Merge pull request #2324 in SNORT/snort3 from ~SBAIGAL/snort3:smtp_abandon to master

Squashed commit of the following:

commit 9a6d342757678b9b98ebd106d13efdbe26fc1d90
Author: Steven Baigal (sbaigal) <sbaigal@cisco.com>
Date:   Thu Jul 9 16:02:57 2020 -0400

    smtp: generate SSL_SEARCH_ABANDONED event when no STARTTLS is detected

diff --git a/src/flow/flow.h b/src/flow/flow.h
index a2b31970c283b607b0f1d92354427f16a2fcd2ec..9ba54d8b1b5b37c9936925a754bc03f5de39e493 100644 (file)
--- a/src/flow/flow.h
+++ b/src/flow/flow.h
@@ -449,6 +449,7 @@ public:  // FIXIT-M privatize if possible
         bool trigger_detained_packet_event : 1;
         bool trigger_finalize_event : 1;
         bool use_direct_inject : 1;
+        bool data_decrypted : 1;    // indicate data in current flow is decrypted TLS application data
     } flags;
 
     FlowState flow_state;

diff --git a/src/framework/data_bus.h b/src/framework/data_bus.h
index 2e133674fd12f7b35f81330b9cc5028585f50a45..adf497a3c119324bbb814e29598893bf6ffa96e8 100644 (file)
--- a/src/framework/data_bus.h
+++ b/src/framework/data_bus.h
@@ -136,6 +136,8 @@ private:
 #define FLOW_SERVICE_CHANGE_EVENT "flow.service_change_event"
 // A flow has found the service inspector
 #define SERVICE_INSPECTOR_CHANGE_EVENT "flow.service_inspector.changed"
+// search of SSL is abandoned on this flow
+#define SSL_SEARCH_ABANDONED "flow.ssl_search_abandoned"
 
 // A flow has entered the setup state
 #define FLOW_STATE_SETUP_EVENT "flow.state_setup"

diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc
index c2311cdaa6afe51e711b897337fddba42841c78d..f8ed7046293a1a1bb49d310f23d65e51d0279967 100644 (file)
--- a/src/service_inspectors/smtp/smtp.cc
+++ b/src/service_inspectors/smtp/smtp.cc
@@ -1104,6 +1104,13 @@ static void SMTP_ProcessServerPacket(
             case RESP_221:
             case RESP_334:
             case RESP_354:
+                if ((smtp_ssn->state == STATE_DATA or smtp_ssn->state == STATE_BDATA)
+                    and !p->flow->flags.data_decrypted
+                    and !(smtp_ssn->state_flags & SMTP_FLAG_ABANDON_EVT))
+                {
+                    smtp_ssn->state_flags |= SMTP_FLAG_ABANDON_EVT;
+                    DataBus::publish(SSL_SEARCH_ABANDONED, p);
+                }
                 break;
 
             case RESP_235:

diff --git a/src/service_inspectors/smtp/smtp.h b/src/service_inspectors/smtp/smtp.h
index e9a9a34396bf14258b848d12b3a9dad2a347e7fa..1646a16385bb60f9f27b5a72de30aa866dd49c72 100644 (file)
--- a/src/service_inspectors/smtp/smtp.h
+++ b/src/service_inspectors/smtp/smtp.h
@@ -66,6 +66,7 @@
 #define SMTP_FLAG_GOT_RCPT_CMD               0x00000002
 #define SMTP_FLAG_BDAT                       0x00001000
 #define SMTP_FLAG_ABORT                      0x00002000
+#define SMTP_FLAG_ABANDON_EVT                0x00010000
 
 // session flags
 #define SMTP_FLAG_XLINK2STATE_GOTFIRSTCHUNK  0x00000001