http: fix multipart parsing leading to missing chunks of files in file extraction.

diff --git a/src/app-layer-htp-file.c b/src/app-layer-htp-file.c
index 341d7ff011f7463dbf87331e4cadc5b402bab291..80aa6a349caf791f1958e66877d190183c5e72bd 100644 (file)
--- a/src/app-layer-htp-file.c
+++ b/src/app-layer-htp-file.c
@@ -1290,6 +1290,150 @@ end:
     return result;
 }
 
+/** \test filedata cut in two pieces */
+static int HTPFileParserTest11(void) {
+    int result = 0;
+    Flow *f = NULL;
+    uint8_t httpbuf1[] = "POST /upload.cgi HTTP/1.1\r\n"
+                         "Host: www.server.lan\r\n"
+                         "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Length: 1102\r\n"
+                         "\r\n";
+    uint32_t httplen1 = sizeof(httpbuf1) - 1; /* minus the \0 */
+
+    uint8_t httpbuf2[] = "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n";
+    uint32_t httplen2 = sizeof(httpbuf2) - 1; /* minus the \0 */
+
+    uint8_t httpbuf3[] = "Content-Disposition: form-data; name=\"PROGRESS_URL\"\r\n"
+                         "\r\n"
+                         "http://somserver.com/progress.php?UPLOAD_IDENTIFIER=XXXXXXXXX.XXXXXXXXXX.XXXXXXXX.XX.X\r\n"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Disposition: form-data; name=\"DESTINATION_DIR\"\r\n"
+                         "\r\n"
+                         "10\r\n"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Disposition: form-data; name=\"js_enabled\"\r\n"
+                         "\r\n"
+                         "1"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Disposition: form-data; name=\"signature\"\r\n"
+                         "\r\n"
+                         "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\r\n"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Disposition: form-data; name=\"upload_files\"\r\n"
+                         "\r\n"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Disposition: form-data; name=\"terms\"\r\n"
+                         "\r\n"
+                         "1"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Disposition: form-data; name=\"file[]\"\r\n"
+                         "\r\n"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Disposition: form-data; name=\"description[]\"\r\n"
+                         "\r\n"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo\r\n"
+                         "Content-Disposition: form-data; name=\"upload_file[]\"; filename=\"filename.doc\"\r\n"
+                         "Content-Type: application/msword\r\n"
+                         "\r\n"
+                         "FILE";
+    uint32_t httplen3 = sizeof(httpbuf3) - 1; /* minus the \0 */
+
+    uint8_t httpbuf4[] = "CONTENT\r\n"
+                         "------WebKitFormBoundaryBRDbP74mBhBxsIdo--";
+    uint32_t httplen4 = sizeof(httpbuf4) - 1; /* minus the \0 */
+
+    TcpSession ssn;
+    HtpState *http_state = NULL;
+
+    memset(&ssn, 0, sizeof(ssn));
+
+    f = UTHBuildFlow(AF_INET, "1.2.3.4", "1.2.3.5", 1024, 80);
+    if (f == NULL)
+        goto end;
+    f->protoctx = &ssn;
+
+    StreamTcpInitConfig(TRUE);
+
+    SCLogDebug("\n>>>> processing chunk 1 <<<<\n");
+    int r = AppLayerParse(NULL, f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START, httpbuf1, httplen1);
+    if (r != 0) {
+        printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
+        goto end;
+    }
+
+    SCLogDebug("\n>>>> processing chunk 2 size %u <<<<\n", httplen2);
+    r = AppLayerParse(NULL, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf2, httplen2);
+    if (r != 0) {
+        printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
+        goto end;
+    }
+
+    SCLogDebug("\n>>>> processing chunk 3 size %u <<<<\n", httplen3);
+    r = AppLayerParse(NULL, f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3);
+    if (r != 0) {
+        printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
+        goto end;
+    }
+
+    SCLogDebug("\n>>>> processing chunk 4 size %u <<<<\n", httplen4);
+    r = AppLayerParse(NULL, f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_EOF, httpbuf4, httplen4);
+    if (r != 0) {
+        printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r);
+        goto end;
+    }
+
+    http_state = f->alstate;
+    if (http_state == NULL) {
+        printf("no http state: ");
+        goto end;
+    }
+
+    AppLayerDecoderEvents *decoder_events = AppLayerGetDecoderEventsForFlow(f);
+    if (decoder_events != NULL) {
+        printf("app events: ");
+        goto end;
+    }
+
+    htp_tx_t *tx = list_get(http_state->connp->conn->transactions, 0);
+    if (tx == NULL) {
+        goto end;
+    }
+
+    if (tx->request_method == NULL || memcmp(bstr_tocstr(tx->request_method), "POST", 4) != 0)
+    {
+        printf("expected method POST, got %s \n", bstr_tocstr(tx->request_method));
+        goto end;
+    }
+
+    if (http_state->files_ts == NULL || http_state->files_ts->tail == NULL ||
+            http_state->files_ts->tail->state != FILE_STATE_CLOSED) {
+        printf("state != FILE_STATE_CLOSED: ");
+        goto end;
+    }
+
+    if (http_state->files_ts->head->chunks_head->len != 11) {
+        printf("expected 11 but file is %u bytes instead: ",
+                http_state->files_ts->head->chunks_head->len);
+        PrintRawDataFp(stdout, http_state->files_ts->head->chunks_head->data,
+                http_state->files_ts->head->chunks_head->len);
+        goto end;
+    }
+
+    if (memcmp("FILECONTENT", http_state->files_ts->head->chunks_head->data,
+                http_state->files_ts->head->chunks_head->len) != 0) {
+        goto end;
+    }
+
+    result = 1;
+end:
+    StreamTcpFreeConfig(TRUE);
+    if (http_state != NULL)
+        HTPStateFree(http_state);
+    UTHFreeFlow(f);
+    return result;
+}
+
 #endif /* UNITTESTS */
 
 void HTPFileParserRegisterTests(void) {
@@ -1304,5 +1448,6 @@ void HTPFileParserRegisterTests(void) {
     UtRegisterTest("HTPFileParserTest08", HTPFileParserTest08, 1);
     UtRegisterTest("HTPFileParserTest09", HTPFileParserTest09, 1);
     UtRegisterTest("HTPFileParserTest10", HTPFileParserTest10, 1);
+    UtRegisterTest("HTPFileParserTest11", HTPFileParserTest11, 1);
 #endif /* UNITTESTS */
 }

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 261578419410754fce43d2c6a611ef236650be9d..62f81da152e943896346a25014432465b1b019ce 100644 (file)
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -1545,9 +1545,6 @@ int HtpRequestBodyHandleMultipart(HtpState *hstate, HtpTxUserData *htud,
                     htud->request_body.body_parsed += (header_end - chunks_buffer);
                 }
             }
-
-        } else {
-            htud->request_body.body_parsed += (header_end - chunks_buffer);
         }
 next:
         SCLogDebug("header_start %p, header_end %p, form_end %p",