Merge pull request #548 in SNORT/snort3 from appid_ws2_plugins_101 to master

Squashed commit of the following:

commit 72cc1d3181ddb17e6ee58fd50c17da7b2bde1971
Author: davis mcpherson <davis.mcpherson@gmail.com>
Date:   Tue Jun 28 16:27:10 2016 -0400

    enable bit torrent client & service detectors

    Added count of SSH clients detected.

    fix appid usage of SearchTool match callback position parameter to ignore for ssh clients

    bit torrent client pattern check should be don't care on pattern position in the payload

    add statistics for bittorrent clients/services, fix imap stats counting

    remove old comment, use #def for banner string length

diff --git a/src/main/snort_debug.h b/src/main/snort_debug.h
index 0049e26c6eed3d29082e549378665837007ad630..540add35ad9aedbda985fd8d700341c6c5fa6192 100644 (file)
--- a/src/main/snort_debug.h
+++ b/src/main/snort_debug.h
@@ -91,7 +91,7 @@
 #define DEBUG_APPID           0x0400000000000000LL
 
 #ifdef PIGLET
-#define DEBUG_PIGLET          0x0400000000000000LL
+#define DEBUG_PIGLET          0x0800000000000000LL
 #endif
 
 

diff --git a/src/network_inspectors/appid/appid_module.cc b/src/network_inspectors/appid/appid_module.cc
index 5fd5f63353678291d1fb9bb69709adf861b2a83b..5a27b4fa054b7733812f6c46fa3b75e8743aeb7a 100644 (file)
--- a/src/network_inspectors/appid/appid_module.cc
+++ b/src/network_inspectors/appid/appid_module.cc
@@ -37,6 +37,9 @@ THREAD_LOCAL ProfileStats appidPerfStats;
 const PegInfo appid_pegs[] =
 {
     { "packets", "count of packets processed by appid" },
+    { "bit_clients", "count of bittorrent clients discovered by appid" },
+    { "bit_flows", "count of bittorrent flows discovered by appid" },
+    { "bittracker_clients", "count of bittorrent tracker clients discovered by appid" },
     { "dns_udp_flows", "count of dns flows over udp discovered by appid" },
     { "dns_tcp_flows", "count of dns flows over tcp discovered by appid" },
     { "ftp_flows", "count of ftp flows discovered by appid" },
@@ -46,6 +49,7 @@ const PegInfo appid_pegs[] =
     { "pop flows", "count of pop service flows discovered by appid" },
     { "smtp_flows", "count of smtp flows discovered by appid" },
     { "smtps_flows", "count of smtps flows discovered by appid" },
+    { "ssh_clients", "count of ssh clients discovered by appid" },
     { "ssh_flows", "count of ssh flows discovered by appid" },
     { "ssl_flows", "count of ssl flows discovered by appid" },
     { "telnet_flows", "count of telnet flows discovered by appid" },

diff --git a/src/network_inspectors/appid/appid_module.h b/src/network_inspectors/appid/appid_module.h
index b9f63b743c72d9d27e315a1b1f7124c3b66d7586..9c5c22c6ce62478a52208b74cb915711d0b429fe 100644 (file)
--- a/src/network_inspectors/appid/appid_module.h
+++ b/src/network_inspectors/appid/appid_module.h
@@ -38,6 +38,9 @@ extern THREAD_LOCAL ProfileStats appidPerfStats;
 struct AppIdStats
 {
     PegCount packets;
+    PegCount bit_clients;
+    PegCount bit_flows;
+    PegCount bittracker_clients;
     PegCount dns_udp_flows;
     PegCount dns_tcp_flows;
     PegCount ftp_flows;
@@ -47,6 +50,7 @@ struct AppIdStats
     PegCount pop_flows;
     PegCount smtp_flows;
     PegCount smtps_flows;
+    PegCount ssh_clients;
     PegCount ssh_flows;
     PegCount ssl_flows;
     PegCount telnet_flows;

diff --git a/src/network_inspectors/appid/client_plugins/client_app_base.cc b/src/network_inspectors/appid/client_plugins/client_app_base.cc
index c443819d1dcade44e0bdc3ca3509aa9ef6ddf093..e4e02c1dfaafa0d6ebfb07543caad54277681c3f 100644 (file)
--- a/src/network_inspectors/appid/client_plugins/client_app_base.cc
+++ b/src/network_inspectors/appid/client_plugins/client_app_base.cc
@@ -120,6 +120,7 @@ extern RNAClientAppModule http_client_mod;
 static RNAClientAppModule* static_client_list[] =
 {
     &smtp_client_mod,
+    &ssh_client_mod,
 
