From: Russ Combs Date: Thu, 5 Jun 2014 14:34:26 +0000 (-0400) Subject: InspectApi updated for content buffers X-Git-Tag: 3.0.0-233~1504 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a5eb679563098e3a6ff16508a076f60a546efeef;p=thirdparty%2Fsnort3.git InspectApi updated for content buffers --- diff --git a/ChangeLog b/ChangeLog index 4498af845..6de9fd8a9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,6 +4,7 @@ defaults) -- removed -b, -N, -Z and, --perfmon-file options -- removed uricontent ips rule option +-- added contents and getbuf to InspectApi for content buffers 84 diff --git a/src/framework/inspector.h b/src/framework/inspector.h index 51b82a8f8..77d8a90db 100644 --- a/src/framework/inspector.h +++ b/src/framework/inspector.h @@ -102,14 +102,18 @@ typedef Inspector* (*InspectCtor)(Module*); typedef void (*InspectDtorFunc)(Inspector*); typedef void (*InspectFunc)(); typedef class Session* (*InspectSsnFunc)(class Flow*); +typedef struct ContentBuffer* (*InspectBufFunc)(unsigned); // FIXIT ensure all provide stats struct InspectApi { BaseApi base; InspectorType type; - const char* service; // nullptr when type != IT_SERVICE uint16_t proto_bits; + const char* service; // nullptr when type != IT_SERVICE + + // list of thread local detection buffers captured by inspector + const char* contents; // space separated, eg "foo_a foo_b foo_c" // main thread funcs - parse time data only InspectFunc init; // allocate process static data @@ -124,6 +128,7 @@ struct InspectApi InspectFunc sum; // accumulate stats InspectFunc stats; // output stats InspectFunc reset; // clear stats + InspectBufFunc getbuf; // 0-based, eg getbuf(1) means foo_b above }; #endif diff --git a/src/managers/module_manager.cc b/src/managers/module_manager.cc index d2a9af91a..7fc4f2006 100644 --- a/src/managers/module_manager.cc +++ b/src/managers/module_manager.cc @@ -198,7 +198,7 @@ static void dump_field(string& key, const char* pfx, const Parameter* p, bool li else if ( !pfx || !strncmp(key.c_str(), pfx, strlen(pfx)) ) { -#if 0 +#if 1 cout << item(); cout << p->get_type(); cout << " " << emphasis(key); diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc index 98642e6e5..4ce95b1ac 100644 --- a/src/network_inspectors/arp_spoof/arp_spoof.cc +++ b/src/network_inspectors/arp_spoof/arp_spoof.cc @@ -330,8 +330,9 @@ static const InspectApi as_api = mod_dtor }, IT_PROTOCOL, - nullptr, // service PROTO_BIT__ARP, + nullptr, // service + nullptr, // contents as_init, nullptr, // term as_ctor, @@ -341,7 +342,8 @@ static const InspectApi as_api = nullptr, // ssn as_sum, as_stats, - as_reset + as_reset, + nullptr // getbuf }; #ifdef BUILDING_SO diff --git a/src/network_inspectors/normalize/normalize.cc b/src/network_inspectors/normalize/normalize.cc index 800571295..4fe211b9c 100644 --- a/src/network_inspectors/normalize/normalize.cc +++ b/src/network_inspectors/normalize/normalize.cc @@ -294,8 +294,9 @@ static const InspectApi no_api = mod_dtor }, IT_PACKET, - nullptr, // service PROTO_BITS, + nullptr, // service + nullptr, // contents no_init, nullptr, // term no_ctor, @@ -305,7 +306,8 @@ static const InspectApi no_api = nullptr, // ssn no_sum, no_stats, - no_reset + no_reset, + nullptr // getbuf }; const BaseApi* nin_normalize = &no_api.base; diff --git a/src/network_inspectors/perf_monitor/perf_monitor.cc b/src/network_inspectors/perf_monitor/perf_monitor.cc index 538d4ad94..921154ad2 100644 --- a/src/network_inspectors/perf_monitor/perf_monitor.cc +++ b/src/network_inspectors/perf_monitor/perf_monitor.cc @@ -405,8 +405,9 @@ static const InspectApi pm_api = mod_dtor }, IT_PACKET, - nullptr, // service PROTO_BIT__ALL, + nullptr, // service + nullptr, // contents pm_init, nullptr, // term pm_ctor, @@ -416,7 +417,8 @@ static const InspectApi pm_api = nullptr, // ssn