Pull request #4522: http_inspect, mime: add hostname and url for http/mime file proce...

Merge in SNORT/snort3 from ~OTORUBAR/snort3:mime_file_processing to master

Squashed commit of the following:

commit 5f58cc4b19b587bc101ae21d9dd22543cc037f88
Author: otorubar <otorubar@cisco.com>
Date:   Fri Nov 1 12:02:18 2024 -0700

    http_inspect, mime: add hostname and url for http with mime

diff --git a/src/mime/file_mime_process.cc b/src/mime/file_mime_process.cc
index 7ae4ebf5827d5b11b1b52919dfabd1449bd95cac..15b49d13ab7ccd0dffea84947aac9d5cdff69998 100644 (file)
--- a/src/mime/file_mime_process.cc
+++ b/src/mime/file_mime_process.cc
@@ -914,7 +914,7 @@ void MimeSession::mime_file_process(Packet* p, const uint8_t* data, int data_siz
             const FileDirection dir = upload ? FILE_UPLOAD : FILE_DOWNLOAD;
             continue_inspecting_file = file_flows->file_process(p, get_file_cache_file_id(), data,
                 data_size, file_offset, dir, get_multiprocessing_file_id(), position, (const uint8_t*)filename.c_str(),
-                filename.length());
+                filename.length(), uri, uri_length, host_name);
         }
         else
         {
@@ -931,3 +931,17 @@ void MimeSession::mime_file_process(Packet* p, const uint8_t* data, int data_siz
         }
     }
 }
+
+void MimeSession::set_host_name(const std::string& host)
+{
+    if (host.empty())
+        return;
+    
+    host_name = host;
+    host_set = true;
+}
+
+bool MimeSession::is_host_set() const
+{
+    return host_set;
+}

diff --git a/src/mime/file_mime_process.h b/src/mime/file_mime_process.h
index cc565561678e00562e1144609fcb5c6ea33ee58b..3bb4850cf1b0c1a5dcfede34fd72a34fc0bfd8dc 100644 (file)
--- a/src/mime/file_mime_process.h
+++ b/src/mime/file_mime_process.h
@@ -80,6 +80,9 @@ public:
     MailLogState* get_log_state();
     void set_mime_stats(MimeStats*);
 
+    void set_host_name(const std::string& host);
+    bool is_host_set() const;
+
     const BufferData& get_ole_buf();
     const BufferData& get_vba_inspect_buf();
 
@@ -105,6 +108,8 @@ private:
     MimeStats* mime_stats = nullptr;
     FilenameState filename_state = CONT_DISP_FILENAME_PARAM_NAME;
     std::string filename;
+    std::string host_name {""};
+    bool host_set = false;
     bool continue_inspecting_file = true;
     // This counter is not an accurate count of files; used only for creating a unique mime_file_id
     uint32_t file_counter = 0;
@@ -116,8 +121,7 @@ private:
     const int32_t uri_length;
     uint64_t get_file_cache_file_id();
     uint64_t get_multiprocessing_file_id();
-    void mime_file_process(Packet* p, const uint8_t* data, int data_size,
-        FilePosition position, bool upload);
+    void mime_file_process(Packet* p, const uint8_t* data, int data_size, FilePosition position, bool upload);
     void reset_part_state();
 
     // Individual service inspectors may have different implementations for these

diff --git a/src/service_inspectors/http_inspect/http_msg_body.cc b/src/service_inspectors/http_inspect/http_msg_body.cc
index 1599e9d06abef90bb6994b16f63758da27a1dd5c..e7c80933ef1736760f9e2ae7dd5f48c37256768e 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_body.cc
+++ b/src/service_inspectors/http_inspect/http_msg_body.cc
@@ -194,11 +194,11 @@ void HttpMsgBody::analyze()
         }
         else
             mime_bufs = new std::list<MimeBufs>;
-
+        
         while (ptr < section_end)
         {
             // After process_mime_data(), ptr will point to the last byte processed in the current MIME part
-            ptr = session_data->mime_state[source_id]->process_mime_data(p, ptr,
+            ptr = session_data->mime_state[source_id]->process_mime_data(p, ptr, 
                 (section_end - ptr), true, SNORT_FILE_POSITION_UNKNOWN);
             ptr++;
 
