move file_data to detection context

diff --git a/extra/src/inspectors/http_server/hi_main.cc b/extra/src/inspectors/http_server/hi_main.cc
index bdf50aab53090f024de037ade7510694138dddf2..fa66eca5d0531e85833887954b071d2e4323e4fa 100644 (file)
--- a/extra/src/inspectors/http_server/hi_main.cc
+++ b/extra/src/inspectors/http_server/hi_main.cc
@@ -1072,7 +1072,7 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p)
                 else
                 {
                     set_file_data((uint8_t*)session->server.response.body,
-                        (uint16_t)detect_data_size);
+                        (uint16_t)detect_data_size); 
                 }
 
                 FileFlows* file_flows = FileFlows::get_file_flows(p->flow);
@@ -1208,7 +1208,10 @@ int IsGzipData(Flow* flow)
     if (hsd == NULL)
         return -1;
 
-    if ((hsd->log_flags & HTTP_LOG_GZIP_DATA) && ( get_file_data().len > 0 ))
+    DataPointer file_data;
+    DetectionEngine::get_file_data(file_data);
+
+    if ((hsd->log_flags & HTTP_LOG_GZIP_DATA) && (file_data.len > 0 ))
         return 0;
     else
         return -1;
@@ -1218,10 +1221,11 @@ int GetHttpGzipData(Flow* flow, uint8_t** buf, uint32_t* len, uint32_t* type)
 {
     if (!IsGzipData(flow))
     {
-        DataPointer& gzip = get_file_data();
+        DataPointer file_data;
+        DetectionEngine::get_file_data(file_data);
 
-        *buf = gzip.data;
-        *len = gzip.len;
+        *buf = (uint8_t*)file_data.data;
+        *len = file_data.len;
         *type = EVENT_INFO_GZIP_DATA;
         return 1;
     }
@@ -1241,7 +1245,10 @@ int IsJSNormData(Flow* flow)
     if (hsd == NULL)
         return -1;
 
-    if ((hsd->log_flags & HTTP_LOG_JSNORM_DATA) && ( get_file_data().len > 0 ))
+    DataPointer file_data;
+    DetectionEngine::get_file_data(file_data);
+
+    if ((hsd->log_flags & HTTP_LOG_JSNORM_DATA) && (file_data.len > 0 ))
         return 0;
     else
         return -1;
@@ -1251,10 +1258,11 @@ int GetHttpJSNormData(Flow* flow, uint8_t** buf, uint32_t* len, uint32_t* type)
 {
     if (!IsJSNormData(flow))
     {
-        DataPointer& js = get_file_data();
+        DataPointer file_data;
+        DetectionEngine::get_file_data(file_data);
 
-        *buf = js.data;
-        *len = js.len;
+        *buf = (uint8_t*)file_data.data;
+        *len = file_data.len;
         *type = EVENT_INFO_JSNORM_DATA;
         return 1;
     }

diff --git a/src/codecs/root/cd_eth.cc b/src/codecs/root/cd_eth.cc
index e8d6dbfab24a9412fb24753dde823bc4905ef09d..c624798aee6756e7dfe3d4548b454f71a910d203 100644 (file)
--- a/src/codecs/root/cd_eth.cc
+++ b/src/codecs/root/cd_eth.cc
@@ -27,6 +27,7 @@
 #include "codecs/codec_module.h"
 #include "framework/codec.h"
 #include "log/text_log.h"
+#include "main/snort_config.h"
 #include "protocols/eth.h"
 #include "protocols/packet_manager.h"
 

diff --git a/src/detection/detection_engine.cc b/src/detection/detection_engine.cc
index db1c64237f0e19ef93765318d2d7d84d3bb27b8f..6eedf01d0493516baedbb65038e0ea00d5830712 100644 (file)
--- a/src/detection/detection_engine.cc
+++ b/src/detection/detection_engine.cc
@@ -20,7 +20,6 @@
 
 #include "detection_engine.h"
 
-#include "detection/detection_engine.h"
 #include "events/sfeventq.h"
 #include "filters/sfthreshold.h"
 #include "framework/endianness.h"
@@ -37,6 +36,7 @@
 #include "utils/stats.h"
 
 #include "context_switcher.h"
+#include "detection_util.h"
 #include "detect.h"
 #include "fp_detect.h"
 #include "ips_context.h"
@@ -72,13 +72,13 @@ Packet* DetectionEngine::get_encode_packet()
 MpseStash* DetectionEngine::get_stash()
 { return Snort::get_switcher()->get_context()->stash; }
 
+// we need to stay in the current context until rebuild is successful
+// any events while rebuilding will be logged against the current packet
 Packet* DetectionEngine::set_packet()
 {
-    // we need to stay in the current context until rebuild is successful
-    // any events while rebuilding will be logged against the current packet
-    // FIXIT-H bypass the interrupt / complete
- 
     ContextSwitcher* sw = Snort::get_switcher();
+
+    // FIXIT-H bypass the interrupt / complete
     const IpsContext* c = sw->interrupt();
     Packet* p = c->packet;
     sw->complete();
@@ -88,7 +88,6 @@ Packet* DetectionEngine::set_packet()
     p->pkt = c->buf;
 
     p->reset();
-
     return p;
 }
 
@@ -115,6 +114,35 @@ uint8_t* DetectionEngine::get_buffer(unsigned& max)
     return Snort::get_switcher()->get_context()->buf;
 }
 
+// similar to set_packet() because http_inspect does everything via the
+// splitter, ie before reassembly.  maybe that should change.  for now
+// we do it this way.
+void DetectionEngine::set_next_file_data(const DataPointer& dp)
+{
+    ContextSwitcher* sw = Snort::get_switcher();
+
+    // FIXIT-H bypass the interrupt / complete
+    IpsContext* c = sw->interrupt();
+    c->file_data = dp;
+    sw->complete();
+}
+
+void DetectionEngine::get_next_file_data(DataPointer& dp)
+{
+    ContextSwitcher* sw = Snort::get_switcher();
+
+    // FIXIT-H bypass the interrupt / complete
+    IpsContext* c = sw->interrupt();
+    dp = c->file_data;
+    sw->complete();
+}
+
+void DetectionEngine::set_file_data(const DataPointer& dp)
+{ Snort::get_switcher()->get_context()->file_data = dp; }
+
+void DetectionEngine::get_file_data(DataPointer& dp)
+{ dp = Snort::get_switcher()->get_context()->file_data; }
+
 void DetectionEngine::set_data(unsigned id, IpsContextData* p)
 { Snort::get_switcher()->get_context()->set_context_data(id, p); }
 

diff --git a/src/detection/detection_engine.h b/src/detection/detection_engine.h
index 12fd50cf8c50aead225a56e51280cd174acd0bfb..3cce494662403459ae259af458177eb760f97f5d 100644 (file)
--- a/src/detection/detection_engine.h
+++ b/src/detection/detection_engine.h
@@ -23,14 +23,17 @@
 
 // DetectionEngine manages a detection context.  To detect a rebuilt
 // packet (PDU), first call set_packet().  If rebuild is successful,
-// then instantiate a new DetectionContext() to detect that packet.
+// then instantiate a new DetectionEngine to detect that packet.
 
 #include "actions/actions.h"
+#include "detection/detection_util.h"
 #include "main/snort_types.h"
 
+struct DataPointer;
+struct Packet;
+
 class IpsContext;
 class IpsContextData;
-struct Packet;
 
 class SO_PUBLIC DetectionEngine
 {
@@ -50,6 +53,12 @@ public:
     static void set_encode_packet(Packet*);
     static Packet* get_encode_packet();
 
+    static void set_next_file_data(const DataPointer&);
+    static void get_next_file_data(DataPointer&);
+
+    static void set_file_data(const DataPointer&);
+    static void get_file_data(DataPointer&);
+
     static class MpseStash* get_stash();
     static uint8_t* get_buffer(unsigned& max);
 
@@ -86,5 +95,22 @@ private:
     static struct SF_EVENTQ* get_event_queue();
 };
 
+static inline void set_next_file_data(const uint8_t* p, unsigned n)
+{
+    DataPointer dp { p, n };
+    DetectionEngine::set_next_file_data(dp);
+}
+
+static inline void set_file_data(const uint8_t* p, unsigned n)
+{
+    DataPointer dp { p, n };
+    DetectionEngine::set_file_data(dp);
+}
+
+// FIXIT-H refactor detection resets
+// this should only be called by framework
+static inline void clear_file_data()
+{ set_file_data(nullptr, 0); }
+    
 #endif
 

diff --git a/src/detection/detection_util.h b/src/detection/detection_util.h
index 4ea132d46bfcbbb5efcdd5fa7a434c44b2e66cc7..29567e816e538ec75b961d92db1a90564bae90de 100644 (file)
--- a/src/detection/detection_util.h
+++ b/src/detection/detection_util.h
@@ -31,7 +31,7 @@
 
 struct DataPointer
 {
-    uint8_t* data;
+    const uint8_t* data;
     unsigned len;
 };
 
