From: Russ Combs Date: Tue, 24 Jun 2014 12:54:48 +0000 (-0400) Subject: more detect buffer cleanup X-Git-Tag: 3.0.0-233~1469 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4e5024d275af3cebcc014715b81d4c2284e225cf;p=thirdparty%2Fsnort3.git more detect buffer cleanup --- diff --git a/ChangeLog b/ChangeLog index 0850cc328..bdbe385c2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +92 +-- fixed fast_pattern only auto configuration +-- more detection buffer cleanup + 91 -- eliminated more RULE_OPTION_TYPE_* -- converted remaining rule options over to use cursor @@ -5,7 +9,6 @@ -- finally eliminated doe_ptr and friends ... yay! -- merged ips_option_base64_{data,decode}.cc -- fast_pattern_only (previously fast_pattern:only) is gone - (delete the option, Snort will figure it out) 90 -- added InspectApi.buffers and Inspector::getbuf() diff --git a/src/detection/detect.cc b/src/detection/detect.cc index e7715b8bf..3393dc120 100644 --- a/src/detection/detect.cc +++ b/src/detection/detect.cc @@ -139,7 +139,6 @@ void snort_inspect(Packet* p) /* ** Reset the appropriate application-layer protocol fields */ - ClearHttpBuffers(); p->alt_dsize = 0; DetectReset(); diff --git a/src/detection/detection_util.cc b/src/detection/detection_util.cc index a3bcb32b5..6f9888de7 100644 --- a/src/detection/detection_util.cc +++ b/src/detection/detection_util.cc @@ -30,8 +30,8 @@ THREAD_LOCAL uint32_t http_mask; THREAD_LOCAL HttpBuffer http_buffer[HTTP_BUFFER_MAX]; -THREAD_LOCAL DataPointer file_data_ptr; -THREAD_LOCAL DataBuffer DecodeBuffer; +THREAD_LOCAL DataPointer g_alt_data; +THREAD_LOCAL DataPointer g_file_data; const char* http_buffer_name[HTTP_BUFFER_MAX] = { diff --git a/src/detection/detection_util.h b/src/detection/detection_util.h index f3ee9f920..1b84e178c 100644 --- a/src/detection/detection_util.h +++ b/src/detection/detection_util.h @@ -37,13 +37,9 @@ #include "detect.h" #include "snort.h" #include "snort_debug.h" -#include "treenodes.h" -#ifndef DECODE_BLEN #define DECODE_BLEN 65535 -#define MAX_URI 8192 - enum HTTP_BUFFER { HTTP_BUFFER_NONE, @@ -59,39 +55,32 @@ enum HTTP_BUFFER HTTP_BUFFER_URI, HTTP_BUFFER_MAX }; -#endif - -enum DetectFlagType -{ - FLAG_ALT_DECODE = 0x0001, - FLAG_DETECT_ALL = 0xffff -}; struct HttpBuffer { const uint8_t* buf; - uint16_t length; + unsigned length; uint32_t encode_type; }; struct DataPointer { uint8_t *data; - uint16_t len; + unsigned len; }; struct DataBuffer { uint8_t data[DECODE_BLEN]; - uint16_t len; + unsigned len; }; extern THREAD_LOCAL uint32_t http_mask; extern THREAD_LOCAL HttpBuffer http_buffer[HTTP_BUFFER_MAX]; extern const char* http_buffer_name[HTTP_BUFFER_MAX]; -extern THREAD_LOCAL DataPointer file_data_ptr; -extern THREAD_LOCAL DataBuffer DecodeBuffer; +extern THREAD_LOCAL DataPointer g_alt_data; +extern THREAD_LOCAL DataPointer g_file_data; static inline void ClearHttpBuffers (void) { @@ -135,10 +124,16 @@ static inline void SetHttpBuffer (HTTP_BUFFER b, const uint8_t* buf, unsigned le #define IsLimitedDetect(pktPtr) (pktPtr->packet_flags & PKT_HTTP_DECODE) -static inline void setFileDataPtr(uint8_t *ptr, uint16_t decode_size) +static inline void set_alt_data(uint8_t* p, unsigned n) { - file_data_ptr.data = ptr; - file_data_ptr.len = decode_size; + g_alt_data.data = p; + g_alt_data.len = n; +} + +static inline void set_file_data(uint8_t* p, unsigned n) +{ + g_file_data.data = p; + g_file_data.len = n; } void EventTrace_Init(void); @@ -151,16 +146,11 @@ static inline int EventTrace_IsEnabled (void) return ( snort_conf->event_trace_max > 0 ); } -static inline void SetAltDecode(uint16_t