From 49eb0335de167a4c642b687bd7ef03c1c00ebf98 Mon Sep 17 00:00:00 2001 From: "Russ Combs (rucombs)" Date: Tue, 10 Nov 2015 12:08:22 -0500 Subject: [PATCH] Merge pull request #127 in SNORT/snort3 from crc/obfu to master Squashed commit of the following: commit fe3281566d1987bfd9cdbacc97e614ece01c0399 Author: Russ Combs Date: Tue Nov 10 07:55:56 2015 -0500 rehome OHI only foo commit d4baae181bbb9067d27be9ee72928e35eae67dc7 Author: Russ Combs Date: Tue Nov 10 07:33:09 2015 -0500 do not build obfuscation until needed --- src/detection/detect.cc | 2 ++ src/detection/detection_util.h | 26 ------------------- src/log/CMakeLists.txt | 4 +-- src/log/Makefile.am | 6 +++-- src/log/log_text.cc | 4 +++ src/log/obfuscation.h | 7 +++++ src/loggers/unified2.cc | 6 +++++ src/service_inspectors/http_inspect/hi_main.h | 23 ++++++++++++++++ 8 files changed, 48 insertions(+), 30 deletions(-) diff --git a/src/detection/detect.cc b/src/detection/detect.cc index c079dc4a4..a72023172 100644 --- a/src/detection/detect.cc +++ b/src/detection/detect.cc @@ -127,6 +127,7 @@ void snort_inspect(Packet* p) } else { +#ifdef BUILD_OBFUSCATION /* Not a completely ideal place for this since any entries added on * the packet callback trail will get obliterated - right now there * isn't anything adding entries there. Really need it here for @@ -136,6 +137,7 @@ void snort_inspect(Packet* p) * overflow if we don't reset it. Putting it here does have the * advantage of fewer entries per logging cycle */ obApi->resetObfuscationEntries(); +#endif do_detect = do_detect_content = 1; diff --git a/src/detection/detection_util.h b/src/detection/detection_util.h index 42708a362..556e30d38 100644 --- a/src/detection/detection_util.h +++ b/src/detection/detection_util.h @@ -35,32 +35,6 @@ #define DECODE_BLEN 65535 -// FIXIT-L this is now used only by http_inspect and should be relocated accordingly -enum HTTP_BUFFER -{ - HTTP_BUFFER_NONE, - HTTP_BUFFER_CLIENT_BODY, - HTTP_BUFFER_COOKIE, - HTTP_BUFFER_HEADER, - HTTP_BUFFER_METHOD, - HTTP_BUFFER_RAW_COOKIE, - HTTP_BUFFER_RAW_HEADER, - HTTP_BUFFER_RAW_URI, - HTTP_BUFFER_STAT_CODE, - HTTP_BUFFER_STAT_MSG, - HTTP_BUFFER_URI, - HTTP_BUFFER_MAX -}; - -// FIXIT-L this is now used only by http_inspect -// and should be relocated accordingly -struct HttpBuffer -{ - const uint8_t* buf; - unsigned length; - uint32_t encode_type; -}; - struct DataPointer { uint8_t* data; diff --git a/src/log/CMakeLists.txt b/src/log/CMakeLists.txt index eb6535910..b358cb996 100644 --- a/src/log/CMakeLists.txt +++ b/src/log/CMakeLists.txt @@ -2,7 +2,7 @@ set (LOG_INCLUDES messages.h - obfuscation.h +# obfuscation.h text_log.h ) @@ -13,7 +13,7 @@ add_library ( log STATIC log_text.cc log_text.h messages.cc - obfuscation.cc +# obfuscation.cc text_log.cc ) diff --git a/src/log/Makefile.am b/src/log/Makefile.am index 6f019b374..0ae868b43 100644 --- a/src/log/Makefile.am +++ b/src/log/Makefile.am @@ -5,7 +5,6 @@ x_includedir = $(pkgincludedir)/log x_include_HEADERS = \ messages.h \ -obfuscation.h \ text_log.h liblog_a_SOURCES = \ @@ -14,9 +13,12 @@ log.h \ log_text.cc \ log_text.h \ messages.cc \ -obfuscation.cc \ text_log.cc +EXTRA_DIST = \ +obfuscation.h \ +obfuscation.cc + #liblog_a_CXXFLAGS = $(AM_CXXFLAGS) -fvisibility=default AM_CXXFLAGS = @AM_CXXFLAGS@ diff --git a/src/log/log_text.cc b/src/log/log_text.cc index 886c80d71..92f546d8f 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -1380,6 +1380,7 @@ void LogDiv(TextLog* log) TextLog_Print(log, "%s\n", SEPARATOR); } +#ifdef BUILD_OBFUSCATION static int LogObfuscatedData(TextLog* log, Packet* p) { uint8_t* payload = NULL; @@ -1416,6 +1417,7 @@ static int LogObfuscatedData(TextLog* log, Packet* p) free(payload); return 0; } +#endif /*-------------------------------------------------------------------- * Function: LogIPPkt(TextLog*, int, Packet *) @@ -1508,11 +1510,13 @@ void LogIPPkt(TextLog* log, Packet* p) void LogPayload(TextLog* log, Packet* p) { +#ifdef BUILD_OBFUSCATION if ((p->dsize > 0) && obApi->payloadObfuscationRequired(p) && (LogObfuscatedData(log, p) == 0)) { return; } +#endif /* dump the application layer data */ if (SnortConfig::output_app_data() && !SnortConfig::verbose_byte_dump()) diff --git a/src/log/obfuscation.h b/src/log/obfuscation.h index bd8873dd2..1b5bae805 100644 --- a/src/log/obfuscation.h +++ b/src/log/obfuscation.h @@ -20,6 +20,13 @@ #ifndef OBFUSCATION_H #define OBFUSCATION_H +// BUILD_OBFUSCATION is not defined because nothing creates obfuscation +// entries. when sdf is ported, BUILD_OBFUSCATION should be deleted so the +// full code is built. at that time the api should be turned into an +// obfuscator class and the test code should be replaced with actual unit +// tests. #ifdef BUILD_OBFUSCATION is used in detect.cc, log_text.cc, and +// unified2.cc. + extern "C" { #include } diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc index 1e0b28ef4..8e98e4b85 100644 --- a/src/loggers/unified2.cc +++ b/src/loggers/unified2.cc @@ -131,8 +131,10 @@ static void Unified2Write(uint8_t*, uint32_t, Unified2Config*); static void _AlertIP4_v2(Packet*, const char*, Unified2Config*, Event*); static void _AlertIP6_v2(Packet*, const char*, Unified2Config*, Event*); +#ifdef BUILD_OBFUSCATION static ObRet Unified2LogObfuscationCallback(const DAQ_PktHdr_t* pkth, const uint8_t* packet_data, ob_size_t length, ob_char_t ob_char, void* userdata); +#endif static void AlertExtraData(Flow*, void* data, LogFunction* log_funcs, uint32_t max_count, uint32_t xtradata_mask, uint32_t event_id, uint32_t event_second); @@ -558,6 +560,7 @@ static void _Unified2LogPacketAlert( logheader.event_second = 0; } +#ifdef BUILD_OBFUSCATION if ( p and p->pkth and obApi->payloadObfuscationRequired(p) ) { Unified2LogCallbackData unifiedData; @@ -576,6 +579,7 @@ static void _Unified2LogPacketAlert( return; } } +#endif if ( p and p->pkth ) { @@ -632,6 +636,7 @@ static void _Unified2LogPacketAlert( Unified2Write(write_pkt_buffer, write_len, config); } +#ifdef BUILD_OBFUSCATION static ObRet Unified2LogObfuscationCallback(const DAQ_PktHdr_t* pkth, const uint8_t* packet_data, ob_size_t length, ob_char_t ob_char, void* userdata) @@ -720,6 +725,7 @@ static ObRet Unified2LogObfuscationCallback(const DAQ_PktHdr_t* pkth, return OB_RET_SUCCESS; } +#endif /****************************************************************************** * Function: Unified2Write() diff --git a/src/service_inspectors/http_inspect/hi_main.h b/src/service_inspectors/http_inspect/hi_main.h index 2c50bf978..f76684c86 100644 --- a/src/service_inspectors/http_inspect/hi_main.h +++ b/src/service_inspectors/http_inspect/hi_main.h @@ -50,6 +50,29 @@ #define DEFLATE_WBITS 15 #define GZIP_WBITS 31 +enum HTTP_BUFFER +{ + HTTP_BUFFER_NONE, + HTTP_BUFFER_CLIENT_BODY, + HTTP_BUFFER_COOKIE, + HTTP_BUFFER_HEADER, + HTTP_BUFFER_METHOD, + HTTP_BUFFER_RAW_COOKIE, + HTTP_BUFFER_RAW_HEADER, + HTTP_BUFFER_RAW_URI, + HTTP_BUFFER_STAT_CODE, + HTTP_BUFFER_STAT_MSG, + HTTP_BUFFER_URI, + HTTP_BUFFER_MAX +}; + +struct HttpBuffer +{ + const uint8_t* buf; + unsigned length; + uint32_t encode_type; +}; + extern SO_PUBLIC THREAD_LOCAL uint32_t http_mask; extern SO_PUBLIC THREAD_LOCAL HttpBuffer http_buffer[HTTP_BUFFER_MAX]; extern THREAD_LOCAL DataBuffer HttpDecodeBuf; -- 2.47.3