From: huica <huica@cisco.com>
Date: Tue, 11 Aug 2015 21:18:13 +0000 (-0400)
Subject: File service class
X-Git-Tag: 3.0.0-233~828^2~25
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9f67c812194d273bdf045effbcd295d6b0746912;p=thirdparty%2Fsnort3.git

File service class
---

diff --git a/src/file_api/file_api.h b/src/file_api/file_api.h
index 8639f0647..b05d66db4 100644
--- a/src/file_api/file_api.h
+++ b/src/file_api/file_api.h
@@ -196,12 +196,8 @@ static inline bool isFileEnd(FilePosition position)
     return ((position == SNORT_FILE_END) || (position == SNORT_FILE_FULL));
 }
 
-void enable_file_type();
-void enable_file_signature ();
-void enable_file_capture();
 uint64_t get_file_processed_size(Flow* flow);
 FilePosition get_file_position(Packet* pkt);
-int64_t get_max_file_depth(void);
 
 #endif /* FILE_API_H */
 
diff --git a/src/file_api/file_service.cc b/src/file_api/file_service.cc
index a134afa95..6b7393abb 100644
--- a/src/file_api/file_service.cc
+++ b/src/file_api/file_service.cc
@@ -54,6 +54,12 @@ int64_t FileConfig::show_data_depth = DEFAULT_FILE_SHOW_DATA_DEPTH;
 bool FileConfig::trace_type = false;
 bool FileConfig::trace_signature = false;
 bool FileConfig::trace_stream = false;
+
+bool FileService::file_type_id_enabled = false;
+bool FileService::file_signature_enabled = false;
+bool FileService::file_capture_enabled = false;
+bool FileService::file_processing_initiated = false;
+
 typedef struct _FileSession
 {
     FileContext* current_context;
@@ -62,10 +68,8 @@ typedef struct _FileSession
     uint32_t max_file_id;
 } FileSession;
 
-static bool file_type_id_enabled = false;
-static bool file_signature_enabled = false;
-static bool file_capture_enabled = false;
-static bool file_processing_initiated = false;
+/* Get current file context */
+FileContext* get_current_file_context(Flow* flow);
 
 /*Main File Processing functions */
 static bool file_process(Flow* flow, uint8_t* file_data, int data_size,
@@ -80,7 +84,6 @@ int64_t get_max_file_depth(void);
 
 static inline void finish_signature_lookup(FileContext* context);
 
-static bool is_file_service_enabled(void);
 static uint32_t get_file_type_id(Flow* flow);
 static uint32_t get_new_file_instance(Flow* flow);
 
@@ -117,7 +120,7 @@ public:
 
 unsigned FileFlowData::flow_id = 0;
 
-void init_fileAPI(void)
+void FileService::init(void)
 {
     fileAPI.file_process = &file_process;
     fileAPI.set_file_name = &set_file_name;
@@ -127,7 +130,7 @@ void init_fileAPI(void)
     FileFlowData::init();
 }
 
-void FileAPIPostInit(void)
+void FileService::post_init(void)
 {
     FileConfig* file_config = (FileConfig*)(snort_conf->file_config);
 
@@ -145,7 +148,14 @@ void FileAPIPostInit(void)
             file_config->file_capture_block_size);
 }
 
-static void start_file_processing(void)
+void FileService::close(void)
+{
+    file_resume_block_cleanup();
+    MimeSession::exit();
+    FileCapture::exit();
+}
+
+void FileService::start_file_processing(void)
 {
     if (!file_processing_initiated)
     {
@@ -155,11 +165,86 @@ static void start_file_processing(void)
     }
 }
 
-void close_fileAPI(void)
+/*
+ * - Only accepts 1 (ONE) callback being registered.
+ *
+ * - Call with NULL callback to "force" (guarantee) file type identification.
+ *
+ * TBD: Remove per-context "file_type_enabled" checking to simplify implementation.
+ *
+ */
+void FileService::enable_file_type()
 {
-    file_resume_block_cleanup();
-    MimeSession::exit();
-    FileCapture::exit();
+    if (!file_type_id_enabled)
+    {
+        file_type_id_enabled = true;
+        start_file_processing();
+    }
+}
+
+void FileService::enable_file_signature()
+{
+
+    if (!file_signature_enabled)
+    {
+        file_signature_enabled = true;
+        start_file_processing();
+    }
+}
+
+/* Enable file capture, also enable file signature */
+void FileService::enable_file_capture()
+{
+    if (!file_capture_enabled)
+    {
+        file_capture_enabled = true;
+        enable_file_signature();
+    }
+}
+
+
+bool FileService::is_file_service_enabled()
+{
+    return (file_type_id_enabled or file_signature_enabled);
+}
+
+
+/* Get maximal file depth based on configuration
+ * This function must be called after all file services are configured/enabled.
+ */
+int64_t FileService::get_max_file_depth(void)
+{
+    FileConfig* file_config =  (FileConfig*)(snort_conf->file_config);
+
+    if (!file_config)
+        return -1;
+
+    if (file_config->file_depth)
+        return file_config->file_depth;
+
+    file_config->file_depth = -1;
+
+    if (file_type_id_enabled)
+    {
+        file_config->file_depth = file_config->file_type_depth;
+    }
+
+    if (file_signature_enabled)
+    {
+        if (file_config->file_signature_depth > file_config->file_depth)
+            file_config->file_depth = file_config->file_signature_depth;
+    }
+
+    if (file_config->file_depth > 0)
+    {
+        /*Extra byte for deciding whether file data will be over limit*/
+        file_config->file_depth++;
+        return (file_config->file_depth);
+    }
+    else
+    {
+        return -1;
+    }
 }
 
 static inline FileSession* get_file_session(Flow* flow)
@@ -177,7 +262,7 @@ FileContext* get_current_file_context(Flow* flow)
     else
         return NULL;
 }
-uint16_t   app_id;
+
 FileContext* get_main_file_context(Flow* flow)
 {
     FileSession* file_session = get_file_session (flow);
@@ -227,9 +312,9 @@ static void file_session_free(FileSession* file_session)
 
 static inline void init_file_context(FileDirection direction, FileContext* context)
 {
-    context->config_file_type(file_type_id_enabled);
-    context->config_file_signature(file_signature_enabled);
-    context->config_file_capture(file_capture_enabled);
+    context->config_file_type(FileService::is_file_type_id_enabled());
+    context->config_file_signature(FileService::is_file_signature_enabled());
+    context->config_file_capture(FileService::is_file_capture_enabled());
     context->set_file_direction(direction);
 }
 
@@ -371,11 +456,6 @@ static uint32_t get_new_file_instance(Flow* flow)
         return 0;
 }
 
-static bool is_file_service_enabled()
-{
-    return (file_type_id_enabled or file_signature_enabled);
-}
-
 /*
  * Return:
  *    true: continue processing/log/block this file
@@ -465,7 +545,7 @@ static bool file_process(Flow* flow, uint8_t* file_data, int data_size,
     FileContext* context;
     FileDirection direction = upload ? FILE_UPLOAD:FILE_DOWNLOAD;
     /* if both disabled, return immediately*/
-    if (!is_file_service_enabled())
+    if (!FileService::is_file_service_enabled())
         return false;
 
     if (position == SNORT_FILE_POSITION_UNKNOWN)
@@ -497,81 +577,6 @@ static bool get_file_name(Flow* flow, uint8_t** file_name, uint32_t* name_size)
         return false;
 }
 
-/*
- * - Only accepts 1 (ONE) callback being registered.
- *
- * - Call with NULL callback to "force" (guarantee) file type identification.
- *
- * TBD: Remove per-context "file_type_enabled" checking to simplify implementation.
- *
- */
-void enable_file_type()
-{
-    if (!file_type_id_enabled)
-    {
-        file_type_id_enabled = true;
-        start_file_processing();
-    }
-}
-
-void enable_file_signature()
-{
-
-    if (!file_signature_enabled)
-    {
-        file_signature_enabled = true;
-        start_file_processing();
-    }
-}
-
-/* Enable file capture, also enable file signature */
-void enable_file_capture()
-{
-    if (!file_capture_enabled)
-    {
-        file_capture_enabled = true;
-        enable_file_signature();
-    }
-}
-
-/* Get maximal file depth based on configuration
- * This function must be called after all file services are configured/enabled.
- */
-int64_t get_max_file_depth(void)
-{
-    FileConfig* file_config =  (FileConfig*)(snort_conf->file_config);
-
-    if (!file_config)
-        return -1;
-
-    if (file_config->file_depth)
-        return file_config->file_depth;
-
-    file_config->file_depth = -1;
-
-    if (file_type_id_enabled)
-    {
-        file_config->file_depth = file_config->file_type_depth;
-    }
-
-    if (file_signature_enabled)
-    {
-        if (file_config->file_signature_depth > file_config->file_depth)
-            file_config->file_depth = file_config->file_signature_depth;
-    }
-
-    if (file_config->file_depth > 0)
-    {
-        /*Extra byte for deciding whether file data will be over limit*/
-        file_config->file_depth++;
-        return (file_config->file_depth);
-    }
-    else
-    {
-        return -1;
-    }
-}
-
 FilePosition get_file_position(Packet* pkt)
 {
     FilePosition position = SNORT_FILE_POSITION_UNKNOWN;
@@ -588,3 +593,5 @@ FilePosition get_file_position(Packet* pkt)
 
     return position;
 }
+
+
diff --git a/src/file_api/file_service.h b/src/file_api/file_service.h
index 8c001ec0c..8810cf1b0 100644
--- a/src/file_api/file_service.h
+++ b/src/file_api/file_service.h
@@ -22,21 +22,38 @@
 #ifndef FILE_SERVICE_H
 #define FILE_SERVICE_H
 
-// This provides a wrapper to start/stop file API
-// FIXIT-L This will be refactored soon
-
-#include "libs/file_lib.h"
-
-/* Initialize file API, this must be called when snort restarts */
-void init_fileAPI(void);
-
-void FileAPIPostInit(void);
-
-/* Close file API, this must be called when snort exits */
-void close_fileAPI(void);
-
-/* Get current file context */
-FileContext* get_current_file_context(Flow* flow);
-
+// This provides a wrapper to start/stop file service
+
+#include <sys/types.h>
+
+class FileService
+{
+public:
+    // This must be called when snort restarts
+    static void init(void);
+
+    // Called after permission is dropped
+    static void post_init(void);
+
+    // This must be called when snort exits
+    static void close(void);
+
+    static void enable_file_type();
+    static void enable_file_signature ();
+    static void enable_file_capture();
+    static bool is_file_type_id_enabled() {return file_type_id_enabled;};
+    static bool is_file_signature_enabled() {return file_signature_enabled;};
+    static bool is_file_capture_enabled() {return file_capture_enabled;};
+    static bool is_file_service_enabled();
+    static int64_t get_max_file_depth();
+
+private:
+    static void start_file_processing(void);
+    static bool file_type_id_enabled;
+    static bool file_signature_enabled;
+    static bool file_capture_enabled;
+    static bool file_processing_initiated;
+
+};
 #endif
 
diff --git a/src/main/modules.cc b/src/main/modules.cc
index e6585cca3..86b5ce20d 100644
--- a/src/main/modules.cc
+++ b/src/main/modules.cc
@@ -42,7 +42,7 @@ using namespace std;
 #include "parser/config_file.h"
 #include "parser/cmd_line.h"
 #include "parser/parse_ip.h"
-#include "file_api/file_api.h"
+#include "file_api/file_service.h"
 #include "file_api/libs/file_config.h"
 #include "filters/sfthd.h"
 #include "filters/sfrf.h"
@@ -1389,17 +1389,17 @@ bool FileIdModule::set(const char*, Value& v, SnortConfig* sc)
     else if ( v.is("enable_type") )
     {
         if ( v.get_bool() )
-            enable_file_type();
+            FileService::enable_file_type();
     }
     else if ( v.is("enable_signature") )
     {
         if ( v.get_bool() )
-            enable_file_signature();
+            FileService::enable_file_signature();
     }
     else if ( v.is("enable_capture") )
     {
         if ( v.get_bool() )
-            enable_file_capture();
+            FileService::enable_file_capture();
     }
     else if ( v.is("show_data_depth") )
         FileConfig::show_data_depth = v.get_long();
diff --git a/src/main/snort.cc b/src/main/snort.cc
index 95a342bb1..bfe51c13e 100644
--- a/src/main/snort.cc
+++ b/src/main/snort.cc
@@ -246,7 +246,7 @@ void Snort::init(int argc, char** argv)
         PluginManager::dump_plugins();
     }
 
-    init_fileAPI();
+    FileService::init();
     register_profiles();
 
     SnortConfig* sc = ParseSnortConf(snort_cmd_line_conf);
@@ -275,7 +275,7 @@ void Snort::init(int argc, char** argv)
 
     snort_conf->setup();
 
-    FileAPIPostInit();
+    FileService::post_init();
 
     // Must be after CodecManager::instantiate()
     if ( !InspectorManager::configure(snort_conf) )
@@ -397,7 +397,7 @@ void Snort::term()
 
     //MpseManager::print_search_engine_stats();
 
-    close_fileAPI();
+    FileService::close();
 
     sfthreshold_free();  // FIXDAQ etc.
     RateFilter_Cleanup();
diff --git a/src/mime/file_mime_config.cc b/src/mime/file_mime_config.cc
index cc29e1e92..98841f235 100644
--- a/src/mime/file_mime_config.cc
+++ b/src/mime/file_mime_config.cc
@@ -27,7 +27,7 @@
 
 #include "main/snort_types.h"
 
-#include "file_api/file_api.h"
+#include "file_api/file_service.h"
 #include "file_mime_process.h"
 
 void DecodeConfig::update_max_depth(int64_t depth)
@@ -135,7 +135,7 @@ void DecodeConfig::set_file_depth(int64_t file_depth)
 // update file depth and max_depth etc
 void DecodeConfig::sync_all_depths()
 {
-    file_depth = get_max_file_depth();
+    file_depth = FileService::get_max_file_depth();
 
     set_file_depth(file_depth);
 }
diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc
index f28990e1d..24a77d3fa 100644
--- a/src/service_inspectors/ftp_telnet/ftp_data.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_data.cc
@@ -43,6 +43,7 @@
 #include "main/snort_debug.h"
 #include "stream/stream_api.h"
 #include "file_api/file_api.h"
+#include "file_api/file_service.h"
 #include "parser/parser.h"
 #include "framework/inspector.h"
 #include "detection/detection_util.h"
@@ -247,7 +248,7 @@ void FtpData::eval(Packet* p)
     // precondition - what we registered for
     assert(p->has_tcp_data());
 
-    if ( get_max_file_depth() < 0 )
+    if ( FileService::get_max_file_depth() < 0 )
         return;
 
     PROFILE_VARS;
diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc
index 5a7d89380..fa7a5e53b 100644
--- a/src/service_inspectors/ftp_telnet/pp_ftp.cc
+++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc
@@ -56,6 +56,7 @@
 #include "stream/stream_api.h"
 #include "detection/detection_util.h"
 #include "sfip/sfip_t.h"
+#include "file_api/file_service.h"
 
 #ifndef MAXHOSTNAMELEN /* Why doesn't Windows define this? */
 #define MAXHOSTNAMELEN 256
@@ -1065,7 +1066,7 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p,
                             sfip_copy(session->clientIP, p->ptrs.ip_api.get_dst());
                             session->clientPort = 0;
 
-                            if ((get_max_file_depth() > 0) ||
+                            if ((FileService::get_max_file_depth() > 0) ||
                                 !(session->server_conf->data_chan))
                             {
                                 FtpDataFlowData* fd = new FtpDataFlowData(p);
@@ -1137,7 +1138,7 @@ static int do_stateful_checks(FTP_SESSION* session, Packet* p,
                         /*
                         session->serverPort = ntohs(p->ptrs.tcph->th_sport) -1;
                         */
-                        if ((get_max_file_depth() > 0) ||
+                        if ((FileService::get_max_file_depth() > 0) ||
                             !(session->server_conf->data_chan))
                         {
                             FtpDataFlowData* fd = new FtpDataFlowData(p);
@@ -1721,7 +1722,7 @@ int check_ftp(FTP_SESSION* ftpssn, Packet* p, int iMode)
                 else if (CmdConf->data_xfer_cmd)
                 {
                     /* If we are not ignoring the data channel OR file processing is enabled */
-                    if (!ftpssn->server_conf->data_chan || (get_max_file_depth() > -1))
+                    if (!ftpssn->server_conf->data_chan || (FileService::get_max_file_depth() > -1))
                     {
                         /* The following  check cleans up filename  for failed data
                          * transfers.  If  the  transfer had  been  successful  the
diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc
index 9d04eebe8..015ea0da5 100644
--- a/src/service_inspectors/http_inspect/http_inspect.cc
+++ b/src/service_inspectors/http_inspect/http_inspect.cc
@@ -52,6 +52,7 @@
 #include "stream/stream_api.h"
 #include "target_based/snort_protocols.h"
 #include "file_api/file_api.h"
+#include "file_api/file_service.h"
 #include "utils/kmap.h"
 #include <mime/decode_base.h>
 #include "utils/util.h"
@@ -134,7 +135,7 @@ static void CheckMemcap(HTTPINSPECT_GLOBAL_CONF* pPolicyConfig)
 static void updateConfigFromFileProcessing(HTTPINSPECT_CONF* ServerConf)
 {
     /*Either one is unlimited*/
-    int64_t fileDepth = get_max_file_depth();
+    int64_t fileDepth = FileService::get_max_file_depth();
 
     /*Config file policy*/
     if (fileDepth > -1)
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
index f4f7a6999..ec6f69ff3 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
@@ -23,6 +23,7 @@
 
 #include "utils/util.h"
 #include "detection/detection_util.h"
+#include "file_api/file_service.h"
 
 #include "nhttp_enum.h"
 #include "nhttp_msg_request.h"
@@ -86,7 +87,7 @@ void NHttpMsgHeader::update_flow()
         session_data->section_size_target[source_id] = DATA_BLOCK_SIZE;
         if (session_data->file_depth_remaining[1-source_id] <= 0)
         {   // Bidirectional file processing is problematic FIXIT-M
-            session_data->file_depth_remaining[source_id] = get_max_file_depth();
+            session_data->file_depth_remaining[source_id] = FileService::get_max_file_depth();
         }
         session_data->infractions[source_id].reset();
         session_data->events[source_id].reset();
@@ -103,7 +104,7 @@ void NHttpMsgHeader::update_flow()
         session_data->section_size_max[source_id] = FINAL_BLOCK_SIZE;
         if (session_data->file_depth_remaining[1-source_id] <= 0)
         {   // Bidirectional file processing is problematic FIXIT-M
-            session_data->file_depth_remaining[source_id] = get_max_file_depth();
+            session_data->file_depth_remaining[source_id] = FileService::get_max_file_depth();
             if (source_id == SRC_CLIENT)
             {
                 session_data->mime_state = new MimeSession(&decode_conf, &mime_conf);