 #ifdef REMOVED_WHILE_NOT_IN_USE
     &msn_client_mod,
@@ -127,10 +128,11 @@ static RNAClientAppModule* static_client_list[] =
     &ym_client_mod,
     &sip_udp_client_mod,
     &sip_tcp_client_mod,
+#endif
     &bit_client_mod,
     &bit_tracker_client_mod,
+#ifdef REMOVED_WHILE_NOT_IN_USE
     &rtp_client_mod,
-    &ssh_client_mod,
     &timbuktu_client_mod,
     &tns_client_mod,
     &vnc_client_mod,
@@ -185,9 +187,9 @@ const RNAClientAppModule* ClientAppGetClientAppModule(RNAClientAppFCN fcn, struc
     return nullptr;
 }
 
-void add_pattern_data(SearchTool* st, const RNAClientAppModule* li, int position, const
-    uint8_t* const pattern, unsigned size,
-    unsigned nocase, int* count, ClientAppConfig* pClientAppConfig)
+void add_pattern_data(SearchTool* st, const RNAClientAppModule* li, int position,
+        const uint8_t* const pattern, unsigned size, unsigned nocase,
+        int* count, ClientAppConfig* pClientAppConfig)
 {
     ClientPatternData* pd = (ClientPatternData*)snort_calloc(sizeof(ClientPatternData));
     pd->ca = li;
@@ -211,34 +213,22 @@ static void clientCreatePattern(IpProtocol proto, const uint8_t* const pattern,
 
     if (proto == IpProtocol::TCP)
     {
-        if (pClientAppConfig->tcp_patterns)
-            delete pClientAppConfig->tcp_patterns;
-        pClientAppConfig->tcp_patterns = new SearchTool("ac_full");
-        pClientAppConfig->udp_patterns = nullptr;
+        if (!pClientAppConfig->tcp_patterns)
+            pClientAppConfig->tcp_patterns = new SearchTool("ac_full");
         count = &pClientAppConfig->tcp_pattern_count;
         add_pattern_data(pClientAppConfig->tcp_patterns, li, position, pattern, size,
             nocase, count, pClientAppConfig);
     }
     else if (proto == IpProtocol::UDP)
     {
-        if (pClientAppConfig->udp_patterns)
-            delete pClientAppConfig->udp_patterns;
-        pClientAppConfig->udp_patterns = new SearchTool("ac_full");
-        pClientAppConfig->tcp_patterns = nullptr;
+        if (!pClientAppConfig->udp_patterns)
+            pClientAppConfig->udp_patterns = new SearchTool("ac_full");
         count = &pClientAppConfig->udp_pattern_count;
         add_pattern_data(pClientAppConfig->udp_patterns, li, position, pattern, size,
             nocase, count, pClientAppConfig);
     }
     else
     {
-        if (pClientAppConfig->tcp_patterns)
-            delete pClientAppConfig->tcp_patterns;
-        pClientAppConfig->tcp_patterns = nullptr;
-
-        if (pClientAppConfig->udp_patterns)
-            delete pClientAppConfig->udp_patterns;
-        pClientAppConfig->udp_patterns = nullptr;
-
         ErrorMessage("Invalid protocol when registering a pattern: %u\n",(unsigned)proto);
     }
 }
@@ -287,8 +277,8 @@ void ClientAppRegisterPattern(RNAClientAppFCN fcn, IpProtocol proto, const uint8
     {
         if ((li->module->validate == fcn) && (li->module->userData == userData))
         {
-            clientCreatePattern(proto, pattern, size, position, nocase, li->module,
-                pClientAppConfig);
+            clientCreatePattern(proto, pattern, size, position, nocase,
+                    li->module, pClientAppConfig);
             break;
         }
     }
@@ -965,8 +955,8 @@ static void ClientAppID(Packet* p, const int /*direction*/, AppIdData* flowp, co
     }
 }
 
