{
if ( proto.first == type )
{
- if (proto.second == true)
+ if ( proto.second )
return false;
else
{
{
if ( proto.first == type )
{
- if (proto.second == true)
+ if ( proto.second )
return false;
else
{
return true;
}
- if (!invisible_swap_candidate and !hm_t.visibility)
+ if ( !invisible_swap_candidate and !hm_t.visibility )
invisible_swap_candidate = &hm_t;
}
- if (invisible_swap_candidate)
+ if ( invisible_swap_candidate )
{
memcpy(invisible_swap_candidate->mac, mac, MAC_SIZE);
invisible_swap_candidate->ttl = ttl;
bool HostTracker::add_payload_no_lock(const AppId pld, HostApplication* ha, size_t max_payloads)
{
- if ( max_payloads and ha->payloads.size() >= max_payloads )
+ Payload_t* invisible_swap_candidate = nullptr;
+
+ for ( auto& p : ha->payloads )
+ {
+ if ( p.first == pld )
+ {
+ if ( p.second )
+ {
+ return false;
+ }
+ else
+ {
+ p.second = true;
+ ha->num_visible_payloads++;
+ return true;
+ }
+ }
+
+ if ( !invisible_swap_candidate and !p.second )
+ invisible_swap_candidate = &p;
+ }
+
+ if ( invisible_swap_candidate )
+ {
+ invisible_swap_candidate->first = pld;
+ invisible_swap_candidate->second = true;
+ ha->num_visible_payloads++;
+ return true;
+ }
+
+ if ( ha->payloads.size() >= max_payloads )
return false;
- for ( const auto& app : ha->payloads )
- if ( app == pld )
- return false;
+ ha->payloads.emplace_back(pld, true);
+ ha->num_visible_payloads++;
- ha->payloads.emplace_back(pld);
return true;
}
bool HostTracker::add_client_payload(HostClient& hc, AppId payload, size_t max_payloads)
{
+ Payload_t* invisible_swap_candidate = nullptr;
std::lock_guard<std::mutex> lck(host_tracker_lock);
for ( auto& client : clients )
if ( client.id == hc.id and client.service == hc.service )
{
- if ( max_payloads and client.payloads.size() >= max_payloads )
- return false;
+ for ( auto& pld : client.payloads )
+ {
+ if ( pld.first == payload )
+ {
+ if ( pld.second )
+ return false;
- for (const auto& pld : client.payloads)
+ pld.second = true;
+ client.num_visible_payloads++;
+ return true;
+ }
+ if ( !invisible_swap_candidate and !pld.second )
+ invisible_swap_candidate = &pld;
+ }
+
+ if ( invisible_swap_candidate )
{
- if ( pld == payload )
- return false;
+ invisible_swap_candidate->second = true;
+ invisible_swap_candidate->first = payload;
+ client.num_visible_payloads++;
+ hc.payloads = client.payloads;
+ return true;
}
- client.payloads.emplace_back(payload);
+ if ( client.payloads.size() >= max_payloads )
+ return false;
+
+ client.payloads.emplace_back(payload, true);
hc.payloads = client.payloads;
strncpy(hc.version, client.version, INFO_SIZE);
+ client.num_visible_payloads++;
return true;
}
*added = true;
}
- if (s.visibility == false)
+ if ( s.visibility == false )
{
if (added)
*added = true;
services.emplace_back(app.port, app.proto, app.appid, app.inferred_appid);
num_visible_services++;
- if (added)
+ if ( added )
*added = true;
return true;
auto ha = find_service_no_lock(port, proto, service);
- if (ha)
+ if ( ha )
{
bool success = add_payload_no_lock(payload, ha, max_payloads);
local_ha = *ha;
void HostTracker::update_ha_no_lock(HostApplication& dst, HostApplication& src)
{
- if (dst.appid == APP_ID_NONE)
+ if ( dst.appid == APP_ID_NONE )
dst.appid = src.appid;
else
src.appid = dst.appid;
- for (auto& i: src.info)
- if (i.visibility == true)
+ for ( auto& i: src.info )
+ if ( i.visibility == true )
dst.info.emplace_back(i.version, i.vendor);
dst.hits = src.hits;
