Pull request #3208: http_inspect/http2_inspect: refuse midstream pickups

Merge in SNORT/snort3 from ~THOPETER/snort3:h2i22 to master

Squashed commit of the following:

commit 75298d3ab6f3e4b977a80b04a542899d64f3e6e7
Author: Tom Peters <thopeter@cisco.com>
Date:   Fri Nov 19 15:57:32 2021 -0500

    http_inspect/http2_inspect: refuse midstream pickups

diff --git a/src/service_inspectors/http2_inspect/http2_inspect.cc b/src/service_inspectors/http2_inspect/http2_inspect.cc
index d77584d204f9b5d2f7982f33eeb28f987b5efc53..9cd462f7e3a46dcb902a159b40e708100ff0274b 100644 (file)
--- a/src/service_inspectors/http2_inspect/http2_inspect.cc
+++ b/src/service_inspectors/http2_inspect/http2_inspect.cc
@@ -131,7 +131,8 @@ void Http2Inspect::eval(Packet* p)
     }
 
     session_data->set_processing_stream_id(source_id);
-    Http2Stream* stream = session_data->get_processing_stream(source_id, params->concurrent_streams_limit);
+    Http2Stream* const stream = session_data->get_processing_stream(source_id,
+        params->concurrent_streams_limit);
     if (!stream)
     {
         delete[] session_data->frame_data[source_id];

diff --git a/src/service_inspectors/http2_inspect/http2_stream_splitter.cc b/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
index 4884f1c51313e2f4f3592dc1b9933aef3194793e..436cf07b818bb4cc3a26b8e8f5d3adb0a6c11887 100644 (file)
--- a/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
+++ b/src/service_inspectors/http2_inspect/http2_stream_splitter.cc
@@ -45,22 +45,26 @@ StreamSplitter::Status Http2StreamSplitter::scan(Packet* pkt, const uint8_t* dat
 {
     Profile profile(Http2Module::get_profile_stats());
 
+    Flow* const flow = pkt->flow;
+    if (flow->session_state & STREAM_STATE_MIDSTREAM)
+        return StreamSplitter::ABORT;
+
     // This is the session state information we share with Http2Inspect and store with stream. A
     // session is defined by a TCP connection. Since scan() is the first to see a new TCP
     // connection the new flow data object is created here.
     Http2FlowData* session_data =
-        (Http2FlowData*)pkt->flow->get_flow_data(Http2FlowData::inspector_id);
+        (Http2FlowData*)flow->get_flow_data(Http2FlowData::inspector_id);
 
     if (session_data == nullptr)
     {
         AssistantGadgetEvent event(pkt, "http");
-        DataBus::publish(FLOW_ASSISTANT_GADGET_EVENT, event, pkt->flow);
-        if (pkt->flow->assistant_gadget == nullptr)
+        DataBus::publish(FLOW_ASSISTANT_GADGET_EVENT, event, flow);
+        if (flow->assistant_gadget == nullptr)
         {
             // http_inspect is not configured
             return HttpStreamSplitter::status_value(StreamSplitter::ABORT, true);
         }
-        pkt->flow->set_flow_data(session_data = new Http2FlowData(pkt->flow));
+        flow->set_flow_data(session_data = new Http2FlowData(flow));
         Http2Module::increment_peg_counts(PEG_FLOW);
     }
 
@@ -84,7 +88,7 @@ StreamSplitter::Status Http2StreamSplitter::scan(Packet* pkt, const uint8_t* dat
     {
         printf("HTTP/2 scan from flow data %" PRIu64
             " direction %d length %u client port %hu server port %hu\n", session_data->seq_num,
-            source_id, length, pkt->flow->client_port, pkt->flow->server_port);
+            source_id, length, flow->client_port, flow->server_port);
         fflush(stdout);
         if (HttpTestManager::get_show_scan())
         {

diff --git a/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc b/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
index dd4c28f41dd4a1112dc3bc35cc51b895d546f466..eff62701dbf01ce6ad50916118b55f24c393956d 100644 (file)
--- a/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
+++ b/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
@@ -129,6 +129,8 @@ StreamSplitter::Status HttpStreamSplitter::scan(Packet* pkt, const uint8_t* data
     Profile profile(HttpModule::get_profile_stats());
 
     Flow* const flow = pkt->flow;
+    if (flow->session_state & STREAM_STATE_MIDSTREAM)
+        return StreamSplitter::ABORT;
 
     // This is the session state information we share with HttpInspect and store with stream. A
     // session is defined by a TCP connection. Since scan() is the first to see a new TCP