Merge pull request #2875 in SNORT/snort3 from ~MDAGON/snort3:depth_trailer to master

Squashed commit of the following:

commit 194cedcca2a396e44522607dfd9add653f829367
Author: Maya Dagon <mdagon@cisco.com>
Date:   Thu Apr 29 13:00:41 2021 -0400

    http2_inspect: handle trailer after reaching flow depth

diff --git a/src/service_inspectors/http2_inspect/http2_headers_frame_trailer.cc b/src/service_inspectors/http2_inspect/http2_headers_frame_trailer.cc
index 3cd3ee3ab24dc58ebaf95e6ecbee5e04e66f9057..723b3ed0840eae40226dd82b626e4b1dd220d630 100644 (file)
--- a/src/service_inspectors/http2_inspect/http2_headers_frame_trailer.cc
+++ b/src/service_inspectors/http2_inspect/http2_headers_frame_trailer.cc
@@ -98,22 +98,24 @@ void Http2HeadersFrameTrailer::analyze_http1()
         const StreamBuffer stream_buf =
             session_data->hi_ss[source_id]->reassemble(session_data->flow,
             0, 0, nullptr, 0, PKT_PDU_TAIL, copied);
-        assert(stream_buf.data != nullptr);
         assert(copied == 0);
 
-        Http2DummyPacket dummy_pkt;
-        dummy_pkt.flow = session_data->flow;
-        dummy_pkt.packet_flags = (source_id == SRC_CLIENT) ? PKT_FROM_CLIENT : PKT_FROM_SERVER;
-        dummy_pkt.dsize = stream_buf.length;
-        dummy_pkt.data = stream_buf.data;
-        session_data->hi->eval(&dummy_pkt);
-        assert (http_flow->get_type_expected(source_id) == HttpEnums::SEC_TRAILER);
-        if (http_flow->get_type_expected(source_id) == HttpEnums::SEC_ABORT)
+        if (stream_buf.data != nullptr)
         {
-            stream->set_state(source_id, STREAM_ERROR);
-            return;
+            Http2DummyPacket dummy_pkt;
+            dummy_pkt.flow = session_data->flow;
+            dummy_pkt.packet_flags = (source_id == SRC_CLIENT) ? PKT_FROM_CLIENT : PKT_FROM_SERVER;
+            dummy_pkt.dsize = stream_buf.length;
+            dummy_pkt.data = stream_buf.data;
+            session_data->hi->eval(&dummy_pkt);
+            assert (http_flow->get_type_expected(source_id) == HttpEnums::SEC_TRAILER);
+            if (http_flow->get_type_expected(source_id) == HttpEnums::SEC_ABORT)
+            {
+                stream->set_state(source_id, STREAM_ERROR);
+                return;
+            }
+            session_data->hi->clear(&dummy_pkt);
         }
-        session_data->hi->clear(&dummy_pkt);
     }
 
     process_decoded_headers(http_flow, source_id);
@@ -139,6 +141,7 @@ void Http2HeadersFrameTrailer::print_frame(FILE* output)
 {
     fprintf(output, "Trailers frame\n");
     Http2HeadersFrame::print_frame(output);
-
 }
+
 #endif
+

diff --git a/src/service_inspectors/http_inspect/http_cutter.cc b/src/service_inspectors/http_inspect/http_cutter.cc
index 5dbddca3dd78828e2d95916268a089e860a2c258..098c17c571f95b71fa0705be217bbc5c6e9ba379 100644 (file)
--- a/src/service_inspectors/http_inspect/http_cutter.cc
+++ b/src/service_inspectors/http_inspect/http_cutter.cc
@@ -769,6 +769,9 @@ ScanResult HttpBodyH2Cutter::cut(const uint8_t* buffer, uint32_t length,
     {
         num_flush = length;
         total_octets_scanned += length;
+        if (state != H2_BODY_NOT_COMPLETE)
+            return SCAN_DISCARD;
+
         return SCAN_DISCARD_PIECE;
     }
 

diff --git a/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc b/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc
index a233f97b6725eb4e44f8049120494cc8d3f3e837..ddfbb4d54cc7478201fe42a8fb8b679a9cf50fee 100644 (file)
--- a/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc
+++ b/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc
@@ -346,8 +346,9 @@ const StreamBuffer HttpStreamSplitter::reassemble(Flow* flow, unsigned total,
                 {
                     session_data->half_reset(source_id);
                 }
-                // FIXIT-M update this to include H2 message once H2I supports trailers and finish()
-                else if (session_data->type_expected[source_id] == SEC_BODY_CHUNK)
+                else if (session_data->type_expected[source_id] == SEC_BODY_CHUNK ||
+                        (session_data->type_expected[source_id] == SEC_BODY_H2 &&
+                        session_data->h2_body_state[source_id] == H2_BODY_COMPLETE_EXPECT_TRAILERS))
                 {
                     session_data->trailer_prep(source_id);
                 }