@@ -41,8 +41,6 @@ struct DataBuffer
     unsigned len;
 };
 
-extern THREAD_LOCAL DataPointer g_file_data;
-
 #define SetDetectLimit(pktPtr, altLen) \
 { \
     pktPtr->alt_dsize = altLen; \
@@ -50,9 +48,6 @@ extern THREAD_LOCAL DataPointer g_file_data;
 
 #define IsLimitedDetect(pktPtr) (pktPtr->packet_flags & PKT_HTTP_DECODE)
 
-SO_PUBLIC DataPointer& get_file_data();
-SO_PUBLIC void set_file_data(uint8_t*, unsigned);
-
 // FIXIT-L event trace should be placed in its own files
 void EventTrace_Init();
 void EventTrace_Term();
@@ -64,8 +59,5 @@ inline int EventTrace_IsEnabled()
     return ( snort_conf->event_trace_max > 0 );
 }
 
-inline void DetectReset()
-{ set_file_data(nullptr, 0); }
-
 #endif
 

diff --git a/src/detection/fp_detect.cc b/src/detection/fp_detect.cc
index 849ce3f9c7dccba96935252e68a8c257eff3dc80..31c10e1266ba7a8ad4910bf1ec3c989c9e47938a 100644 (file)
--- a/src/detection/fp_detect.cc
+++ b/src/detection/fp_detect.cc
@@ -905,8 +905,10 @@ static int fp_search(
         {
             // FIXIT-M file data should be obtained from
             // inspector gadget as is done with SEARCH_BUFFER
-            if ( g_file_data.len )
-                SEARCH_DATA(g_file_data.data, g_file_data.len, pc.file_searches);
+            DataPointer file_data;
+            DetectionEngine::get_file_data(file_data);
+            if ( file_data.len )
+                SEARCH_DATA(file_data.data, file_data.len, pc.file_searches);
         }
     }
     return 0;

diff --git a/src/detection/ips_context.h b/src/detection/ips_context.h
index 8ba9ecf8029b81711d78d94954759ce090c17c3d..9c1580a61f4001b4f7862f04b7c0144c130c2b8d 100644 (file)
--- a/src/detection/ips_context.h
+++ b/src/detection/ips_context.h
@@ -36,6 +36,8 @@
 // required to get a decent decl of pkth
 #include "protocols/packet.h"
 
+#include "detection/detection_util.h"
+
 class SO_PUBLIC IpsContextData
 {
 public:
@@ -69,6 +71,8 @@ public:
     DAQ_PktHdr_t* pkth;
     uint8_t* buf;
 
+    DataPointer file_data;
+
     class MpseStash* stash;
     struct OtnxMatchData* otnx;
     uint64_t pkt_count;

diff --git a/src/ips_options/ips_file_data.cc b/src/ips_options/ips_file_data.cc
index ed9b99349fed45440adb3846e766867f02a4fa77..c79179b04cbbe0c6a360812b4b4c9f2395026574 100644 (file)
--- a/src/ips_options/ips_file_data.cc
+++ b/src/ips_options/ips_file_data.cc
@@ -23,7 +23,7 @@
 #endif
 
 #include "detection/detection_defines.h"
-#include "detection/detection_util.h"
+#include "detection/detection_engine.h"
 #include "framework/cursor.h"
 #include "framework/ips_option.h"
 #include "framework/module.h"
@@ -53,7 +53,8 @@ int FileDataOption::eval(Cursor& c, Packet*)
 {
     Profile profile(fileDataPerfStats);
 
-    DataPointer& dp = get_file_data();
+    DataPointer dp;
+    DetectionEngine::get_file_data(dp);
 
     if ( !dp.data || !dp.len )
         return DETECTION_OPTION_NO_MATCH;

diff --git a/src/log/log_text.cc b/src/log/log_text.cc
index f1f705868f2b405079d8e7e08dcb5451feb4a6fe..624692f8471ac92298826dce8fe20d61674dae24 100644 (file)
--- a/src/log/log_text.cc
+++ b/src/log/log_text.cc
@@ -28,7 +28,7 @@
 
 #include <sfbpf_dlt.h>
 
-#include "detection/detection_util.h"
+#include "detection/detection_engine.h"
 #include "detection/signature.h"
 #include "events/event.h"
 #include "main/snort_config.h"
@@ -1183,10 +1183,10 @@ void LogXrefs(TextLog* log, const Event* e, bool doNewLine)
  * Returns: void function
  *--------------------------------------------------------------------
  */
-static void LogCharData(TextLog* log, const char* data, int len)
+static void LogCharData(TextLog* log, const uint8_t* data, int len)
 {
-    const char* pb = data;
-    const char* end = data + len;
+    const uint8_t* pb = data;
+    const uint8_t* end = data + len;
     int lineCount = 0;
 
     if ( !data )
@@ -1463,14 +1463,15 @@ void LogPayload(TextLog* log, Packet* p)
     {
         if (SnortConfig::output_char_data())
         {
-            LogCharData(log, (const char*)p->data, p->dsize);
+            LogCharData(log, p->data, p->dsize);
 
-            DataPointer& fdata = get_file_data();
+            DataPointer file_data;
+            DetectionEngine::get_file_data(file_data);
 
-            if ( fdata.len > 0 )
+            if ( file_data.len > 0 )
             {
                 TextLog_Print(log, "%s\n", "File data");
-                LogCharData(log, (const char*)fdata.data, fdata.len);
+                LogCharData(log, file_data.data, file_data.len);
             }
         }
         else
@@ -1489,10 +1490,13 @@ void LogPayload(TextLog* log, Packet* p)
             {
                 LogNetData(log, p->data, p->dsize, p);
 
-                if ( g_file_data.len > 0 )
+                DataPointer file_data;
+                DetectionEngine::get_file_data(file_data);
+
+                if ( file_data.len > 0 )
                 {
                     TextLog_Print(log, "%s\n", "File data");
-                    LogNetData(log, g_file_data.data, g_file_data.len, p);
+                    LogNetData(log, file_data.data, file_data.len, p);
                 }
             }
         }

diff --git a/src/main/snort.cc b/src/main/snort.cc
index e22281c5d388bd70041f9b514bd77f3023cdfafa..b545413f2eacde3b3060a93b023279f875e606d5 100644 (file)
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -739,8 +739,7 @@ void Snort::inspect(Packet* p)
     DetectionEngine de;
     main_hook(p);
 
-    DetectReset();  // FIXIT-H context
-
+    clear_file_data();
     DetectionEngine::set_detects(save_detect);
 }
 
@@ -760,7 +759,7 @@ DAQ_Verdict Snort::process_packet(
 
     if ( !(p->packet_flags & PKT_IGNORE) )
     {
-        DetectReset();
+        clear_file_data();
         main_hook(p);
     }
 

diff --git a/src/mime/file_mime_process.cc b/src/mime/file_mime_process.cc
index bfba6398f9071ab7b9f7060aae51e7c1cebced4d..38921491be5a93923e7b1eeb1ec456d28a9209e0 100644 (file)
--- a/src/mime/file_mime_process.cc
+++ b/src/mime/file_mime_process.cc
@@ -26,7 +26,7 @@
 
 #include "file_mime_process.h"
 
-#include "detection/detection_util.h"
+#include "detection/detection_engine.h"
 #include "file_api/file_flows.h"
 #include "log/messages.h"
 #include "search_engines/search_tool.h"
@@ -527,7 +527,7 @@ const uint8_t* MimeSession::process_mime_data_paf(
     // FIXIT-L why is this being set?  we don't search file data until
     // we set it again below after decoding.  can it be deleted?
     if ( decode_conf && (!decode_conf->is_ignore_data()))
-        set_file_data((uint8_t*)start, (end - start));
+        set_file_data(start, (end - start));
 
     if (data_state == STATE_DATA_HEADER)
     {

diff --git a/src/service_inspectors/dce_rpc/dce_smb2.cc b/src/service_inspectors/dce_rpc/dce_smb2.cc
index fb613edc77825a4e28938a13fbc8cc3eb66f6d3f..d57407310b7ebecd285a0abde0ede11eef1188d9 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_smb2.cc
+++ b/src/service_inspectors/dce_rpc/dce_smb2.cc
@@ -273,7 +273,7 @@ static inline void DCE2_Smb2ProcessFileData(DCE2_SmbSsnData* ssd, const uint8_t*
 
     if (detection_size)
     {
-        set_file_data((uint8_t*)file_data,
+        set_file_data(file_data,
             (detection_size > UINT16_MAX) ? UINT16_MAX : (uint16_t)detection_size);
 
