From: Mike Stepanek (mstepane) <mstepane@cisco.com>
Date: Tue, 11 Jan 2022 22:50:35 +0000 (+0000)
Subject: Pull request #3224: wizard: make curses follow max_search_depth
X-Git-Tag: 3.1.20.0~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=93d95c7f697bfe700eab9dfc7276deb463880d76;p=thirdparty%2Fsnort3.git

Pull request #3224: wizard: make curses follow max_search_depth

Merge in SNORT/snort3 from ~YVELYKOZ/snort3:curs_max_sear to master

Squashed commit of the following:

commit 9a12b1cfb8f359fe9eed43131a8bff3961d60d60
Author: Yehor Velykozhon <yvelykoz@cisco.com>
Date:   Thu Dec 16 12:08:42 2021 +0200

    wizard: make max_search_depth applicably for curses
---

diff --git a/src/service_inspectors/wizard/wizard.cc b/src/service_inspectors/wizard/wizard.cc
index 703392a8d..67ab959d5 100644
--- a/src/service_inspectors/wizard/wizard.cc
+++ b/src/service_inspectors/wizard/wizard.cc
@@ -138,8 +138,9 @@ public:
 
     StreamSplitter* get_splitter(bool) override;
 
+    inline bool finished(Wand& w)
+    { return !w.hex && !w.spell && w.curse_tracker.empty(); };
     void reset(Wand&, bool tcp, bool c2s);
-    bool finished(Wand&);
     bool cast_spell(Wand&, Flow*, const uint8_t*, unsigned, uint16_t&);
     bool spellbind(const MagicPage*&, Flow*, const uint8_t*, unsigned);
     bool cursebind(const vector<CurseServiceTracker>&, Flow*, const uint8_t*, unsigned);
@@ -175,7 +176,7 @@ MagicSplitter::~MagicSplitter()
     wizard->rem_ref();
 
     // release trackers
-    for (unsigned i=0; i<wand.curse_tracker.size(); i++)
+    for (unsigned i = 0; i < wand.curse_tracker.size(); i++)
         delete wand.curse_tracker[i].tracker;
 }
 
@@ -224,7 +225,7 @@ StreamSplitter::Status MagicSplitter::scan(
     // delayed. Because AppId depends on wizard only for SSH detection and SSH inspector can be
     // attached very early, event is raised here after first scan. In the future, wizard should be
     // enhanced to abort sooner if it can't detect service.
-    if (!pkt->flow->service and !pkt->flow->flags.svc_event_generated)
+    if (!pkt->flow->service && !pkt->flow->flags.svc_event_generated)
     {
         DataBus::publish(FLOW_NO_SERVICE_EVENT, pkt);
         pkt->flow->flags.svc_event_generated = true;
@@ -371,21 +372,14 @@ bool Wizard::cast_spell(
     {
         w.spell = nullptr;
         w.hex = nullptr;
-    }
 
-    return false;
-}
+        for ( const CurseServiceTracker& cst : w.curse_tracker )
+            delete cst.tracker;
 
-bool Wizard::finished(Wand& w)
-{
-    if ( w.hex or w.spell )
-        return false;
-
-    // FIXIT-L how to know curses are done?
-    if ( !w.curse_tracker.empty() )
-        return false;
+        w.curse_tracker.clear();
+    }
 
-    return true;
+    return false;
 }
 
 //-------------------------------------------------------------------------