From 4f53d17f1817d0e565da6b25153627240c6a8973 Mon Sep 17 00:00:00 2001 From: Russ Combs Date: Sat, 22 Oct 2016 11:08:07 -0400 Subject: [PATCH] move remaining http_inspect thread local to flow data --- src/detection/detection_engine.cc | 1 + src/events/event_queue.cc | 2 -- .../http_inspect/http_flow_data.h | 2 ++ .../http_inspect/http_inspect.cc | 25 +++++++++---------- .../http_inspect/ips_http.cc | 1 + 5 files changed, 16 insertions(+), 15 deletions(-) diff --git a/src/detection/detection_engine.cc b/src/detection/detection_engine.cc index a28aad097..7eb2d7a50 100644 --- a/src/detection/detection_engine.cc +++ b/src/detection/detection_engine.cc @@ -23,6 +23,7 @@ #include "detection/detection_engine.h" #include "events/sfeventq.h" #include "filters/sfthreshold.h" +#include "framework/endianness.h" #include "latency/packet_latency.h" #include "main/snort.h" #include "main/snort_config.h" diff --git a/src/events/event_queue.cc b/src/events/event_queue.cc index 83b9176b8..dff83f132 100644 --- a/src/events/event_queue.cc +++ b/src/events/event_queue.cc @@ -69,8 +69,6 @@ #include "sfeventq.h" -static THREAD_LOCAL unsigned s_events = 0; - //------------------------------------------------- EventQueueConfig* EventQueueConfigNew() diff --git a/src/service_inspectors/http_inspect/http_flow_data.h b/src/service_inspectors/http_inspect/http_flow_data.h index 1c411af03..e74144c3b 100644 --- a/src/service_inspectors/http_inspect/http_flow_data.h +++ b/src/service_inspectors/http_inspect/http_flow_data.h @@ -68,6 +68,8 @@ private: // 0 element refers to client request, 1 element refers to server response + // FIXIT-P reorganize HttpFlowData to minimize void space + // *** StreamSplitter internal data - scan() HttpCutter* cutter[2] = { nullptr, nullptr }; diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc index 3156e9432..005806045 100644 --- a/src/service_inspectors/http_inspect/http_inspect.cc +++ b/src/service_inspectors/http_inspect/http_inspect.cc @@ -143,35 +143,34 @@ const Field& HttpInspect::process(const uint8_t* data, const uint16_t dsize, Flo HttpModule::increment_peg_counts(PEG_INSPECT); - HttpMsgSection*& latest_section = session_data->latest_section; switch (session_data->section_type[source_id]) { case SEC_REQUEST: - latest_section = new HttpMsgRequest( + session_data->latest_section = new HttpMsgRequest( data, dsize, session_data, source_id, buf_owner, flow, params); break; case SEC_STATUS: - latest_section = new HttpMsgStatus( + session_data->latest_section = new HttpMsgStatus( data, dsize, session_data, source_id, buf_owner, flow, params); break; case SEC_HEADER: - latest_section = new HttpMsgHeader( + session_data->latest_section = new HttpMsgHeader( data, dsize, session_data, source_id, buf_owner, flow, params); break; case SEC_BODY_CL: - latest_section = new HttpMsgBodyCl( + session_data->latest_section = new HttpMsgBodyCl( data, dsize, session_data, source_id, buf_owner, flow, params); break; case SEC_BODY_OLD: - latest_section = new HttpMsgBodyOld( + session_data->latest_section = new HttpMsgBodyOld( data, dsize, session_data, source_id, buf_owner, flow, params); break; case SEC_BODY_CHUNK: - latest_section = new HttpMsgBodyChunk( + session_data->latest_section = new HttpMsgBodyChunk( data, dsize, session_data, source_id, buf_owner, flow, params); break; case SEC_TRAILER: - latest_section = new HttpMsgTrailer( + session_data->latest_section = new HttpMsgTrailer( data, dsize, session_data, source_id, buf_owner, flow, params); break; default: @@ -183,13 +182,13 @@ const Field& HttpInspect::process(const uint8_t* data, const uint16_t dsize, Flo return Field::FIELD_NULL; } - latest_section->analyze(); - latest_section->update_flow(); + session_data->latest_section->analyze(); + session_data->latest_section->update_flow(); #ifdef REG_TEST if (HttpTestManager::use_test_output()) { - latest_section->print_section(HttpTestManager::get_output_file()); + session_data->latest_section->print_section(HttpTestManager::get_output_file()); fflush(HttpTestManager::get_output_file()); if (HttpTestManager::use_test_input()) { @@ -200,8 +199,8 @@ const Field& HttpInspect::process(const uint8_t* data, const uint16_t dsize, Flo } #endif - latest_section->publish(); - return latest_section->get_detect_buf(); + session_data->latest_section->publish(); + return session_data->latest_section->get_detect_buf(); } void HttpInspect::clear(Packet* p) diff --git a/src/service_inspectors/http_inspect/ips_http.cc b/src/service_inspectors/http_inspect/ips_http.cc index 181c6ab2b..e98f29d6b 100644 --- a/src/service_inspectors/http_inspect/ips_http.cc +++ b/src/service_inspectors/http_inspect/ips_http.cc @@ -29,6 +29,7 @@ #include "log/messages.h" #include "protocols/packet.h" +#include "http_flow_data.h" #include "http_inspect.h" #include "http_msg_head_shared.h" -- 2.47.2