From: huica Date: Tue, 1 Sep 2015 16:36:11 +0000 (-0400) Subject: Merge branch 'master' of X-Git-Tag: 3.0.0-233~828^2~22 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5d463e22e61e433429e91f020d1f0483d3eaeded;p=thirdparty%2Fsnort3.git Merge branch 'master' of https://huica@stash-eng-rtp1.cisco.com/stash/scm/snort/snort3.git into fileclass2 Conflicts: src/CMakeLists.txt src/file_api/file_capture.cc src/file_api/file_mime_process.cc src/file_api/file_service.cc src/service_inspectors/nhttp_inspect/nhttp_flow_data.h src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc src/service_inspectors/smtp/smtp.cc --- 5d463e22e61e433429e91f020d1f0483d3eaeded diff --cc src/CMakeLists.txt index 318aa9e45,df1b7a184..9a88aadfe --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@@ -95,12 -103,14 +103,15 @@@ target_link_libraries( snor stream_udp stream_user stream_file - http_inspect - flow - parser - file_api file + file_api + mime + http_inspect + ${PIGLET_LIBRARIES} + ips_options + parser + search_engines + flow control filter detection diff --cc src/Makefile.am index 19195c815,5396e6fcc..f5b3d491f --- a/src/Makefile.am +++ b/src/Makefile.am @@@ -59,8 -67,8 +67,9 @@@ stream/user/libstream_user.a stream/file/libstream_file.a \ file_api/libfile_api.a \ file_api/libs/libfile.a \ +mime/libmime.a \ service_inspectors/http_inspect/libhttp_inspect.a \ + $(pig_list) \ ips_options/libips_options.a \ parser/libparser.a \ search_engines/libsearch_engines.a \ diff --cc src/file_api/file_capture.cc index 705a890a8,916c18f18..648f8a8d8 --- a/src/file_api/file_capture.cc +++ b/src/file_api/file_capture.cc @@@ -46,17 -57,40 +46,15 @@@ FileMemPool* file_mempool = NULL; File_Capture_Stats file_capture_stats; - /* - * Verify file capture information and file context information matched - * This is used for debug purpose - */ + #ifdef DEBUG_MSGS + // verify file capture information and file context information matched -static void verify_file_capture_info( - FileContext* context, FileCaptureInfo* fileInfo) +void FileCapture::verifiy(FileContext* context) { - /* file capture length should be one of two possible values */ - if (context->processed_bytes) - { - if ((fileInfo->file_size != context->processed_bytes) && - (fileInfo->file_size + context->current_data_len - != context->processed_bytes)) - { - FILE_DEBUG_MSGS("File capture size failed w.r.t processed size!\n"); - } - } - else - { - if ((fileInfo->file_size != context->file_size) && - (fileInfo->file_size + context->current_data_len - != context->file_size)) - { - FILE_DEBUG_MSGS("File capture size failed w.r.t final file size!\n"); - } - } -} - -static void verifiy_file_capture( - FileContext* context, FileCaptureInfo* fileInfo) -{ - SHA256CONTEXT sha_ctx; + SHA256_CTX sha_ctx; uint8_t* buff; int size; - FileCaptureInfo* file_mem = fileInfo; + FileCaptureBlock* file_mem = head; uint8_t sha256[SHA256_HASH_SIZE + 1]; int i; diff --cc src/file_api/file_stats.h index 7ad59fe4d,ff73fddb6..c62130b0f --- a/src/file_api/file_stats.h +++ b/src/file_api/file_stats.h @@@ -52,9 -52,16 +52,9 @@@ typedef struct _File_Stat extern FileStats file_stats; - #define FILE_DEBUG_MSGS(msg) DEBUG_WRAP(DebugMessage(DEBUG_FILE, msg); ) + #define FILE_DEBUG_MSGS(msg) DebugMessage(DEBUG_FILE, msg) -void printFileContext(FileContext* context); - void print_file_stats(); -/* - * Print out file statistics - */ -void print_file_stats(int exiting); - #endif diff --cc src/service_inspectors/imap/imap_paf.cc index 07002e768,8609fe61d..548eb389e --- a/src/service_inspectors/imap/imap_paf.cc +++ b/src/service_inspectors/imap/imap_paf.cc @@@ -206,10 -206,10 +206,10 @@@ static bool find_data_end_mime_data(con } // check for mime flush point - if (file_api->process_mime_paf_data(&(pfdata->mime_info), ch)) + if (process_mime_paf_data(&(pfdata->mime_info), ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_IMAP, "IMAP PAF: Mime Boundary found." - " Flushing data!