
-    }
 
     return isTpAppidDiscoveryDone;
 }

diff --git a/src/network_inspectors/appid/tp_lib_handler.cc b/src/network_inspectors/appid/tp_lib_handler.cc
index 319a8b37848a4a9117790651aaa5afa55694cdeb..a19cc1ed7a6ed4e95b374e1c1450eb9f8a7eba6e 100644 (file)
--- a/src/network_inspectors/appid/tp_lib_handler.cc
+++ b/src/network_inspectors/appid/tp_lib_handler.cc
@@ -136,7 +136,8 @@ void TPLibHandler::pinit(const AppIdModuleConfig* config)
         tp_config.http_upgrade_reporting_enabled = 1;
     else
         tp_config.http_upgrade_reporting_enabled = 0;
-    // FIXIT-H: Init http_response_version_enabled
+
+    tp_config.http_response_version_enabled = config->http_response_version_enabled;
 
     ret = tp_appid_module->pinit(tp_config);
     if (ret != 0)