From: huica Date: Thu, 16 Jul 2015 13:04:11 +0000 (-0400) Subject: Merge branch 'master' of X-Git-Tag: 3.0.0-233~828^2~62 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8946ee97ca8fafc2c1d886728121fb8d97a69aa5;p=thirdparty%2Fsnort3.git Merge branch 'master' of ssh://huica@chivas64dev.cm.sourcefire.com/nfs/home/rucombs/Snort++ into fileclass2 Conflicts: src/file_api/file_capture.h src/service_inspectors/smtp/smtp_config.h --- 8946ee97ca8fafc2c1d886728121fb8d97a69aa5 diff --cc src/file_api/file_api.h index 71fd11715,b938d7389..c99e6b3be --- a/src/file_api/file_api.h +++ b/src/file_api/file_api.h @@@ -145,13 -248,13 +141,13 @@@ typedef uint8_t*(*Get_file_sig_sha256_f typedef void (*Set_file_name_func)(Flow* flow, uint8_t*, uint32_t); typedef void (*Set_file_direction_func)(Flow* flow, bool); - typedef int64_t (*Get_file_depth_func)(void); + typedef int64_t (*Get_file_depth_func)(); -typedef void (*Set_file_policy_func)(File_policy_callback_func); -typedef void (*Enable_file_type_func)(File_type_callback_func); -typedef void (*Enable_file_signature_func)(File_signature_callback_func); -typedef void (*Enable_file_capture_func)(File_signature_callback_func); -typedef void (*Set_file_action_log_func)(Log_file_action_func); +typedef void (*Set_file_policy_func)(); +typedef void (*Enable_file_type_func)(); +typedef void (*Enable_file_signature_func)(); +typedef void (*Enable_file_capture_func)(); +typedef void (*Set_file_action_log_func)(); typedef int (*Set_log_buffers_func)(MAIL_LogState** log_state, MAIL_LogConfig* conf); typedef int (*File_resume_block_add_file_func)(Packet* pkt, uint32_t file_sig, @@@ -176,8 -279,12 +172,8 @@@ typedef void (*Finalize_mime_position_f FilePosition* position); typedef File_Verdict (*Get_file_verdict_func)(Flow* flow); typedef void (*Render_block_verdict_func)(void* ctx, Packet* p); -typedef FileCaptureState (*Reserve_file_func)(Flow* flow, FileCaptureInfo** file_mem); -typedef FileCaptureInfo* (*Get_file_func)(FileCaptureInfo* file_mem, uint8_t** buff, int* size); -typedef void (*Release_file_func)(FileCaptureInfo* data); -typedef size_t (*File_capture_size_func)(FileCaptureInfo* file_mem); - typedef bool (*Is_file_service_enabled)(void); + typedef bool (*Is_file_service_enabled)(); typedef bool (*Check_paf_abort_func)(Flow* ssn); typedef FilePosition (*GetFilePosition)(Packet* pkt); typedef void (*Reset_mime_paf_state_func)(MimeDataPafInfo* data_info); diff --cc src/file_api/file_capture.h index 315fb447d,8ccbdd1e8..84e05d99c --- a/src/file_api/file_capture.h +++ b/src/file_api/file_capture.h @@@ -27,128 -22,25 +22,84 @@@ #ifndef FILE_CAPTURE_H #define FILE_CAPTURE_H + // There are several steps for file capture: + // 1) To improve performance, file data are stored in file mempool first by + // calling file_capture_process() during file data processing. + // 2) If file capture is needed, file_capture_reserve() should be called to + // allow file data remains in mempool. Even if a session is closed, the file + // data will stay in the mempool. + // 3) Then file data can be read through file_capture_read() + // 4) Finally, fila data must be released from mempool file_capture_release() + #include "file_api.h" #include "libs/file_lib.h" +#include "file_mempool.h" -struct FileCaptureInfo +struct FileCaptureBlock { uint32_t length; + FileCaptureBlock* next; /* next block of file data */ +}; + +class FileCapture +{ +public: + FileCapture(); + void verifiy(FileContext* context); - /* - * Initialize the file memory pool - * - * Arguments: - * int64_t max_file_mem: memcap in bytes - * int64_t block_size: file block size - * - * Returns: NONE - */ ++ ++ // this must be called during snort init + static void init_mempool(int64_t max_file_mem, int64_t block_size); + - /* - * Capture file data to local buffer - * This is the main function call to enable file capture - * - * Arguments: - * uint8_t *file_data: current file data - * int data_size: current file data size - * FilePosition position: position of file data - * - * Returns: - * 0: successful - * 1: fail to capture the file or file capture is disabled - */ ++ // Capture