From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Thu, 8 Jun 2017 13:54:10 +0000 (-0400)
Subject: Merge pull request #918 in SNORT/snort3 from sip_buf to master
X-Git-Tag: 3.0.0-239~55
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=657eba933dc144e0c4fd7900e562c8efc473e354;p=thirdparty%2Fsnort3.git

Merge pull request #918 in SNORT/snort3 from sip_buf to master

Squashed commit of the following:

commit dc7ee447477092476f4071404673623ac58be1b3
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Jun 7 15:57:48 2017 -0400

    conf: set HOME_NET and EXTERNAL_NET before loading defaults

commit 72bbbf5da7c4911c01bf6366c03be5ef2e5741f1
Author: Russ Combs <rucombs@cisco.com>
Date:   Tue Jun 6 09:02:56 2017 -0400

    sip: fix get body buffer
---

diff --git a/lua/snort.lua b/lua/snort.lua
index f387b4378..ac2ea072b 100644
--- a/lua/snort.lua
+++ b/lua/snort.lua
@@ -20,6 +20,13 @@
 -- export LUA_PATH=$DIR/include/snort/lua/?.lua\;\;
 -- export SNORT_LUA_PATH=$DIR/etc/snort
 
+-- setup the network addresses you are protecting
+HOME_NET = 'any'
+
+-- set up the external network addresses.
+-- (leave as "any" in most situations)
+EXTERNAL_NET = 'any'
+
 ---------------------------------------------------------------------------
 
 ---------------------------------------------------------------------------
@@ -97,13 +104,6 @@ wizard = default_wizard
 -- 4. configure rules
 ---------------------------------------------------------------------------
 
--- setup the network addresses you are protecting
-HOME_NET = 'any'
-
--- set up the external network addresses.
--- (leave as "any" in most situations)
-EXTERNAL_NET = 'any'
-
 -- see snort_defaults.lua for other nets, ports, and servers
 -- and default references and classifications
 
diff --git a/src/service_inspectors/sip/sip.cc b/src/service_inspectors/sip/sip.cc
index 552fd655a..894f78af9 100644
--- a/src/service_inspectors/sip/sip.cc
+++ b/src/service_inspectors/sip/sip.cc
@@ -323,6 +323,8 @@ bool Sip::get_buf(
     if (!len)
         return false;
 
+    assert(data);
+
     b.data = data;
     b.len = len;
 
diff --git a/src/service_inspectors/sip/sip_parser.cc b/src/service_inspectors/sip/sip_parser.cc
index 64e292e9f..784346e26 100644
--- a/src/service_inspectors/sip/sip_parser.cc
+++ b/src/service_inspectors/sip/sip_parser.cc
@@ -531,6 +531,7 @@ static bool sip_body_parse(SIPMsg* msg, const char* buff, char* end, char** body
         return true;
 
     msg->body_data = (uint8_t*)buff;
+    msg->bodyLen = end - buff;
 
     // Create a media session
     msg->mediaSession = (SIP_MediaSession*)snort_calloc(sizeof(SIP_MediaSession));
@@ -1268,7 +1269,7 @@ bool sip_parse(SIPMsg* msg, const char* buff, char* end, SIP_PROTO_CONF* config)
     msg->header = (uint8_t*)buff;
     status = sip_startline_parse(msg, start, end, &nextIndex, config);
 
-    if (false == status )
+    if ( !status )
     {
         DebugMessage(DEBUG_SIP, "Start line parsing failed...\n");
         return status;
@@ -1279,48 +1280,41 @@ bool sip_parse(SIPMsg* msg, const char* buff, char* end, SIP_PROTO_CONF* config)
     status = sip_headers_parse(msg, start, end, &nextIndex, config);
     msg->headerLen =  nextIndex - buff;
 
-    if (false == status )
+    if ( !status )
     {
         DebugMessage(DEBUG_SIP, "Header parsing failed...\n");
     }
 
     status = sip_check_headers(msg, config);
 
-    if (false == status )
+    if ( !status )
     {
         DebugMessage(DEBUG_SIP, "Headers validation failed...\n");
     }
 
     /*Parse the body*/
     start = nextIndex;
-    msg->bodyLen = end - start;
+    uint16_t bodyLen = end - start;
+
     /*Disable this check for TCP. Revisit this again when PAF enabled for SIP*/
-    if ((!msg->isTcp)&&(msg->content_len > msg->bodyLen))
+    if ((!msg->isTcp)&&(msg->content_len > bodyLen))
         DetectionEngine::queue_event(GID_SIP, SIP_EVENT_MISMATCH_CONTENT_LEN);
 
-    if (msg->content_len < msg->bodyLen)
-        status = sip_body_parse(msg, start, start + msg->content_len, &nextIndex);
-    else
-        status = sip_body_parse(msg, start, end, &nextIndex);
+    status = sip_body_parse(msg, start, start + msg->content_len, &nextIndex);
 
-    if (false == status )
+    if ( !status )
     {
         DebugMessage(DEBUG_SIP, "Headers validation failed...\n");
     }
 
     // Find out whether multiple SIP messages in this packet
     /*Disable this check for TCP. Revisit this again when PAF enabled for SIP*/
-    if ((!msg->isTcp) && (msg->content_len < msg->bodyLen))
+    if ((!msg->isTcp) && (msg->content_len < bodyLen))
     {
-        if (true == sip_startline_parse(msg, start + msg->content_len, end, &nextIndex,
-            config))
-        {
+        if ( sip_startline_parse(msg, start + msg->content_len, end, &nextIndex, config) )
             DetectionEngine::queue_event(GID_SIP, SIP_EVENT_MULTI_MSGS);
-        }
         else
-        {
             DetectionEngine::queue_event(GID_SIP, SIP_EVENT_MISMATCH_CONTENT_LEN);
-        }
     }
     return status;
 }