         DCE2_FileDetect();

diff --git a/src/service_inspectors/dce_rpc/dce_smb_utils.cc b/src/service_inspectors/dce_rpc/dce_smb_utils.cc
index df5fa9468ceccbf03420c8f07f3cc42c1a4865e7..bf2f64b39f7793750e91d7bde39c442511359904 100644 (file)
--- a/src/service_inspectors/dce_rpc/dce_smb_utils.cc
+++ b/src/service_inspectors/dce_rpc/dce_smb_utils.cc
@@ -1887,9 +1887,7 @@ void DCE2_SmbProcessFileData(DCE2_SmbSsnData* ssd,
         ((ftracker->ff_file_offset == ftracker->ff_bytes_processed) &&
         ((file_data_depth == 0) || (ftracker->ff_bytes_processed < (uint64_t)file_data_depth))))
     {
-        set_file_data((uint8_t*)data_ptr,
-            (data_len > UINT16_MAX) ? UINT16_MAX : (uint16_t)data_len);
-
+        set_file_data(data_ptr, (data_len > UINT16_MAX) ? UINT16_MAX : (uint16_t)data_len);
         DCE2_FileDetect();
     }
 
@@ -1993,7 +1991,7 @@ void DCE2_FileDetect()
     DetectionEngine::detect(top_pkt);
 
     // Reset file data pointer after detecting
-    set_file_data(nullptr, 0);
+    clear_file_data();
     dce2_detected = 1;
 }
 

diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc
index 9eaa1f81ea5329d2e843fceba872567c20d932b5..f3cb904f22e8b26e7b31322bd147faf6b6db4f9d 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftp_data.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_data.cc
@@ -23,7 +23,7 @@
 
 #include "ftp_data.h"
 
-#include "detection/detection_util.h"
+#include "detection/detection_engine.h"
 #include "file_api/file_flows.h"
 #include "file_api/file_service.h"
 #include "packet_io/active.h"
@@ -48,14 +48,12 @@ static THREAD_LOCAL SimpleStats fdstats;
 // implementation stuff
 //-------------------------------------------------------------------------
 
-// FIXIT-L seems like file_data should be const pointer.
-// Need to root this out and eliminate const-removing casts.
 static void FTPDataProcess(
     Packet* p, FTP_DATA_SESSION* data_ssn, uint8_t* file_data, uint16_t data_length)
 {
     int status;
 
-    set_file_data((uint8_t*)p->data, p->dsize);
+    set_file_data(p->data, p->dsize);
 
     if (data_ssn->packet_flags & FTPDATA_FLG_REST)
     {

diff --git a/src/service_inspectors/http_inspect/http_msg_body.cc b/src/service_inspectors/http_inspect/http_msg_body.cc
index 61ee1466a34d83fed9edf1c47adb4a0bd11d29ea..570e77858cdf620a4ccd5151c36af5cb384ea2fb 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_body.cc
+++ b/src/service_inspectors/http_inspect/http_msg_body.cc
@@ -53,8 +53,10 @@ void HttpMsgBody::analyze()
             js_norm_body.length() : session_data->detect_depth_remaining[source_id];
         detect_data.set(detect_length, js_norm_body.start());
         session_data->detect_depth_remaining[source_id] -= detect_length;
+
         // Always set file data. File processing will later set a new value in some cases.
-        set_file_data(const_cast<uint8_t*>(detect_data.start()), (unsigned)detect_data.length());
+        set_next_file_data(
+            const_cast<uint8_t*>(detect_data.start()), (unsigned)detect_data.length());
     }
 
     if (session_data->file_depth_remaining[source_id] > 0)
@@ -199,7 +201,9 @@ void HttpMsgBody::print_body_section(FILE* output)
     get_classic_buffer(HTTP_BUFFER_CLIENT_BODY, 0, 0).print(output,
         HttpApi::classic_buffer_names[HTTP_BUFFER_CLIENT_BODY-1]);
 
-    DataPointer& body = get_file_data();
+    DataPointer body;
+    DetectionEngine::get_next_file_data(body);
+
     if (body.len > 0)
     {
         Field(body.len, body.data).print(output, "file_data");

diff --git a/src/stream/file/file_session.cc b/src/stream/file/file_session.cc
index 0a812e7eda5d7f772ed71956ba66e73d694e4fb7..2d4f169e4e602cd7f37df359b37c5b12700e8130 100644 (file)
--- a/src/stream/file/file_session.cc
+++ b/src/stream/file/file_session.cc
@@ -23,7 +23,7 @@
 
 #include "file_session.h"
 
-#include "detection/detection_util.h"
+#include "detection/detection_engine.h"
 #include "file_api/file_flows.h"
 #include "packet_io/sfdaq.h"
 #include "profiler/profiler_defs.h"
@@ -84,7 +84,7 @@ int FileSession::process(Packet* p)
         if (file_name)
             file_flows->set_file_name((uint8_t*)file_name, strlen(file_name));
     }
-    set_file_data((uint8_t*)p->data, p->dsize);
+    set_file_data(p->data, p->dsize);
 
     return 0;
 }