From: Russ Combs Date: Sat, 21 Feb 2015 18:53:58 +0000 (-0500) Subject: refactor file_decomp X-Git-Tag: 3.0.0-233~1042 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a5ce5859380b915bcc7a76fb4f07c75ef3372ef7;p=thirdparty%2Fsnort3.git refactor file_decomp --- diff --git a/configure.ac b/configure.ac index f3a2c7bcc..1905ce351 100644 --- a/configure.ac +++ b/configure.ac @@ -137,7 +137,6 @@ else AC_MSG_RESULT(no) fi - #-------------------------------------------------------------------------- # visibility foo #-------------------------------------------------------------------------- @@ -859,6 +858,7 @@ src/codecs/link/Makefile \ src/codecs/ip/Makefile \ src/codecs/misc/Makefile \ src/control/Makefile \ +src/decompress/Makefile \ src/detection/Makefile \ src/events/Makefile \ src/file_api/Makefile \ diff --git a/doc/config_changes.txt b/doc/config_changes.txt index 728517c73..53c307109 100644 --- a/doc/config_changes.txt +++ b/doc/config_changes.txt @@ -22,7 +22,6 @@ change -> config 'max_attribute_hosts' ==> 'attribute_table.max_hosts' change -> config 'max_attribute_services_per_host' ==> 'attribute_table.max_services_per_host' change -> config 'nopcre' ==> 'detection.pcre_enable' change -> config 'pkt_count' ==> 'packets.limit' -change -> config 'policy_mode' ==> 'ips.mode' change -> config 'rate_filter' ==> 'alerts.rate_filter_memcap' change -> config 'react' ==> 'react.page' change -> config 'threshold' ==> 'alerts.event_filter_memcap' @@ -133,16 +132,6 @@ change -> http_inspect_server: 'whitespace_chars' ==> 'profile.whitespace_chars' change -> mpls_payload_type: 'config mpls_payload_type: ethernet' ==> 'mpls_payload_type = eth' change -> mpls_payload_type: 'config mpls_payload_type: ipv4' ==> 'mpls_payload_type = ip4' change -> mpls_payload_type: 'config mpls_payload_type: ipv6' ==> 'mpls_payload_type = ip6' -change -> normalizers: 'block' ==> 'base' -change -> normalizers: 'pad' ==> 'base' -change -> normalizers: 'req_pay' ==> 'base' -change -> normalizers: 'req_urg' ==> 'base' -change -> normalizers: 'req_urp' ==> 'base' -change -> normalizers: 'rsv' ==> 'base' -change -> normalizers: 'trim_mss' ==> 'trim' -change -> normalizers: 'trim_rst' ==> 'trim' -change -> normalizers: 'trim_syn' ==> 'trim' -change -> normalizers: 'trim_win' ==> 'trim' change -> paf_max: 'paf_max [0:63780]' ==> 'max_pdu [1460:63780]' change -> perfmonitor: 'accumulate' ==> 'reset = false' change -> perfmonitor: 'flow-file' ==> 'flow_file = true' @@ -153,6 +142,7 @@ change -> perfmonitor: 'flow-ports' ==> 'flow_ports' change -> perfmonitor: 'pktcnt' ==> 'packets' change -> perfmonitor: 'snortfile' ==> 'file = true' change -> perfmonitor: 'time' ==> 'seconds' +change -> policy_mode: 'inline_test' ==> 'inline-test' change -> ppm: 'debug-pkts' ==> 'debug_pkts' change -> ppm: 'fastpath-expensive-packets' ==> 'fastpath_expensive_packets' change -> ppm: 'max-pkt-time' ==> 'max_pkt_time' diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 2a9621631..f912765a4 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -111,6 +111,7 @@ target_link_libraries( snort network_inspectors search_engines helpers + decompress ips_options loggers service_inspectors @@ -151,6 +152,7 @@ add_subdirectory(target_based) add_subdirectory(time) add_subdirectory(utils) add_subdirectory(helpers) +add_subdirectory(decompress) add_subdirectory(ips_options) add_subdirectory(loggers) add_subdirectory(network_inspectors) diff --git a/src/Makefile.am b/src/Makefile.am index e37c42792..8f910ab59 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -67,6 +67,7 @@ hash/libhash.a \ log/liblog.a \ packet_io/libpacket_io.a \ helpers/libhelpers.a \ +decompress/libdecompress.a \ sfip/libsfip.a \ sfrt/libsfrt.a \ protocols/libprotocols.a \ @@ -76,6 +77,7 @@ SUBDIRS = \ actions \ codecs \ control \ +decompress \ detection \ events \ file_api \ diff --git a/src/decompress/CMakeLists.txt b/src/decompress/CMakeLists.txt new file mode 100644 index 000000000..7ab7f5267 --- /dev/null +++ b/src/decompress/CMakeLists.txt @@ -0,0 +1,15 @@ + +add_library (decompress STATIC + file_decomp.cc + file_decomp.h + file_decomp_pdf.cc + file_decomp_pdf.h + file_decomp_swf.cc + file_decomp_swf.h +) + + +target_link_libraries(decompress + log + utils +) diff --git a/src/decompress/Makefile.am b/src/decompress/Makefile.am new file mode 100644 index 000000000..b5162d989 --- /dev/null +++ b/src/decompress/Makefile.am @@ -0,0 +1,13 @@ +AUTOMAKE_OPTIONS=foreign no-dependencies + +noinst_LIBRARIES = libdecompress.a + +libdecompress_a_SOURCES = \ +file_decomp.cc \ +file_decomp.h \ +file_decomp_pdf.cc \ +file_decomp_pdf.h \ +file_decomp_swf.cc \ +file_decomp_swf.h + +AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/src/service_inspectors/http_inspect/hi_file_decomp.cc b/src/decompress/file_decomp.cc similarity index 99% rename from src/service_inspectors/http_inspect/hi_file_decomp.cc rename to src/decompress/file_decomp.cc index b6a9eda83..790007fa7 100644 --- a/src/service_inspectors/http_inspect/hi_file_decomp.cc +++ b/src/decompress/file_decomp.cc @@ -20,12 +20,12 @@ #include "config.h" #endif -#include "util.h" -#include "hi_file_decomp.h" +#include "utils/util.h" +#include "file_decomp.h" #include "snort_types.h" #include "detection_util.h" -#include "hi_file_decomp_pdf.h" -#include "hi_file_decomp_swf.h" +#include "file_decomp_pdf.h" +#include "file_decomp_swf.h" static const char PDF_Sig[5] = { '%', 'P', 'D', 'F', '-' }; static const char SWF_ZLIB_Sig[3] = { 'C', 'W', 'S' }; @@ -415,3 +415,4 @@ void File_Decomp_Alert( fd_session_p_t SessionPtr, int Event ) if( (SessionPtr != NULL) && (SessionPtr->Alert_Callback != NULL) && (SessionPtr->Alert_Context) ) (SessionPtr->Alert_Callback)(SessionPtr->Alert_Context, Event); } + diff --git a/src/service_inspectors/http_inspect/hi_file_decomp.h b/src/decompress/file_decomp.h similarity index 95% rename from src/service_inspectors/http_inspect/hi_file_decomp.h rename to src/decompress/file_decomp.h index ea35dc403..b4d12bcb1 100644 --- a/src/service_inspectors/http_inspect/hi_file_decomp.h +++ b/src/decompress/file_decomp.h @@ -17,11 +17,8 @@ // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -#ifndef HI_FILE_DECOMP_H -#define HI_FILE_DECOMP_H - -// FIXIT-H temporary for development convenience -//#define LZMA 1 +#ifndef FILE_DECOMP_H +#define FILE_DECOMP_H #include #include @@ -50,8 +47,8 @@ typedef enum file_compression_type typedef struct fd_session_s *fd_session_p_t, fd_session_t; -#include "hi_file_decomp_pdf.h" -#include "hi_file_decomp_swf.h" +#include "file_decomp_pdf.h" +#include "file_decomp_swf.h" #include #ifdef LZMA @@ -68,6 +65,16 @@ typedef struct fd_session_s *fd_session_p_t, fd_session_t; #define FILE_PDF_ANY (FILE_PDF_DEFL_BIT) #define FILE_SWF_ANY (FILE_SWF_LZMA_BIT | FILE_SWF_ZLIB_BIT) +enum FileDecompError +{ + FILE_DECOMP_ERR_SWF_ZLIB_FAILURE, + FILE_DECOMP_ERR_SWF_LZMA_FAILURE, + FILE_DECOMP_ERR_PDF_DEFL_FAILURE, + FILE_DECOMP_ERR_PDF_UNSUP_COMP_TYPE, + FILE_DECOMP_ERR_PDF_CASC_COMP, + FILE_DECOMP_ERR_PDF_PARSE_FAILURE +}; + /* Private Types */ typedef enum file_type { diff --git a/src/service_inspectors/http_inspect/hi_file_decomp_pdf.cc b/src/decompress/file_decomp_pdf.cc similarity index 98% rename from src/service_inspectors/http_inspect/hi_file_decomp_pdf.cc rename to src/decompress/file_decomp_pdf.cc index f80cebdf2..5d10c66cc 100644 --- a/src/service_inspectors/http_inspect/hi_file_decomp_pdf.cc +++ b/src/decompress/file_decomp_pdf.cc @@ -24,10 +24,10 @@ #include #include -#include "hi_file_decomp.h" -#include "hi_file_decomp_pdf.h" -#include "hi_events.h" +#include "file_decomp.h" +#include "file_decomp_pdf.h" #include "mstring.h" +#include "service_inspectors/http_inspect/hi_events.h" /* Define characters and tokens in PDF grammar */ #define TOK_STRM_OPEN "stream" @@ -158,7 +158,7 @@ static inline void Process_One_Filter( fd_session_p_t SessionPtr, uint8_t *Token /* Check if we've found one already. Indicate cascading if we did. */ if( SessionPtr->Decomp_Type != FILE_COMPRESSION_TYPE_NONE ) { - File_Decomp_Alert( SessionPtr, HI_SERVER_PDF_CASC_COMP ); + File_Decomp_Alert( SessionPtr, FILE_DECOMP_ERR_PDF_CASC_COMP ); SessionPtr->Decomp_Type = FILE_COMPRESSION_TYPE_NONE; } else @@ -170,7 +170,7 @@ static inline void Process_One_Filter( fd_session_p_t SessionPtr, uint8_t *Token } else { - File_Decomp_Alert( SessionPtr, HI_SERVER_PDF_UNSUP_COMP_TYPE ); + File_Decomp_Alert( SessionPtr, FILE_DECOMP_ERR_PDF_UNSUP_COMP_TYPE ); SessionPtr->Decomp_Type = FILE_COMPRESSION_TYPE_NONE; } } @@ -923,7 +923,7 @@ static fd_status_t Init_Stream( fd_session_p_t SessionPtr ) if( z_ret != Z_OK ) { - File_Decomp_Alert( SessionPtr, HI_SERVER_PDF_DEFL_FAILURE ); + File_Decomp_Alert( SessionPtr, FILE_DECOMP_ERR_PDF_DEFL_FAILURE ); return( File_Decomp_Error ); } @@ -968,7 +968,7 @@ static fd_status_t Decomp_Stream( fd_session_p_t SessionPtr ) if( z_ret != Z_OK ) { DEBUG_WRAP(DebugMessage(DEBUG_HTTPINSPECT, "Decompression Error: objnum: %u\n", StPtr->Parse.Obj_Number);); - File_Decomp_Alert( SessionPtr, HI_SERVER_PDF_DEFL_FAILURE ); + File_Decomp_Alert( SessionPtr, FILE_DECOMP_ERR_PDF_DEFL_FAILURE ); return( File_Decomp_Error ); } @@ -1019,7 +1019,7 @@ fd_status_t File_Decomp_End_PDF( fd_session_p_t SessionPtr ) if( z_ret != Z_OK ) { - File_Decomp_Alert( SessionPtr, HI_SERVER_PDF_DEFL_FAILURE ); + File_Decomp_Alert( SessionPtr, FILE_DECOMP_ERR_PDF_DEFL_FAILURE ); return( File_Decomp_Error ); } @@ -1104,7 +1104,7 @@ fd_status_t File_Decomp_PDF( fd_session_p_t SessionPtr ) Ret_Code = File_Decomp_End_PDF( SessionPtr ); if( Close_Stream( SessionPtr ) != File_Decomp_OK ) return( File_Decomp_Error ); - File_Decomp_Alert( SessionPtr, HI_SERVER_PDF_DEFL_FAILURE ); + File_Decomp_Alert( SessionPtr, FILE_DECOMP_ERR_PDF_DEFL_FAILURE ); break; } @@ -1121,7 +1121,7 @@ fd_status_t File_Decomp_PDF( fd_session_p_t SessionPtr ) Ret_Code = File_Decomp_End_PDF( SessionPtr ); if( Close_Stream( SessionPtr ) != File_Decomp_OK ) return( File_Decomp_Error ); - File_Decomp_Alert( SessionPtr, HI_SERVER_PDF_DEFL_FAILURE ); + File_Decomp_Alert( SessionPtr, FILE_DECOMP_ERR_PDF_DEFL_FAILURE ); break; } /* OK -> circle back for more