Pull request #4294: file_api: set max file depth as part of snort configuration

Merge in SNORT/snort3 from ~UMUNNIKR/snort3:file_race_condition_fix to master

Squashed commit of the following:

commit 181b94d110f4736315a41c66d9979947d46022d1
Author: Unnikrishnan M <umunnikr@cisco.com>
Date:   Thu Feb 15 09:48:35 2024 +0530

    file_api: max depth is set as part of initial config

diff --git a/src/file_api/file_inspect.cc b/src/file_api/file_inspect.cc
index 02d488abdd4dfdfc6f21de1de1f2c0c9ddd6df79..2b9abfcbe90f8872b087e3e4ff86378e67bc4615 100644 (file)
--- a/src/file_api/file_inspect.cc
+++ b/src/file_api/file_inspect.cc
@@ -1,5 +1,5 @@
 //--------------------------------------------------------------------------
-// Copyright (C) 2014-2023 Cisco and/or its affiliates. All rights reserved.
+// Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
 // Copyright (C) 2012-2013 Sourcefire, Inc.
 //
 // This program is free software; you can redistribute it and/or modify it
@@ -50,7 +50,7 @@ FileInspect:: ~FileInspect()
         delete config;
 }
 
-bool FileInspect::configure(SnortConfig*)
+bool FileInspect::configure(SnortConfig* sc)
 {
     if (!config)
         return true;
@@ -63,6 +63,8 @@ bool FileInspect::configure(SnortConfig*)
         file_cache->set_max_files(config->max_files_cached);
     }
 
+    FileService::set_max_file_depth(sc);
+
     return true;
 }
 

diff --git a/src/file_api/file_service.cc b/src/file_api/file_service.cc
index 5f076679a8b5f465eda05d4592c1e109c102bc52..a87ac0f6f69d395d8015aea59bd62a140828c6b4 100644 (file)
--- a/src/file_api/file_service.cc
+++ b/src/file_api/file_service.cc
@@ -150,49 +150,44 @@ bool FileService::is_file_service_enabled()
 /* Get maximal file depth based on configuration
  * This function must be called after all file services are configured/enabled.
  */
-int64_t FileService::get_max_file_depth()
+int64_t FileService::get_max_file_depth(FileConfig *fc)
 {
-    FileConfig* file_config = get_file_config();
+    FileConfig* file_config = fc ? fc : get_file_config();
 
     if (!file_config)
         return -1;
 
-    if (file_config->file_depth)
+    if (file_config->file_depth > 0)
         return file_config->file_depth;
 
-    file_config->file_depth = -1;
+    return -1;
+}
+
+void FileService::set_max_file_depth(const SnortConfig* sc)
+{
+    FileConfig* file_config = get_file_config(sc);
+
+    if (!file_config)
+        return;
 
     if (file_type_id_enabled)
     {
         file_config->file_depth = file_config->file_type_depth;
     }
 
-    if (file_signature_enabled)
+    if ((file_signature_enabled) and
+        (file_config->file_signature_depth > file_config->file_depth))
     {
-        if (file_config->file_signature_depth > file_config->file_depth)
-            file_config->file_depth = file_config->file_signature_depth;
+        file_config->file_depth = file_config->file_signature_depth;
     }
 
     if (file_config->file_depth > 0)
     {
         /*Extra byte for deciding whether file data will be over limit*/
         file_config->file_depth++;
-        return (file_config->file_depth);
     }
-    else
-    {
-        return -1;
-    }
-}
-
-void FileService::reset_depths()
-{
-    FileConfig* file_config = get_file_config();
-
-    if (file_config)
-        file_config->file_depth = 0;
 
-    decode_conf.sync_all_depths();
+    return;
 }
 
 namespace snort

diff --git a/src/file_api/file_service.h b/src/file_api/file_service.h
index 6698a74ed43f8732117705cd9eb6982d26951940..f13634aeb5a40622a61067b11aaa4e0b3deed843 100644 (file)
--- a/src/file_api/file_service.h
+++ b/src/file_api/file_service.h
@@ -30,6 +30,7 @@
 
 class FileEnforcer;
 class FileCache;
+class FileConfig;
 
 namespace snort
 {
@@ -58,8 +59,8 @@ public:
     static bool is_file_signature_enabled() { return file_signature_enabled; }
     static bool is_file_capture_enabled() { return file_capture_enabled; }
     static bool is_file_service_enabled();
-    static int64_t get_max_file_depth();
-    static void reset_depths();
+    static int64_t get_max_file_depth(FileConfig* = nullptr);
+    static void set_max_file_depth(const SnortConfig*);
 
     static FileCache* get_file_cache() { return file_cache; }
     static DecodeConfig decode_conf;

diff --git a/src/mime/file_mime_config.cc b/src/mime/file_mime_config.cc
index 9776dcfd0a03fcd6d44d7a9dc6920f71535f89f7..56a9c52db42ab5613b7a4641ba8bd6b4da214866 100644 (file)
--- a/src/mime/file_mime_config.cc
+++ b/src/mime/file_mime_config.cc
@@ -28,6 +28,7 @@
 
