From 1f8e2d15e12e1af2c22b8004ba85e067a269f1cf Mon Sep 17 00:00:00 2001 From: "Russ Combs (rucombs)" Date: Wed, 30 Sep 2015 17:09:40 -0400 Subject: [PATCH] Merge pull request #52 in SNORT/snort3 from nhttp19 to master Squashed commit of the following: commit f9451d42bc6ad29c895b55180550f49ddbe48081 Author: Tom Peters Date: Tue Sep 29 10:51:52 2015 -0400 File processing fix --- src/service_inspectors/nhttp_inspect/nhttp_cutter.cc | 1 + src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc | 4 ++++ src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc | 6 +++++- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc b/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc index fcba4bd99..25ff98e18 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_cutter.cc @@ -308,6 +308,7 @@ ScanResult NHttpChunkCutter::cut(const uint8_t* buffer, uint32_t length, } else if (buffer[k] == '\n') { + // FIXIT-L better to keep parsing chunks after bare LF (several changes needed)? infractions += INF_CHUNK_BARE_LF; events.create_event(EVENT_BROKEN_CHUNK); curr_state = CHUNK_BAD; diff --git a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc index 6d524f8a6..0da4b0713 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc @@ -110,6 +110,10 @@ void NHttpFlowData::show(FILE* out_file) const fprintf(out_file, "Status code: %d\n", status_code_num); fprintf(out_file, "Type expected: %d/%d\n", type_expected[0], type_expected[1]); fprintf(out_file, "Data length: %" PRIi64 "/%" PRIi64 "\n", data_length[0], data_length[1]); + fprintf(out_file, "Detect depth remaining: %" PRIi64 "/%" PRIi64 "\n", + detect_depth_remaining[0], detect_depth_remaining[1]); + fprintf(out_file, "File depth remaining: %" PRIi64 "/%" PRIi64 "\n", file_depth_remaining[0], + file_depth_remaining[1]); fprintf(out_file, "Body octets: %" PRIi64 "/%" PRIi64 "\n", body_octets[0], body_octets[1]); fprintf(out_file, "Pipelining: front %d back %d overflow %d underflow %d\n", pipeline_front, pipeline_back, pipeline_overflow, pipeline_underflow); diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc index 3441949dd..7ab49b75f 100644 --- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc +++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc @@ -124,7 +124,7 @@ void NHttpMsgHeader::setup_file_processing() { // FIXIT-M Bidirectional file processing is problematic so we don't do it. When the library // fully supports it remove the outer if statement that prevents it from being done. - if (session_data->file_depth_remaining[1-source_id] == 0) + if (session_data->file_depth_remaining[1-source_id] <= 0) { if ((session_data->file_depth_remaining[source_id] = FileService::get_max_file_depth()) < 0) { @@ -143,6 +143,10 @@ void NHttpMsgHeader::setup_file_processing() session_data->file_depth_remaining[source_id] = 0; } } + else + { + session_data->file_depth_remaining[source_id] = 0; + } } void NHttpMsgHeader::setup_decompression() -- 2.47.3