-int AppIdDiscoverClientApp(Packet* p, int direction, AppIdData* rnaData, const
-    AppIdConfig* pConfig)
+int AppIdDiscoverClientApp(Packet* p, int direction, AppIdData* rnaData,
+        const AppIdConfig* pConfig)
 {
     if (!pConfig->clientAppConfig.enabled)
         return APPID_SESSION_SUCCESS;

diff --git a/src/network_inspectors/appid/client_plugins/client_app_bit.cc b/src/network_inspectors/appid/client_plugins/client_app_bit.cc
index 286b00538b20108764d1b081f0cbbd25cc069024..cfd92aa50152cb5a4756ea0b33b606f03d90c760 100644 (file)
--- a/src/network_inspectors/appid/client_plugins/client_app_bit.cc
+++ b/src/network_inspectors/appid/client_plugins/client_app_bit.cc
@@ -21,6 +21,7 @@
 
 #include "client_app_api.h"
 #include "application_ids.h"
+#include "appid_module.h"
 
 #include "main/snort_debug.h"
 #include "utils/util.h"
@@ -101,7 +102,7 @@ struct Client_App_Pattern
 
 static Client_App_Pattern patterns[] =
 {
-    { (const uint8_t*)BIT_BANNER, sizeof(BIT_BANNER)-1, 0, APP_ID_BITTORRENT },
+    { (const uint8_t*)BIT_BANNER, BIT_BANNER_LEN, -1, APP_ID_BITTORRENT },
 };
 
 static AppRegistryEntry appIdRegistry[] =
@@ -224,6 +225,7 @@ inprocess:
 done:
     bit_client_mod.api->add_app(flowp, APP_ID_BITTORRENT, APP_ID_BITTORRENT, nullptr);
     setAppIdFlag(flowp, APPID_SESSION_CLIENT_DETECTED);
+    appid_stats.bit_clients++;
     return CLIENT_APP_SUCCESS;
 }
 

diff --git a/src/network_inspectors/appid/client_plugins/client_app_bit_tracker.cc b/src/network_inspectors/appid/client_plugins/client_app_bit_tracker.cc
index 0d96299befda832a266aac90f2d5c85b723e2ab8..2b6cc0e833248048000fb4e79afc9736f017910f 100644 (file)
--- a/src/network_inspectors/appid/client_plugins/client_app_bit_tracker.cc
+++ b/src/network_inspectors/appid/client_plugins/client_app_bit_tracker.cc
@@ -27,6 +27,7 @@
 #include "app_info_table.h"
 #include "application_ids.h"
 #include "client_app_api.h"
+#include "appid_module.h"
 
 static const char UDP_BIT_QUERY[] = "d1:a";
 static const char UDP_BIT_RESPONSE[] = "d1:r";
@@ -99,9 +100,9 @@ struct Client_App_Pattern
 
 static Client_App_Pattern udp_patterns[] =
 {
-    { (const uint8_t*)UDP_BIT_QUERY,    sizeof(UDP_BIT_QUERY),    0, APP_ID_BITTRACKER_CLIENT },
-    { (const uint8_t*)UDP_BIT_RESPONSE, sizeof(UDP_BIT_RESPONSE), 0, APP_ID_BITTRACKER_CLIENT },
-    { (const uint8_t*)UDP_BIT_ERROR,    sizeof(UDP_BIT_ERROR),    0, APP_ID_BITTRACKER_CLIENT },
+    { (const uint8_t*)UDP_BIT_QUERY,    sizeof(UDP_BIT_QUERY) - 1,    -1, APP_ID_BITTRACKER_CLIENT },
+    { (const uint8_t*)UDP_BIT_RESPONSE, sizeof(UDP_BIT_RESPONSE) - 1, -1, APP_ID_BITTRACKER_CLIENT },
+    { (const uint8_t*)UDP_BIT_ERROR,    sizeof(UDP_BIT_ERROR) - 1,    -1, APP_ID_BITTRACKER_CLIENT },
 };
 
