From: Tom Peters Date: Tue, 1 Sep 2015 20:40:27 +0000 (-0400) Subject: cookie processing mods X-Git-Tag: 3.0.0-233~851^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e994498de4d2bea1896def00c117f73bed05557c;p=thirdparty%2Fsnort3.git cookie processing mods --- diff --git a/src/service_inspectors/nhttp_inspect/nhttp_enum.h b/src/service_inspectors/nhttp_inspect/nhttp_enum.h index e5848a2ab..d76837478 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_enum.h +++ b/src/service_inspectors/nhttp_inspect/nhttp_enum.h @@ -146,6 +146,7 @@ enum Infraction INF_CHUNK_BAD_END, INF_PARTIAL_START, INF_CHUNK_WHITESPACE, + INF_HEAD_NAME_WHITESPACE, INF__MAX_VALUE }; @@ -226,6 +227,7 @@ enum EventSid EVENT_URI_BAD_PORT, EVENT_BROKEN_CHUNK, EVENT_CHUNK_WHITESPACE, + EVENT_HEAD_NAME_WHITESPACE, EVENT__MAX_VALUE }; diff --git a/src/service_inspectors/nhttp_inspect/nhttp_head_norm.cc b/src/service_inspectors/nhttp_inspect/nhttp_head_norm.cc index 37e478971..3c21b555c 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_head_norm.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_head_norm.cc @@ -131,8 +131,7 @@ void HeaderNormalizer::normalize(const HeaderId head_id, const int count, Scratc { *working++ = ','; data_length++; - while (header_name_id[++curr_match] != head_id) - ; + while (header_name_id[++curr_match] != head_id); } int32_t growth = derive_header_content(header_value[curr_match].start, header_value[curr_match].length, working); diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc index cf818b548..c6685c36a 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.cc @@ -171,18 +171,32 @@ void NHttpMsgHeadShared::parse_header_lines() void NHttpMsgHeadShared::derive_header_name_id(int index) { - // Normalize header field name to lower case for matching purposes + const int32_t& length = header_name[index].length; + const uint8_t*& buffer = header_name[index].start; + + // Normalize header field name to lower case and remove LWS for matching purposes + int32_t lower_length = 0; uint8_t* lower_name; - if ((lower_name = scratch_pad.request(header_name[index].length)) == nullptr) + if ((lower_name = scratch_pad.request(length)) == nullptr) { infractions += INF_NO_SCRATCH; header_name_id[index] = HEAD__INSUFMEMORY; return; } - norm_to_lower(header_name[index].start, header_name[index].length, lower_name, infractions, - events, nullptr); - header_name_id[index] = (HeaderId)str_to_code(lower_name, header_name[index].length, - header_list); + for (int32_t k=0; k < length; k++) + { + if (!is_sp_tab[buffer[k]]) + { + lower_name[lower_length++] = ((buffer[k] < 'A') || (buffer[k] > 'Z')) ? + buffer[k] : buffer[k] - ('A' - 'a'); + } + else + { + infractions += INF_HEAD_NAME_WHITESPACE; + events.create_event(EVENT_HEAD_NAME_WHITESPACE); + } + } + header_name_id[index] = (HeaderId)str_to_code(lower_name, lower_length, header_list); } NHttpMsgHeadShared::NormalizedHeader* NHttpMsgHeadShared::get_header_node(HeaderId header_id) const diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h index d0d6c3248..8f3b491f0 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_head_shared.h @@ -59,6 +59,7 @@ protected: static const HeaderNormalizer NORMALIZER_NIL; static const HeaderNormalizer NORMALIZER_BASIC; static const HeaderNormalizer NORMALIZER_CAT; + static const HeaderNormalizer NORMALIZER_COOKIE; static const HeaderNormalizer NORMALIZER_NOREPEAT; static const HeaderNormalizer