Pull request #3411: http_inspect: added field for raw_body

Merge in SNORT/snort3 from ~ADMAMOLE/snort3:new_field_for_raw_body_w_depth to master

Squashed commit of the following:

commit ecfe918412a0ac3914b649f5f4eb8d8d57d88a62
Author: Adrian Mamolea <admamole@cisco.com>
Date:   Wed May 4 15:59:54 2022 -0400

    http_inspect: added field for raw_body

diff --git a/src/service_inspectors/http_inspect/http_msg_body.cc b/src/service_inspectors/http_inspect/http_msg_body.cc
index c45690bce871bf6b69dcc9de6e02bf263eb5e24c..b3fb14de148f0f513be54dcc768eb582b85fd20a 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_body.cc
+++ b/src/service_inspectors/http_inspect/http_msg_body.cc
@@ -111,6 +111,15 @@ void HttpMsgBody::clean_partial(uint32_t& partial_inspected_octets, uint32_t& pa
 
 void HttpMsgBody::analyze()
 {
+    const int32_t raw_body_length =
+        (msg_text.length() <= session_data->detect_depth_remaining[source_id]) ?
+        msg_text.length() : session_data->detect_depth_remaining[source_id];
+
+    if (raw_body_length > 0)
+        raw_body.set(raw_body_length, msg_text.start());
+    else
+        raw_body.set(STAT_NO_SOURCE);
+
     uint32_t& partial_inspected_octets = session_data->partial_inspected_octets[source_id];
 
     // When there have been partial inspections we focus on the part of the message we have not

diff --git a/src/service_inspectors/http_inspect/http_msg_body.h b/src/service_inspectors/http_inspect/http_msg_body.h
index 96b871ee3b0055d840984c691b3c6053dac97481..4241cdb822bba1a2cf657b47f714f5dcb6729159 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_body.h
+++ b/src/service_inspectors/http_inspect/http_msg_body.h
@@ -38,6 +38,7 @@ public:
     bool detection_required() const override { return (detect_data.length() > 0); }
     HttpMsgBody* get_body() override { return this; }
     const Field& get_classic_client_body();
+    const Field& get_raw_body() { return raw_body; }
     const Field& get_decomp_vba_data();
     const Field& get_norm_js_data();
     const Field& get_detect_data() { return detect_data; }
@@ -77,6 +78,7 @@ private:
     // In order of generation
     Field msg_text_new;
     Field decoded_body;
+    Field raw_body;              // request_depth or response_depth applied
     Field decompressed_file_body;
     Field cumulative_data;
     Field js_norm_body;

diff --git a/src/service_inspectors/http_inspect/http_msg_section.cc b/src/service_inspectors/http_inspect/http_msg_section.cc
index 6f8c9f7b5a20bc9b9ac0d89c5bb9f025c994bdd3..3522fd3d2b6371531c5e2b2f50150964e74f82fa 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_section.cc
+++ b/src/service_inspectors/http_inspect/http_msg_section.cc
@@ -193,7 +193,7 @@ const Field& HttpMsgSection::get_classic_buffer(const HttpBufferInfo& buf)
       }
     case HTTP_BUFFER_RAW_BODY:
       {
-        return (get_body() != nullptr) ? get_body()->msg_text : Field::FIELD_NULL;
+        return (get_body() != nullptr) ? get_body()->get_raw_body() : Field::FIELD_NULL;
       }
     case HTTP_BUFFER_RAW_HEADER:
     case HTTP_BUFFER_RAW_TRAILER: