code format

diff --git a/src/file_api/file_mime_decode.cc b/src/file_api/file_mime_decode.cc
index 9efac87fa2d8ac7f791aeb6a88e5cfe459503b6b..1692bb99bfe61bc4dc2d070d9f30198bba30e949 100644 (file)
--- a/src/file_api/file_mime_decode.cc
+++ b/src/file_api/file_mime_decode.cc
@@ -26,9 +26,11 @@
 #include "utils/util.h"
 #include "utils/sf_email_attach_decode.h"
 
+#define MAX_BUF 65535
+
 #define UU_DECODE_CHAR(c) (((c) - 0x20) & 0x3f)
 
-int Email_DecodeState::getCodeDepth(int code_depth, int64_t file_depth)
+int MimeDecode::getCodeDepth(int code_depth, int64_t file_depth)
 {
     if (file_depth < 0 )
         return code_depth;
@@ -52,39 +54,14 @@ static inline int limitDetection(int depth, int decoded_bytes, int decode_bytes_
         return (depth + decoded_bytes - decode_bytes_total);
 }
 
-int Email_DecodeState::getDetectionSize(int b64_depth, int qp_depth, int uu_depth, int bitenc_depth)
-{
-    int iRet = 0;
-
-    switch (decode_type)
-    {
-    case DECODE_B64:
-        iRet = limitDetection(b64_depth, decoded_bytes, b64_state.decode_bytes_read);
-        break;
-    case DECODE_QP:
-        iRet = limitDetection(qp_depth, decoded_bytes, qp_state.decode_bytes_read);
-        break;
-    case DECODE_UU:
-        iRet = limitDetection(uu_depth, decoded_bytes, uu_state.decode_bytes_read);
-        break;
-    case DECODE_BITENC:
-        iRet = limitDetection(bitenc_depth, decoded_bytes, bitenc_state.bytes_read);
-        break;
-    default:
-        break;
-    }
-
-    return iRet;
-}
-
-inline void Email_DecodeState::ClearPrevEncodeBuf()
+inline void MimeDecode::ClearPrevEncodeBuf()
 {
     prev_encoded_bytes = 0;
     prev_encoded_buf = nullptr;
 }
 
 
-void Email_DecodeState::ResetBytesRead()
+void MimeDecode::reset_bytes_read()
 {
     uu_state.begin_found = uu_state.end_found = 0;
     ClearPrevEncodeBuf();
@@ -94,27 +71,27 @@ void Email_DecodeState::ResetBytesRead()
     bitenc_state.bytes_read = 0;
 }
 
-void Email_DecodeState::ResetDecodedBytes()
+void MimeDecode::reset_decoded_bytes()
 {
     decodePtr = nullptr;
     decoded_bytes = 0;
     decode_present = 0;
 }
 
-inline void Email_DecodeState::ResetEmailDecodeState()
+inline void MimeDecode::reset_decode_state()
 {
     uu_state.begin_found = uu_state.end_found = 0;
-    ResetDecodedBytes();
+    reset_decoded_bytes();
     ClearPrevEncodeBuf();
 }
 
-void Email_DecodeState::ClearEmailDecodeState()
+void MimeDecode::clear_decode_state()
 {
     decode_type = DECODE_NONE;
-    ResetEmailDecodeState();
+    reset_decode_state();
 }
 
-int Email_DecodeState::Base64Decode(const uint8_t* start, const uint8_t* end)
+DecodeResult MimeDecode::Base64Decode(const uint8_t* start, const uint8_t* end)
 {
     uint32_t encode_avail = 0, decode_avail = 0;
     uint8_t* encode_buf, * decode_buf;
@@ -144,7 +121,7 @@ int Email_DecodeState::Base64Decode(const uint8_t* start, const uint8_t* end)
     if (encode_avail ==0 || decode_avail ==0 ||
         (!encode_buf) || (!decode_buf))
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_EXCEEDED;
     }
 
@@ -172,7 +149,7 @@ int Email_DecodeState::Base64Decode(const uint8_t* start, const uint8_t* end)
     if (sf_strip_CRLF(start, (end-start), encode_buf + prev_bytes, encode_avail,
         &act_encode_size) != 0)
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_FAIL;
     }
 