NORMALIZER_DECIMAL; static const HeaderNormalizer NORMALIZER_TRANSCODE; diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc index e68ff5f14..ef4e7ea1f 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.cc @@ -98,6 +98,10 @@ const Field& NHttpMsgSection::get_legacy(unsigned buffer_id) return (body != nullptr) ? body->get_detect_data() : Field::FIELD_NULL; } case HTTP_BUFFER_COOKIE: + case HTTP_BUFFER_RAW_COOKIE: + // FIXIT-M when real cookie normalization is implemented these need to become separate cases. + // Currently "normalization" is aggregation of multiple cookies. That is correct for raw + // cookies and all there is for normalized cookies. { NHttpMsgHeadShared* header = transaction->get_latest_header(source_id); if (header == nullptr) @@ -115,22 +119,6 @@ const Field& NHttpMsgSection::get_legacy(unsigned buffer_id) NHttpMsgRequest* request = transaction->get_request(); return (request != nullptr) ? request->get_method() : Field::FIELD_NULL; } - case HTTP_BUFFER_RAW_COOKIE: - { - NHttpMsgHeadShared* header = transaction->get_latest_header(source_id); - if (header == nullptr) - return Field::FIELD_NULL; - HeaderId cookie_head = (source_id == SRC_CLIENT) ? HEAD_COOKIE : HEAD_SET_COOKIE; - // FIXIT-M there can be multiple cookie header in one message. - for (int k=0; k < header->get_num_headers(); k++) - { - if (header->get_header_name_id(k) == cookie_head) - { - return header->get_header_value(k); - } - } - return Field::FIELD_NULL; - } case HTTP_BUFFER_RAW_HEADER: { NHttpMsgHeadShared* header = transaction->get_latest_header(source_id); diff --git a/src/service_inspectors/nhttp_inspect/nhttp_normalizers.cc b/src/service_inspectors/nhttp_inspect/nhttp_normalizers.cc index 87877f31b..681ca0a19 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_normalizers.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_normalizers.cc @@ -103,7 +103,7 @@ int32_t norm_remove_lws(const uint8_t* in_buf, int32_t in_length, uint8_t* out_b int32_t length = 0; for (int32_t k = 0; k < in_length; k++) { - if ((in_buf[k] != ' ') && (in_buf[k] != '\t')) + if (!is_sp_tab[in_buf[k]]) out_buf[length++] = in_buf[k]; } return length; diff --git a/src/service_inspectors/nhttp_inspect/nhttp_tables.cc b/src/service_inspectors/nhttp_inspect/nhttp_tables.cc index 2cc61fcdd..203f08c6b 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_tables.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_tables.cc @@ -172,6 +172,9 @@ const HeaderNormalizer NHttpMsgHeadShared::NORMALIZER_BASIC const HeaderNormalizer NHttpMsgHeadShared::NORMALIZER_CAT { NORM_FIELD, true, norm_remove_lws, nullptr, nullptr, nullptr, nullptr, nullptr }; +const HeaderNormalizer NHttpMsgHeadShared::NORMALIZER_COOKIE +{ NORM_FIELD, true, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr }; + const HeaderNormalizer NHttpMsgHeadShared::NORMALIZER_DECIMAL { NORM_INT64, false, norm_decimal_integer, nullptr, nullptr, nullptr, nullptr, nullptr }; @@ -194,8 +197,8 @@ const HeaderNormalizer* const NHttpMsgHeadShared::header_norms[HEAD__MAX_VALUE] [HEAD_DATE] = &NORMALIZER_BASIC, [HEAD_PRAGMA] = &NORMALIZER_BASIC, [HEAD_TRAILER] = &NORMALIZER_BASIC, - [HEAD_COOKIE] = &NORMALIZER_BASIC, - [HEAD_SET_COOKIE] = &NORMALIZER_BASIC, + [HEAD_COOKIE] = &NORMALIZER_COOKIE, + [HEAD_SET_COOKIE] = &NORMALIZER_COOKIE, [HEAD_TRANSFER_ENCODING] = &NORMALIZER_TRANSCODE, [HEAD_UPGRADE] = &NORMALIZER_BASIC, [HEAD_VIA] = &NORMALIZER_BASIC,