altLen) -{ - DecodeBuffer.len = altLen; -} - static inline void DetectReset() { - file_data_ptr.data = NULL; - file_data_ptr.len = 0; - DecodeBuffer.len = 0; + g_alt_data.len = 0; + g_file_data.len = 0; + ClearHttpBuffers(); } int IsGzipData(Flow*); // FIXIT these from HI diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc index e48670dc7..86399a98a 100644 --- a/src/detection/fpdetect.cc +++ b/src/detection/fpdetect.cc @@ -1080,11 +1080,11 @@ static inline int fpEvalHeaderSW(PORT_GROUP *port_group, Packet *p, if ( so && so->get_pattern_count() > 0 ) { - if ( DecodeBuffer.len ) + if(g_alt_data.len) { start_state = 0; - so->search(DecodeBuffer.data, DecodeBuffer.len, - rule_tree_match, omd, &start_state); + so->search(g_alt_data.data, g_alt_data.len, + rule_tree_match, omd, &start_state); #ifdef PPM_MGR /* Bail if we spent too much time already */ if (PPM_PACKET_ABORT_FLAG()) @@ -1092,11 +1092,10 @@ static inline int fpEvalHeaderSW(PORT_GROUP *port_group, Packet *p, #endif } - /* Adding this extra search on file data since we no more use DecodeBuffer to decode now*/ - if(file_data_ptr.len) + if(g_file_data.len) { start_state = 0; - so->search(file_data_ptr.data, file_data_ptr.len, + so->search(g_file_data.data, g_file_data.len, rule_tree_match, omd, &start_state); #ifdef PPM_MGR /* Bail if we spent too much time already */ diff --git a/src/file_api/file_mime_process.cc b/src/file_api/file_mime_process.cc index 7832c67ba..c5d2b1498 100644 --- a/src/file_api/file_mime_process.cc +++ b/src/file_api/file_mime_process.cc @@ -941,7 +941,7 @@ const uint8_t * process_mime_data(void *packet, const uint8_t *start, const uint } */ - setFileDataPtr((uint8_t*)start, (uint16_t)(data_end - start)); + set_file_data((uint8_t*)start, (data_end - start)); if ((mime_ssn->data_state == STATE_DATA_HEADER) || (mime_ssn->data_state == STATE_DATA_UNKNOWN)) @@ -977,7 +977,7 @@ const uint8_t * process_mime_data(void *packet, const uint8_t *start, const uint int detection_size = getDetectionSize(conf->b64_depth, conf->qp_depth, conf->uu_depth, conf->bitenc_depth, (Email_DecodeState *)(mime_ssn->decode_state) ); - setFileDataPtr(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, (uint16_t)detection_size); + set_file_data(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, detection_size); /*Process file type/file signature*/ if (file_api->file_process(p,(uint8_t *)((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, (uint16_t)((Email_DecodeState *)(mime_ssn->decode_state))->decoded_bytes, position, upload, false) @@ -1016,11 +1016,11 @@ const uint8_t * process_mime_data(void *packet, const uint8_t *start, const uint DecodeConfig *conf= mime_ssn->decode_conf; int detection_size = getDetectionSize(conf->b64_depth, conf->qp_depth, conf->uu_depth, conf->bitenc_depth, (Email_DecodeState *)(mime_ssn->decode_state) ); - setFileDataPtr(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, (uint16_t)detection_size); + set_file_data(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, detection_size); } else { - setFileDataPtr(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, 0); + set_file_data(((Email_DecodeState *)(mime_ssn->decode_state))->decodePtr, 0); } if ((data_end_marker != end)||(mime_ssn->state_flags & MIME_FLAG_MIME_END)) { diff --git a/src/framework/cursor.cc b/src/framework/cursor.cc index 82bf271f2..3288590a3 100644 --- a/src/framework/cursor.cc +++ b/src/framework/cursor.cc @@ -35,9 +35,9 @@ Cursor::Cursor(const Cursor& rhs) void Cursor::reset(Packet* p) { - if ( DecodeBuffer.len ) + if ( g_alt_data.len ) { - set("pkt_data", (uint8_t *)DecodeBuffer.data, DecodeBuffer.len); + set("pkt_data", g_alt_data.data, g_alt_data.len); } else if( IsLimitedDetect(p) ) { diff --git a/src/ips_options/ips_file_data.cc b/src/ips_options/ips_file_data.cc index 80c35bd2e..6d65e412e 100644 --- a/src/ips_options/ips_file_data.cc +++ b/src/ips_options/ips_file_data.cc @@ -81,8 +81,8 @@ int FileDataOption::eval(Cursor& c, Packet*) PROFILE_VARS; PREPROC_PROFILE_START(fileDataPerfStats); - data = file_data_ptr.data; - len = file_data_ptr.len; + data = g_file_data.data; + len = g_file_data.len; if ( (data == NULL)|| (len == 0) ) { diff --git a/src/log/log_text.cc b/src/log/log_text.cc index 3d2c26110..85234632a 100644 --- a/src/log/log_text.cc +++ b/src/log/log_text.cc @@ -1762,12 +1762,12 @@ void LogIPPkt(TextLog* log, int type, Packet * p) if(!IsJSNormData(p->flow)) { TextLog_Print(log, "%s\n", "Normalized JavaScript for this packet"); - LogCharData(log, (char *)file_data_ptr.data, file_data_ptr.len); + LogCharData(log, (char *)g_file_data.data, g_file_data.len); } else if(!IsGzipData(p->flow)) { TextLog_Print(log, "%s\n", "Decompressed Data for this packet"); - LogCharData(log, (char *)file_data_ptr.data, file_data_ptr.len); + LogCharData(log, (char *)g_file_data.data, g_file_data.len); } } else @@ -1776,12 +1776,12 @@ void LogIPPkt(TextLog* log, int type, Packet * p) if(!IsJSNormData(p->flow)) { TextLog_Print(log, "%s\n", "Normalized JavaScript for this packet"); - LogNetData(log, file_data_ptr.data, file_data_ptr.len, NULL); + LogNetData(log, g_file_data.data, g_file_data.len, NULL); } else if(!IsGzipData(p->flow)) { TextLog_Print(log, "%s\n", "Decompressed Data for this packet"); - LogNetData(log, file_data_ptr.data, file_data_ptr.len, NULL); + LogNetData(log, g_file_data.data, g_file_data.len, NULL); } } } diff --git a/src/service_inspectors/ftp_telnet/ftp.cc b/src/service_inspectors/ftp_telnet/ftp.cc index 51ef27ebc..0fb8af396 100644 --- a/src/service_inspectors/ftp_telnet/ftp.cc +++ b/src/service_inspectors/ftp_telnet/ftp.cc @@ -94,7 +94,7 @@ static void FTPDataProcess(Packet *p, FTP_DATA_SESSION *data_ssn) { int status; - setFileDataPtr((uint8_t *)p->data, (uint16_t)p->dsize); + set_file_data((uint8_t *)p->data, p->dsize); status = file_api->file_process(p, (uint8_t *)p->data, (uint16_t)p->dsize, data_ssn->position, data_ssn->direction, false); diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc index 366d8a4fa..a036d1777 100644 --- a/src/service_inspectors/ftp_telnet/pp_ftp.cc +++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc @@ -62,6 +62,8 @@ #include "ipv6_port.h" +static THREAD_LOCAL DataBuffer DecodeBuffer; + /* * Used to keep track of pipelined commands and the last one * that resulted in a diff --git a/src/service_inspectors/ftp_telnet/pp_telnet.cc b/src/service_inspectors/ftp_telnet/pp_telnet.cc index 68aa7261e..ec0a9bb82 100644 --- a/src/service_inspectors/ftp_telnet/pp_telnet.cc +++ b/src/service_inspectors/ftp_telnet/pp_telnet.cc @@ -66,6 +66,8 @@ */ #define CONSECUTIVE_8BIT_THRESHOLD 3 +static THREAD_LOCAL DataBuffer DecodeBuffer; + /* * Function: normalize_telnet(Packet *) * @@ -419,11 +421,7 @@ int normalize_telnet( } } - SetAltDecode((uint16_t)(write_ptr - start)); + set_alt_data(DecodeBuffer.data, (uint16_t)(write_ptr - start)); - /* DEBUG_WRAP(DebugMessage(DEBUG_FTPTELNET, - "Converted buffer after telnet normalization:\n"); - LogNetData(DecodeBuffer.data, DecodeBuffer.len, NULL);); - */ return ret; } diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc index 0df997ae0..2b9ce3c89 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/src/service_inspectors/http_inspect/hi_main.cc @@ -1012,7 +1012,7 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet *p) detect_data_size = 0; } - setFileDataPtr((uint8_t *)session->server.response.body, (uint16_t)detect_data_size); + set_file_data((uint8_t *)session->server.response.body, detect_data_size); if (PacketHasPAFPayload(p) && file_api->file_process(p,(uint8_t *)session->server.response.body, (uint16_t)session->server.response.body_size, @@ -1142,7 +1142,7 @@ int IsGzipData(Flow* flow) if(hsd == NULL) return -1; - if((hsd->log_flags & HTTP_LOG_GZIP_DATA) && (file_data_ptr.len > 0 )) + if((hsd->log_flags & HTTP_LOG_GZIP_DATA) && (g_file_data.len > 0 )) return 0; else return -1; @@ -1153,8 +1153,8 @@ int GetHttpGzipData(Flow* flow, uint8_t **buf, uint32_t *len, uint32_t *type) { if(!IsGzipData(flow)) { - *buf = file_data_ptr.data; - *len = file_data_ptr.len; + *buf = g_file_data.data; + *len = g_file_data.len; *type = EVENT_INFO_GZIP_DATA; return 1; } @@ -1175,7 +1175,7 @@ int IsJSNormData(Flow* flow) if(hsd == NULL) return -1; - if((hsd->log_flags & HTTP_LOG_JSNORM_DATA) && (file_data_ptr.len > 0 )) + if((hsd->log_flags & HTTP_LOG_JSNORM_DATA) && (g_file_data.len > 0 )) return 0; else return -1; @@ -1186,8 +1186,8 @@ int GetHttpJSNormData(Flow* flow, uint8_t **buf, uint32_t *len, uint32_t *type) { if(!IsJSNormData(flow)) { - *buf = file_data_ptr.data; - *len = file_data_ptr.len; + *buf = g_file_data.data; + *len = g_file_data.len; *type = EVENT_INFO_JSNORM_DATA; return 1; } diff --git a/src/service_inspectors/http_inspect/hi_norm.h b/src/service_inspectors/http_inspect/hi_norm.h index 1cc6b5f68..0f04372ae 100644 --- a/src/service_inspectors/http_inspect/hi_norm.h +++ b/src/service_inspectors/http_inspect/hi_norm.h @@ -41,6 +41,8 @@ #include "hi_ui_config.h" #include "hi_si.h" +#define MAX_URI 8192 + int hi_normalization(HI_SESSION *session, int iInspectMode, HttpsessionData *hsd); int hi_norm_uri(HI_SESSION *session, u_char *uribuf,int *uribuf_size, const u_char *uri, int uri_size, uint16_t *encodeType); diff --git a/src/service_inspectors/rpc_decode/rpc_decode.cc b/src/service_inspectors/rpc_decode/rpc_decode.cc index 805d6d1c2..455497042 100644 --- a/src/service_inspectors/rpc_decode/rpc_decode.cc +++ b/src/service_inspectors/rpc_decode/rpc_decode.cc @@ -67,6 +67,8 @@ #define RPC_FRAG_HDR_SIZE sizeof(uint32_t) #define RPC_FRAG_LEN(ptr) (ntohl(*((uint32_t *)ptr)) & 0x7FFFFFFF) +static THREAD_LOCAL DataBuffer DecodeBuffer; + using namespace std; struct RpcDecodeConfig @@ -477,7 +479,7 @@ static RpcStatus RpcPrepRaw(const uint8_t *data, uint32_t fraglen, Packet*) return RPC_STATUS__ERROR; } - SetAltDecode((uint16_t)(RPC_FRAG_HDR_SIZE + fraglen)); + set_alt_data(DecodeBuffer.data, (RPC_FRAG_HDR_SIZE + fraglen)); return RPC_STATUS__SUCCESS; } @@ -506,7 +508,7 @@ static RpcStatus RpcPrepFrag(RpcSsnData *rsdata, Packet*) return RPC_STATUS__ERROR; } - SetAltDecode((uint16_t)RpcBufLen(&rsdata->frag)); + set_alt_data(DecodeBuffer.data, RpcBufLen(&rsdata->frag)); if (RpcBufLen(&rsdata->frag) > RPC_MAX_BUF_SIZE) RpcBufClean(&rsdata->frag); @@ -530,7 +532,7 @@ static RpcStatus RpcPrepSeg(RpcSsnData *rsdata, Packet*) return RPC_STATUS__ERROR; } - SetAltDecode((uint16_t)RpcBufLen(&rsdata->seg)); + set_alt_data(DecodeBuffer.data, RpcBufLen(&rsdata->seg)); if (RpcBufLen(&rsdata->seg) > RPC_MAX_BUF_SIZE) { @@ -976,7 +978,7 @@ static int ConvertRPC(RpcDecodeConfig *rconfig, RpcSsnData *rsdata, Packet *p) //LogNetData(data, decoded_len, NULL); ); - SetAltDecode((uint16_t)decoded_len); + set_alt_data(DecodeBuffer.data, decoded_len); return 0; }