@@ -192,12 +169,12 @@ int Email_DecodeState::Base64Decode(const uint8_t* start, const uint8_t* end)
     if (sf_base64decode(encode_buf, act_encode_size, decode_buf, decode_avail, &act_decode_size) !=
         0)
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_FAIL;
     }
     else if (!act_decode_size && !encode_avail)
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_FAIL;
     }
 
@@ -210,7 +187,7 @@ int Email_DecodeState::Base64Decode(const uint8_t* start, const uint8_t* end)
     return DECODE_SUCCESS;
 }
 
-int Email_DecodeState::QPDecode(const uint8_t* start, const uint8_t* end)
+DecodeResult MimeDecode::QPDecode(const uint8_t* start, const uint8_t* end)
 {
     uint32_t encode_avail = 0, decode_avail = 0;
     uint8_t* encode_buf, * decode_buf;
@@ -240,7 +217,7 @@ int Email_DecodeState::QPDecode(const uint8_t* start, const uint8_t* end)
     if (encode_avail ==0 || decode_avail ==0 ||
         (!encode_buf) || (!decode_buf))
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_EXCEEDED;
     }
 
@@ -268,7 +245,7 @@ int Email_DecodeState::QPDecode(const uint8_t* start, const uint8_t* end)
     if (sf_strip_LWS(start, (end-start), encode_buf + prev_bytes, encode_avail,
         &act_encode_size) != 0)
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_FAIL;
     }
 
@@ -277,12 +254,12 @@ int Email_DecodeState::QPDecode(const uint8_t* start, const uint8_t* end)
     if (sf_qpdecode((char*)encode_buf, act_encode_size, (char*)decode_buf, decode_avail,
         &bytes_read, &act_decode_size) != 0)
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_FAIL;
     }
     else if (!act_decode_size && !encode_avail)
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_FAIL;
     }
 
@@ -302,7 +279,7 @@ int Email_DecodeState::QPDecode(const uint8_t* start, const uint8_t* end)
     return DECODE_SUCCESS;
 }
 
-int Email_DecodeState::UUDecode(const uint8_t* start, const uint8_t* end)
+DecodeResult MimeDecode::UUDecode(const uint8_t* start, const uint8_t* end)
 {
     uint32_t encode_avail = 0, decode_avail = 0;
     uint8_t* encode_buf, * decode_buf;
@@ -334,7 +311,7 @@ int Email_DecodeState::UUDecode(const uint8_t* start, const uint8_t* end)
         (!encode_buf) || (!decode_buf))
     {
         uu_state.begin_found = 0;
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_EXCEEDED;
     }
 
@@ -369,7 +346,7 @@ int Email_DecodeState::UUDecode(const uint8_t* start, const uint8_t* end)
         if (SafeMemcpy((encode_buf + prev_bytes), start, act_encode_size, encode_buf, (encode_buf+
             encode_avail + prev_bytes)) != SAFEMEM_SUCCESS)
         {
-            ResetEmailDecodeState();
+            reset_decode_state();
             return DECODE_FAIL;
         }
     }
@@ -380,13 +357,13 @@ int Email_DecodeState::UUDecode(const uint8_t* start, const uint8_t* end)
         &act_decode_size,
         &(uu_state.begin_found), &(uu_state.end_found)) != 0)
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_FAIL;
     }
     else if (!act_decode_size && !encode_avail)
     {
         /* Have insufficient data to decode */
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_FAIL;
     }
 
@@ -414,7 +391,7 @@ int Email_DecodeState::UUDecode(const uint8_t* start, const uint8_t* end)
     return DECODE_SUCCESS;
 }
 
-int Email_DecodeState::BitEncExtract(const uint8_t* start, const uint8_t* end)
+DecodeResult MimeDecode::BitEncExtract(const uint8_t* start, const uint8_t* end)
 {
     uint32_t bytes_avail = 0;
     uint32_t act_size = 0;
@@ -439,7 +416,7 @@ int Email_DecodeState::BitEncExtract(const uint8_t* start, const uint8_t* end)
      * 2. Stop decoding when we are out of memory */
     if (bytes_avail ==0)
     {
-        ResetEmailDecodeState();
+        reset_decode_state();
         return DECODE_EXCEEDED;
     }
 
@@ -460,7 +437,7 @@ int Email_DecodeState::BitEncExtract(const uint8_t* start, const uint8_t* end)
     return DECODE_SUCCESS;
 }
 