HostApplicationInfo* available = nullptr;
for ( auto& i : s.info )
{
- if (((!version and i.version[0] == '\0') or
+ if ( ((!version and i.version[0] == '\0') or
(version and !strncmp(version, i.version, INFO_SIZE)))
and ((!vendor and i.vendor[0] == '\0') or
- (vendor and !strncmp(vendor, i.vendor, INFO_SIZE))))
+ (vendor and !strncmp(vendor, i.vendor, INFO_SIZE))) )
{
- if (i.visibility == false)
+ if ( i.visibility == false )
{
i.visibility = true; // rediscover it
update_ha_no_lock(ha, s);
visibility = v;
- if (visibility == false)
+ if ( visibility == false )
{
for (auto& proto : network_protos)
proto.second = false;
for (auto& info : s.info)
info.visibility = false;
s.user[0] = '\0';
+ set_payload_visibility_no_lock(s.payloads, v, s.num_visible_payloads);
}
num_visible_services = 0;
for ( auto& c : clients )
+ {
c.visibility = false;
+ set_payload_visibility_no_lock(c.payloads, v, c.num_visible_payloads);
+ }
num_visible_clients = 0;
tcp_fpids.clear();
bool HostTracker::set_network_proto_visibility(uint16_t proto, bool v)
{
std::lock_guard<std::mutex> lck(host_tracker_lock);
- for (auto& pp : network_protos)
+ for ( auto& pp : network_protos )
{
- if (pp.first == proto)
+ if ( pp.first == proto )
{
pp.second = v;
return true;
bool HostTracker::set_xproto_visibility(uint8_t proto, bool v)
{
std::lock_guard<std::mutex> lck(host_tracker_lock);
- for (auto& pp : xport_protos)
+ for ( auto& pp : xport_protos )
{
- if (pp.first == proto)
+ if ( pp.first == proto )
{
pp.second = v;
return true;
return false;
}
+void HostTracker::set_payload_visibility_no_lock(PayloadVector& pv, bool v, size_t& num_vis)
+{
+ for ( auto& p : pv )
+ {
+ if ( p.second != v )
+ {
+ p.second = v;
+ if ( v )
+ num_vis++;
+ else
+ num_vis--;
+ }
+ }
+}
+
bool HostTracker::set_service_visibility(Port port, IpProtocol proto, bool v)
{
std::lock_guard<std::mutex> lck(host_tracker_lock);
s.user[0] = '\0';
s.banner_updated = false;
}
+
+ set_payload_visibility_no_lock(s.payloads, v, s.num_visible_payloads);
return true;
}
}
assert(num_visible_clients > 0 );
num_visible_clients--;
}
- else if (c.visibility == false and v == true)
+ else if ( c.visibility == false and v == true )
num_visible_clients++;
c.visibility = v;
+ set_payload_visibility_no_lock(c.payloads, v, c.num_visible_payloads);
deleted = true;
}
}
HostClient::HostClient(AppId clientid, const char *ver, AppId ser) :
id(clientid), service(ser)
{
- if (ver)
+ if ( ver )
{
strncpy(version, ver, INFO_SIZE);
version[INFO_SIZE-1] = '\0';
return c;
}
- else if ( !available and !c.visibility)
+ else if ( !available and !c.visibility )
available = &c;
}
HostApplicationInfo::HostApplicationInfo(const char *ver, const char *ven)
{
- if (ver)
+ if ( ver )
{
strncpy(version, ver, INFO_SIZE);
version[INFO_SIZE-1] = '\0';
}
- if (ven)
+ if ( ven )
{
strncpy(vendor, ven, INFO_SIZE);
vendor[INFO_SIZE-1] = '\0';
str += ", version: " + string(i.version);
}
- auto total_payloads = s.payloads.size();
- if ( total_payloads > 0 )
+ auto vis_payloads = s.num_visible_payloads;
+ if ( vis_payloads > 0 )
{
str += ", payload";
- str += (total_payloads > 1) ? "s: " : ": ";
+ str += (vis_payloads > 1) ? "s: " : ": ";
for ( const auto& pld : s.payloads )
{
- str += to_string(pld) + (--total_payloads ? ", " : "");
+ if ( pld.second )
+ str += to_string(pld.first) + (--vis_payloads ? ", " : "");
}
}
if ( *s.user )
str += "\nclients size: " + to_string(num_visible_clients);
for ( const auto& c : clients )
