-- latest from Josh
-- initial /* comments */ for text rules (needs to ignore \")
-- latest from Josh
+-- added hi event squelch
126
-- pulled latest from tom
hi_norm.h
hi_paf.cc
hi_paf.h
+ hi_events.cc
hi_events.h
hi_module.cc
hi_module.h
hi_client_norm.cc hi_client_norm.h \
hi_client_stateful.h \
hi_cmd_lookup.cc hi_cmd_lookup.h \
-hi_events.h \
+hi_events.cc hi_events.h \
hi_include.h \
hi_mi.cc hi_mi.h \
hi_module.cc hi_module.h \
if(data[0]=='H' && data[1]=='T' && data[2]=='T' && data[3]=='P' &&
data[4]=='/')
{
- SnortEventqAdd(GID_HTTP_SERVER, HI_ANOM_SERVER);
+ hi_set_event(GID_HTTP_SERVER, HI_ANOM_SERVER);
}
}
&& (iInspectMode == HI_SI_CLIENT_MODE)
&& (session->server_conf->chunk_length < iChunkLen) )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LARGE_CHUNK);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_LARGE_CHUNK);
}
if (session->server_conf->small_chunk_length.size != 0)
{
if ( !alerted )
{
- SnortEventqAdd(gid, sid);
+ hi_set_event(gid, sid);
alerted = true;
}
*chunk_count = 0;
(*ptr != '\n') && (*ptr != '\r')
&& ((ptr + 1) < end) && (*(ptr + 1) != '\n') )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_CHUNK_SIZE_MISMATCH);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_CHUNK_SIZE_MISMATCH);
}
}
else
&& (iInspectMode == HI_SI_CLIENT_MODE)
&& (session->server_conf->chunk_length < iChunkLen) )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LARGE_CHUNK);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_LARGE_CHUNK);
}
iCheckChunk = 0;
if ( session->server_conf->max_hdr_len &&
(p - offset) >= session->server_conf->max_hdr_len )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
}
p++;
if ( session->server_conf->max_hdr_len &&
(p - start) >= session->server_conf->max_hdr_len )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
}
return NULL;
{
if(ServerConf->apache_whitespace.on)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_APACHE_WS);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_APACHE_WS);
}
(*ptr)++;
continue;
*/
if(ServerConf->iis_delimiter.on)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_IIS_DELIMITER);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_IIS_DELIMITER);
uri_ptr->delimiter = *ptr;
if ( iDirLen > session->server_conf->long_dir )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_OVERSIZE_DIR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_OVERSIZE_DIR);
}
}
if( (hdrs_args->true_clnt_xff & HDRS_BOTH) == HDRS_BOTH)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_BOTH_TRUEIP_XFF_HDRS);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_BOTH_TRUEIP_XFF_HDRS);
}
SkipBlankSpace(start,end,&p);
if ( session->server_conf->max_spaces &&
num_spaces >= session->server_conf->max_spaces )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
}
p = p + unfold_size;
{
if((status != SFIP_ARG_ERR) && (status !=SFIP_ALLOC_ERR))
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_INVALID_TRUEIP);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_INVALID_TRUEIP);
return p;
}
}
}
else if((status != SFIP_ARG_ERR) && (status !=SFIP_ALLOC_ERR))
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_INVALID_TRUEIP);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_INVALID_TRUEIP);
free(ipAddr);
return p;
}
sfip_free(*true_ip);
*true_ip = tmp;
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_MULTIPLE_TRUEIP_IN_SESSION);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_MULTIPLE_TRUEIP_IN_SESSION);
}
else
sfip_free(tmp);
if ( session->server_conf->max_spaces &&
num_spaces >= session->server_conf->max_spaces )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
}
p = p + unfold_size;
if((end_ptr - start_ptr) >= MAX_HOSTNAME)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HOSTNAME);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_LONG_HOSTNAME);
}
iRet = HTTP_CopyExtraDataTosession((uint8_t *)start_ptr, (end_ptr - start_ptr), COPY_HOSTNAME, hsd->log_state);
int space_present = 0;
if (header_ptr->content_len.cont_len_start)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_MULTIPLE_CONTLEN);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_MULTIPLE_CONTLEN);
header_ptr->header.uri_end = p;
header_ptr->content_len.len = 0;
return p;
if ( session->server_conf->max_spaces &&
num_spaces >= session->server_conf->max_spaces )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
}
if ( isdigit((int)*p))
break;
/* Alert when there are multiple host headers in one request */
if(hdrs_args->hst_name_hdr)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_MULTIPLE_HOST_HDRS);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_MULTIPLE_HOST_HDRS);