 #include "log/messages.h"
 #include "file_api/file_service.h"
+#include "file_api/file_config.h"
 
 using namespace snort;
 
@@ -142,9 +143,9 @@ bool DecodeConfig::is_decoding_enabled() const
 }
 
 // update file depth and max_depth etc
-void DecodeConfig::sync_all_depths()
+void DecodeConfig::sync_all_depths(const SnortConfig* sc)
 {
-    file_depth = FileService::get_max_file_depth();
+    file_depth = FileService::get_max_file_depth(get_file_config(sc));
     decode_enabled = (file_depth >= 0) or (b64_depth >= 0) or (qp_depth >= 0) or
         (bitenc_depth >= 0) or (uu_depth >= 0);
 }

diff --git a/src/mime/file_mime_config.h b/src/mime/file_mime_config.h
index 3c36256240bf463829dbd8d4234b59689f7c5acf..7f335d27e2cd441fdb239a638633035a433b1872 100644 (file)
--- a/src/mime/file_mime_config.h
+++ b/src/mime/file_mime_config.h
@@ -23,6 +23,7 @@
 
 // List of MIME decode and log configuration functions
 #include "main/snort_types.h"
+#include "main/snort_config.h"
 
 /*These are temporary values*/
 #define DEFAULT_MIME_MEMCAP           838860
@@ -71,7 +72,7 @@ public:
 
     int64_t get_file_depth() const;
     bool is_decoding_enabled() const;
-    void sync_all_depths();
+    void sync_all_depths(const SnortConfig*);
     void show(bool = false) const;
     int get_max_depth(int) const;
 

diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc
index c4f9b37c65440f6017a9939aa643200e456a5105..3e353794c7948874466dd32798e787fa7a8fe402 100755 (executable)
--- a/src/service_inspectors/http_inspect/http_inspect.cc
+++ b/src/service_inspectors/http_inspect/http_inspect.cc
@@ -137,10 +137,10 @@ HttpInspect::~HttpInspect()
     delete script_finder;
 }
 
-bool HttpInspect::configure(SnortConfig*)
+bool HttpInspect::configure(SnortConfig* sc)
 {
     params->js_norm_param.configure();
-    params->mime_decode_conf->sync_all_depths();
+    params->mime_decode_conf->sync_all_depths(sc);
     pub_id = DataBus::get_id(http_pub_key);
 
     return true;

diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc
index cd5b4e677ae0268c889845e6365574882b497f3b..cbe4a1e7c88a15f0612ce942850c623d4cad81f6 100644 (file)
--- a/src/service_inspectors/imap/imap.cc
+++ b/src/service_inspectors/imap/imap.cc
@@ -787,9 +787,9 @@ Imap::~Imap()
         delete config;
 }
 
-bool Imap::configure(SnortConfig*)
+bool Imap::configure(SnortConfig* sc)
 {
-    config->decode_conf.sync_all_depths();
+    config->decode_conf.sync_all_depths(sc);
 
     if (config->decode_conf.get_file_depth() > -1)
         config->log_config.log_filename = true;

diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc
index fc82f8a445cca77046c7847ae05b943fa1339916..c09c4025f59459ce9b8498ff06544d835924525c 100644 (file)
--- a/src/service_inspectors/pop/pop.cc
+++ b/src/service_inspectors/pop/pop.cc
@@ -723,9 +723,9 @@ Pop::~Pop()
         delete config;
 }
 
-bool Pop::configure(SnortConfig* )
+bool Pop::configure(SnortConfig* sc)
 {
-    config->decode_conf.sync_all_depths();
+    config->decode_conf.sync_all_depths(sc);
 
     if (config->decode_conf.get_file_depth() > -1)
         config->log_config.log_filename = true;

diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc
index cdcff88b17bff5679f8effc385c9d6206f6e4aa4..0879d8885605627b78574b02c9c9e3a3c581262c 100644 (file)
--- a/src/service_inspectors/smtp/smtp.cc
+++ b/src/service_inspectors/smtp/smtp.cc
@@ -1560,11 +1560,11 @@ Smtp::~Smtp()
     delete config;
 }
 
-bool Smtp::configure(SnortConfig*)
+bool Smtp::configure(SnortConfig* sc)
 {
     SMTP_RegXtraDataFuncs(config);
 
-    config->decode_conf.sync_all_depths();
+    config->decode_conf.sync_all_depths(sc);
 
     if (config->decode_conf.get_file_depth() > -1)
         config->log_config.log_filename = true;