Merge pull request #78 in SNORT/snort3 from nhttp21 to master

Squashed commit of the following:

commit b337c08a020355526198b3a29fa0755de7b64de9
Author: Tom Peters <thopeter@cisco.com>
Date:   Tue Oct 13 10:52:25 2015 -0400

    gen_events() no longer public

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_enum.h b/src/service_inspectors/nhttp_inspect/nhttp_enum.h
index 9f0e035c69881d9a4980dcbfddbda1ee6b8cdb0f..7c4e9453d41f80a1715a62b25a7f6e2f6edced88 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_enum.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_enum.h
@@ -97,7 +97,7 @@ enum HeaderId { HEAD__NOTCOMPUTE=-14, HEAD__INSUFMEMORY=-13, HEAD__PROBLEMATIC=-
 // All the infractions we might find while parsing and analyzing a message
 enum Infraction
 {
-    INF_TRUNCATED = 0,
+    INF_NOT_USED_1 = 0,
     INF_HEAD_TOO_LONG,
     INF_BAD_REQ_LINE,
     INF_BAD_STAT_LINE,

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc b/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
index 1d32db43fe56c3e8093d17cad6bd0b2047a94a60..d2b6ee11c84444f765c986c68959fb9a736d244e 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_inspect.cc
@@ -132,7 +132,6 @@ const Field& NHttpInspect::process(const uint8_t* data, const uint16_t dsize, Fl
 
     latest_section->analyze();
     latest_section->update_flow();
-    latest_section->gen_events();
 
 #ifdef REG_TEST
     if (NHttpTestManager::use_test_output())

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
index f3516bc12951404ebf84c63512e1249ea7424572..ba03ec947e42730da07147a77e8f1b59b9c4b108 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
@@ -64,9 +64,6 @@ void NHttpMsgBody::analyze()
     }
 
     body_octets += msg_text.length;
-
-    if (tcp_close && (body_octets < data_length))
-        infractions += INF_TRUNCATED;
 }
 
 void NHttpMsgBody::do_file_processing()
@@ -132,10 +129,6 @@ void NHttpMsgBody::do_file_processing()
     }
 }
 
-void NHttpMsgBody::gen_events()
-{
-}
-
 void NHttpMsgBody::print_section(FILE* output)
 {
     NHttpMsgSection::print_message_title(output, "body");

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.h
index de62f4425eb3a7e3b33284d6f83a027738da3970..6aa3b15d3521cde4faaf44b5e729940add0c4d35 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.h
@@ -35,7 +35,6 @@ public:
         const NHttpParaList* params_);
     void analyze() override;
     void print_section(FILE* output) override;
-    void gen_events() override;
     void update_flow() override;
     Field& get_detect_data() { return detect_data; }
     const Field& get_detect_buf() const override { return detect_data; }

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
index e99c1e07909e5e404d166cb8c24442b34958f980..4a64dc7df69325c8e98887e809216abd94192373 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
@@ -36,8 +36,6 @@ NHttpMsgChunk::NHttpMsgChunk(const uint8_t* buffer, const uint16_t buf_size,
     transaction->set_body(this);
 }
 
-void NHttpMsgChunk::gen_events() { }
-
 void NHttpMsgChunk::print_section(FILE* output)
 {
     NHttpMsgSection::print_message_title(output, "chunked body");

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.h
index 57ff77eaa17f4bde6924285d3f149d5bf3be5668..f487319357d3a59207df8a66a4a14e98223a5856 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.h
@@ -33,7 +33,6 @@ public:
         NHttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
         const NHttpParaList* params_);
     void print_section(FILE* output) override;
-    void gen_events() override;
     void update_flow() override;
 };
 

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
index 4c1711a313b20bb477df89fb7394203c34a08b69..6fe40da7e5f27b45dd2bd35063c70767f544d5ad 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
@@ -39,12 +39,6 @@ NHttpMsgHeader::NHttpMsgHeader(const uint8_t* buffer, const uint16_t buf_size,
     transaction->set_header(this, source_id);
 }
 
-void NHttpMsgHeader::gen_events()
-{
-    if (get_header_count(HEAD_CONTENT_LENGTH) > 1)
-        events.create_event(EVENT_MULTIPLE_CONTLEN);
-}
-
 void NHttpMsgHeader::print_section(FILE* output)
 {
     NHttpMsgSection::print_message_title(output, "header");
@@ -56,6 +50,11 @@ void NHttpMsgHeader::update_flow()
 {
     session_data->section_type[source_id] = SEC__NOTCOMPUTE;
 
+    // FIXIT-L put this test here for now. May want to integrate into the following code and
+    // do more careful checks for inappropriate Content-Length.
+    if (get_header_count(HEAD_CONTENT_LENGTH) > 1)
+        events.create_event(EVENT_MULTIPLE_CONTLEN);
+
     // The following logic to determine body type is by no means the last word on this topic.
     // FIXIT-H need to distinguish methods such as POST that should have a body from those that
     // should not.

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
index f06b8d794e0bf79d96379c1ff39b8ea3fb4e0408..f7ac295b7effbca8862098c0831fe4927b452f38 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
@@ -36,7 +36,6 @@ public:
         NHttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
         const NHttpParaList* params_);
     void print_section(FILE* output) override;
-    void gen_events() override;
     void update_flow() override;
 private:
     // Dummy configurations to support MIME processing

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.h
index a495be9868560a4ba28bb96d124876179e52a429..8672e0dd38d27618422e07c71237718e54f86f5d 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_section.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_section.h
@@ -42,9 +42,6 @@ public:
     // Minimum necessary processing for every message
     virtual void analyze() = 0;
 
-    // Internal client that triggers JIT processing for optional inspections
-    virtual void gen_events() = 0;
-
     // Manages the splitter and communication between message sections
     virtual void update_flow() = 0;
 

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_start.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_start.cc
index 7ec126618448e77a8b0ecc52a9db26f8a55059c5..ea1d7b8867e4ca6ec001e3e15568ce4c570f8d64 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_start.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_start.cc
@@ -31,6 +31,7 @@ void NHttpMsgStart::analyze()
     start_line.start = msg_text.start;
     start_line.length = msg_text.length;
     parse_start_line();
+    gen_events();
 }
 
 void NHttpMsgStart::derive_version_id()
@@ -68,5 +69,3 @@ void NHttpMsgStart::derive_version_id()
     }
 }
 
-void NHttpMsgStart::gen_events() { }
-

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_start.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_start.h
index 0f552b694fc8423147103aa6938e953a8b93f79d..bc44952d6e62196e00a0c602329ad7fa030802fc 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_start.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_start.h
@@ -31,7 +31,6 @@ class NHttpMsgStart : public NHttpMsgSection
 {
 public:
     void analyze() override;
-    void gen_events() override;
 
 protected:
     NHttpMsgStart(const uint8_t* buffer, const uint16_t buf_size, NHttpFlowData* session_data_,
@@ -39,6 +38,7 @@ protected:
         : NHttpMsgSection(buffer, buf_size, session_data_, source_id_, buf_owner, flow_, params_)
         { }
     virtual void parse_start_line() = 0;
+    virtual void gen_events() {};
     void derive_version_id();
 
     Field start_line;

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
index 2eeb39ecbac1178f2fb13f937673ab307b247c60..8ba4ed5c2bf0f332c572b8639bd9b068e04146b1 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.cc
@@ -36,10 +36,6 @@ NHttpMsgTrailer::NHttpMsgTrailer(const uint8_t* buffer, const uint16_t buf_size,
     transaction->set_trailer(this, source_id);
 }
 
-void NHttpMsgTrailer::gen_events()
-{
-}
-
 void NHttpMsgTrailer::print_section(FILE* output)
 {
     NHttpMsgSection::print_message_title(output, "trailer");

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.h
index 44a1fb1894d6d27a2a40926d00ef5d70e32e2989..ce9137da5ccbbde5089386baede0e5776433c244 100644 (file)
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_trailer.h
@@ -33,7 +33,6 @@ public:
         NHttpEnums::SourceId source_id_, bool buf_owner, Flow* flow_,
         const NHttpParaList* params_);
     void print_section(FILE* output) override;
-    void gen_events() override;
     void update_flow() override;
 };