InspectApi updated for content buffers

diff --git a/ChangeLog b/ChangeLog
index 4498af84597f48c2b0f176d2bf234cd2a73d3d05..6de9fd8a92b2fdb015cc26255a7733e39b876282 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,7 @@
    defaults)
 -- removed -b, -N, -Z and, --perfmon-file options
 -- removed uricontent ips rule option
+-- added contents and getbuf to InspectApi for content buffers
 
 
 84

diff --git a/src/framework/inspector.h b/src/framework/inspector.h
index 51b82a8f8da835b5ec2f1ccab24d664b7bed0612..77d8a90dbdef5a927b5d6187b2f371d4e0c43088 100644 (file)
--- a/src/framework/inspector.h
+++ b/src/framework/inspector.h
@@ -102,14 +102,18 @@ typedef Inspector* (*InspectCtor)(Module*);
 typedef void (*InspectDtorFunc)(Inspector*);
 typedef void (*InspectFunc)();
 typedef class Session* (*InspectSsnFunc)(class Flow*);
+typedef struct ContentBuffer* (*InspectBufFunc)(unsigned);
 
 // FIXIT ensure all provide stats
 struct InspectApi
 {
     BaseApi base;
     InspectorType type;
-    const char* service;   // nullptr when type != IT_SERVICE
     uint16_t proto_bits;
+    const char* service;   // nullptr when type != IT_SERVICE
+
+    // list of thread local detection buffers captured by inspector
+    const char* contents;  // space separated, eg "foo_a foo_b foo_c" 
 
     // main thread funcs - parse time data only
     InspectFunc init;      // allocate process static data
@@ -124,6 +128,7 @@ struct InspectApi
     InspectFunc sum;       // accumulate stats
     InspectFunc stats;     // output stats
     InspectFunc reset;     // clear stats
+    InspectBufFunc getbuf; // 0-based, eg getbuf(1) means foo_b above
 };
 
 #endif

diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc
index d2a9af91af8683243f409000ece3443fd131cbc4..7fc4f200622ca7dd4ea2a76ebd0e906d3aaa4355 100644 (file)
--- a/src/managers/module_manager.cc
+++ b/src/managers/module_manager.cc
@@ -198,7 +198,7 @@ static void dump_field(string& key, const char* pfx, const Parameter* p, bool li
 
     else if ( !pfx || !strncmp(key.c_str(), pfx, strlen(pfx)) )
     {
-#if 0
+#if 1
         cout << item();
         cout << p->get_type();
         cout << " " << emphasis(key);

diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc
index 98642e6e5df343abb468409e1770c41efec57507..4ce95b1ac4a338672aef7cceb4e8c6dd4472b932 100644 (file)
--- a/src/network_inspectors/arp_spoof/arp_spoof.cc
+++ b/src/network_inspectors/arp_spoof/arp_spoof.cc
@@ -330,8 +330,9 @@ static const InspectApi as_api =
         mod_dtor
     },
     IT_PROTOCOL, 
-    nullptr, // service
     PROTO_BIT__ARP,
+    nullptr, // service
+    nullptr, // contents
     as_init,
     nullptr, // term
     as_ctor,
@@ -341,7 +342,8 @@ static const InspectApi as_api =
     nullptr, // ssn
     as_sum,
     as_stats,
-    as_reset
+    as_reset,
+    nullptr  // getbuf
 };
 
 #ifdef BUILDING_SO

diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc
index 800571295626d627143fe198f7eef884d243eda4..4fe211b9c2a5fbb151ae43ef1517a65df900f5ad 100644 (file)
--- a/src/network_inspectors/normalize/normalize.cc
+++ b/src/network_inspectors/normalize/normalize.cc
@@ -294,8 +294,9 @@ static const InspectApi no_api =
         mod_dtor
     },
     IT_PACKET,
-    nullptr, // service
     PROTO_BITS,
+    nullptr, // service
+    nullptr, // contents
     no_init,
     nullptr, // term
     no_ctor,
@@ -305,7 +306,8 @@ static const InspectApi no_api =
     nullptr, // ssn
     no_sum,
     no_stats,
-    no_reset
+    no_reset,
+    nullptr  // getbuf
 };
 
 const BaseApi* nin_normalize = &no_api.base;

diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc
index 538d4ad9424a1277bf91d074eda294f2a8db3342..921154ad2e7f32949321848399d2b5915371ed44 100644 (file)
--- a/src/network_inspectors/perf_monitor/perf_monitor.cc
+++ b/src/network_inspectors/perf_monitor/perf_monitor.cc
@@ -405,8 +405,9 @@ static const InspectApi pm_api =
         mod_dtor
     },
     IT_PACKET,
-    nullptr, // service
     PROTO_BIT__ALL,
+    nullptr, // service
+    nullptr, // contents
     pm_init,
     nullptr, // term
     pm_ctor,
@@ -416,7 +417,8 @@ static const InspectApi pm_api =
     nullptr, // ssn
     pm_sum,
     pm_stats,
-    pm_reset
+    pm_reset,
+    nullptr  // getbuf
 };
 
 const BaseApi* nin_perf_monitor = &pm_api.base;

diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc
index 162cdba62415fa4699afac7756dd1f58a4421bb7..22363cda88c5fd7156e9bea5b7bffc4a95457b1c 100644 (file)
--- a/src/network_inspectors/port_scan/port_scan.cc
+++ b/src/network_inspectors/port_scan/port_scan.cc
@@ -1031,8 +1031,9 @@ static const InspectApi sp_api =
         mod_dtor
     },
     IT_PROTOCOL,
-    nullptr, // service
     PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP|PROTO_BIT__UDP,  // FIXIT dynamic assign
+    nullptr, // service
+    nullptr, // contents
     sp_init,
     nullptr, // term
     sp_ctor,
@@ -1042,7 +1043,8 @@ static const InspectApi sp_api =
     nullptr, // ssn
     sp_sum,
     sp_stats,
-    sp_reset
+    sp_reset,
+    nullptr  // getbuf
 };
 
 #ifdef BUILDING_SO

diff --git a/src/service_inspectors/back_orifice/back_orifice.cc b/src/service_inspectors/back_orifice/back_orifice.cc
index f8d0db00e5f79bd743b80b78f711d53dcbf7a76e..38e083647b23444ffdcbcac36500190d12c19708 100644 (file)
--- a/src/service_inspectors/back_orifice/back_orifice.cc
+++ b/src/service_inspectors/back_orifice/back_orifice.cc
@@ -626,8 +626,9 @@ static const InspectApi bo_api =
         mod_dtor
     },
     IT_SERVICE, 
-    nullptr, // service
     PROTO_BIT__UDP,
+    nullptr, // service
+    nullptr, // contents
     bo_init,
     nullptr, // term
     bo_ctor,
@@ -637,7 +638,8 @@ static const InspectApi bo_api =
     nullptr, // ssn
     bo_sum,
     bo_stats,
-    bo_reset
+    bo_reset,
+    nullptr  // getbuf
 };
 
 #ifdef BUILDING_SO

diff --git a/src/service_inspectors/ftp_telnet/ftp.cc b/src/service_inspectors/ftp_telnet/ftp.cc
index 06738200fa1921cdf221405e012da9860de9d9c0..1e3d2eba112c61a9a51170d3be9e450c6b354f73 100644 (file)
--- a/src/service_inspectors/ftp_telnet/ftp.cc
+++ b/src/service_inspectors/ftp_telnet/ftp.cc
@@ -716,8 +716,9 @@ static const InspectApi fs_api =
     },
     //IT_SESSION,  // FIXIT should be service only
     IT_SERVICE,
-    "ftp", // FIXIT add ftp-data inspector
     PROTO_BIT__TCP,
+    "ftp",   // FIXIT add ftp-data inspector
+    nullptr, // contents
     fs_init,
     nullptr, // term
     fs_ctor,
@@ -727,7 +728,8 @@ static const InspectApi fs_api =
     nullptr, // ssn
     fs_sum,
     fs_stats,
-    fs_reset
+    fs_reset,
+    nullptr  // getbuf
 };
 