{
- if (c.visibility == false)
+ if ( c.visibility == false )
continue;
str += "\n id: " + to_string(c.id)
if ( c.version[0] != '\0' )
str += ", version: " + string(c.version);
- auto total_payloads = c.payloads.size();
- if ( total_payloads )
+ auto vis_payloads = c.num_visible_payloads;
+ if ( vis_payloads )
{
str += ", payload";
- str += (total_payloads > 1) ? "s: " : ": ";
+ str += (vis_payloads > 1) ? "s: " : ": ";
for ( const auto& pld : c.payloads )
- str += to_string(pld) + (--total_payloads ? ", " : "");
+ {
+ if ( pld.second )
+ str += to_string(pld.first) + (--vis_payloads ? ", " : "");
+ }
}
}
}
};
typedef HostCacheAllocIp<HostApplicationInfo> HostAppInfoAllocator;
-typedef AppId Payload_t;
+typedef std::pair<AppId, bool> Payload_t;
+typedef std::vector<Payload_t, HostCacheAllocIp<Payload_t>> PayloadVector;
struct HostApplication
{
bool banner = false) : port(pt), proto(pr), appid(ap), inferred_appid(in), hits(ht),
last_seen(ls), banner_updated(banner) { }
HostApplication(const HostApplication& ha): port(ha.port), proto(ha.proto), appid(ha.appid),
- inferred_appid(ha.inferred_appid), hits(ha.hits), last_seen(ha.last_seen), info(ha.info),
- payloads(ha.payloads) { }
+ inferred_appid(ha.inferred_appid), hits(ha.hits), last_seen(ha.last_seen),
+ num_visible_payloads(ha.num_visible_payloads), info(ha.info), payloads(ha.payloads),
+ visibility(ha.visibility) { }
+
HostApplication& operator=(const HostApplication& ha)
{
port = ha.port;
payloads = ha.payloads;
visibility = ha.visibility;
banner_updated = ha.banner_updated;
+ num_visible_payloads = ha.num_visible_payloads;
return *this;
}
uint32_t last_seen = 0;
char user[INFO_SIZE] = { '\0' };
bool banner_updated = false;
+ size_t num_visible_payloads = 0;
std::vector<HostApplicationInfo, HostAppInfoAllocator> info;
- std::vector<Payload_t, HostCacheAllocIp<Payload_t>> payloads;
+ PayloadVector payloads;
friend class HostTracker;
+// visibility is public in UT only, to avoid extra lock/unlock funcs used only by UT
+#ifndef UNIT_TEST
private:
+#endif
bool visibility = true;
+
};
struct HostClient
AppId id;
char version[INFO_SIZE] = { '\0' };
AppId service;
- std::vector<Payload_t, HostCacheAllocIp<Payload_t>> payloads;
+ PayloadVector payloads;
+ size_t num_visible_payloads = 0;
bool operator==(const HostClient& c) const
{
bool set_service_visibility(Port, IpProtocol, bool v = true);
bool set_client_visibility(const HostClient&, bool v = true);
+#ifdef UNIT_TEST
+ // Caller is responsible for checking visibility
+ std::vector<HostApplication, HostAppAllocator> get_services()
+ {
+ std::lock_guard<std::mutex> lck(host_tracker_lock);
+ return services;
+ }
+
+ // Caller is responsible for checking visibility
+ std::vector<HostClient, HostClientAllocator> get_clients()
+ {
+ std::lock_guard<std::mutex> lck(host_tracker_lock);
+ return clients;
+ }
+#endif
+
private:
mutable std::mutex host_tracker_lock; // ensure that updates to a shared object are safe
uint8_t hops; // hops from the snort inspector, e.g., zero for ARP
HostApplication* find_and_add_service_no_lock(Port, IpProtocol, uint32_t lseen,
bool& is_new, AppId, uint16_t max_services = 0);
+ // Sets all payloads visible or invisible
+ void set_payload_visibility_no_lock(PayloadVector& pv, bool v, size_t& num_vis);
+
// Hide / delete the constructor from the outside world. We don't want to
// have zombie host trackers, i.e. host tracker objects that live outside
// the host cache.
CHECK(APP_ID_NONE == ht.get_appid(8080, IpProtocol::UDP));
}
+// Test HostTracker add and rediscover service payload
+// (reuse/rediscover a deleted payload)
+TEST(host_tracker, add_rediscover_service_payload_test)
+{
+ HostTracker ht;
+ HostApplication local_ha;
+
+ ht.add_service(80, IpProtocol::TCP, 676, true);
+ ht.add_service(443, IpProtocol::TCP, 1122);
+
+ // Test adding payload
+ // Add a payload for service http (appid 676), payload == appid 261
+ // With 5 max payloads
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 261, 676, 5);
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 100, 676, 5);
+
+ auto services = ht.get_services();
+
+ // Verify we added the services, payload visibility == true
+ for (auto& srv : services)
+ {
+ CHECK(srv.visibility);
+ for (auto& pld : srv.payloads)
+ CHECK(pld.second);
+ }
+
+ // Delete the service
+ ht.set_service_visibility(80, IpProtocol::TCP, false);
+
+ // Verify that the service (and payloads) are deleted
+ services = ht.get_services();
+ for (auto& srv : services)
+ {
+ if (srv.port == 80)
+ CHECK(srv.visibility == false);
+ for ( auto& pld : srv.payloads )
+ CHECK(pld.second == false);
+ }
+
+ // Test rediscovery
+ // One payload is rediscovered as itself (existing payload with visibility = false)
+ // The other payload uses an existing slot that was freed when payload 100 was deleted
+ ht.add_service(80, IpProtocol::TCP, 676, true);
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 261, 676, 5);
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 101, 676, 5);
+
+ services = ht.get_services();
+ for (auto& srv : services)
+ {
+ if (srv.port == 80)
+ CHECK(srv.visibility == true);
+ for ( auto& pld : srv.payloads )
+ CHECK(pld.second);
+ }
+
+ CHECK(services.front().payloads.size() == 2);
+}
+
+// Test HostTracker with max payloads and payload reuse
+// (reuse a deleted payload for a new payload)
+TEST(host_tracker, max_payloads_test)
+{
+ HostTracker ht;
+ HostApplication local_ha;
+
+ ht.add_service(80, IpProtocol::TCP, 676, true);
+
+ // These payloads aren't valid payloads, but host tracker doesn't care
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 111, 676, 5);
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 222, 676, 5);
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 333, 676, 5);
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 444, 676, 5);
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 555, 676, 5);
+
+ auto services = ht.get_services();
+
+ // Verify we added the services, payload visibility == true
+ CHECK(services.front().payloads.size() == 5);
+
+ for (auto& pld : services.front().payloads)
+ CHECK(pld.second);
+
+ // Delete the service
+ ht.set_service_visibility(80, IpProtocol::TCP, false);
+
+ // Check all payloads are invisible after service visibility is false
+ services = ht.get_services();
+ for (auto& pld : services.front().payloads)
+ CHECK(pld.second == false);
+
+ // Add a payload; we are already at max payloads, so re-use an existing slot
+ ht.add_service(80, IpProtocol::TCP, 676, true);
+ ht.add_payload(local_ha, 80, IpProtocol::TCP, 999, 676, 5);
+ bool found_new = false;
+ services = ht.get_services();
+ for (auto& pld : services.front().payloads)
+ {
+ if (pld.first == 999)
+ {
+ CHECK(pld.second);
+ found_new = true;
+ }
+ else
+ {