file data to local buffer ++ // This is the main function call to enable file capture ++ // Returns: ++ // 0: successful ++ // 1: fail to capture the file or file capture is disabled + FileCaptureState process_buffer(const uint8_t* file_data, int data_size, + FilePosition pos); + - /* - * Stop file capture, memory resource will be released if not reserved - * - * Returns: NONE - */ ++ // Stop file capture, memory resource will be released if not reserved + void stop(); + - /* - * Preserve the file in memory until it is released - * - * Arguments: - * Flow *ssnptr: flow pointer - * FileCapture **file_mem: the pointer to store the memory block - * that stores file and its metadata. - * It will set NULL if no memory or fail to store - * - * Returns: - * FileCaptureState: - * FILE_CAPTURE_SUCCESS = 0, - * FILE_CAPTURE_MIN, - * FILE_CAPTURE_MAX, - * FILE_CAPTURE_MEMCAP, - * FILE_CAPTURE_FAIL - */ ++ // Preserve the file in memory until it is released + FileCaptureState reserve_file(FileContext* context, FileCaptureBlock** file_mem); + - /* - * Get the file that is reserved in memory - * - * Arguments: - * FileCapture *file_mem: the memory block working on - * uint8_t **buff: address to store buffer address - * int *size: address to store size of file - * - * Returns: - * the next memory block - * NULL: end of file or fail to get file - */ ++ // Get the file that is reserved in memory, this should be called repeatedly ++ // until NULL is returned to get the full file ++ // Returns: ++ // the next memory block ++ // NULL: end of file or fail to get file + FileCaptureBlock* read_file(FileCaptureBlock* file_mem, uint8_t** buff, int* size); + - /* - * Get the file size captured in the file buffer - * - * Arguments: - * FileCapture *file_mem: the first memory block of file buffer - * - * Returns: - * the size of file - * 0: no memory or fail to get file - */ ++ // Get the file size captured in the file buffer ++ // Returns: ++ // the size of file ++ // 0: no memory or fail to get file + size_t capture_size(FileCapture* file_mem); + - /* - * Release the file that is reserved in memory, this function might be - * called in a different thread. - */ ++ // Release the file that is reserved in memory, this function might be ++ // called in a different thread. + void release_file(); + - /*Log file capture mempool usage*/ - ++ // Log file capture mempool usage + static void print_mem_usage(void); + - /* - * Exit file capture, release all file capture memory etc, - * this must be called when snort exits - */ ++ // Exit file capture, release all file capture memory etc, ++ // this must be called when snort exits + static void exit(void); + +private: + + inline FileCaptureBlock* create_file_buffer(FileMemPool* file_mempool); + inline FileCaptureState save_to_file_buffer(FileMemPool* file_mempool, + const uint8_t* file_data, int data_size, int64_t max_size); bool reserved; - FileCaptureInfo* last; /* last block of file data */ - FileCaptureInfo* next; /* next block of file data */ uint64_t file_size; /*file_size*/ + FileCaptureBlock* last; /* last block of file data */ + FileCaptureBlock* head; /* first block of file data */ + const uint8_t *current_data; /*current file data*/ + uint32_t current_data_len; + FileCaptureState capture_state; }; typedef struct _File_Capture_Stats diff --cc src/file_api/file_mime_process.h index 2ba6ce273,bc70e1997..f8dcd56cb --- a/src/file_api/file_mime_process.h +++ b/src/file_api/file_mime_process.h @@@ -26,13 -22,15 +22,17 @@@ #ifndef FILE_MIME_PROCESS_H #define FILE_MIME_PROCESS_H + // Provides list of MIME processing functions. Encoded file data will be decoded + // and file name will be extracted from MIME header + // FIXIT-L This will be refactored soon + #include - #include "file_api.h" - #include "sf_email_attach_decode.h" + #include "file_api/file_api.h" + #include "utils/sf_email_attach_decode.h" -#define BOUNDARY 0 +#define MAX_FILE 1024 +#define MAX_EMAIL 1024 +#define BOUNDARY 0 /* state flags */ #define MIME_FLAG_FOLDING 0x00000001 diff --cc src/service_inspectors/http_inspect/hi_ui_config.h index 352901d94,3a1f03828..eabf121ae --- a/src/service_inspectors/http_inspect/hi_ui_config.h +++ b/src/service_inspectors/http_inspect/hi_ui_config.h @@@ -34,18 -34,14 +34,15 @@@ #define HI_UI_CONFIG_H #include "hi_include.h" - #include "snort_bounds.h" - #include "sfrt/sfrt.h" - #include "sf_ip.h" #include "hi_util_kmap.h" + #include "sfrt/sfrt.h" + #include "sfip/sf_ip.h" #include "file_api/file_api.h" +#include "file_api/file_mime_process.h" #include "decompress/file_decomp.h" #include "framework/bits.h" + #include "utils/snort_bounds.h" - /* - ** Defines - */ #define HI_UI_CONFIG_MAX_HDR_DEFAULT 0 #define HI_UI_CONFIG_MAX_HEADERS_DEFAULT 0 #define HI_UI_CONFIG_MAX_SPACES_DEFAULT 200 diff --cc src/service_inspectors/imap/imap_config.h index e400147e2,8983efd9b..49ea8b94f --- a/src/service_inspectors/imap/imap_config.h +++ b/src/service_inspectors/imap/imap_config.h @@@ -20,7 -19,9 +19,9 @@@ #ifndef IMAP_CONFIG_H #define IMAP_CONFIG_H + // Configuration for Imap service inspector + -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" struct IMAP_PROTO_CONF { diff --cc src/service_inspectors/imap/imap_paf.h index 14ec73e5e,1af944682..016c78825 --- a/src/service_inspectors/imap/imap_paf.h +++ b/src/service_inspectors/imap/imap_paf.h @@@ -21,10 -22,12 +22,12 @@@ #ifndef IMAP_PAF_H #define IMAP_PAF_H - #include "snort_types.h" + // Protocol aware flushing for IMAP + + #include "main/snort_types.h" #include "stream/stream_api.h" #include "stream/stream_splitter.h" -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" struct ImapDataInfo { diff --cc src/service_inspectors/pop/pop_config.h index 487b26990,cf4bf8a86..50597d50e --- a/src/service_inspectors/pop/pop_config.h +++ b/src/service_inspectors/pop/pop_config.h @@@ -19,8 -19,9 +19,9 @@@ #ifndef POP_CONFIG_H #define POP_CONFIG_H + // Configuration for Pop service inspector -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" struct POP_PROTO_CONF { diff --cc src/service_inspectors/pop/pop_paf.h index 2ebafdd5e,04817c231..4050214a3 --- a/src/service_inspectors/pop/pop_paf.h +++ b/src/service_inspectors/pop/pop_paf.h @@@ -21,18 -22,20 +22,20 @@@ #ifndef POP_PAF_H #define POP_PAF_H - #include "snort_types.h" + // Protocol aware flushing for POP. + + #include "main/snort_types.h" #include "stream/stream_api.h" #include "stream/stream_splitter.h" -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" - /* Structure used to record expected server termination sequence */ + // Structure used to record expected server termination sequence enum PopExpectedResp { - POP_PAF_SINGLE_LINE_STATE, /* server response will end with \r\n */ - POP_PAF_MULTI_LINE_STATE, /* server response will end with \r\n.\r\n */ - POP_PAF_DATA_STATE, /* Indicated MIME will be contained in response */ - POP_PAF_HAS_ARG /* Intermediate state when parsing LIST */ + POP_PAF_SINGLE_LINE_STATE, // server response will end with \r\n + POP_PAF_MULTI_LINE_STATE, // server response will end with \r\n.\r\n + POP_PAF_DATA_STATE, // Indicated MIME will be contained in response + POP_PAF_HAS_ARG // Intermediate state when parsing LIST }; enum PopParseCmdState diff --cc src/service_inspectors/smtp/smtp_config.h index 6f2996ae2,6f29c0656..d530d0532 --- a/src/service_inspectors/smtp/smtp_config.h +++ b/src/service_inspectors/smtp/smtp_config.h @@@ -20,8 -19,11 +19,10 @@@ #ifndef SMTP_CONFIG_H #define SMTP_CONFIG_H + // Configuration for SMTP inspector - -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" #include "search_engines/search_tool.h" + enum NORM_TYPES { NORMALIZE_NONE = 0, diff --cc src/service_inspectors/smtp/smtp_paf.h index f1f559738,19cda6c53..dd307b970 --- a/src/service_inspectors/smtp/smtp_paf.h +++ b/src/service_inspectors/smtp/smtp_paf.h @@@ -19,12 -21,14 +21,14 @@@ #ifndef SMTP_PAF_H #define SMTP_PAF_H - #include "snort_types.h" + // Protocol aware flushing for SMTP + + #include "main/snort_types.h" #include "stream/stream_api.h" #include "stream/stream_splitter.h" -#include "file_api/file_api.h" +#include "file_api/file_mime_process.h" - /* State tracker for SMTP PAF */ + // State tracker for SMTP PAF enum SmtpPafState { SMTP_PAF_CMD_STATE,