From: huica Date: Wed, 16 Sep 2015 18:42:23 +0000 (-0400) Subject: update interfaces based on comments X-Git-Tag: 3.0.0-233~828^2~7 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=55d77efbdff740f0821eecfb71684859886de2ed;p=thirdparty%2Fsnort3.git update interfaces based on comments --- diff --git a/src/file_api/file_flows.cc b/src/file_api/file_flows.cc index b7e49a6dc..26fb9fbfb 100644 --- a/src/file_api/file_flows.cc +++ b/src/file_api/file_flows.cc @@ -240,7 +240,7 @@ bool FileFlows::file_process(const uint8_t* file_data, int data_size, return file_process(context, file_data, data_size, position); } -void FileFlows::set_file_name(uint8_t* fname, uint32_t name_size) +void FileFlows::set_file_name(const uint8_t* fname, uint32_t name_size) { FileContext* context = get_current_file_context(); if (context) @@ -249,7 +249,6 @@ void FileFlows::set_file_name(uint8_t* fname, uint32_t name_size) context->print(); } - FilePosition get_file_position(Packet* pkt) { FilePosition position = SNORT_FILE_POSITION_UNKNOWN; diff --git a/src/file_api/file_flows.h b/src/file_api/file_flows.h index 0dd6ec89b..98db6fed8 100644 --- a/src/file_api/file_flows.h +++ b/src/file_api/file_flows.h @@ -21,7 +21,7 @@ #ifndef FILE_FLOWS_H #define FILE_FLOWS_H -// This provides a wrapper to start/stop file service +// This provides a wrapper to manage several file contexts #include #include "main/snort_types.h" @@ -46,7 +46,7 @@ public: uint32_t get_new_file_instance(); - void set_file_name(uint8_t* fname, uint32_t name_size); + void set_file_name(const uint8_t* fname, uint32_t name_size); // This is used when there is only one file per session bool file_process(const uint8_t* file_data, int data_size, diff --git a/src/file_api/libs/file_lib.h b/src/file_api/libs/file_lib.h index 271c07b8e..2db3df22e 100644 --- a/src/file_api/libs/file_lib.h +++ b/src/file_api/libs/file_lib.h @@ -81,7 +81,7 @@ private: bool file_type_enabled = false; bool file_signature_enabled = false; bool file_capture_enabled = false; - uint8_t* file_name = NULL; + uint8_t* file_name = nullptr; uint32_t file_name_size = 0; uint64_t file_size = 0; FileDirection direction = DIRECTION_UNKNOWN; diff --git a/src/mime/CMakeLists.txt b/src/mime/CMakeLists.txt index 7318c0ad3..dc55ce109 100644 --- a/src/mime/CMakeLists.txt +++ b/src/mime/CMakeLists.txt @@ -11,7 +11,7 @@ add_library ( mime STATIC file_mime_paf.cc file_mime_process.h file_mime_process.cc - decode_base.h.cc + decode_base.cc decode_base.h decode_b64.cc decode_b64.h diff --git a/src/mime/decode_uu.cc b/src/mime/decode_uu.cc index 8c9fb8303..95f7b35cd 100644 --- a/src/mime/decode_uu.cc +++ b/src/mime/decode_uu.cc @@ -20,15 +20,12 @@ #include #include "decode_uu.h" - #include "utils/snort_bounds.h" #include "utils/util.h" #include "utils/util_unfold.h" - #define UU_DECODE_CHAR(c) (((c) - 0x20) & 0x3f) - void UUDecode::reset_decode_state() { reset_decoded_bytes(); diff --git a/src/mime/dev_notes.txt b/src/mime/dev_notes.txt index fb624ce4d..5f0d9719c 100644 --- a/src/mime/dev_notes.txt +++ b/src/mime/dev_notes.txt @@ -5,5 +5,5 @@ service inpsectors such as HTTP, SMTP, POP, and IMAP. * Decode: supports Base64, UU-encoding, QP-encoding, and Bit-encoding * Log: logs file names and email headers * Configuration: configure decode and log -* PAF: provides common processing for PAF (Protocol Wware Flushing) +* PAF: provides common processing for PAF (Protocol Aware Flushing) diff --git a/src/mime/file_mime_process.cc b/src/mime/file_mime_process.cc index a7507fcff..455a4981c 100644 --- a/src/mime/file_mime_process.cc +++ b/src/mime/file_mime_process.cc @@ -629,14 +629,15 @@ const uint8_t* MimeSession::process_mime_data_paf(Flow* flow, const uint8_t* sta // Main function for mime processing // This should be called when mime data is available const uint8_t* MimeSession::process_mime_data(Flow* flow, const uint8_t* start, - const uint8_t* data_end_marker, bool upload, FilePosition