 #ifdef BUILDING_SO

diff --git a/src/service_inspectors/ftp_telnet/telnet.cc b/src/service_inspectors/ftp_telnet/telnet.cc
index f282a4d30ca901cf57b56ae784cb128578e961f9..096340f37162fa0b0cd5738d75947a1ac55380a1 100644 (file)
--- a/src/service_inspectors/ftp_telnet/telnet.cc
+++ b/src/service_inspectors/ftp_telnet/telnet.cc
@@ -344,8 +344,9 @@ const InspectApi tn_api =
         mod_dtor
     },
     IT_SERVICE,
-    "telnet",
     PROTO_BIT__TCP,
+    "telnet",
+    nullptr, // contents
     tn_init,
     nullptr, // term
     tn_ctor,
@@ -355,6 +356,7 @@ const InspectApi tn_api =
     nullptr, // ssn
     tn_sum,
     tn_stats,
-    tn_reset
+    tn_reset,
+    nullptr  // getbuf
 };
 

diff --git a/src/service_inspectors/http_inspect/hi_client.cc b/src/service_inspectors/http_inspect/hi_client.cc
index 6c0f8bbe52b124f21fa3dc7bd79b97ee8acc2109..6caa8fcf72496833f797c731b5a9e25d200e854e 100644 (file)
--- a/src/service_inspectors/http_inspect/hi_client.cc
+++ b/src/service_inspectors/http_inspect/hi_client.cc
@@ -1,6 +1,6 @@
 /****************************************************************************
  *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
+ * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
  * Copyright (C) 2003-2013 Sourcefire, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -457,7 +457,8 @@ static inline const u_char *FindPipelineReq(HI_SESSION *session,
     {
         if(*p == '\n')
         {
-            if( (p - offset) >= session->server_conf->max_hdr_len )
+            if ( session->server_conf->max_hdr_len &&
+                (p - offset) >= session->server_conf->max_hdr_len )
             {
                 SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
             }
@@ -488,7 +489,8 @@ static inline const u_char *FindPipelineReq(HI_SESSION *session,
     }
 
     /* Never observed an end-of-field.  Maybe it's not there, but the header is long anyway: */
-    if( (p - start) >= session->server_conf->max_hdr_len )
+    if ( session->server_conf->max_hdr_len &&
+        (p - start) >= session->server_conf->max_hdr_len )
     {
         SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
     }
@@ -1811,7 +1813,8 @@ const u_char *extract_http_xff(HI_SESSION *session, const u_char *p, const u_cha
             return end;
         }
 
-        if(num_spaces >= session->server_conf->max_spaces)
+        if ( session->server_conf->max_spaces &&
+            num_spaces >= session->server_conf->max_spaces )
         {
             SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
         }
@@ -1919,7 +1922,8 @@ const u_char *extract_http_hostname(HI_SESSION *session, const u_char *p, const
             return end;
         }
 
-        if(num_spaces >= session->server_conf->max_spaces)
+        if ( session->server_conf->max_spaces &&
+            num_spaces >= session->server_conf->max_spaces )
         {
             SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
         }
@@ -2005,7 +2009,8 @@ const u_char *extract_http_content_length(HI_SESSION *session,
                             }
                             if ( space_present )
                             {
-                                if(num_spaces >= session->server_conf->max_spaces)
+                                if ( session->server_conf->max_spaces &&
+                                    num_spaces >= session->server_conf->max_spaces )
                                 {
                                     SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
                                 }
@@ -2345,9 +2350,10 @@ static inline const u_char *hi_client_extract_header(
                             return p;
                         }
 
-
                         num_spaces =  SkipBlankSpace(start,end,&p);
-                        if(num_spaces >= session->server_conf->max_spaces)
+
+                        if ( session->server_conf->max_spaces &&
+                            num_spaces >= session->server_conf->max_spaces )
                         {
                             SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
                         }
@@ -2400,7 +2406,8 @@ static inline const u_char *hi_client_extract_header(
         {
             header_count++;
 
-            if( (p - offset) >= session->server_conf->max_hdr_len )
+            if ( session->server_conf->max_hdr_len &&
+                (p - offset) >= session->server_conf->max_hdr_len )
             {
                 SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
             }
@@ -2414,7 +2421,9 @@ static inline const u_char *hi_client_extract_header(
             p++;
 
             num_spaces =  SkipBlankSpace(start,end,&p);
-            if(num_spaces >= session->server_conf->max_spaces)
+
+            if ( session->server_conf->max_spaces &&
+                num_spaces >= session->server_conf->max_spaces )
             {
                 SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES);
             }
@@ -2473,7 +2482,8 @@ static inline const u_char *hi_client_extract_header(
     }
 