return p;
}
else
if ( session->server_conf->max_spaces &&
num_spaces >= session->server_conf->max_spaces )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
}
}
break;
}
else
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_UNESCAPED_SPACE_URI);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_UNESCAPED_SPACE_URI);
if(p < end)
{
crlf = (u_char *)SnortStrnStr((const char *)p, end - p, "\n");
if ( session->server_conf->max_hdr_len &&
(p - offset) >= session->server_conf->max_hdr_len )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
}
if (session->server_conf->max_headers &&
(header_count > session->server_conf->max_headers))
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_MAX_HEADERS);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_MAX_HEADERS);
}
p++;
if ( session->server_conf->max_spaces &&
num_spaces >= session->server_conf->max_spaces )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
}
offset = (u_char*)p;
if ( session->server_conf->max_hdr_len &&
(p - start) >= session->server_conf->max_hdr_len )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
}
header_ptr->header.uri_end = p;
if(iRet == -1 || (CmdConf == NULL))
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_UNKNOWN_METHOD);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_UNKNOWN_METHOD);
Client->request.method = HI_UNKNOWN_METHOD;
}
}
* so we know we're looking for a method and not guessing that we're in
* the body or somewhere else because we found a non-ascii character */
if ( !stream_ins )
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_UNKNOWN_METHOD);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_UNKNOWN_METHOD);
Client->request.method = HI_UNKNOWN_METHOD;
}
}
if ( iRet == URI_END && ServerConf->max_hdr_len &&
((uri_ptr.uri_end - uri_ptr.uri) >= ServerConf->max_hdr_len) )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
}
if(iRet == URI_END &&
if(uri_ptr.proxy && session->global_conf->proxy_alert &&
(!ServerConf->allow_proxy && !ClientConf->allow_proxy))
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_PROXY_USE);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_PROXY_USE);
}
return HI_SUCCESS;
--- /dev/null
+/****************************************************************************
+ *
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2003-2013 Sourcefire, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License Version 2 as
+ * published by the Free Software Foundation. You may not use, modify or
+ * distribute this program under any other version of the GNU General
+ * Public License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
+ *
+ ****************************************************************************/
+// hi_events.cc author Russ Combs <rucombs@cisco.com>
+
+#include "hi_events.h"
+
+#include <assert.h>
+#include <strings.h>
+
+#include "events/event_queue.h"
+
+static THREAD_LOCAL uint64_t gid_client = 0;
+static THREAD_LOCAL uint64_t gid_server = 0;
+
+static inline void set(uint64_t& mask, unsigned sid)
+{
+ assert(sid && sid < 64);
+ mask |= (1 << (sid-1));
+}
+
+static void queue(unsigned gid, uint64_t mask)
+{
+ int sid;
+
+ while ( (sid = ffs(mask)) )
+ {
+ SnortEventqAdd(gid, sid);
+ mask ^= (1 << (sid-1));
+ }
+}
+
+void hi_set_event(unsigned gid, unsigned sid)
+{
+ switch ( gid )
+ {
+ case GID_HTTP_CLIENT:
+ set(gid_client, sid);
+ break;
+
+ case GID_HTTP_SERVER:
+ set(gid_server, sid);
+ break;
+
+ default:
+ assert(false);
+ }
+}
+
+void hi_clear_events()
+{
+ gid_client = gid_server = 0;
+}
+
+void hi_queue_events()
+{
+ if ( gid_client )
+ queue(GID_HTTP_CLIENT, gid_client);
+
+ if ( gid_server )
+ queue(GID_HTTP_SERVER, gid_server);
+}
+
#define HI_SERVER_MIXED_ENCODINGS_STR \
"multiple encodings within javascript obfuscated data"
+void hi_set_event(unsigned gid, unsigned sid);
+void hi_clear_events();
+void hi_queue_events();
+
#endif
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_IIS_UNICODE);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_IIS_UNICODE);
}
*encodeType |= HTTP_ENCODE_TYPE__IIS_UNICODE;
}
*/
if( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_U_ENCODE);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_U_ENCODE);
}
byte_decoded = true;
if( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_ASCII);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_ASCII);
}
return iNorm;
*encodeType |= HTTP_ENCODE_TYPE__BARE_BYTE;
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_BARE_BYTE);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_BARE_BYTE);