\n"); ); + DebugMessage(DEBUG_IMAP, "IMAP PAF: Mime Boundary found." + " Flushing data!\n"); return true; } diff --cc src/service_inspectors/nhttp_inspect/nhttp_flow_data.h index 87f8a8844,46710fe85..0aaa86613 --- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h +++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h @@@ -96,7 -96,9 +96,9 @@@ private NHttpEnums::MethodId method_id = NHttpEnums::METH__NOTPRESENT; int32_t status_code_num = NHttpEnums::STAT_NOTPRESENT; int64_t file_depth_remaining[2] = { NHttpEnums::STAT_NOTPRESENT, NHttpEnums::STAT_NOTPRESENT }; + int64_t detect_depth_remaining[2] = { NHttpEnums::STAT_NOTPRESENT, + NHttpEnums::STAT_NOTPRESENT }; - MimeState* mime_state = nullptr; // SRC_CLIENT only + MimeSession* mime_state = nullptr; // SRC_CLIENT only // number of user data octets seen so far (regular body or chunks) int64_t body_octets[2] = { NHttpEnums::STAT_NOTPRESENT, NHttpEnums::STAT_NOTPRESENT }; diff --cc src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc index 26a100371,c5ae1fbea..d115646dd --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc @@@ -110,10 -116,10 +116,10 @@@ void NHttpMsgBody::do_file_processing( session_data->file_depth_remaining[source_id] = 0; } } - else + else if (session_data->mime_state != nullptr) { - session_data->mime_state->process_mime_data(flow, data.start, data.start + fp_length, - true, file_position); - file_api->process_mime_data(flow, file_data.start, file_data.start + fp_length, - session_data->mime_state, true, file_position); ++ session_data->mime_state->process_mime_data(flow, file_data.start, ++ file_data.start + fp_length, true, file_position); session_data->file_depth_remaining[source_id] -= fp_length; if (session_data->file_depth_remaining[source_id] == 0) diff --cc src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc index ec6f69ff3,f447b9795..abdc06640 --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc @@@ -123,3 -104,46 +105,46 @@@ void NHttpMsgHeader::update_flow( session_data->section_type[source_id] = SEC__NOTCOMPUTE; } + // Common activities of preparing for upcoming regular body or chunked body + void NHttpMsgHeader::prepare_body() + { + session_data->body_octets[source_id] = 0; + const int64_t& depth = (source_id == SRC_CLIENT) ? params->request_depth : + params->response_depth; + session_data->detect_depth_remaining[source_id] = (depth != -1) ? depth : INT64_MAX; + setup_file_processing(); + setup_decompression(); + update_depth(); + session_data->infractions[source_id].reset(); + session_data->events[source_id].reset(); + } + + void NHttpMsgHeader::setup_file_processing() + { + // FIXIT-M Bidirectional file processing is problematic so we don't do it. When the library + // fully supports it remove the outer if statement that prevents it from being done. + if (session_data->file_depth_remaining[1-source_id] == 0) + { - if ((session_data->file_depth_remaining[source_id] = file_api->get_max_file_depth()) < 0) ++ if ((session_data->file_depth_remaining[source_id] = FileService::get_max_file_depth) < 0) + { + session_data->file_depth_remaining[source_id] = 0; + } + if (source_id == SRC_CLIENT) + { + // FIXIT-L Cannot use new because file_api insists on freeing the mime_state using + // free(). + session_data->mime_state = (MimeState*) new_calloc(1, sizeof(MimeState)); + file_api->set_mime_log_config_defauts(&mime_conf); + session_data->mime_state->log_config = &mime_conf; + file_api->set_mime_decode_config_defauts(&decode_conf); + session_data->mime_state->decode_conf = &decode_conf; + file_api->set_log_buffers(&session_data->mime_state->log_state, + session_data->mime_state->log_config); + } + } + } + + void