 static AppRegistryEntry appIdRegistry[] =
@@ -269,6 +270,7 @@ done:
     bit_tracker_client_mod.api->add_app(flowp, APP_ID_BITTORRENT, APP_ID_BITTRACKER_CLIENT,
         nullptr);
     setAppIdFlag(flowp, APPID_SESSION_CLIENT_DETECTED);
+    appid_stats.bittracker_clients++;
     return CLIENT_APP_SUCCESS;
 }
 

diff --git a/src/network_inspectors/appid/client_plugins/client_app_ssh.cc b/src/network_inspectors/appid/client_plugins/client_app_ssh.cc
index b4ad9472969c9f3bd231835b33be56bd6aab14b5..b634479142010c3170b79f524e8af5e76242c2e1 100644 (file)
--- a/src/network_inspectors/appid/client_plugins/client_app_ssh.cc
+++ b/src/network_inspectors/appid/client_plugins/client_app_ssh.cc
@@ -27,6 +27,7 @@
 #include "app_info_table.h"
 #include "application_ids.h"
 #include "client_app_api.h"
+#include "appid_module.h"
 
 static const char SSH_CLIENT_BANNER[] = "SSH-";
 #define SSH_CLIENT_BANNER_LEN (sizeof(SSH_CLIENT_BANNER)-1)
@@ -183,11 +184,11 @@ struct Client_App_Pattern
 
 static Client_App_Pattern patterns[] =
 {
-    { (const uint8_t*)SSH_CLIENT_BANNER, sizeof(SSH_CLIENT_BANNER)-1, 0, APP_ID_SSH },
-    { (const uint8_t*)OPENSSH_BANNER,    sizeof(OPENSSH_BANNER)-1,    0, APP_ID_OPENSSH },
-    { (const uint8_t*)PUTTY_BANNER,      sizeof(PUTTY_BANNER)-1,      0, APP_ID_PUTTY },
-    { (const uint8_t*)LSH_BANNER,        sizeof(LSH_BANNER)-1,        0, APP_ID_LSH },
-    { (const uint8_t*)DROPBEAR_BANNER,   sizeof(DROPBEAR_BANNER)-1,   0, APP_ID_DROPBEAR },
+    { (const uint8_t*)SSH_CLIENT_BANNER, sizeof(SSH_CLIENT_BANNER) - 1, 0, APP_ID_SSH },
+    { (const uint8_t*)OPENSSH_BANNER,    sizeof(OPENSSH_BANNER) - 1,    -1, APP_ID_OPENSSH },
+    { (const uint8_t*)PUTTY_BANNER,      sizeof(PUTTY_BANNER) - 1,      -1, APP_ID_PUTTY },
+    { (const uint8_t*)LSH_BANNER,        sizeof(LSH_BANNER) - 1,        0, APP_ID_LSH },
+    { (const uint8_t*)DROPBEAR_BANNER,   sizeof(DROPBEAR_BANNER) - 1,   -1, APP_ID_DROPBEAR },
 };
 
 static AppRegistryEntry appIdRegistry[] =
@@ -633,6 +634,7 @@ static CLIENT_APP_RETCODE ssh_client_validate(const uint8_t* data, uint16_t size
 
     ssh_client_mod.api->add_app(flowp, APP_ID_SSH, fd->client_id, (const char*)fd->version);
     setAppIdFlag(flowp, APPID_SESSION_CLIENT_DETECTED);
+    appid_stats.ssh_clients++;
     return CLIENT_APP_SUCCESS;
 }
 

diff --git a/src/network_inspectors/appid/detector_plugins/detector_imap.cc b/src/network_inspectors/appid/detector_plugins/detector_imap.cc
index 689118888111a33f408f7da4c69380b095de1f1d..2c06209e531f5f86e2dfab0377d35eebcbfdb31a 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_imap.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_imap.cc
@@ -1052,7 +1052,6 @@ static int imap_validate(ServiceValidationArgs* args)
     else
     {
         clearAppIdFlag(flowp, APPID_SESSION_CONTINUE);
-        appid_stats.imap_flows++;
         return SERVICE_SUCCESS;
     }
 