@@ -692,7 +692,9 @@ void HttpMsgBody::do_file_processing(const Field& file_data)
     const FileDirection dir = source_id == SRC_SERVER ? FILE_DOWNLOAD : FILE_UPLOAD;
 
     uint64_t file_index = get_header(source_id)->get_file_cache_index();
-    const std::string host = get_header(source_id)->get_host_header_field();
+    // Get host from the header field.
+    std::string host = get_header(source_id)->get_host_header_field();
+    
     const uint8_t* filename_buffer = nullptr;
     uint32_t filename_length = 0;
     const uint8_t* uri_buffer = nullptr;
@@ -700,6 +702,10 @@ void HttpMsgBody::do_file_processing(const Field& file_data)
     if (request != nullptr)
         get_file_info(dir, filename_buffer, filename_length, uri_buffer, uri_length);
 
+    // Get host from the uri.
+    if (host.empty() and request != nullptr)
+        host = request->get_host_string();
+
     bool continue_processing_file = file_flows->file_process(p, file_index, file_data.start(),
         fp_length, session_data->file_octets[source_id], dir,
         get_header(source_id)->get_multi_file_processing_id(), file_position,

diff --git a/src/service_inspectors/http_inspect/http_msg_header.cc b/src/service_inspectors/http_inspect/http_msg_header.cc
index ee2c05a1727aa55b14489797697dd052d1c0cd3a..5612ce8b6be805fe43d176f1b918ef7fbceb2aa0 100755 (executable)
--- a/src/service_inspectors/http_inspect/http_msg_header.cc
+++ b/src/service_inspectors/http_inspect/http_msg_header.cc
@@ -551,6 +551,18 @@ void HttpMsgHeader::setup_mime()
                     session_data->mime_state[source_id] = new MimeSession(p,
                         params->mime_decode_conf, &mime_conf, get_multi_file_processing_id());
 
+                // Get host from the header field.
+                if (!session_data->mime_state[source_id]->is_host_set())
+                {
+                    std::string host = get_host_header_field();
+                    // Get host from the uri.
+                    if (host.empty())
+                        host = request->get_host_string();
+
+                    session_data->mime_state[source_id]->set_host_name(host);
+                }
+
+
                 // Show file processing the Content-Type header as if it were regular data.
                 // This will enable it to find the boundary string.
                 // FIXIT-L develop a proper interface for passing the boundary string.

diff --git a/src/service_inspectors/http_inspect/http_msg_request.cc b/src/service_inspectors/http_inspect/http_msg_request.cc
index 63436f9d6c68bb1858d1291f3de24c9d7a01f060..5820f9d17c5a066207563242802fefddc40fb05f 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_request.cc
+++ b/src/service_inspectors/http_inspect/http_msg_request.cc
@@ -394,6 +394,17 @@ string HttpMsgRequest::get_aux_ip()
     return ip_str;
 }
 
+std::string HttpMsgRequest::get_host_string()
+{
+    if (!uri)
+        return "";
+
+    const Field& host = uri->get_host();
+    if (host.length() > STAT_EMPTY_STRING)
+        return string((const char*)host.start(), (size_t)host.length());
+    return "";
+}
+
 #ifdef REG_TEST
 
 void HttpMsgRequest::print_section(FILE* output)

diff --git a/src/service_inspectors/http_inspect/http_msg_request.h b/src/service_inspectors/http_inspect/http_msg_request.h
index f4553e44863e5bc7a68a19e2b1f72d020504dc11..aa2ab625c27a08dbfbf6ff8317317e69ddd4bf50 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_request.h
+++ b/src/service_inspectors/http_inspect/http_msg_request.h
@@ -51,6 +51,7 @@ public:
     const Field& get_uri();
     const Field& get_uri_norm_classic();
     std::string get_aux_ip();
+    std::string get_host_string();
     HttpUri* get_http_uri() { return uri; }
     ParameterMap& get_query_params();
     ParameterMap& get_body_params();