pm_sum, pm_stats, - pm_reset + pm_reset, + nullptr // getbuf }; const BaseApi* nin_perf_monitor = &pm_api.base; diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc index 162cdba62..22363cda8 100644 --- a/src/network_inspectors/port_scan/port_scan.cc +++ b/src/network_inspectors/port_scan/port_scan.cc @@ -1031,8 +1031,9 @@ static const InspectApi sp_api = mod_dtor }, IT_PROTOCOL, - nullptr, // service PROTO_BIT__IP|PROTO_BIT__ICMP|PROTO_BIT__TCP|PROTO_BIT__UDP, // FIXIT dynamic assign + nullptr, // service + nullptr, // contents sp_init, nullptr, // term sp_ctor, @@ -1042,7 +1043,8 @@ static const InspectApi sp_api = nullptr, // ssn sp_sum, sp_stats, - sp_reset + sp_reset, + nullptr // getbuf }; #ifdef BUILDING_SO diff --git a/src/service_inspectors/back_orifice/back_orifice.cc b/src/service_inspectors/back_orifice/back_orifice.cc index f8d0db00e..38e083647 100644 --- a/src/service_inspectors/back_orifice/back_orifice.cc +++ b/src/service_inspectors/back_orifice/back_orifice.cc @@ -626,8 +626,9 @@ static const InspectApi bo_api = mod_dtor }, IT_SERVICE, - nullptr, // service PROTO_BIT__UDP, + nullptr, // service + nullptr, // contents bo_init, nullptr, // term bo_ctor, @@ -637,7 +638,8 @@ static const InspectApi bo_api = nullptr, // ssn bo_sum, bo_stats, - bo_reset + bo_reset, + nullptr // getbuf }; #ifdef BUILDING_SO diff --git a/src/service_inspectors/ftp_telnet/ftp.cc b/src/service_inspectors/ftp_telnet/ftp.cc index 06738200f..1e3d2eba1 100644 --- a/src/service_inspectors/ftp_telnet/ftp.cc +++ b/src/service_inspectors/ftp_telnet/ftp.cc @@ -716,8 +716,9 @@ static const InspectApi fs_api = }, //IT_SESSION, // FIXIT should be service only IT_SERVICE, - "ftp", // FIXIT add ftp-data inspector PROTO_BIT__TCP, + "ftp", // FIXIT add ftp-data inspector + nullptr, // contents fs_init, nullptr, // term fs_ctor, @@ -727,7 +728,8 @@ static const InspectApi fs_api = nullptr, // ssn fs_sum, fs_stats, - fs_reset + fs_reset, + nullptr // getbuf }; #ifdef BUILDING_SO diff --git a/src/service_inspectors/ftp_telnet/telnet.cc b/src/service_inspectors/ftp_telnet/telnet.cc index f282a4d30..096340f37 100644 --- a/src/service_inspectors/ftp_telnet/telnet.cc +++ b/src/service_inspectors/ftp_telnet/telnet.cc @@ -344,8 +344,9 @@ const InspectApi tn_api = mod_dtor }, IT_SERVICE, - "telnet", PROTO_BIT__TCP, + "telnet", + nullptr, // contents tn_init, nullptr, // term tn_ctor, @@ -355,6 +356,7 @@ const InspectApi tn_api = nullptr, // ssn tn_sum, tn_stats, - tn_reset + tn_reset, + nullptr // getbuf }; diff --git a/src/service_inspectors/http_inspect/hi_client.cc b/src/service_inspectors/http_inspect/hi_client.cc index 6c0f8bbe5..6caa8fcf7 100644 --- a/src/service_inspectors/http_inspect/hi_client.cc +++ b/src/service_inspectors/http_inspect/hi_client.cc @@ -1,6 +1,6 @@ /**************************************************************************** * -** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. + * Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. * Copyright (C) 2003-2013 Sourcefire, Inc. * * This program is free software; you can redistribute it and/or modify @@ -457,7 +457,8 @@ static inline const u_char *FindPipelineReq(HI_SESSION *session, { if(*p == '\n') { - if( (p - offset) >= session->server_conf->max_hdr_len ) + if ( session->server_conf->max_hdr_len && + (p - offset) >= session->server_conf->max_hdr_len ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR); } @@ -488,7 +489,8 @@ static inline const u_char *FindPipelineReq(HI_SESSION *session, } /* Never observed an end-of-field. Maybe it's not there, but the header is long anyway: */ - if( (p - start) >= session->server_conf->max_hdr_len ) + if ( session->server_conf->max_hdr_len && + (p - start) >= session->server_conf->max_hdr_len ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR); } @@ -1811,7 +1813,8 @@ const u_char *extract_http_xff(HI_SESSION *session, const u_char *p, const u_cha return end; } - if(num_spaces >= session->server_conf->max_spaces) + if ( session->server_conf->max_spaces && + num_spaces >= session->server_conf->max_spaces ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES); } @@ -1919,7 +1922,8 @@ const u_char *extract_http_hostname(HI_SESSION *session, const u_char *p, const return end; } - if(num_spaces >= session->server_conf->max_spaces) + if ( session->server_conf->max_spaces && + num_spaces >= session->server_conf->max_spaces ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES); } @@ -2005,7 +2009,8 @@ const u_char *extract_http_content_length(HI_SESSION *session, } if ( space_present ) { - if(num_spaces >= session->server_conf->max_spaces) + if ( session->server_conf->max_spaces && + num_spaces >= session->server_conf->max_spaces ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES); } @@ -2345,9 +2350,10 @@ static inline const u_char *hi_client_extract_header( return p; } - num_spaces = SkipBlankSpace(start,end,&p); - if(num_spaces >= session->server_conf->max_spaces) + + if ( session->server_conf->max_spaces && + num_spaces >= session->server_conf->max_spaces ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES); } @@ -2400,7 +2406,8 @@ static inline const u_char *hi_client_extract_header( { header_count++; - if( (p - offset) >= session->server_conf->max_hdr_len ) + if ( session->server_conf->max_hdr_len && + (p - offset) >= session->server_conf->max_hdr_len ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR); } @@ -2414,7 +2421,9 @@ static inline const u_char *hi_client_extract_header( p++; num_spaces = SkipBlankSpace(start,end,&p); - if(num_spaces >= session->server_conf->max_spaces) + + if ( session->server_conf->max_spaces && + num_spaces >= session->server_conf->max_spaces ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_EXCEEDS_SPACES); } @@ -2473,7 +2482,8 @@ static inline const u_char *hi_client_extract_header( } /* Never observed an end-of-field. Maybe it's not there, but the header is long anyway: */ - if( (p - start) >= session->server_conf->max_hdr_len ) + if ( session->server_conf->max_hdr_len && + (p - start) >= session->server_conf->max_hdr_len ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR); } @@ -2716,7 +2726,7 @@ int StatelessInspection(Packet *p, HI_SESSION *session, HttpsessionData *hsd, in /* Check if the URI exceeds the max header field length */ /* Only check if we succesfully observed a GET or POST method, otherwise, * this may very well be a POST body */ - if ( iRet == URI_END && + if ( iRet == URI_END && ServerConf->max_hdr_len && ((uri_ptr.uri_end - uri_ptr.uri) >= ServerConf->max_hdr_len) ) { SnortEventqAdd(GID_HTTP_CLIENT, HI_CLIENT_LONG_HDR); diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc index 68c35d36a..da36b6726 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/src/service_inspectors/http_inspect/http_inspect.cc @@ -672,6 +672,18 @@ static void hs_reset() //------------------------------------------------------------------------- +static const char* contents = + "http_client_body " + "http_cookie " + "http_raw_cookie " + "http_header " + "http_raw_header " + "http_method " + "http_uri " + "http_raw_uri " + "http_stat_code " + "http_stat_msg "; + static const InspectApi hs_api = { { @@ -683,8 +695,9 @@ static const InspectApi hs_api = mod_dtor }, IT_SERVICE, - "http", PROTO_BIT__TCP, + "http", + contents, hs_init, hs_term, hs_ctor, @@ -694,7 +707,8 @@ static const InspectApi hs_api = nullptr, // ssn hs_sum, hs_stats, - hs_reset + hs_reset, + nullptr // getbuf }; #ifdef BUILDING_SO diff --git a/src/service_inspectors/nhttp_inspect/nhttp_api.cc b/src/service_inspectors/nhttp_inspect/nhttp_api.cc index 16873b125..009c0e16f 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_api.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_api.cc @@ -115,8 +115,9 @@ const InspectApi NHttpApi::nhttp_api = NHttpApi::nhttp_mod_dtor }, IT_SERVICE, - "http", PROTO_BIT__TCP, + "http", + nullptr, // contents NHttpApi::nhttp_init, NHttpApi::nhttp_term, NHttpApi::nhttp_ctor, @@ -126,7 +127,8 @@ const InspectApi NHttpApi::nhttp_api = nullptr, // ssn NHttpApi::nhttp_sum, NHttpApi::nhttp_stats, - NHttpApi::nhttp_reset + NHttpApi::nhttp_reset, + nullptr // getbuf }; #ifdef BUILDING_SO diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc index 4b5de7fbc..d7b31984f 100644 --- a/src/service_inspectors/rpc_decode/rpc_decode.cc +++ b/src/service_inspectors/rpc_decode/rpc_decode.cc @@ -1164,8 +1164,9 @@ static const InspectApi rd_api = mod_dtor }, IT_SERVICE, - "sunrpc", PROTO_BIT__TCP, + "sunrpc", + nullptr, // contents rd_init, nullptr, // term rd_ctor, @@ -1175,7 +1176,8 @@ static const InspectApi rd_api = nullptr, // ssn rd_sum, rd_stats, - rd_reset + rd_reset, + nullptr // getbuf }; #ifdef BUILDING_SO diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc index d6254b6fd..a5bc47fe8 100644 --- a/src/stream/base/stream_base.cc +++ b/src/stream/base/stream_base.cc @@ -297,8 +297,9 @@ static const InspectApi base_api = mod_dtor }, IT_STREAM, - nullptr, // service PROTO_BIT__IP, + nullptr, // service + nullptr, // contents base_init, nullptr, // term base_ctor, @@ -308,7 +309,8 @@ static const InspectApi base_api = nullptr, // ssn base_sum, base_stats, - base_reset + base_reset, + nullptr // getbuf }; const BaseApi* nin_stream_base = &base_api.base; diff --git a/src/stream/icmp/stream_icmp.cc b/src/stream/icmp/stream_icmp.cc index f154b5971..26bb1eac4 100644 --- a/src/stream/icmp/stream_icmp.cc +++ b/src/stream/icmp/stream_icmp.cc @@ -121,8 +121,9 @@ static const InspectApi icmp_api = mod_dtor }, IT_STREAM, - nullptr, // service PROTO_BIT__ICMP, + nullptr, // service + nullptr, // contents icmp_init, nullptr, // term icmp_ctor, @@ -132,7 +133,8 @@ static const InspectApi icmp_api = icmp_ssn, icmp_sum, icmp_stats, - icmp_reset + icmp_reset, + nullptr // getbuf }; const BaseApi* nin_stream_icmp = &icmp_api.base; diff --git a/src/stream/ip/stream_ip.cc b/src/stream/ip/stream_ip.cc index 356d92548..3e0cc376a 100644 --- a/src/stream/ip/stream_ip.cc +++ b/src/stream/ip/stream_ip.cc @@ -168,8 +168,9 @@ static const InspectApi ip_api = mod_dtor }, IT_STREAM, - nullptr, // service PROTO_BIT__IP, + nullptr, // service + nullptr, // contents ip_init, nullptr, // term ip_ctor, @@ -179,7 +180,8 @@ static const InspectApi ip_api = ip_ssn, ip_sum, ip_stats, - ip_reset + ip_reset, + nullptr // getbuf }; const BaseApi* nin_stream_ip = &ip_api.base; diff --git a/src/stream/tcp/stream_tcp.cc b/src/stream/tcp/stream_tcp.cc index 5da44c1e8..b731523b6 100644 --- a/src/stream/tcp/stream_tcp.cc +++ b/src/stream/tcp/stream_tcp.cc @@ -136,8 +136,9 @@ static const InspectApi tcp_api = mod_dtor }, IT_STREAM, - nullptr, // service PROTO_BIT__TCP, + nullptr, // service + nullptr, // contents tcp_init, nullptr, // term tcp_ctor, @@ -147,7 +148,8 @@ static const InspectApi tcp_api = tcp_ssn, tcp_sum, tcp_stats, - tcp_reset + tcp_reset, + nullptr // getbuf }; const BaseApi* nin_stream_tcp = &tcp_api.base; diff --git a/src/stream/udp/stream_udp.cc b/src/stream/udp/stream_udp.cc index 58d946409..28bb4acac 100644 --- a/src/stream/udp/stream_udp.cc +++ b/src/stream/udp/stream_udp.cc @@ -136,8 +136,9 @@ static const InspectApi udp_api = mod_dtor }, IT_STREAM, - nullptr, // service PROTO_BIT__UDP, + nullptr, // service + nullptr, // contents udp_init, nullptr, // term udp_ctor, @@ -147,7 +148,8 @@ static const InspectApi udp_api = udp_ssn, udp_sum, udp_stats, - udp_reset + udp_reset, + nullptr // getbuf }; const BaseApi* nin_stream_udp = &udp_api.base;