From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Wed, 14 Oct 2015 16:45:34 +0000 (-0400)
Subject: Merge pull request #78 in SNORT/snort3 from nhttp21 to master
X-Git-Tag: 3.0.0-233~787
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fa0c6c8b7eb3f8d0033d88f35d8d186c4dee9123;p=thirdparty%2Fsnort3.git

Merge pull request #78 in SNORT/snort3 from nhttp21 to master

Squashed commit of the following:

commit b337c08a020355526198b3a29fa0755de7b64de9
Author: Tom Peters <thopeter@cisco.com>
Date:   Tue Oct 13 10:52:25 2015 -0400

    gen_events() no longer public
---

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_enum.h b/src/service_inspectors/nhttp_inspect/nhttp_enum.h
index 9f0e035c6..7c4e9453d 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_enum.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_enum.h
@@ -97,7 +97,7 @@ enum HeaderId { HEAD__NOTCOMPUTE=-14, HEAD__INSUFMEMORY=-13, HEAD__PROBLEMATIC=-
 // All the infractions we might find while parsing and analyzing a message
 enum Infraction
 {
-    INF_TRUNCATED = 0,
+    INF_NOT_USED_1 = 0,
     INF_HEAD_TOO_LONG,
     INF_BAD_REQ_LINE,
     INF_BAD_STAT_LINE,
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc b/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
index 1d32db43f..d2b6ee11c 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
@@ -132,7 +132,6 @@ const Field& NHttpInspect::process(const uint8_t* data, const uint16_t dsize, Fl
 
     latest_section->analyze();
     latest_section->update_flow();
-    latest_section->gen_events();
 
 #ifdef REG_TEST
     if (NHttpTestManager::use_test_output())
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
index f3516bc12..ba03ec947 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
@@ -64,9 +64,6 @@ void NHttpMsgBody::analyze()
     }
 
     body_octets += msg_text.length;
-
-    if (tcp_close && (body_octets < data_length))
-        infractions += INF_TRUNCATED;
 }
 
 void NHttpMsgBody::do_file_processing()
@@ -132,10 +129,6 @@ void NHttpMsgBody::do_file_processing()
     }
 }
 
-void NHttpMsgBody::gen_events()
-{
-}
-
 void NHttpMsgBody::print_section(FILE* output)
 {
     NHttpMsgSection::print_message_title(output, "body");
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.h
index de62f4425..6aa3b15d3 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.h
@@ -35,7 +35,6 @@ public:
         const NHttpParaList* params_);
     void analyze() override;
     void print_section(FILE* output) override;
-    void gen_events() override;
     void update_flow() override;
     Field& get_detect_data() { return detect_data; }
     const Field& get_detect_buf() const override { return detect_data; }
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
index e99c1e079..4a64dc7df 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
@@ -36,8 +36,6 @@ NHttpMsgChunk::NHttpMsgChunk(const uint8_t* buffer, const uint16_t buf_size,
     transaction->set_body(this);
 }
 
-void NHttpMsgChunk::gen_events() { }
-
 void NHttpMsgChunk::print_section(FILE* output)
 {
     NHttpMsgSection::print_message_title(output, "chunked body");
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.h
index 57ff77eaa..f48731935 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.h
@@ -33,7 +33,6 @@ public:
         NHttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
         const NHttpParaList* params_);
     void print_section(FILE* output) override;
-    void gen_events() override;
     void update_flow() override;
 };
 
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
index 4c1711a31..6fe40da7e 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
@@ -39,12 +39,6 @@ NHttpMsgHeader::NHttpMsgHeader(const uint8_t* buffer, const uint16_t buf_size,
     transaction->set_header(this, source_id);
 }
 
-void NHttpMsgHeader::gen_events()
-{
-    if (get_header_count(HEAD_CONTENT_LENGTH) > 1)
-        events.create_event(EVENT_MULTIPLE_CONTLEN);
-}
-
 void NHttpMsgHeader::print_section(FILE* output)
 {
     NHttpMsgSection::print_message_title(output, "header");
@@ -56,6 +50,11 @@ void NHttpMsgHeader::update_flow()
 {
     session_data->section_type[source_id] = SEC__NOTCOMPUTE;
 
+    // FIXIT-L put this test here for now. May want to integrate into the following code and
+    // do more careful checks for inappropriate Content-Length.
+    if (get_header_count(HEAD_CONTENT_LENGTH) > 1)
+        events.create_event(EVENT_MULTIPLE_CONTLEN);
+
     // The following logic to determine body type is by no means the last word on this topic.
     // FIXIT-H need to distinguish methods such as POST that should have a body from those that
     // should not.
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
index f06b8d794..f7ac295b7 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
@@ -36,7 +36,6 @@ public:
         NHttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
         const NHttpParaList* params_);
     void print_section(FILE* output) override;
-    void gen_events() override;
     void update_flow() override;
 private:
     // Dummy configurations to support MIME processing
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.h
index a495be986..8672e0dd3 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.h
@@ -42,9 +42,6 @@ public:
     // Minimum necessary processing for every message
     virtual void analyze() = 0;
 
-    // Internal client that triggers JIT processing for optional inspections
-    virtual void gen_events() = 0;
-
     // Manages the splitter and communication between message sections
     virtual void update_flow() = 0;
 
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_start.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_start.cc
index 7ec126618..ea1d7b886 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_start.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_start.cc
@@ -31,6 +31,7 @@ void NHttpMsgStart::analyze()
     start_line.start = msg_text.start;
     start_line.length = msg_text.length;
     parse_start_line();
+    gen_events();
 }
 
 void NHttpMsgStart::derive_version_id()
@@ -68,5 +69,3 @@ void NHttpMsgStart::derive_version_id()
     }
 }
 
-void NHttpMsgStart::gen_events() { }
-
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_start.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_start.h
index 0f552b694..bc44952d6 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_start.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_start.h
@@ -31,7 +31,6 @@ class NHttpMsgStart : public NHttpMsgSection
 {
 public:
     void analyze() override;
-    void gen_events() override;
 
 protected:
     NHttpMsgStart(const uint8_t* buffer, const uint16_t buf_size, NHttpFlowData* session_data_,
@@ -39,6 +38,7 @@ protected:
         : NHttpMsgSection(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
         { }
     virtual void parse_start_line() = 0;
+    virtual void gen_events() {};
     void derive_version_id();
 
     Field start_line;
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
index 2eeb39ecb..8ba4ed5c2 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
@@ -36,10 +36,6 @@ NHttpMsgTrailer::NHttpMsgTrailer(const uint8_t* buffer, const uint16_t buf_size,
     transaction->set_trailer(this, source_id);
 }
 
-void NHttpMsgTrailer::gen_events()
-{
-}
-
 void NHttpMsgTrailer::print_section(FILE* output)
 {
     NHttpMsgSection::print_message_title(output, "trailer");
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.h
index 44a1fb189..ce9137da5 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.h
@@ -33,7 +33,6 @@ public:
         NHttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
         const NHttpParaList* params_);
     void print_section(FILE* output) override;
-    void gen_events() override;
     void update_flow() override;
 };