From: Russ Combs (rucombs) Date: Wed, 11 Nov 2015 16:05:38 +0000 (-0500) Subject: Merge pull request #128 in SNORT/snort3 from nhttp29 to master X-Git-Tag: 3.0.0-233~733 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bf95cb98a0fff449fdae7ef3d2458fa1c42f374a;p=thirdparty%2Fsnort3.git Merge pull request #128 in SNORT/snort3 from nhttp29 to master Squashed commit of the following: commit b3b14b27f22dc83396ea94a124b639fe0764335f Author: Tom Peters Date: Tue Nov 10 15:32:19 2015 -0500 NHI-related buffer work --- diff --git a/src/ips_options/ips_http.cc b/src/ips_options/ips_http.cc index 1e6f36edc..dc368bbae 100644 --- a/src/ips_options/ips_http.cc +++ b/src/ips_options/ips_http.cc @@ -34,9 +34,8 @@ enum PsIdx { - PSI_URI, PSI_CB, PSI_METH, PSI_COOK, PSI_CODE, - PSI_MSG, PSI_RAW_URI, PSI_RAW_HDR, PSI_RAW_COOK, - PSI_MAX + PSI_URI, PSI_CLIENT_BODY, PSI_METHOD, PSI_COOKIE, PSI_STAT_CODE, PSI_STAT_MSG, PSI_RAW_URI, + PSI_RAW_HEADER, PSI_RAW_COOKIE, PSI_MAX }; static THREAD_LOCAL ProfileStats http_ps[PSI_MAX]; @@ -49,13 +48,13 @@ class HttpCursorModule : public Module { public: HttpCursorModule(const char* s, const char* h, PsIdx psi) : - Module(s, h) { idx = psi; } + Module(s, h), idx(psi) {} ProfileStats* get_profile() const override { return http_ps + idx; } private: - PsIdx idx; + const PsIdx idx; }; static void mod_dtor(Module* m) @@ -77,8 +76,7 @@ class HttpIpsOption : public IpsOption public: HttpIpsOption( const char* s, PsIdx psi, CursorActionType c = CAT_SET_OTHER) : - IpsOption(s) - { key = s; cat = c; idx = psi; } + IpsOption(s), key(s), cat(c), idx(psi) {} CursorActionType get_cursor_type() const override { return cat; } @@ -86,9 +84,9 @@ public: int eval(Cursor&, Packet*) override; private: - const char* key; - CursorActionType cat; - PsIdx idx; + const char* const key; + const CursorActionType cat; + const PsIdx idx; }; int HttpIpsOption::eval(Cursor& c, Packet* p) @@ -166,12 +164,12 @@ static const IpsApi uri_api = static Module* client_body_mod_ctor() { - return new HttpCursorModule(IPS_OPT, cb_help, PSI_CB); + return new HttpCursorModule(IPS_OPT, cb_help, PSI_CLIENT_BODY); } static IpsOption* client_body_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, PSI_CB, CAT_SET_BODY); + return new HttpIpsOption(IPS_OPT, PSI_CLIENT_BODY, CAT_SET_BODY); } static const IpsApi client_body_api = @@ -211,12 +209,12 @@ static const IpsApi client_body_api = static Module* method_mod_ctor() { - return new HttpCursorModule(IPS_OPT, meth_help, PSI_METH); + return new HttpCursorModule(IPS_OPT, meth_help, PSI_METHOD); } static IpsOption* method_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, PSI_METH); + return new HttpIpsOption(IPS_OPT, PSI_METHOD); } static const IpsApi method_api = @@ -256,12 +254,12 @@ static const IpsApi method_api = static Module* cookie_mod_ctor() { - return new HttpCursorModule(IPS_OPT, cookie_help, PSI_COOK); + return new HttpCursorModule(IPS_OPT, cookie_help, PSI_COOKIE); } static IpsOption* cookie_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, PSI_COOK); + return new HttpIpsOption(IPS_OPT, PSI_COOKIE); } static const IpsApi cookie_api = @@ -301,12 +299,12 @@ static const IpsApi cookie_api = static Module* stat_code_mod_ctor() { - return new HttpCursorModule(IPS_OPT, stat_code_help, PSI_CODE); + return new HttpCursorModule(IPS_OPT, stat_code_help, PSI_STAT_CODE); } static IpsOption* stat_code_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, PSI_CODE); + return new HttpIpsOption(IPS_OPT, PSI_STAT_CODE); } static const IpsApi stat_code_api = @@ -346,12 +344,12 @@ static const IpsApi stat_code_api = static Module* stat_msg_mod_ctor() { - return new HttpCursorModule(IPS_OPT, stat_msg_help, PSI_MSG); + return new HttpCursorModule(IPS_OPT, stat_msg_help, PSI_STAT_MSG); } static IpsOption* stat_msg_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, PSI_MSG); + return new HttpIpsOption(IPS_OPT, PSI_STAT_MSG); } static const IpsApi stat_msg_api = @@ -436,12 +434,12 @@ static const IpsApi raw_uri_api = static Module* raw_header_mod_ctor() { - return new HttpCursorModule(IPS_OPT, raw_header_help, PSI_RAW_HDR); + return new HttpCursorModule(IPS_OPT, raw_header_help, PSI_RAW_HEADER); } static IpsOption* raw_header_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, PSI_RAW_HDR); + return new HttpIpsOption(IPS_OPT, PSI_RAW_HEADER); } static const IpsApi raw_header_api = @@ -481,12 +479,12 @@ static const IpsApi raw_header_api = static Module* raw_cookie_mod_ctor() { - return new HttpCursorModule(IPS_OPT, raw_cookie_help, PSI_RAW_COOK); + return new HttpCursorModule(IPS_OPT, raw_cookie_help, PSI_RAW_COOKIE); } static IpsOption* raw_cookie_opt_ctor(Module*, OptTreeNode*) { - return new HttpIpsOption(IPS_OPT, PSI_RAW_COOK); + return new HttpIpsOption(IPS_OPT, PSI_RAW_COOKIE); } static const IpsApi raw_cookie_api = diff --git a/src/ips_options/ips_http_header.cc b/src/ips_options/ips_http_header.cc index 7a5b8ef0e..0e19a0b5d 100644 --- a/src/ips_options/ips_http_header.cc +++ b/src/ips_options/ips_http_header.cc @@ -94,8 +94,7 @@ bool HttpHeaderModule::set(const char*, Value& v, SnortConfig*) class HttpHeaderOption : public IpsOption { public: - HttpHeaderOption(string& s) : IpsOption(s_name) - { name = s; } + HttpHeaderOption(string& s) : IpsOption(s_name), name(s) {} CursorActionType get_cursor_type() const override { return CAT_SET_HEADER; } @@ -106,7 +105,7 @@ public: int eval(Cursor&, Packet*) override; private: - string name; + const string name; }; static bool find( diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc index 3770556c8..896d8116a 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc @@ -85,6 +85,8 @@ const Field& NHttpMsgSection::get_legacy(unsigned buffer_id) { case NHTTP_BUFFER_CLIENT_BODY: { + if (source_id != SRC_CLIENT) + return Field::FIELD_NULL; NHttpMsgBody* body = transaction->get_body(); return (body != nullptr) ? body->get_detect_buf() : Field::FIELD_NULL; }