position) + int data_size, bool upload, FilePosition position) { const uint8_t* attach_start = start; const uint8_t* attach_end; + const uint8_t* data_end_marker = start + data_size; + if (position != SNORT_FILE_POSITION_UNKNOWN) { - //FilePosition position = file_api->get_file_position(p); process_mime_data_paf(flow, attach_start, data_end_marker, upload, position); return data_end_marker; diff --git a/src/mime/file_mime_process.h b/src/mime/file_mime_process.h index f04370033..84e5719da 100644 --- a/src/mime/file_mime_process.h +++ b/src/mime/file_mime_process.h @@ -59,7 +59,7 @@ public: virtual ~MimeSession(); static void init(); static void exit(); - const uint8_t* process_mime_data(Flow *flow, const uint8_t *start, const uint8_t *end, + const uint8_t* process_mime_data(Flow *flow, const uint8_t *data, int data_size, bool upload, FilePosition position); int get_data_state(); void set_data_state(int); diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc index 8dbafedc0..081425398 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/src/service_inspectors/http_inspect/hi_main.cc @@ -659,8 +659,7 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) { if (hsd->mime_ssn) { - uint8_t* end = ( uint8_t*)(p->data) + p->dsize; - hsd->mime_ssn->process_mime_data(p->flow, p->data, end, 1, + hsd->mime_ssn->process_mime_data(p->flow, p->data, p->dsize, 1, SNORT_FILE_POSITION_UNKNOWN); } else if (get_file_processed_size(p->flow) >0) @@ -783,10 +782,8 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) &(conf->global->mime_conf)); } - end = (uint8_t*)(session->client.request.post_raw + - session->client.request.post_raw_size); - hsd->mime_ssn->process_mime_data(p->flow, start, end, 1, - SNORT_FILE_POSITION_UNKNOWN); + hsd->mime_ssn->process_mime_data(p->flow, start, + session->client.request.post_raw_size, 1, SNORT_FILE_POSITION_UNKNOWN); } else { @@ -823,8 +820,7 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) { if (hsd->mime_ssn) { - uint8_t* end = ( uint8_t*)(p->data) + p->dsize; - hsd->mime_ssn->process_mime_data(p->flow, p->data, end, 1, + hsd->mime_ssn->process_mime_data(p->flow, p->data, p->dsize, 1, SNORT_FILE_POSITION_UNKNOWN); } else if (get_file_processed_size(p->flow) >0) diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc index 10efccaf8..14d463e4a 100644 --- a/src/service_inspectors/imap/imap.cc +++ b/src/service_inspectors/imap/imap.cc @@ -452,9 +452,9 @@ static void IMAP_ProcessServerPacket(Packet* p, IMAPData* imap_ssn) DebugMessage(DEBUG_IMAP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); if ( imap_ssn->body_len > imap_ssn->body_read) { - uint32_t len = imap_ssn->body_len - imap_ssn->body_read; + int len = imap_ssn->body_len - imap_ssn->body_read; - if ( (uint32_t)(end - ptr) < len ) + if ( (end - ptr) < len ) { data_end = end; len = data_end - ptr; @@ -463,7 +463,9 @@ static void IMAP_ProcessServerPacket(Packet* p, IMAPData* imap_ssn) data_end = ptr + len; FilePosition position = get_file_position(p); - ptr = imap_ssn->mime_ssn->process_mime_data(p->flow, ptr, end, 0, + + int data_len = end - ptr; + ptr = imap_ssn->mime_ssn->process_mime_data(p->flow, ptr, data_len, 0, position); if ( ptr < data_end) len = len - (data_end - ptr); diff --git a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc index 77c6b93e3..1122c1c38 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc @@ -53,7 +53,7 @@ NHttpFlowData::~NHttpFlowData() if (mime_state != nullptr) { - delete(mime_state); + delete mime_state; } delete_pipeline(); diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc index 604d8a0eb..0b3e712f3 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc @@ -93,7 +93,7 @@ void NHttpMsgBody::do_file_processing() { FileFlows* file_flows = FileFlows::get_file_flows(flow); - if (file_flows && file_flows->file_process(const_cast(file_data.start), fp_length, + if (file_flows && file_flows->file_process(file_data.start, fp_length, file_position, false, false)) { session_data->file_depth_remaining[source_id] -= fp_length; @@ -107,8 +107,7 @@ void NHttpMsgBody::do_file_processing() const Field& tranaction_uri = request->get_uri_norm_legacy(); if (tranaction_uri.length > 0) { - file_flows->set_file_name(const_cast(tranaction_uri.start), - tranaction_uri.length); + file_flows->set_file_name(tranaction_uri.start, tranaction_uri.length); } } } @@ -119,15 +118,15 @@ void NHttpMsgBody::do_file_processing() session_data->file_depth_remaining[source_id] = 0; } } - else if (session_data->mime_state != nullptr) + else { session_data->mime_state->process_mime_data(flow, file_data.start, - file_data.start + fp_length, true, file_position); + fp_length, true, file_position); session_data->file_depth_remaining[source_id] -= fp_length; if (session_data->file_depth_remaining[source_id] == 0) { - delete(session_data->mime_state); + delete session_data->mime_state; session_data->mime_state = nullptr; } } diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc index abdd74778..e99c1e079 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc @@ -59,7 +59,7 @@ void NHttpMsgChunk::update_flow() if ((source_id == SRC_CLIENT) && (session_data->mime_state != nullptr)) { - delete(session_data->mime_state); + delete session_data->mime_state; session_data->mime_state = nullptr; } } diff --git a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc index efb326ad3..ce1f9144a 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc @@ -500,7 +500,7 @@ bool NHttpStreamSplitter::finish(Flow* flow) { session_data->mime_state->process_mime_data(flow, nullptr, 0, true, SNORT_FILE_END); - delete(session_data->mime_state); + delete session_data->mime_state; session_data->mime_state = nullptr; } return false; diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc index 8fcdea7cf..7c18550b1 100644 --- a/src/service_inspectors/pop/pop.cc +++ b/src/service_inspectors/pop/pop.cc @@ -430,7 +430,8 @@ static void POP_ProcessServerPacket(Packet* p, POPData* pop_ssn) DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); //ptr = POP_HandleData(p, ptr, end); FilePosition position = get_file_position(p); - ptr = pop_ssn->mime_ssn->process_mime_data(p->flow, ptr, end, 0, position); + int len = end - ptr; + ptr = pop_ssn->mime_ssn->process_mime_data(p->flow, ptr, len, 0, position); continue; } POP_GetEOL(ptr, end, &eol, &eolm); diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc index d41568c72..17b802c71 100644 --- a/src/service_inspectors/smtp/smtp.cc +++ b/src/service_inspectors/smtp/smtp.cc @@ -170,7 +170,7 @@ SmtpFlowData::SmtpFlowData() : FlowData(flow_id) SmtpFlowData::~SmtpFlowData() { if (session.mime_ssn) - delete(session.mime_ssn); + delete session.mime_ssn; } unsigned SmtpFlowData::flow_id = 0; @@ -1002,6 +1002,8 @@ static void SMTP_ProcessClientPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat while ((ptr != NULL) && (ptr < end)) { FilePosition position; + int len = end - ptr; + switch (smtp_ssn->state) { case STATE_COMMAND: @@ -1012,7 +1014,7 @@ static void SMTP_ProcessClientPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat case STATE_BDATA: DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); position = get_file_position(p); - ptr = smtp_ssn->mime_ssn->process_mime_data(p->flow, ptr, end, 1, position); + ptr = smtp_ssn->mime_ssn->process_mime_data(p->flow, ptr, len, 1, position); //ptr = SMTP_HandleData(p, ptr, end, &(smtp_ssn->mime_ssn)); break; case STATE_XEXCH50: diff --git a/src/utils/util.h b/src/utils/util.h index 95744c556..2de92d083 100644 --- a/src/utils/util.h +++ b/src/utils/util.h @@ -128,15 +128,6 @@ static inline void* SnortAlloc(unsigned long size) return NULL; } -static inline void* new_calloc(size_t num, size_t size) -{ - void* ret_val = calloc(num, size); - if (ret_val == nullptr) - throw std::bad_alloc(); - - return ret_val; -} - static inline long SnortStrtol(const char* nptr, char** endptr, int base) { long iRet;