}
/*
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_IIS_UNICODE);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_IIS_UNICODE);
}
*encodeType |= HTTP_ENCODE_TYPE__IIS_UNICODE;
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_UTF_8);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_UTF_8);
}
return iNorm;
if( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_DOUBLE_DECODE);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_DOUBLE_DECODE);
}
byte_decoded = true;
{
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_IIS_BACKSLASH);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_IIS_BACKSLASH);
}
iChar = 0x2f;
*/
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_WEBROOT_DIR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_WEBROOT_DIR);
}
}
hi_stats.slashes++;
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_MULTI_SLASH);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_MULTI_SLASH);
}
continue;
*/
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_DIR_TRAV);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_DIR_TRAV);
}
*ptr = dir_ptr;
*/
if ( !norm_state->param )
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_SELF_DIR_TRAV);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_SELF_DIR_TRAV);
}
continue;
if(iDirLen > session->server_conf->long_dir &&
!norm_state->param)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_OVERSIZE_DIR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_OVERSIZE_DIR);
}
}
{
if(!norm_state->param)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_NON_RFC_CHAR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_NON_RFC_CHAR);
}
}
{
if(!norm_state.param)
{
- SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_NON_RFC_CHAR);
+ hi_set_event(GID_HTTP_CLIENT, HI_CLIENT_NON_RFC_CHAR);
}
}
static inline void hi_paf_event_post ()
{
- SnortEventqAdd(
+ hi_set_event(
GID_HTTP_CLIENT,
HI_CLIENT_UNBOUNDED_POST);
}
static inline void hi_paf_event_simple ()
{
- SnortEventqAdd(
+ hi_set_event(
GID_HTTP_CLIENT,
HI_CLIENT_SIMPLE_REQUEST);
}
static inline void hi_paf_event_msg_size ()
{
- SnortEventqAdd(
+ hi_set_event(
GID_HTTP_SERVER,
HI_CLISRV_MSG_SIZE_EXCEPTION);
}
static inline void hi_paf_event_pipe ()
{
- SnortEventqAdd(
+ hi_set_event(
GID_HTTP_CLIENT,
HI_CLIENT_PIPELINE_MAX);
}
else
{
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_INVALID_STATCODE);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_INVALID_STATCODE);
ptr++;
}
}
else if ((cmplen > 0) && (*ptr == '7'))
{
set_decode_utf_state_charset(&(hsd->utf_state), CHARSET_UTF7);
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_UTF7);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_UTF7);
}
else if (cmplen >= 4)
{
if(!(sd->resp_state.last_pkt_chunked) && !simple_response)
{
if ( headers )
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_NO_CONTLEN);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_NO_CONTLEN);
}
else
sd->resp_state.last_pkt_chunked = 0;
else
{
/* No Content-Length or Transfer-Encoding : chunked */
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_NO_CONTLEN);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_NO_CONTLEN);
zRet = uncompress_gzip(decompression_buffer, decompr_avail, ptr, compr_avail,
sd, &total_bytes_read, sd->decomp_state->compress_fmt);
{
if(sd->decomp_state->decompr_bytes_read)
{
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_DECOMPR_FAILED);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_DECOMPR_FAILED);
}
}
if (result == DECODE_UTF_FAILURE)
{
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_UTF_NORM_FAIL);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_UTF_NORM_FAIL);
}
SetHttpDecode((uint16_t)bytes_copied);
ServerResp->body = HttpDecodeBuf.data;
{
if(js.alerts & ALERT_LEVELS_EXCEEDED)
{
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_JS_OBFUSCATION_EXCD);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_JS_OBFUSCATION_EXCD);
}
if(js.alerts & ALERT_SPACES_EXCEEDED)
{
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_JS_EXCESS_WS);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_JS_EXCESS_WS);
}
if(js.alerts & ALERT_MIXED_ENCODINGS)
{
- SnortEventqAdd(GID_HTTP_SERVER, HI_SERVER_MIXED_ENCODINGS);
+ hi_set_event(GID_HTTP_SERVER, HI_SERVER_MIXED_ENCODINGS);
}
}
assert(p->is_tcp() && p->dsize && p->data);
MODULE_PROFILE_START(hiPerfStats);
+ hi_clear_events();
HttpInspectMain(config, p);
+ hi_queue_events();
ClearHttpBuffers();
/* XXX:
projects / thirdparty / snort3.git / commitdiff
