Merge pull request #846 in SNORT/snort3 from nhttp68 to master

Squashed commit of the following:

commit 5285027596f1c21bb700a05933ff9cf7639568f7
Author: Tom Peters <thopeter@cisco.com>
Date:   Wed Mar 22 16:46:50 2017 -0400

    New feature for test tool used to investigate chunk reassembly problem

diff --git a/src/service_inspectors/http_inspect/http_enum.h b/src/service_inspectors/http_inspect/http_enum.h
index dc7bc0da646b2f2c901e7c796dbaf214a7fab651..f72b01a2c0cc959b726b5fd1f782e5dc339e8aa3 100644 (file)
--- a/src/service_inspectors/http_inspect/http_enum.h
+++ b/src/service_inspectors/http_inspect/http_enum.h
@@ -238,7 +238,7 @@ enum EventSid
     EVENT_DOUBLE_DECODE,
     EVENT_U_ENCODE,
     EVENT_BARE_BYTE,
-    EVENT_OBSOLETE_1,
+    EVENT_OBSOLETE_1,       // Previously used, do not reuse this number
     EVENT_UTF_8,
     EVENT_IIS_UNICODE,
     EVENT_MULTI_SLASH,
@@ -270,12 +270,12 @@ enum EventSid
     EVENT_PIPELINE_MAX,
     EVENT_ANOM_SERVER,
     EVENT_INVALID_STATCODE,
-    EVENT_NO_CONTLEN,
+    EVENT_UNUSED_1,
     EVENT_UTF_NORM_FAIL,
     EVENT_UTF7,
     EVENT_DECOMPR_FAILED,
     EVENT_CONSECUTIVE_SMALL_CHUNKS_S,
-    EVENT_MSG_SIZE_EXCEPTION,
+    EVENT_UNUSED_2,
     EVENT_JS_OBFUSCATION_EXCD,
     EVENT_JS_EXCESS_WS,
     EVENT_MIXED_ENCODINGS,

diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc
index b695cb6b951265a17586be6b85180a15891546fb..238ddeadf6aff075723c7df6a103cdb143115c13 100644 (file)
--- a/src/service_inspectors/http_inspect/http_inspect.cc
+++ b/src/service_inspectors/http_inspect/http_inspect.cc
@@ -51,6 +51,7 @@ HttpInspect::HttpInspect(const HttpParaList* params_) : params(params_)
     HttpTestManager::set_print_amount(params->print_amount);
     HttpTestManager::set_print_hex(params->print_hex);
     HttpTestManager::set_show_pegs(params->show_pegs);
+    HttpTestManager::set_show_scan(params->show_scan);
 #endif
 }
 

diff --git a/src/service_inspectors/http_inspect/http_module.cc b/src/service_inspectors/http_inspect/http_module.cc
index fd144a6071647d2afe7267858daddf9f31c37126..bd7dfbb07167a11eb71b9da41f35bf42bf892eb8 100644 (file)
--- a/src/service_inspectors/http_inspect/http_module.cc
+++ b/src/service_inspectors/http_inspect/http_module.cc
@@ -81,6 +81,7 @@ const Parameter HttpModule::http_params[] =
     { "print_hex", Parameter::PT_BOOL, nullptr, "false",
       "nonprinting characters printed in [HH] format instead of using an asterisk" },
     { "show_pegs", Parameter::PT_BOOL, nullptr, "true", "display peg counts with test output" },
+    { "show_scan", Parameter::PT_BOOL, nullptr, "false", "display scanned segments" },
 #endif
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -209,6 +210,10 @@ bool HttpModule::set(const char*, Value& val, SnortConfig*)
     {
         params->show_pegs = val.get_bool();
     }
+    else if (val.is("show_scan"))
+    {
+        params->show_scan = val.get_bool();
+    }
 #endif
     else
     {

diff --git a/src/service_inspectors/http_inspect/http_module.h b/src/service_inspectors/http_inspect/http_module.h
index 44e2abfc3d3e14b4ed4f97d7d616d36c5c94bb65..9f6bc7e0eaa6caa5fa88df319d3e80c0c261c552 100644 (file)
--- a/src/service_inspectors/http_inspect/http_module.h
+++ b/src/service_inspectors/http_inspect/http_module.h
@@ -80,6 +80,7 @@ public:
     long print_amount;
     bool print_hex;
     bool show_pegs;
+    bool show_scan;
 #endif
 };
 

diff --git a/src/service_inspectors/http_inspect/http_msg_head_shared.cc b/src/service_inspectors/http_inspect/http_msg_head_shared.cc
index 6541837a4dacd4eef1c0e4d7efe3fe268fd43e88..ef5abd5c7a84a4a7622711b3a14c51cf35063276 100644 (file)
--- a/src/service_inspectors/http_inspect/http_msg_head_shared.cc
+++ b/src/service_inspectors/http_inspect/http_msg_head_shared.cc
@@ -106,7 +106,6 @@ void HttpMsgHeadShared::parse_header_block()
     }
     if (bytes_used < msg_text.length())
     {
-        // FIXIT-M eventually need to separate max header alert from internal maximum
         infractions += INF_TOO_MANY_HEADERS;
         events.create_event(EVENT_MAX_HEADERS);
     }

diff --git a/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc b/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
index b43edcfbd4770d495abb3498ce31eca4fcbea712..b799348f2a406cfc3e49b8abe31258e4092b2dea 100644 (file)
--- a/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
+++ b/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
@@ -118,6 +118,10 @@ StreamSplitter::Status HttpStreamSplitter::scan(Flow* flow, const uint8_t* data,
             " direction %d length %u client port %u server port %u\n", session_data->seq_num,
             source_id, length, flow->client_port, flow->server_port);
         fflush(stdout);
+        if (HttpTestManager::get_show_scan())
+        {
+            Field(length, data).print(stdout, "Scan segment");
+        }
     }
 #endif
 

diff --git a/src/service_inspectors/http_inspect/http_tables.cc b/src/service_inspectors/http_inspect/http_tables.cc
index 3e169319e88ec4ed25acf1ee6cdec1a58d948918..7b9005e2c3274d1bbcd65360bbb9d4dc76863dca 100644 (file)
--- a/src/service_inspectors/http_inspect/http_tables.cc
+++ b/src/service_inspectors/http_inspect/http_tables.cc
@@ -305,12 +305,12 @@ const RuleMap HttpModule::http_events[] =
     { EVENT_PIPELINE_MAX,               "too many pipelined requests" },
     { EVENT_ANOM_SERVER,                "anomalous http server on undefined HTTP port" },
     { EVENT_INVALID_STATCODE,           "invalid status code in HTTP response" },
-    { EVENT_NO_CONTLEN,                 "no content-length or transfer-encoding in HTTP response" },
+    { EVENT_UNUSED_1,                   "unused event number--should not appear" },
     { EVENT_UTF_NORM_FAIL,              "HTTP response has UTF charset which failed to normalize" },
     { EVENT_UTF7,                       "HTTP response has UTF-7 charset" },
     { EVENT_DECOMPR_FAILED,             "HTTP response gzip decompression failed" },
     { EVENT_CONSECUTIVE_SMALL_CHUNKS_S, "server consecutive small chunk sizes" },
-    { EVENT_MSG_SIZE_EXCEPTION,         "invalid content-length or chunk size" },
+    { EVENT_UNUSED_2,                   "unused event number--should not appear" },
     { EVENT_JS_OBFUSCATION_EXCD,        "javascript obfuscation levels exceeds 1" },
     { EVENT_JS_EXCESS_WS,               "javascript whitespaces exceeds max allowed" },
     { EVENT_MIXED_ENCODINGS,            "multiple encodings within javascript obfuscated data" },

diff --git a/src/service_inspectors/http_inspect/http_test_manager.cc b/src/service_inspectors/http_inspect/http_test_manager.cc
index 7b6f2573e13c8fcc9c2ebe5fbde4ff5a1ca95edc..0d0e82928c712af6b86ac0abf94cfa14bd41fc9e 100644 (file)
--- a/src/service_inspectors/http_inspect/http_test_manager.cc
+++ b/src/service_inspectors/http_inspect/http_test_manager.cc
@@ -38,6 +38,7 @@ FILE* HttpTestManager::test_out = nullptr;
 long HttpTestManager::print_amount = 1200;
 bool HttpTestManager::print_hex = false;
 bool HttpTestManager::show_pegs = true;
+bool HttpTestManager::show_scan = false;
 
 void HttpTestManager::update_test_number(int64_t new_test_number)
 {

diff --git a/src/service_inspectors/http_inspect/http_test_manager.h b/src/service_inspectors/http_inspect/http_test_manager.h
index 5a23c5e549929855db5bc5e1eea5b0cc3dce2436..0dd9d2c4b548d51c43e44f9bded43c34a3893755 100644 (file)
--- a/src/service_inspectors/http_inspect/http_test_manager.h
+++ b/src/service_inspectors/http_inspect/http_test_manager.h
@@ -48,6 +48,8 @@ public:
     static bool get_print_hex() { return print_hex; }
     static void set_show_pegs(bool show_pegs_) { show_pegs = show_pegs_; }
     static bool get_show_pegs() { return show_pegs; }
+    static void set_show_scan(bool show_scan_) { show_scan = show_scan_; }
+    static bool get_show_scan() { return show_scan; }
 
 private:
     HttpTestManager() = delete;
@@ -63,6 +65,7 @@ private:
     static long print_amount;
     static bool print_hex;
     static bool show_pegs;
+    static bool show_scan;
 };
 
 #endif