-void Email_DecodeState::process_decode_type(const char* start, int length, bool cnt_xf)
+void MimeDecode::process_decode_type(const char* start, int length, bool cnt_xf)
 {
     const char* tmp = NULL;
 
@@ -504,9 +481,9 @@ void Email_DecodeState::process_decode_type(const char* start, int length, bool
     }
 }
 
-int Email_DecodeState::EmailDecode(const uint8_t* start, const uint8_t* end)
+DecodeResult MimeDecode::decode_data(const uint8_t* start, const uint8_t* end)
 {
-    int iRet = DECODE_FAIL;
+    DecodeResult iRet = DECODE_FAIL;
 
     switch (decode_type)
     {
@@ -529,7 +506,32 @@ int Email_DecodeState::EmailDecode(const uint8_t* start, const uint8_t* end)
     return iRet;
 }
 
-int Email_DecodeState::get_decoded_data(uint8_t** buf,  uint32_t* size)
+int MimeDecode::get_detection_depth(int b64_depth, int qp_depth, int uu_depth, int bitenc_depth)
+{
+    int iRet = 0;
+
+    switch (decode_type)
+    {
+    case DECODE_B64:
+        iRet = limitDetection(b64_depth, decoded_bytes, b64_state.decode_bytes_read);
+        break;
+    case DECODE_QP:
+        iRet = limitDetection(qp_depth, decoded_bytes, qp_state.decode_bytes_read);
+        break;
+    case DECODE_UU:
+        iRet = limitDetection(uu_depth, decoded_bytes, uu_state.decode_bytes_read);
+        break;
+    case DECODE_BITENC:
+        iRet = limitDetection(bitenc_depth, decoded_bytes, bitenc_state.bytes_read);
+        break;
+    default:
+        break;
+    }
+
+    return iRet;
+}
+
+int MimeDecode::get_decoded_data(uint8_t** buf,  uint32_t* size)
 {
     if (decoded_bytes > 0)
         *size = decoded_bytes;
@@ -542,12 +544,12 @@ int Email_DecodeState::get_decoded_data(uint8_t** buf,  uint32_t* size)
         return 0;
 }
 
-DecodeType Email_DecodeState::get_decode_type()
+DecodeType MimeDecode::get_decode_type()
 {
     return decode_type;
 }
 
-Email_DecodeState::Email_DecodeState(
+MimeDecode::MimeDecode(
     int max_depth, int b64_depth, int qp_depth,
     int uu_depth, int bitenc_depth, int64_t file_depth)
 {
@@ -578,7 +580,7 @@ Email_DecodeState::Email_DecodeState(
     bitenc_state.bytes_read = 0;
 }
 
-Email_DecodeState::~Email_DecodeState()
+MimeDecode::~MimeDecode()
 {
     if (work_buffer)
         free(work_buffer);

diff --git a/src/file_api/file_mime_decode.h b/src/file_api/file_mime_decode.h
index 5d5c288cd384c0a91984fbffa67e5179bc491c37..ce2b33d24ed8971f0021394abdbf4da091bf7f1c 100644 (file)
--- a/src/file_api/file_mime_decode.h
+++ b/src/file_api/file_mime_decode.h
@@ -21,20 +21,19 @@
 #ifndef FILE_MIME_DECODE_H
 #define FILE_MIME_DECODE_H
 
-// Email attachment decoder
+// Email attachment decoder, supports Base64, QP, UU, and Bit7/8
 
 #include <stdlib.h>
 
 #include "main/snort_types.h"
 
-#define MAX_BUF 65535
-
-// FIXIT-L: Should make this a (scoped?) enum
-#define DECODE_SUCCESS  0
-#define DECODE_EXCEEDED  1 // Decode Complete when we reach the max depths
-#define DECODE_FAIL    -1
+typedef enum
+{
+    DECODE_SUCCESS,
+    DECODE_EXCEEDED, // Decode Complete when we reach the max depths
+    DECODE_FAIL
+} DecodeResult;
 
-// FIXIT-L: Should be a scoped enum
 typedef enum
 {
     DECODE_NONE = 0,
@@ -77,19 +76,25 @@ struct BitEnc_DecodeState
     int depth;
 };
 
-// Should be a C++ OOP struct with constructor, etc
-class Email_DecodeState
+class MimeDecode
 {
 public:
-    Email_DecodeState(int max_depth, int b64_depth, int qp_depth,
+    MimeDecode(int max_depth, int b64_depth, int qp_depth,
         int uu_depth, int bitenc_depth, int64_t file_depth);
-    ~Email_DecodeState();
+    ~MimeDecode();
+
+    // get the decode type from buffer
+    // bool cnt_xf: true if there is transfer encode defined, false otherwise
     void process_decode_type(const char* start, int length, bool cnt_xf);
-    int EmailDecode(const uint8_t* start, const uint8_t* end);
-    int getDetectionSize(int b64_depth, int qp_depth, int uu_depth, int bitenc_depth);
-    void ClearEmailDecodeState();
-    void ResetDecodedBytes();
-    void ResetBytesRead();
+
+    // Main function to decode file data
+    DecodeResult decode_data(const uint8_t* start, const uint8_t* end);
+
+    int get_detection_depth(int b64_depth, int qp_depth, int uu_depth, int bitenc_depth);
+
+    void clear_decode_state();
+    void reset_decoded_bytes();
+    void reset_bytes_read();
     int get_decoded_data(uint8_t** buf,  uint32_t* size);
     DecodeType get_decode_type();
 
@@ -110,21 +115,20 @@ private:
     BitEnc_DecodeState bitenc_state;
     int getCodeDepth(int code_depth, int64_t file_depth);
     inline void ClearPrevEncodeBuf();
-
-    inline void ResetEmailDecodeState();
-    int Base64Decode(const uint8_t* start, const uint8_t* end);
-    int QPDecode(const uint8_t* start, const uint8_t* end);
-    int UUDecode(const uint8_t* start, const uint8_t* end);
-    int BitEncExtract(const uint8_t* start, const uint8_t* end);
-
+    inline void reset_decode_state();
+    DecodeResult Base64Decode(const uint8_t* start, const uint8_t* end);
+    DecodeResult QPDecode(const uint8_t* start, const uint8_t* end);
+    DecodeResult UUDecode(const uint8_t* start, const uint8_t* end);
+    DecodeResult BitEncExtract(const uint8_t* start, const uint8_t* end);
 };
 
-struct MimeStats
-{
-    uint64_t memcap_exceeded;
-    uint64_t attachments[DECODE_ALL];
-    uint64_t decoded_bytes[DECODE_ALL];
-};
+// Todo: add statistics
+//struct MimeStats
+//{
+//    uint64_t memcap_exceeded;
+//    uint64_t attachments[DECODE_ALL];
+//    uint64_t decoded_bytes[DECODE_ALL];
+//};
 
 #endif
 

diff --git a/src/file_api/file_mime_process.cc b/src/file_api/file_mime_process.cc
index 18639b8f9cc7394c984de2d26c6913d8ac1f55bc..688a71a8084d8c88793e5f6e8ab0422f3dddbf0f 100644 (file)
--- a/src/file_api/file_mime_process.cc
+++ b/src/file_api/file_mime_process.cc
@@ -153,7 +153,7 @@ void MimeSession::setup_decode(const char* data, int size, bool cnt_xf)
     {
         if (decode_state == NULL)
         {
-            decode_state = new Email_DecodeState(
+            decode_state = new MimeDecode(
                 decode_conf->get_max_depth(), decode_conf->get_b64_depth(),
                 decode_conf->get_qp_depth(), decode_conf->get_uu_depth(),
                 decode_conf->get_bitenc_depth(), decode_conf->get_file_depth());
@@ -161,7 +161,7 @@ void MimeSession::setup_decode(const char* data, int size, bool cnt_xf)
 
         if (decode_state != NULL)
         {
-            decode_state->ResetBytesRead();
+            decode_state->reset_bytes_read();
             decode_state->process_decode_type(data, size, cnt_xf);
             state_flags |= MIME_FLAG_EMAIL_ATTACH;
         }
@@ -471,7 +471,7 @@ const uint8_t* MimeSession::process_mime_body(const uint8_t* ptr,
 
         if (( attach_start < attach_end ) && decode_state)
         {
-            if (decode_state->EmailDecode(attach_start, attach_end) < DECODE_SUCCESS )
+            if (decode_state->decode_data(attach_start, attach_end) == DECODE_FAIL )
             {
                 decode_alert(decode_state);
             }
@@ -495,7 +495,7 @@ void MimeSession::reset_mime_state()
     data_state = STATE_DATA_INIT;
     state_flags = 0;
     if (decode_state)
-        decode_state->ClearEmailDecodeState();
+        decode_state->clear_decode_state();
 }
 
 const uint8_t* MimeSession::process_mime_data_paf(Flow* flow, const uint8_t* start, const uint8_t* end,
@@ -603,7 +603,7 @@ const uint8_t* MimeSession::process_mime_data_paf(Flow* flow, const uint8_t* sta
 
         if (conf)
         {
-            int detection_size = decode_state->getDetectionSize(conf->get_b64_depth(),
+            int detection_size = decode_state->get_detection_depth(conf->get_b64_depth(),
                 conf->get_qp_depth(), conf->get_uu_depth(), conf->get_bitenc_depth());
             set_file_data(buffer, (uint16_t)detection_size);
         }
@@ -615,7 +615,7 @@ const uint8_t* MimeSession::process_mime_data_paf(Flow* flow, const uint8_t* sta
             log_state->set_file_name_from_log(flow);
         }
 
-        decode_state->ResetDecodedBytes();
+        decode_state->reset_decoded_bytes();
     }
 
     /* if we got the data end reset state, otherwise we're probably still in the data

diff --git a/src/file_api/file_mime_process.h b/src/file_api/file_mime_process.h
index 39fd86d4421621858ec519dfcfafcabc8dcfd188..6102d2ab9bb2d24fedd8fb93512b857c4e431bf7 100644 (file)
--- a/src/file_api/file_mime_process.h
+++ b/src/file_api/file_mime_process.h
@@ -68,7 +68,7 @@ public:
 private:
     int data_state = STATE_DATA_INIT;
     int state_flags = 0;
-    Email_DecodeState* decode_state = NULL;
+    MimeDecode* decode_state = NULL;
     MimeDataPafInfo mime_boundary;
     DecodeConfig* decode_conf = NULL;
     MailLogConfig* log_config = NULL;

diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc
index d494e8883ae54858687fabafa5173b8bed948f5f..d2ab9526093a00faa9e5fa165d534004335618e8 100644 (file)
--- a/src/service_inspectors/imap/imap.cc
+++ b/src/service_inspectors/imap/imap.cc
@@ -743,7 +743,7 @@ static void snort_imap(IMAP_PROTO_CONF* config, Packet* p)
 
 void ImapMime::decode_alert(void* ds)
 {
-    Email_DecodeState* decode_state = (Email_DecodeState*)ds;
+    MimeDecode* decode_state = (MimeDecode*)ds;
     switch ( decode_state->get_decode_type() )
     {
     case DECODE_B64:

diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc
index 8685ae7da7eb8adc7240891261b629e5e0effc54..b6520e53135e884946f30883b7b64ee9e9c917fe 100644 (file)
--- a/src/service_inspectors/pop/pop.cc
+++ b/src/service_inspectors/pop/pop.cc
@@ -677,7 +677,7 @@ static void snort_pop(POP_PROTO_CONF* config, Packet* p)
 
 void PopMime::decode_alert(void* ds)
 {
-    Email_DecodeState* decode_state = (Email_DecodeState*)ds;
+    MimeDecode* decode_state = (MimeDecode*)ds;
     switch ( decode_state->get_decode_type() )
     {
     case DECODE_B64:

diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc
index 4c56d8e67493850a656d3565ec5c2d1d006f257b..a5e3b0b8607e554f6b5add2aa1f58bad56d80cc1 100644 (file)
--- a/src/service_inspectors/smtp/smtp.cc
+++ b/src/service_inspectors/smtp/smtp.cc
@@ -1508,7 +1508,7 @@ int SmtpMime::normalize_data(void* conf, const uint8_t* ptr, const uint8_t* data
 
 void SmtpMime::decode_alert(void* ds)
 {
-    Email_DecodeState* decode_state = (Email_DecodeState*)ds;
+    MimeDecode* decode_state = (MimeDecode*)ds;
     switch ( decode_state->get_decode_type() )
     {
     case DECODE_B64: