From: Mike Stepanek (mstepane) Date: Fri, 31 Jan 2020 14:40:15 +0000 (+0000) Subject: Merge pull request #1975 in SNORT/snort3 from ~THOPETER/snort3:h2i_xtra_data to master X-Git-Tag: 3.0.0-268~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ecde9fae388eb373b0239631d6a6a540807593c7;p=thirdparty%2Fsnort3.git Merge pull request #1975 in SNORT/snort3 from ~THOPETER/snort3:h2i_xtra_data to master Squashed commit of the following: commit 7cd28267a8c166bc495818c24e33ebf930aeb25a Author: Tom Peters Date: Tue Jan 28 13:57:41 2020 -0500 http_inspect/http2_inspect: H2I unified2 extra data logging --- diff --git a/src/service_inspectors/http2_inspect/http2_frame.h b/src/service_inspectors/http2_inspect/http2_frame.h index d1748da82..a3080b883 100644 --- a/src/service_inspectors/http2_inspect/http2_frame.h +++ b/src/service_inspectors/http2_inspect/http2_frame.h @@ -42,6 +42,7 @@ public: HttpCommon::SourceId source_id); virtual void clear() { } virtual const Field& get_buf(unsigned id); + virtual uint32_t get_xtradata_mask() { return 0; } #ifdef REG_TEST virtual void print_frame(FILE* output); #endif diff --git a/src/service_inspectors/http2_inspect/http2_headers_frame.cc b/src/service_inspectors/http2_inspect/http2_headers_frame.cc index 673acfc4f..ddaac6e27 100644 --- a/src/service_inspectors/http2_inspect/http2_headers_frame.cc +++ b/src/service_inspectors/http2_inspect/http2_headers_frame.cc @@ -148,7 +148,9 @@ Http2HeadersFrame::Http2HeadersFrame(const uint8_t* header_buffer, const int32_t dummy_pkt.packet_flags = (source_id == SRC_CLIENT) ? PKT_FROM_CLIENT : PKT_FROM_SERVER; dummy_pkt.dsize = stream_buf.length; dummy_pkt.data = stream_buf.data; + dummy_pkt.xtradata_mask = 0; session_data->hi->eval(&dummy_pkt); + xtradata_mask = dummy_pkt.xtradata_mask; } } diff --git a/src/service_inspectors/http2_inspect/http2_headers_frame.h b/src/service_inspectors/http2_inspect/http2_headers_frame.h index da3f80f94..f022ec2f2 100644 --- a/src/service_inspectors/http2_inspect/http2_headers_frame.h +++ b/src/service_inspectors/http2_inspect/http2_headers_frame.h @@ -34,6 +34,7 @@ public: void clear() override; const Field& get_buf(unsigned id) override; + uint32_t get_xtradata_mask() override { return xtradata_mask; } friend Http2Frame* Http2Frame::new_frame(const uint8_t*, const int32_t, const uint8_t*, const int32_t, Http2FlowData*, HttpCommon::SourceId); @@ -54,5 +55,6 @@ private: const Field* start_line = nullptr; bool error_during_decode = false; bool hi_abort = false; + uint32_t xtradata_mask = 0; }; #endif diff --git a/src/service_inspectors/http2_inspect/http2_inspect.cc b/src/service_inspectors/http2_inspect/http2_inspect.cc index 0fa6646e1..809b05b82 100644 --- a/src/service_inspectors/http2_inspect/http2_inspect.cc +++ b/src/service_inspectors/http2_inspect/http2_inspect.cc @@ -129,6 +129,8 @@ void Http2Inspect::eval(Packet* p) session_data->frame_header_size[source_id], session_data->frame_data[source_id], session_data->frame_data_size[source_id], source_id); + p->xtradata_mask |= stream->get_xtradata_mask(); + // The current frame now owns these buffers, clear them from the flow data session_data->frame_header[source_id] = nullptr; session_data->frame_data[source_id] = nullptr; diff --git a/src/service_inspectors/http2_inspect/http2_stream.h b/src/service_inspectors/http2_inspect/http2_stream.h index 3e4ff6e13..8a2ebed2b 100644 --- a/src/service_inspectors/http2_inspect/http2_stream.h +++ b/src/service_inspectors/http2_inspect/http2_stream.h @@ -44,6 +44,8 @@ public: { assert(hi_flow_data == nullptr); hi_flow_data = flow_data; } HttpMsgSection* get_hi_msg_section() const { return hi_msg_section; } void set_hi_msg_section(HttpMsgSection* section) { hi_msg_section = section; } + uint32_t get_xtradata_mask() { return (current_frame != nullptr) ? + current_frame->get_xtradata_mask() : 0; } #ifdef REG_TEST void print_frame(FILE* output); #endif diff --git a/src/service_inspectors/http_inspect/http_context_data.cc b/src/service_inspectors/http_inspect/http_context_data.cc index f59617a73..e9b912a60 100644 --- a/src/service_inspectors/http_inspect/http_context_data.cc +++ b/src/service_inspectors/http_inspect/http_context_data.cc @@ -33,19 +33,39 @@ unsigned HttpContextData::ips_id = 0; HttpMsgSection* HttpContextData::get_snapshot(const Packet* p) { - // FIXIT-H checking for nullptr prevents a crash but it doesn't solve the problem of making - // xtra data work with H2I - if ((p != nullptr) && (Http2FlowData::inspector_id != 0)) + assert(p != nullptr); + + if (Http2FlowData::inspector_id != 0) { const Http2FlowData* const h2i_flow_data = - (Http2FlowData*)p->flow->get_flow_data(Http2FlowData::inspector_id); + (Http2FlowData*)p->flow->get_flow_data(Http2FlowData::inspector_id); if (h2i_flow_data != nullptr) return h2i_flow_data->get_hi_msg_section(); } - IpsContext* context = p ? p->context : nullptr; HttpContextData* hcd = (HttpContextData*)DetectionEngine::get_data(HttpContextData::ips_id, - context); + p->context); + + if ( !hcd ) + return nullptr; + + return hcd->current_section; +} + +HttpMsgSection* HttpContextData::get_snapshot(const Flow* flow) +{ + assert(flow != nullptr); + + if (Http2FlowData::inspector_id != 0) + { + const Http2FlowData* const h2i_flow_data = + (Http2FlowData*)flow->get_flow_data(Http2FlowData::inspector_id); + if (h2i_flow_data != nullptr) + return h2i_flow_data->get_hi_msg_section(); + } + + HttpContextData* hcd = (HttpContextData*)DetectionEngine::get_data(HttpContextData::ips_id, + nullptr); if ( !hcd ) return nullptr; diff --git a/src/service_inspectors/http_inspect/http_context_data.h b/src/service_inspectors/http_inspect/http_context_data.h index 630734532..0114d73dd 100644 --- a/src/service_inspectors/http_inspect/http_context_data.h +++ b/src/service_inspectors/http_inspect/http_context_data.h @@ -33,6 +33,7 @@ public: static void init() { ips_id = IpsContextData::get_ips_id(); } static HttpMsgSection* get_snapshot(const snort::Packet* p); + static HttpMsgSection* get_snapshot(const snort::Flow* flow); static void save_snapshot(HttpMsgSection* section); static HttpMsgSection* clear_snapshot(snort::IpsContext* context); static unsigned ips_id; diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc index 7317a1d40..653b63f55 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/src/service_inspectors/http_inspect/http_inspect.cc @@ -221,9 +221,9 @@ bool HttpInspect::get_fp_buf(InspectionBuffer::Type ibt, Packet* p, InspectionBu return get_buf(ibt, p, b); } -int HttpInspect::get_xtra_trueip(Flow*, uint8_t** buf, uint32_t* len, uint32_t* type) +int HttpInspect::get_xtra_trueip(Flow* flow, uint8_t** buf, uint32_t* len, uint32_t* type) { - HttpMsgSection* current_section = HttpContextData::get_snapshot(nullptr); + HttpMsgSection* current_section = HttpContextData::get_snapshot(flow); if (current_section == nullptr) return 0; @@ -241,9 +241,9 @@ int HttpInspect::get_xtra_trueip(Flow*, uint8_t** buf, uint32_t* len, uint32_t* return 1; } -int HttpInspect::get_xtra_uri(Flow*, uint8_t** buf, uint32_t* len, uint32_t* type) +int HttpInspect::get_xtra_uri(Flow* flow, uint8_t** buf, uint32_t* len, uint32_t* type) { - HttpMsgSection* current_section = HttpContextData::get_snapshot(nullptr); + HttpMsgSection* current_section = HttpContextData::get_snapshot(flow); if (current_section == nullptr) return 0; @@ -262,9 +262,9 @@ int HttpInspect::get_xtra_uri(Flow*, uint8_t** buf, uint32_t* len, uint32_t* typ return 1; } -int HttpInspect::get_xtra_host(Flow*, uint8_t** buf, uint32_t* len, uint32_t* type) +int HttpInspect::get_xtra_host(Flow* flow, uint8_t** buf, uint32_t* len, uint32_t* type) { - HttpMsgSection* current_section = HttpContextData::get_snapshot(nullptr); + HttpMsgSection* current_section = HttpContextData::get_snapshot(flow); if (current_section == nullptr) return 0; @@ -286,9 +286,9 @@ int HttpInspect::get_xtra_host(Flow*, uint8_t** buf, uint32_t* len, uint32_t* ty // The name of this method reflects its legacy purpose. We actually return the normalized data // from a response message body which may include other forms of normalization in addition to // JavaScript normalization. But if you don't turn JavaScript normalization on you get nothing. -int HttpInspect::get_xtra_jsnorm(Flow*, uint8_t** buf, uint32_t* len, uint32_t* type) +int HttpInspect::get_xtra_jsnorm(Flow* flow, uint8_t** buf, uint32_t* len, uint32_t* type) { - HttpMsgSection* current_section = HttpContextData::get_snapshot(nullptr); + HttpMsgSection* current_section = HttpContextData::get_snapshot(flow); if ((current_section == nullptr) || (current_section->get_source_id() != SRC_SERVER) ||