     /* Never observed an end-of-field.  Maybe it's not there, but the header is long anyway: */
-    if( (p - start) >= session->server_conf->max_hdr_len )
+    if ( session->server_conf->max_hdr_len &&
+        (p - start) >= session->server_conf->max_hdr_len )
     {
         SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);
     }
@@ -2716,7 +2726,7 @@ int StatelessInspection(Packet *p, HI_SESSION *session, HttpsessionData *hsd, in
     /* Check if the URI exceeds the max header field length */
     /* Only check if we succesfully observed a GET or POST method, otherwise,
      * this may very well be a POST body */
-    if ( iRet == URI_END &&
+    if ( iRet == URI_END && ServerConf->max_hdr_len &&
          ((uri_ptr.uri_end - uri_ptr.uri) >= ServerConf->max_hdr_len) )
     {
         SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR);

diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc
index 68c35d36afc04cd5403aeba3b3c27b3abd0cdfa1..da36b67262ea4dc741053d428af653b810e930c8 100644 (file)
--- a/src/service_inspectors/http_inspect/http_inspect.cc
+++ b/src/service_inspectors/http_inspect/http_inspect.cc
@@ -672,6 +672,18 @@ static void hs_reset()
 
 //-------------------------------------------------------------------------
 
+static const char* contents =
+    "http_client_body "
+    "http_cookie "
+    "http_raw_cookie "
+    "http_header "
+    "http_raw_header "
+    "http_method "
+    "http_uri "
+    "http_raw_uri  "
+    "http_stat_code "
+    "http_stat_msg ";
+
 static const InspectApi hs_api =
 {
     {
@@ -683,8 +695,9 @@ static const InspectApi hs_api =
         mod_dtor
     },
     IT_SERVICE,
-    "http",
     PROTO_BIT__TCP,
+    "http",
+    contents,
     hs_init,
     hs_term,
     hs_ctor,
@@ -694,7 +707,8 @@ static const InspectApi hs_api =
     nullptr, // ssn
     hs_sum,
     hs_stats,
-    hs_reset
+    hs_reset,
+    nullptr  // getbuf
 };
 
 #ifdef BUILDING_SO

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_api.cc b/src/service_inspectors/nhttp_inspect/nhttp_api.cc
index 16873b125b48c7ec410b32bd1cb503a2a95a6045..009c0e16fbc846a00b240a3f5c2b402c24028710 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_api.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_api.cc
@@ -115,8 +115,9 @@ const InspectApi NHttpApi::nhttp_api =
         NHttpApi::nhttp_mod_dtor
     },
     IT_SERVICE,
-    "http",
     PROTO_BIT__TCP,
+    "http",
+    nullptr, // contents
     NHttpApi::nhttp_init,
     NHttpApi::nhttp_term,
     NHttpApi::nhttp_ctor,
@@ -126,7 +127,8 @@ const InspectApi NHttpApi::nhttp_api =
     nullptr, // ssn
     NHttpApi::nhttp_sum,
     NHttpApi::nhttp_stats,
-    NHttpApi::nhttp_reset
+    NHttpApi::nhttp_reset,
+    nullptr  // getbuf
 };
 
 #ifdef BUILDING_SO

diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc
index 4b5de7fbc98e10be1392db960a58e5922704665d..d7b31984f40b1d7cd87ab541860592d71378c0ea 100644 (file)
--- a/src/service_inspectors/rpc_decode/rpc_decode.cc
+++ b/src/service_inspectors/rpc_decode/rpc_decode.cc
@@ -1164,8 +1164,9 @@ static const InspectApi rd_api =
         mod_dtor
     },
     IT_SERVICE,
-    "sunrpc",
     PROTO_BIT__TCP,
+    "sunrpc",
+    nullptr, // contents
     rd_init,
     nullptr, // term
     rd_ctor,
@@ -1175,7 +1176,8 @@ static const InspectApi rd_api =
     nullptr, // ssn
     rd_sum,
     rd_stats,
-    rd_reset
+    rd_reset,
+    nullptr  // getbuf
 };
 
 #ifdef BUILDING_SO

diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc
index d6254b6fdffc035109ae20472b171d50594be00f..a5bc47fe8bc589b7acf2262591063c5594066382 100644 (file)
--- a/src/stream/base/stream_base.cc
+++ b/src/stream/base/stream_base.cc
@@ -297,8 +297,9 @@ static const InspectApi base_api =
         mod_dtor
     },
     IT_STREAM,
-    nullptr, // service
     PROTO_BIT__IP,
+    nullptr, // service
+    nullptr, // contents
     base_init,
     nullptr, // term
     base_ctor,
@@ -308,7 +309,8 @@ static const InspectApi base_api =
     nullptr, // ssn
     base_sum,
     base_stats,
-    base_reset
+    base_reset,
+    nullptr  // getbuf
 };
 
 const BaseApi* nin_stream_base = &base_api.base;

diff --git a/src/stream/icmp/stream_icmp.cc b/src/stream/icmp/stream_icmp.cc
index f154b59712ea71012b7ed70ab269a1d19282f0ee..26bb1eac49398c45be0e46e11a0a9610eeeb4236 100644 (file)
--- a/src/stream/icmp/stream_icmp.cc
+++ b/src/stream/icmp/stream_icmp.cc
@@ -121,8 +121,9 @@ static const InspectApi icmp_api =
         mod_dtor
     },
     IT_STREAM,
-    nullptr, // service
     PROTO_BIT__ICMP,
+    nullptr, // service
+    nullptr, // contents
     icmp_init,
     nullptr, // term
     icmp_ctor,
@@ -132,7 +133,8 @@ static const InspectApi icmp_api =
     icmp_ssn,
     icmp_sum,
     icmp_stats,
-    icmp_reset
+    icmp_reset,
+    nullptr  // getbuf
 };
 
 const BaseApi* nin_stream_icmp = &icmp_api.base;

diff --git a/src/stream/ip/stream_ip.cc b/src/stream/ip/stream_ip.cc
index 356d9254829aafe8500858a4b078aee31894581a..3e0cc376aec0d396425a84a3d5f307f68c532366 100644 (file)
--- a/src/stream/ip/stream_ip.cc
+++ b/src/stream/ip/stream_ip.cc
@@ -168,8 +168,9 @@ static const InspectApi ip_api =
         mod_dtor
     },
     IT_STREAM,
-    nullptr, // service
     PROTO_BIT__IP,
+    nullptr, // service
+    nullptr, // contents
     ip_init,
     nullptr, // term
     ip_ctor,
@@ -179,7 +180,8 @@ static const InspectApi ip_api =
     ip_ssn,
     ip_sum,
     ip_stats,
-    ip_reset
+    ip_reset,
+    nullptr  // getbuf
 };
 
 const BaseApi* nin_stream_ip = &ip_api.base;

diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc
index 5da44c1e841df0521e46436da64c3fbaedd750b8..b731523b61ead7be7544d2ac0d0b87a4081f5b2e 100644 (file)
--- a/src/stream/tcp/stream_tcp.cc
+++ b/src/stream/tcp/stream_tcp.cc
@@ -136,8 +136,9 @@ static const InspectApi tcp_api =
         mod_dtor
     },
     IT_STREAM,
-    nullptr, // service
     PROTO_BIT__TCP,
+    nullptr, // service
+    nullptr, // contents
     tcp_init,
     nullptr, // term
     tcp_ctor,
@@ -147,7 +148,8 @@ static const InspectApi tcp_api =
     tcp_ssn,
     tcp_sum,
     tcp_stats,
-    tcp_reset
+    tcp_reset,
+    nullptr  // getbuf
 };
 
 const BaseApi* nin_stream_tcp = &tcp_api.base;

diff --git a/src/stream/udp/stream_udp.cc b/src/stream/udp/stream_udp.cc
index 58d946409954eeca7dfb84e177dc0ae9859a8221..28bb4acac04699d58d751c12f4bac420c755999f 100644 (file)
--- a/src/stream/udp/stream_udp.cc
+++ b/src/stream/udp/stream_udp.cc
@@ -136,8 +136,9 @@ static const InspectApi udp_api =
         mod_dtor
     },
     IT_STREAM,
-    nullptr, // service
     PROTO_BIT__UDP,
+    nullptr, // service
+    nullptr, // contents
     udp_init,
     nullptr, // term
     udp_ctor,
@@ -147,7 +148,8 @@ static const InspectApi udp_api =
     udp_ssn,
     udp_sum,
     udp_stats,
-    udp_reset
+    udp_reset,
+    nullptr  // getbuf
 };
 
 const BaseApi* nin_stream_udp = &udp_api.base;