Merge pull request #2145 in SNORT/snort3 from ~DERAMADA/snort3:hi_http_uri_fragment...

Squashed commit of the following:

commit 54f33541eeb50c01b81671321e32f03551d9f19b
Author: deramada <deramada@cisco.com>
Date:   Fri Apr 10 09:17:24 2020 -0400

    http_inspect: add fragment to http_uri

diff --git a/doc/http_inspect.txt b/doc/http_inspect.txt
index 4fb7e587a785ccd6a32cfcf153bb3d5a9ccf9a70..20768244e1b1376a27945d6a9ef81c571d4fbe80 100644 (file)
--- a/doc/http_inspect.txt
+++ b/doc/http_inspect.txt
@@ -359,9 +359,10 @@ http_uri represents the normalized uri, normalization of components depends
 on uri type. If the uri is of type absolute (contains all six components) or 
 absolute path (contains path, query and fragment) then the path and query 
 components are normalized. In these cases, http_uri represents the normalized
-path and query (/path?query). If the uri is of type authority (host and port),
-the host is normalized and http_uri represents the normalized host with the port
-number. In all other cases http_uri is the same as http_raw_uri.  
+path, query, and fragment (/path?query#fragment). If the uri is of type 
+authority (host and port), the host is normalized and http_uri represents the 
+normalized host with the port number. In all other cases http_uri is the same 
+as http_raw_uri.  
 
 Note: this section uses informal language to explain some things. Nothing
 here is intended to conflict with the technical language of the HTTP RFCs

diff --git a/src/service_inspectors/http_inspect/http_uri.cc b/src/service_inspectors/http_inspect/http_uri.cc
index ad7207154ec2ca5b253b3a49d7dcf3a6c0fb00df..f92cb465e7cd612bda11bcb9fe3056d98bda7b47 100644 (file)
--- a/src/service_inspectors/http_inspect/http_uri.cc
+++ b/src/service_inspectors/http_inspect/http_uri.cc
@@ -243,17 +243,26 @@ void HttpUri::normalize()
                     UriNormalizer::need_norm(query, false, uri_param, infractions, events))
                 *infractions += INF_URI_NEED_NORM_QUERY;
 
-            if (!((*infractions & INF_URI_NEED_NORM_PATH)  || (*infractions & INF_URI_NEED_NORM_QUERY)))
+            if ((fragment.length() > 0) &&
+                    UriNormalizer::need_norm(fragment, false, uri_param, infractions, events))
+                *infractions += INF_URI_NEED_NORM_FRAGMENT;
+
+            if (!((*infractions & INF_URI_NEED_NORM_PATH)
+                  || (*infractions & INF_URI_NEED_NORM_QUERY)
+                  || (*infractions & INF_URI_NEED_NORM_FRAGMENT)))
             {
                 // This URI is OK, normalization not required
                 path_norm.set(path);
                 query_norm.set(query);
+                fragment_norm.set(fragment);
 
                 const int path_len = (path.length() > 0) ? path.length() : 0;
                 // query_len = length of query + 1 (? char)
                 const int query_len = (query.length() >= 0) ? query.length() + 1 : 0;
+                // fragment_len = length of fragment + 1 (# char)
+                const int fragment_len = (fragment.length() >= 0) ? fragment.length() + 1 : 0;
 
-                classic_norm.set(path_len + query_len, abs_path.start());
+                classic_norm.set(path_len + query_len + fragment_len, abs_path.start());
 
                 check_oversize_dir(path_norm);
                 return;
@@ -264,6 +273,7 @@ void HttpUri::normalize()
             // Create a new buffer containing the normalized URI by normalizing each individual piece.
             int total_length = path.length() ? path.length() + UriNormalizer::URI_NORM_EXPANSION : 0;
             total_length += (query.length() >= 0) ? query.length() + 1 : 0;
+            total_length += (fragment.length() >= 0) ? fragment.length() + 1 : 0;
             uint8_t* const new_buf = new uint8_t[total_length];
             uint8_t* current = new_buf;
 
@@ -293,6 +303,20 @@ void HttpUri::normalize()
                 }
                 current += query_norm.length();
             }
+            if (fragment.length() >= 0)
+            {
+                memcpy(current, "#", 1);
+                current += 1;
+                if (*infractions & INF_URI_NEED_NORM_FRAGMENT)
+                    UriNormalizer::normalize(fragment, fragment_norm, false, current, uri_param, infractions,
+                        events);
+                else
+                {
+                    memcpy(current, fragment.start(), fragment.length());
+                    fragment_norm.set(fragment);
+                }
+                current += fragment_norm.length();
+            }
 
             assert(current - new_buf <= total_length);
 
@@ -351,24 +375,3 @@ const Field& HttpUri::get_norm_host()
 
     return host_norm;
 }
-
-const Field& HttpUri::get_norm_fragment()
-{
-    if (fragment_norm.length() != STAT_NOT_COMPUTE)
-        return fragment_norm;
-
-    if ((fragment.length() > 0) and
-        UriNormalizer::need_norm(fragment, false, uri_param, infractions, events))
-    {
-        uint8_t *buf = new uint8_t[fragment.length()];
-
-        *infractions += INF_URI_NEED_NORM_FRAGMENT;
-
-        UriNormalizer::normalize(fragment, fragment_norm, false, buf, uri_param,
-            infractions, events, true);
-    }
-    else
-        fragment_norm.set(fragment);
-
-    return fragment_norm;
-}

diff --git a/src/service_inspectors/http_inspect/http_uri.h b/src/service_inspectors/http_inspect/http_uri.h
index 7152f4b5b2df2f037a86dc02b0f584526ec7ca26..c8e5f847f59c17a815a3d60469c2e16030238252 100644 (file)
--- a/src/service_inspectors/http_inspect/http_uri.h
+++ b/src/service_inspectors/http_inspect/http_uri.h
@@ -53,7 +53,7 @@ public:
     const Field& get_norm_host();
     const Field& get_norm_path() { return path_norm; }
     const Field& get_norm_query() { return query_norm; }
-    const Field& get_norm_fragment();
+    const Field& get_norm_fragment() { return fragment_norm; }
     const Field& get_norm_classic() { return classic_norm; }
     size_t get_file_proc_hash();