From: Tom Peters <thopeter@cisco.com>
Date: Tue, 21 Oct 2014 14:45:15 +0000 (-0400)
Subject: peek bug fix
X-Git-Tag: 3.0.0-233~1343^2~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cc00e5b4309fc9eead027fafadabdeef335d40e8;p=thirdparty%2Fsnort3.git

peek bug fix
---

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_splitter.cc b/src/service_inspectors/nhttp_inspect/nhttp_splitter.cc
index ff2b10f04..2855f3c35 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_splitter.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_splitter.cc
@@ -42,7 +42,7 @@ ScanResult NHttpStartSplitter::split(const uint8_t* buffer, uint32_t length) {
                     num_crlf++;
                     continue;
                 }
-                else {
+                else { // FIXIT-M there needs to be an event for this
                     complete = true;
                     return SCAN_ABORT;
                 }
@@ -61,7 +61,7 @@ ScanResult NHttpStartSplitter::split(const uint8_t* buffer, uint32_t length) {
             complete = true;
             return SCAN_FOUND;
         }
-        if (num_crlf == 1) {
+        if (num_crlf == 1) { // FIXIT-M there needs to be an event for this
             // CR not followed by LF
             complete = true;
             return SCAN_ABORT;
@@ -77,10 +77,14 @@ ScanResult NHttpStartSplitter::split(const uint8_t* buffer, uint32_t length) {
 ScanResult NHttpHeaderSplitter::split(const uint8_t* buffer, uint32_t length) {
     conditional_reset();
     if (peek_status == SCAN_FOUND) {
+        complete = true;
         return SCAN_FOUND;
     }
     buffer += peek_octets;
     length -= peek_octets;
+
+    // Header separators: leading \r\n, leading \n, nonleading \r\n\r\n, nonleading \n\r\n, nonleading \r\n\n, and
+    // nonleading \n\n. The separator itself becomes num_excess which is discarded during reassemble().
     for (uint32_t k = 0; k < length; k++) {
         if (buffer[k] == '\n') {
             num_crlf++;
@@ -116,14 +120,15 @@ ScanResult NHttpHeaderSplitter::peek(const uint8_t* buffer, uint32_t length) {
     assert(octets_seen == 0);
     peek_status = split(buffer, length);
     peek_octets = length;
+    complete = false;
     return peek_status;
 }
 
 void NHttpHeaderSplitter::conditional_reset() {
     if (complete) {
         peek_octets = 0;
-        peek_status = SCAN_NOTFOUND;
         first_lf = 0;
+        peek_status = SCAN_NOTFOUND;
     }
     NHttpSplitter::conditional_reset();
 }
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_splitter.h b/src/service_inspectors/nhttp_inspect/nhttp_splitter.h
index 6dfdc1418..53c02dae9 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_splitter.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_splitter.h
@@ -39,7 +39,7 @@ public:
     virtual bool partial_ok() const { return true; };
 
 protected:
-    uint32_t octets_seen = 0;
+    uint32_t octets_seen = 0; // number of octets processed by previous split() calls that returned NOTFOUND
     uint32_t num_crlf = 0;
     uint32_t num_flush = 0;
     bool complete = false;
@@ -49,19 +49,19 @@ protected:
 
 class NHttpStartSplitter : public NHttpSplitter {
 public:
-    NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length);
-    uint32_t get_num_excess() const { return num_crlf; };
+    NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length) override;
+    uint32_t get_num_excess() const override { return num_crlf; };
 private:
     static const int MAX_LEADING_WHITESPACE = 20;
 };
 
 class NHttpHeaderSplitter : public NHttpSplitter {
 public:
-    NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length);
-    NHttpEnums::ScanResult peek(const uint8_t* buffer, uint32_t length);
-    void conditional_reset();
-    uint32_t get_octets_seen() const { return octets_seen - peek_octets; };
-    uint32_t get_num_excess() const { return num_crlf; };
+    NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length) override;
+    NHttpEnums::ScanResult peek(const uint8_t* buffer, uint32_t length) override;
+    void conditional_reset() override;
+    uint32_t get_octets_seen() const override { return octets_seen - peek_octets; };
+    uint32_t get_num_excess() const override { return num_crlf; };
 private:
     uint32_t peek_octets = 0;
     unsigned first_lf = 0;
@@ -70,10 +70,10 @@ private:
 
 class NHttpChunkSplitter : public NHttpSplitter {
 public:
-    NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length);
-    uint32_t get_num_excess() const { return zero_chunk ? 1 : 0; };
-    void conditional_reset();
-    bool partial_ok() const { return false; };
+    NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length) override;
+    uint32_t get_num_excess() const override { return zero_chunk ? 1 : 0; };
+    void conditional_reset() override;
+    bool partial_ok() const override { return false; };
 private:
     uint32_t expected_length = 0;
     bool length_started = false;
@@ -85,9 +85,9 @@ private:
 
 class NHttpTrailerSplitter : public NHttpSplitter {
 public:
-    NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length);
-    void conditional_reset();
-    uint32_t get_num_excess() const { return num_crlf; };
+    NHttpEnums::ScanResult split(const uint8_t* buffer, uint32_t length) override;
+    void conditional_reset() override;
+    uint32_t get_num_excess() const override { return num_crlf; };
 private:
     unsigned first_lf = 0;
 };