NHttpMsgHeader::setup_decompression() + { + } + diff --cc src/service_inspectors/nhttp_inspect/nhttp_msg_header.h index d6473cfd4,72e131a83..4c03cb44f --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h @@@ -38,8 -39,12 +39,12 @@@ public void update_flow() override; private: // Dummy configurations to support MIME processing - MAIL_LogConfig mime_conf; + MailLogConfig mime_conf; DecodeConfig decode_conf; + + void prepare_body(); + void setup_file_processing(); + void setup_decompression(); }; #endif diff --cc src/service_inspectors/pop/pop.cc index aaec27433,ce0749b0c..b908f3521 --- a/src/service_inspectors/pop/pop.cc +++ b/src/service_inspectors/pop/pop.cc @@@ -485,10 -517,11 +485,10 @@@ static void POP_ProcessServerPacket(Pac { if (pop_ssn->state == STATE_DATA) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); //ptr = POP_HandleData(p, ptr, end); - FilePosition position = file_api->get_file_position(p); - ptr = file_api->process_mime_data(p->flow, ptr, end, &(pop_ssn->mime_ssn), 0, - position); + FilePosition position = get_file_position(p); + ptr = pop_ssn->mime_ssn->process_mime_data(p->flow, ptr, end, 0, position); continue; } POP_GetEOL(ptr, end, &eol, &eolm); diff --cc src/service_inspectors/pop/pop_paf.cc index f3ec905fe,5a1af3543..89c41b6da --- a/src/service_inspectors/pop/pop_paf.cc +++ b/src/service_inspectors/pop/pop_paf.cc @@@ -201,9 -201,9 +201,9 @@@ static bool find_data_end_multi_line(Po { // FIXIT: This will currently flush on MIME boundary, and one line later at end of PDU - if (file_api->check_data_end(&(pfdata->end_state), ch)) + if (check_data_end(&(pfdata->end_state), ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "End of Multi-line response found\n"); ); + DebugMessage(DEBUG_POP, "End of Multi-line response found\n"); pfdata->end_of_data = true; pfdata->pop_state = POP_PAF_SINGLE_LINE_STATE; reset_data_states(pfdata); @@@ -213,9 -213,9 +213,9 @@@ // if this is a data command, search for MIME ending if (mime_data) { - if (file_api->process_mime_paf_data(&(pfdata->data_info), ch)) + if (process_mime_paf_data(&(pfdata->data_info), ch)) { - DEBUG_WRAP(DebugMessage(DEBUG_POP, "Mime Boundary found. Flushing data!\n"); ); + DebugMessage(DEBUG_POP, "Mime Boundary found. Flushing data!\n"); pfdata->cmd_continued = true; return true; } diff --cc src/service_inspectors/smtp/smtp.cc index 53b8e9cdc,53679a4ae..fc3c1fc6b --- a/src/service_inspectors/smtp/smtp.cc +++ b/src/service_inspectors/smtp/smtp.cc @@@ -1073,9 -1182,10 +1073,9 @@@ static void SMTP_ProcessClientPacket(SM break; case STATE_DATA: case STATE_BDATA: - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); + DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); - position = file_api->get_file_position(p); - ptr = file_api->process_mime_data(p->flow, ptr, end, &(smtp_ssn->mime_ssn), 1, - position); + position = get_file_position(p); + ptr = smtp_ssn->mime_ssn->process_mime_data(p->flow, ptr, end, 1, position); //ptr = SMTP_HandleData(p, ptr, end, &(smtp_ssn->mime_ssn)); break; case STATE_XEXCH50: diff --cc src/service_inspectors/smtp/smtp_paf.cc index 167c55b8b,74fab0c7c..91112c9bb --- a/src/service_inspectors/smtp/smtp_paf.cc +++ b/src/service_inspectors/smtp/smtp_paf.cc @@@ -260,9 -260,9 +260,9 @@@ static inline bool flush_based_length(S * * Process data boundary and flush each file based on boundary*/ static inline bool process_data(SmtpPafData* pfdata, uint8_t data) { - if (flush_based_length(pfdata)|| file_api->check_data_end(&(pfdata->data_end_state), data)) + if (flush_based_length(pfdata)|| check_data_end(&(pfdata->data_end_state), data)) { - DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "End of data\n"); ); + DebugMessage(DEBUG_SMTP, "End of data\n"); /*Clean up states*/ pfdata->smtp_state = SMTP_PAF_CMD_STATE; pfdata->end_of_data = true;