From: Tom Peters Date: Tue, 25 Nov 2014 19:11:23 +0000 (-0500) Subject: CRLF fix X-Git-Tag: 3.0.0-233~1155^2~1^2~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7d1368bde798eefb467cd368a0dd71cb245772ac;p=thirdparty%2Fsnort3.git CRLF fix --- diff --git a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h index 81316c03b..cd5a8d310 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h +++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h @@ -69,6 +69,7 @@ private: // 0 element refers to client request, 1 element refers to server response NHttpEnums::SectionType section_type[2] = { NHttpEnums::SEC__NOTCOMPUTE, NHttpEnums::SEC__NOTCOMPUTE }; uint32_t num_excess[2] = { 0, 0 }; + bool zero_chunk[2] = { false, false }; bool tcp_close[2] = { false, false }; uint64_t infractions[2] = { 0, 0 }; diff --git a/src/service_inspectors/nhttp_inspect/nhttp_splitter.h b/src/service_inspectors/nhttp_inspect/nhttp_splitter.h index 05c554217..0281fa7d4 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_splitter.h +++ b/src/service_inspectors/nhttp_inspect/nhttp_splitter.h @@ -37,6 +37,7 @@ public: uint32_t get_num_flush() const { return num_flush; }; virtual uint32_t get_octets_seen() const { return octets_seen; }; virtual uint32_t get_num_excess() const { return 0; }; + virtual bool get_zero_chunk() const { return false; }; virtual bool partial_ok() const { return true; }; protected: @@ -72,7 +73,7 @@ private: class NHttpChunkSplitter : public NHttpSplitter { public: NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length) override; - uint32_t get_num_excess() const override { return zero_chunk ? 1 : 0; }; + bool get_zero_chunk() const override { return zero_chunk; }; void conditional_reset() override; bool partial_ok() const override { return false; }; private: diff --git a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc index 9c92772d0..2b79d10c2 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc @@ -33,9 +33,10 @@ using namespace NHttpEnums; // Convenience function. All the housekeeping that must be done before we can return FLUSH to stream. void NHttpStreamSplitter::prepare_flush(NHttpFlowData* session_data, uint32_t* flush_offset, SourceId source_id, SectionType section_type, bool tcp_close, uint64_t infractions, uint32_t num_octets, uint32_t length, - uint32_t num_excess) { + uint32_t num_excess, bool zero_chunk) { session_data->section_type[source_id] = section_type; session_data->num_excess[source_id] = num_excess; + session_data->zero_chunk[source_id] = zero_chunk; session_data->tcp_close[source_id] = tcp_close; session_data->infractions[source_id] = infractions; switch (section_type) { @@ -140,37 +141,37 @@ StreamSplitter::Status NHttpStreamSplitter::scan (Flow* flow, const uint8_t* dat case SCAN_NOTFOUND: if (splitter->get_octets_seen() == MAXOCTETS) { // FIXIT-H need to process this data (except chunk header) not just discard it. - prepare_flush(session_data, flush_offset, source_id, SEC_DISCARD, tcp_close, 0, length, length, 0); + prepare_flush(session_data, flush_offset, source_id, SEC_DISCARD, tcp_close, 0, length, length, 0, 0); session_data->type_expected[source_id] = SEC_ABORT; return StreamSplitter::FLUSH; } if (tcp_close) { if (splitter->partial_ok()) { prepare_flush(session_data, flush_offset, source_id, type, true, INF_TRUNCATED, length, length, - splitter->get_num_excess()); + splitter->get_num_excess(), splitter->get_zero_chunk()); return StreamSplitter::FLUSH; } else { - prepare_flush(session_data, flush_offset, source_id, SEC_DISCARD, true, 0, length, length, 0); + prepare_flush(session_data, flush_offset, source_id, SEC_DISCARD, true, 0, length, length, 0, 0); return StreamSplitter::FLUSH; } } // Incomplete headers wait patiently for more data return NHttpTestManager::use_test_input() ? StreamSplitter::FLUSH : StreamSplitter::SEARCH; case SCAN_ABORT: - prepare_flush(session_data, flush_offset, source_id, SEC_DISCARD, tcp_close, 0, length, length, 0); + prepare_flush(session_data, flush_offset, source_id, SEC_DISCARD, tcp_close, 0, length, length, 0, 0); session_data->type_expected[source_id] = SEC_ABORT; return StreamSplitter::FLUSH; case SCAN_DISCARD: { const uint32_t flush_octets = splitter->get_num_flush(); prepare_flush(session_data, flush_offset, source_id, SEC_DISCARD, tcp_close && (flush_octets >= length), 0, - flush_octets, length, 0); + flush_octets, length, 0, 0); return StreamSplitter::FLUSH; } case SCAN_FOUND: { const uint32_t flush_octets = splitter->get_num_flush(); prepare_flush(session_data, flush_offset, source_id, type, tcp_close && (flush_octets == length), 0, - flush_octets, length, splitter->get_num_excess()); + flush_octets, length, splitter->get_num_excess(), splitter->get_zero_chunk()); if ((type == SEC_REQUEST) || (type == SEC_STATUS)) { // Look ahead to see if entire header section is already here so we can aggregate it for detection. if (session_data->header_splitter[source_id].peek(data + flush_octets, length - flush_octets) == SCAN_FOUND) { @@ -184,7 +185,7 @@ StreamSplitter::Status NHttpStreamSplitter::scan (Flow* flow, const uint8_t* dat case SEC_BODY: { prepare_flush(session_data, flush_offset, source_id, SEC_BODY, tcp_close && (length <= session_data->data_length[source_id]), - 0, session_data->data_length[source_id], length, 0); + 0, session_data->data_length[source_id], length, 0, 0); return StreamSplitter::FLUSH; } case SEC_ABORT: @@ -271,22 +272,21 @@ const StreamBuffer* NHttpStreamSplitter::reassemble(Flow* flow, unsigned total, buffer_owned = true; } - uint32_t num_excess = session_data->num_excess[source_id]; memcpy(buffer + buffer_length + offset, data, len); if (flags & PKT_PDU_TAIL) { ProcessResult send_to_detection; if (!is_chunk) { // start line/headers/body individual section processing with aggregation prior to being sent to detection // only the last section added to the buffer goes to the inspector - send_to_detection = my_inspector->process(buffer + buffer_length, offset + len - num_excess, flow, - source_id, buffer_length == 0); + send_to_detection = my_inspector->process(buffer + buffer_length, + offset + len - session_data->num_excess[source_id], flow, source_id, buffer_length == 0); } else { // small chunks are aggregated before processing and are kept here until the buffer is full (paf_max) - // all the chunks in the buffer go to the inspector together. Zero-length chunk (len == 1, num_excess == 1) - // flushes accumulated chunks. - const int32_t total_chunk_len = chunk_buffer_length + offset + len - num_excess; - if ((total_chunk_len < DATABLOCKSIZE) && (num_excess == 0) && !tcp_close) { + // all the chunks in the buffer go to the inspector together. Zero-length chunk (len == 1, + // zero_chunk == true) flushes accumulated chunks. + const int32_t total_chunk_len = chunk_buffer_length + offset + len - session_data->zero_chunk[source_id]; + if ((total_chunk_len < DATABLOCKSIZE) && (!session_data->zero_chunk[source_id]) && !tcp_close) { chunk_buffer_length = total_chunk_len; return nullptr; } @@ -302,7 +302,7 @@ const StreamBuffer* NHttpStreamSplitter::reassemble(Flow* flow, unsigned total, } paf_max = DATABLOCKSIZE; send_to_detection = my_inspector->process(chunk_buffer, total_chunk_len, flow, source_id, true); - if (num_excess > 0) { + if (session_data->zero_chunk[source_id]) { // zero-length chunk is not visible to inspector. Transition to trailer must be handled here. session_data->section_type[source_id] = SEC__NOTCOMPUTE; session_data->type_expected[source_id] = SEC_TRAILER; @@ -313,7 +313,7 @@ const StreamBuffer* NHttpStreamSplitter::reassemble(Flow* flow, unsigned total, switch (send_to_detection) { case RES_INSPECT: nhttp_buf.data = buffer; - nhttp_buf.length = buffer_length + offset + len - num_excess; + nhttp_buf.length = buffer_length + offset + len - session_data->zero_chunk[source_id]; assert((nhttp_buf.length <= MAXOCTETS) && (nhttp_buf.length != 0)); buffer = nullptr; buffer_length = 0; @@ -327,7 +327,7 @@ const StreamBuffer* NHttpStreamSplitter::reassemble(Flow* flow, unsigned total, buffer_length = 0; return nullptr; case RES_AGGREGATE: - buffer_length += offset + len - num_excess; + buffer_length += offset + len; buffer_owned = false; return nullptr; } @@ -335,32 +335,3 @@ const StreamBuffer* NHttpStreamSplitter::reassemble(Flow* flow, unsigned total, return nullptr; } - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.h b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.h index 1065d88e1..bb30b8d71 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.h +++ b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.h @@ -40,7 +40,7 @@ public: private: void prepare_flush(NHttpFlowData* session_data, uint32_t* flush_offset, NHttpEnums::SourceId source_id, NHttpEnums::SectionType section_type, bool tcp_close, uint64_t infractions, uint32_t num_octets, uint32_t length, - uint32_t num_excess); + uint32_t num_excess, bool zero_chunk); NHttpSplitter* choose_splitter(NHttpEnums::SectionType type, NHttpEnums::SourceId source_id, const NHttpFlowData* session_data) const; NHttpInspect* const my_inspector;