input */ diff --git a/src/service_inspectors/http_inspect/hi_file_decomp_pdf.h b/src/decompress/file_decomp_pdf.h similarity index 97% rename from src/service_inspectors/http_inspect/hi_file_decomp_pdf.h rename to src/decompress/file_decomp_pdf.h index 8d715692d..a2ee9f289 100644 --- a/src/service_inspectors/http_inspect/hi_file_decomp_pdf.h +++ b/src/decompress/file_decomp_pdf.h @@ -17,8 +17,8 @@ // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -#ifndef HI_FILE_DECOMP_PDF_H -#define HI_FILE_DECOMP_PDF_H +#ifndef FILE_DECOMP_PDF_H +#define FILE_DECOMP_PDF_H #include diff --git a/src/service_inspectors/http_inspect/hi_file_decomp_swf.cc b/src/decompress/file_decomp_swf.cc similarity index 93% rename from src/service_inspectors/http_inspect/hi_file_decomp_swf.cc rename to src/decompress/file_decomp_swf.cc index 43d8ddf55..c2cf5d3d5 100644 --- a/src/service_inspectors/http_inspect/hi_file_decomp_swf.cc +++ b/src/decompress/file_decomp_swf.cc @@ -27,9 +27,9 @@ #include #endif -#include "hi_file_decomp.h" -#include "hi_file_decomp_swf.h" -#include "hi_events.h" +#include "file_decomp.h" +#include "file_decomp_swf.h" +//#include "service_inspectors/http_inspect/hi_events.h" #ifdef LZMA #define LZMA_HEADER_LEN (13) @@ -58,7 +58,7 @@ static fd_status_t File_Decomp_Process_LZMA_Header( fd_session_p_t SessionPtr ) if( SWF_Uncomp_Len < SWF_HDR_LEN ) { - SessionPtr->Error_Event = HI_SERVER_SWF_LZMA_FAILURE; + SessionPtr->Error_Event = FILE_DECOMP_ERR_SWF_LZMA_FAILURE; return( File_Decomp_DecompError ); } @@ -90,7 +90,7 @@ static fd_status_t File_Decomp_Process_LZMA_Header( fd_session_p_t SessionPtr ) if( l_ret != LZMA_OK ) { - SessionPtr->Error_Event = HI_SERVER_SWF_LZMA_FAILURE; + SessionPtr->Error_Event = FILE_DECOMP_ERR_SWF_LZMA_FAILURE; return( File_Decomp_DecompError ); } @@ -120,7 +120,7 @@ static fd_status_t Decomp( fd_session_p_t SessionPtr ) if( z_ret != Z_OK ) { - SessionPtr->Error_Event = HI_SERVER_SWF_ZLIB_FAILURE; + SessionPtr->Error_Event = FILE_DECOMP_ERR_SWF_ZLIB_FAILURE; return( File_Decomp_DecompError ); } @@ -146,7 +146,7 @@ static fd_status_t Decomp( fd_session_p_t SessionPtr ) if( l_ret != LZMA_OK ) { - SessionPtr->Error_Event = HI_SERVER_SWF_LZMA_FAILURE; + SessionPtr->Error_Event = FILE_DECOMP_ERR_SWF_LZMA_FAILURE; return( File_Decomp_DecompError ); } @@ -176,7 +176,7 @@ fd_status_t File_Decomp_End_SWF( fd_session_p_t SessionPtr ) if( z_ret != Z_OK ) { - SessionPtr->Error_Event = HI_SERVER_SWF_ZLIB_FAILURE; + SessionPtr->Error_Event = FILE_DECOMP_ERR_SWF_ZLIB_FAILURE; return( File_Decomp_DecompError ); } @@ -232,7 +232,7 @@ fd_status_t File_Decomp_Init_SWF( fd_session_p_t SessionPtr ) if( z_ret != Z_OK ) { - SessionPtr->Error_Event = HI_SERVER_SWF_ZLIB_FAILURE; + SessionPtr->Error_Event = FILE_DECOMP_ERR_SWF_ZLIB_FAILURE; return( File_Decomp_DecompError ); } @@ -257,7 +257,7 @@ fd_status_t File_Decomp_Init_SWF( fd_session_p_t SessionPtr ) if( l_ret != LZMA_OK ) { - SessionPtr->Error_Event = HI_SERVER_SWF_LZMA_FAILURE; + SessionPtr->Error_Event = FILE_DECOMP_ERR_SWF_LZMA_FAILURE; return( File_Decomp_DecompError ); } diff --git a/src/service_inspectors/http_inspect/hi_file_decomp_swf.h b/src/decompress/file_decomp_swf.h similarity index 97% rename from src/service_inspectors/http_inspect/hi_file_decomp_swf.h rename to src/decompress/file_decomp_swf.h index 46c243350..567a2828a 100644 --- a/src/service_inspectors/http_inspect/hi_file_decomp_swf.h +++ b/src/decompress/file_decomp_swf.h @@ -17,8 +17,8 @@ // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. //-------------------------------------------------------------------------- -#ifndef HI_FILE_DECOMP_SWF_H -#define HI_FILE_DECOMP_SWF_H +#ifndef FILE_DECOMP_SWF_H +#define FILE_DECOMP_SWF_H #include #ifdef LZMA diff --git a/src/service_inspectors/http_inspect/CMakeLists.txt b/src/service_inspectors/http_inspect/CMakeLists.txt index f643fd2b1..f9570f182 100644 --- a/src/service_inspectors/http_inspect/CMakeLists.txt +++ b/src/service_inspectors/http_inspect/CMakeLists.txt @@ -11,12 +11,6 @@ set (FILE_LIST hi_client_norm.h hi_cmd_lookup.cc hi_cmd_lookup.h - hi_file_decomp.cc - hi_file_decomp.h - hi_file_decomp_pdf.cc - hi_file_decomp_pdf.h - hi_file_decomp_swf.cc - hi_file_decomp_swf.h hi_include.h hi_mi.cc hi_mi.h diff --git a/src/service_inspectors/http_inspect/Makefile.am b/src/service_inspectors/http_inspect/Makefile.am index 135ed08c4..de3d23e77 100644 --- a/src/service_inspectors/http_inspect/Makefile.am +++ b/src/service_inspectors/http_inspect/Makefile.am @@ -8,9 +8,6 @@ hi_client.cc hi_client.h \ hi_client_norm.cc hi_client_norm.h \ hi_cmd_lookup.cc hi_cmd_lookup.h \ hi_events.cc hi_events.h \ -hi_file_decomp.cc hi_file_decomp.h \ -hi_file_decomp_pdf.cc hi_file_decomp_pdf.h \ -hi_file_decomp_swf.cc hi_file_decomp_swf.h \ hi_include.h \ hi_mi.cc hi_mi.h \ hi_module.cc hi_module.h \ diff --git a/src/service_inspectors/http_inspect/hi_server.cc b/src/service_inspectors/http_inspect/hi_server.cc index 50be3091f..2cac8b62d 100644 --- a/src/service_inspectors/http_inspect/hi_server.cc +++ b/src/service_inspectors/http_inspect/hi_server.cc @@ -819,8 +819,27 @@ static inline int hi_server_extract_body( static void LogFileDecomp(void*, int event) { - // FIXIT-H first argument is supposed to be pointer to session which may be needed to - // generate the event correctly. + switch ( event ) + { + case FILE_DECOMP_ERR_SWF_ZLIB_FAILURE: + event = HI_SERVER_SWF_ZLIB_FAILURE; + break; + case FILE_DECOMP_ERR_SWF_LZMA_FAILURE: + event = HI_SERVER_SWF_LZMA_FAILURE; + break; + case FILE_DECOMP_ERR_PDF_DEFL_FAILURE: + event = HI_SERVER_PDF_DEFL_FAILURE; + break; + case FILE_DECOMP_ERR_PDF_UNSUP_COMP_TYPE: + event = HI_SERVER_PDF_UNSUP_COMP_TYPE; + break; + case FILE_DECOMP_ERR_PDF_CASC_COMP: + event = HI_SERVER_PDF_CASC_COMP; + break; + case FILE_DECOMP_ERR_PDF_PARSE_FAILURE: + event = HI_SERVER_PDF_PARSE_FAILURE; + break; + } hi_set_event(GID_HTTP_SERVER, event); } diff --git a/src/service_inspectors/http_inspect/hi_ui_config.h b/src/service_inspectors/http_inspect/hi_ui_config.h index 99d8da715..b1a2c1683 100644 --- a/src/service_inspectors/http_inspect/hi_ui_config.h +++ b/src/service_inspectors/http_inspect/hi_ui_config.h @@ -39,7 +39,7 @@ #include "sf_ip.h" #include "hi_util_kmap.h" #include "file_api/file_api.h" -#include "hi_file_decomp.h" +#include "decompress/file_decomp.h" #include "framework/bits.h" /* diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc index 30fec3450..5437ad2c0 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/src/service_inspectors/http_inspect/http_inspect.cc @@ -47,7 +47,7 @@ #include "snort_debug.h" #include "util.h" #include "parser.h" -#include "hi_file_decomp.h" +#include "decompress/file_decomp.h" #include "hi_client.h" #include "hi_ui_config.h"