+ CHECK(pld.second == false);
+ }
+ }
+
+ // Check we still have only 5 payloads, and the new payload was added
+ CHECK(services.front().payloads.size() == 5 and found_new);
+ CHECK(services.front().num_visible_payloads == 1);
+}
+
+// Test HostTracker with simple client payload rediscovery
+// (reuse/rediscover a deleted payload)
+TEST(host_tracker, client_payload_rediscovery_test)
+{
+ HostTracker ht;
+ HostClient hc;
+ bool new_client = false;
+
+ // Create a new client, HTTP
+ hc = ht.find_or_add_client(2, "one", 676, new_client);
+ CHECK(new_client);
+
+ // Add payloads 123 and 456
+ ht.add_client_payload(hc, 123, 5);
+ ht.add_client_payload(hc, 456, 5);
+ auto clients = ht.get_clients();
+ CHECK(clients.front().payloads.size() == 2);
+
+ // Delete client, ensure payloads are also deleted
+ ht.set_client_visibility(hc, false);
+ clients = ht.get_clients();
+ for (auto& pld : clients.front().payloads)
+ CHECK(pld.second == false);
+
+ // Rediscover client, make sure payloads are still deleted
+ hc = ht.find_or_add_client(2, "one", 676, new_client);
+ clients = ht.get_clients();
+ for (auto& pld : clients.front().payloads)
+ CHECK(pld.second == false);
+
+ // Re-add payloads, ensure they're actually visible now
+ ht.add_client_payload(hc, 123, 5);
+ ht.add_client_payload(hc, 456, 5);
+ clients = ht.get_clients();
+ for (auto& pld : clients.front().payloads)
+ CHECK(pld.second == true);
+
+ CHECK(clients.front().payloads.size() == 2);
+
+ // Make sure we didn't just add an extra client and two new payloads, rather than reusing
+ CHECK(clients.size() == 1);
+}
+
+// Test HostTracker with max payloads and payload reuse
+// (reuse an old payload for a new payload)
+TEST(host_tracker, client_payload_max_payloads_test)
+{
+ HostTracker ht;
+ HostClient hc;
+ bool new_client = false;
+
+ // Create a new client, HTTP
+ hc = ht.find_or_add_client(2, "one", 676, new_client);
+
+ // Add five (max payloads) payloads
+ ht.add_client_payload(hc, 111, 5);
+ ht.add_client_payload(hc, 222, 5);
+ ht.add_client_payload(hc, 333, 5);
+ ht.add_client_payload(hc, 444, 5);
+ ht.add_client_payload(hc, 555, 5);
+ auto clients = ht.get_clients();
+ CHECK_FALSE(ht.add_client_payload(hc, 666, 5));
+ CHECK(clients.front().payloads.size() == 5);
+
+ // Delete client, ensure payloads are also deleted
+ ht.set_client_visibility(hc, false);
+ clients = ht.get_clients();
+ for (auto& pld : clients.front().payloads)
+ CHECK(pld.second == false);
+
+ // Rediscover client, make sure payloads are still deleted
+ hc = ht.find_or_add_client(2, "one", 676, new_client);
+ clients = ht.get_clients();
+ for (auto& pld : clients.front().payloads)
+ CHECK(pld.second == false);
+
+ CHECK(clients.front().num_visible_payloads == 0);
+
+ //Re-add payloads, ensure they're actually visible now
+ ht.add_client_payload(hc, 666, 5);
+ ht.add_client_payload(hc, 777, 5);
+ clients = ht.get_clients();
+ for (auto& pld : clients.front().payloads)
+ {
+ if (pld.first == 666 or pld.first == 777)
+ {
+ CHECK(pld.second);
+ }
+ else
+ {
+ CHECK(pld.second == false);
+ }
+ }
+
+ CHECK(clients.front().payloads.size() == 5);
+ CHECK(clients.front().num_visible_payloads == 2);
+ CHECK(clients.size() == 1);
+}
+
// Test copying data and deleting copied list
TEST(host_tracker, copy_data_test)
{
projects / thirdparty / snort3.git / commitdiff