diff --git a/src/network_inspectors/appid/service_plugins/service_base.cc b/src/network_inspectors/appid/service_plugins/service_base.cc
index 2a256589e1cc8ce16062602ac904794edadd99e0..1d355ab781bdb972fd829a8de9edd0a32c08b3c6 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_base.cc
+++ b/src/network_inspectors/appid/service_plugins/service_base.cc
@@ -209,9 +209,9 @@ static RNAServiceValidationModule* static_service_list[] =
     &battlefield_service_mod,
     &mdns_service_mod,
     &timbuktu_service_mod,
-    &bit_service_mod,
     &tns_service_mod,
 #endif
+    &bit_service_mod,
     &pattern_service_mod,
     &http_service_mod
 };

diff --git a/src/network_inspectors/appid/service_plugins/service_bit.cc b/src/network_inspectors/appid/service_plugins/service_bit.cc
index 0afabc95d2ea0b23ed6d49774e9257b66d6fec6c..801d5cfcd5e3bbbe0b558211d6bbb19c4e079a2e 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_bit.cc
+++ b/src/network_inspectors/appid/service_plugins/service_bit.cc
@@ -19,10 +19,13 @@
 
 // service_bit.cc author Sourcefire Inc.
 
-#include "main/snort_debug.h"
-#include "utils/util.h"
+
 #include "application_ids.h"
 #include "service_api.h"
+#include "appid_module.h"
+
+#include "main/snort_debug.h"
+#include "utils/util.h"
 
 static const char svc_name[] = "bt";
 static const uint8_t BIT_BANNER[]  = "\023BitTorrent protocol";
@@ -202,6 +205,7 @@ inprocess:
 success:
     bit_service_mod.api->add_service(flowp, args->pkt, args->dir, &svc_element,
         APP_ID_BITTORRENT, nullptr, nullptr,  nullptr);
+    appid_stats.bit_flows++;
     return SERVICE_SUCCESS;
 
 fail:

diff --git a/src/search_engines/ac_full.cc b/src/search_engines/ac_full.cc
index 1726c297080449a9ce4634aa405afa586bb56297..b73fbfedd95598ab506a9400d5aef61d321e99b4 100644 (file)
--- a/src/search_engines/ac_full.cc
+++ b/src/search_engines/ac_full.cc
@@ -77,9 +77,9 @@ public:
         void* context, int* current_state) override
     {
         if ( !obj->dfa_enabled() )
-            return 0;  // nfa + all not supported
-
-        return acsm_search_dfa_full_all(obj, T, n, match, context, current_state);
+            return acsm_search_nfa(obj, T, n, match, context, current_state);
+        else
+            return acsm_search_dfa_full_all(obj, T, n, match, context, current_state);
     }
 
     int print_info() override

diff --git a/src/search_engines/test/search_tool_test.cc b/src/search_engines/test/search_tool_test.cc
index fad9fed1a0362e29f1b7fc4108ace73371008534..941cdf59b56c71815e4ae90a6653eefcf2d08ee2 100644 (file)
--- a/src/search_engines/test/search_tool_test.cc
+++ b/src/search_engines/test/search_tool_test.cc
@@ -206,6 +206,35 @@ TEST(search_tool_tests, ac_full)
     delete stool;
 }
 
+TEST(search_tool_tests, search_all_ac_full)
+{
+    SearchTool *stool = new SearchTool("ac_full");
+    CHECK(stool->mpse);
+
+    pattern_id = 1;
+    stool->add("the", 3, pattern_id);
+    CHECK(stool->max_len == 3);
+
+    pattern_id = 77;
+    stool->add("uba", 3, pattern_id);
+    CHECK(stool->max_len == 3);
+
+    pattern_id = 2112;
+    stool->add("away", 4, pattern_id);
+    CHECK(stool->max_len == 4);
+
+    pattern_id = 1000;
+    stool->add("nothere", 7, pattern_id);
+    CHECK(stool->max_len == 7);
+
+    stool->prep();
+
+    const char *datastr = "the tuba ran away";
+    int result = stool->find_all(datastr, strlen(datastr), Test_SearchStrFound);
+    CHECK(result == 3);
+    delete stool;
+}
+
 //-------------------------------------------------------------------------
 // main
 //-------------------------------------------------------------------------