From: huica Date: Thu, 2 Jul 2015 13:31:53 +0000 (-0400) Subject: Merge branch 'master' of X-Git-Tag: 3.0.0-233~828^2~69 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b4492cd579b7386fa654ead3f4a82e58671e8737;p=thirdparty%2Fsnort3.git Merge branch 'master' of ssh://huica@chivas64dev.cm.sourcefire.com/nfs/home/rucombs/Snort++ into fileclass2 Conflicts: src/file_api/file_service.cc src/file_api/file_stats.cc src/file_api/libs/file_identifier.h --- b4492cd579b7386fa654ead3f4a82e58671e8737 diff --cc src/file_api/file_service.cc index 58813ebb9,b8859a232..8634029b8 --- a/src/file_api/file_service.cc +++ b/src/file_api/file_service.cc @@@ -370,13 -445,165 +370,12 @@@ static void DumpHex(FILE* fp, const uin } } -static inline void updateFileSize(FileContext* context, int data_size, FilePosition position) -{ - context->processed_bytes += data_size; - if ((position == SNORT_FILE_END)or (position == SNORT_FILE_FULL)) - { - if (get_max_file_depth() == (int64_t)context->processed_bytes) - context->file_size = 0; - else - context->file_size = context->processed_bytes; - context->processed_bytes = 0; - } -} - -static inline int file_eventq_add(uint32_t gid, uint32_t sid, RuleType type) -{ - return SnortEventqAdd(gid, sid, type); -} - -static inline void add_file_to_block(Packet* p, File_Verdict verdict, - uint32_t file_type_id, uint8_t* signature) -{ - uint8_t* buf = NULL; - uint32_t len = 0; - uint32_t type = 0; - uint32_t file_sig; - FileConfig* file_config = (FileConfig*)(snort_conf->file_config); - - Active::drop_packet(p, true); - DisableInspection(p); - p->packet_flags |= PKT_FILE_EVENT_SET; - - /*Use URI as the identifier for file*/ - if (GetHttpUriData(p->flow, &buf, &len, &type)) - { - file_sig = str_to_hash(buf, len); - file_resume_block_add_file(p, file_sig, (uint32_t)file_config->file_block_timeout, - verdict, file_type_id, signature); - } -} - -/* - * Check HTTP partial content header - * Return: 1: partial content header - * 0: not http partial content header - */ -static inline int check_http_partial_content(Packet* p) -{ - uint8_t* buf = NULL; - uint32_t len = 0; - uint32_t type = 0; - uint32_t file_sig; - InspectionBuffer hb; - - if ( !p->flow or !p->flow->clouseau or - // FIXIT-P cache id at parse time for runtime use - !p->flow->clouseau->get_buf("http_stat_code", p, hb) ) - { - return 0; - } - - /*Not partial content, return*/ - if ( (hb.len != 3) or strncmp((const char*)hb.data, "206", 3) ) - return 0; - - /*Use URI as the identifier for file*/ - if (GetHttpUriData(p->flow, &buf, &len, &type)) - { - file_sig = str_to_hash(buf, len); - file_resume_block_check(p, file_sig); - } - - return 1; -} - -/* File signature lookup at the end of file - * File signature callback can be used for malware lookup, file capture etc - */ -static inline void _file_signature_lookup(FileContext* context, - Packet* pkt, bool is_retransmit, bool suspend_block_verdict) -{ - File_Verdict verdict = FILE_VERDICT_UNKNOWN; - - if (!pkt) - { - finish_signature_lookup(context); - return; - } - - if (file_signature_cb) - { - verdict = file_signature_cb(pkt, pkt->flow, context->sha256, - context->file_size, &(context->file_state), context->upload, - context->file_id); - file_stats.verdicts_signature[verdict]++; - } - - if (suspend_block_verdict) - context->suspend_block_verdict = true; - - context->verdict = verdict; - - if (verdict == FILE_VERDICT_LOG ) - { - file_eventq_add(GENERATOR_FILE_SIGNATURE, FILE_SIGNATURE_SHA256, - RULE_TYPE__ALERT); - pkt->packet_flags |= PKT_FILE_EVENT_SET; - context->file_signature_enabled = false; - } - else if (verdict == FILE_VERDICT_PENDING) - { - /*Can't decide verdict, drop packet and waiting...*/ - if (is_retransmit) - { - FileConfig* file_config = (FileConfig*)context->file_config; - /*Drop packets if not timeout*/ - if (pkt->pkth->ts.tv_sec <= context->expires) - { - Active::drop_packet(pkt); - return; - } - /*Timeout, let packet go through OR block based on config*/ - context->file_signature_enabled = false; - if (file_config and file_config->block_timeout_lookup) - file_eventq_add(GENERATOR_FILE_SIGNATURE, FILE_SIGNATURE_SHA256, - RULE_TYPE__DROP); - else - file_eventq_add(GENERATOR_FILE_SIGNATURE, FILE_SIGNATURE_SHA256, - RULE_TYPE__ALERT); - pkt->packet_flags |= PKT_FILE_EVENT_SET; - } - else - { - FileConfig* file_config = (FileConfig*)context->file_config; - if (file_config) - context->expires = (time_t)(file_config->file_lookup_timeout + - pkt->pkth->ts.tv_sec); - Active::drop_packet(pkt); - save_to_pending_context(pkt->flow); - return; - } - } - else if ((verdict == FILE_VERDICT_BLOCK)or (verdict == FILE_VERDICT_REJECT)) - { - if (!context->suspend_block_verdict) - render_block_verdict(context, pkt); - context->file_signature_enabled = false; - return; - } - - finish_signature_lookup(context); -} -- static inline void finish_signature_lookup(FileContext* context) { - if (context->sha256) + if (context->get_file_sig_sha256()) { - context->file_signature_enabled = false; - file_stats.signatures_processed[context->file_type_id][context->upload]++; - file_stats.signatures_by_proto[context->app_id]++; + context->config_file_signature(false); + file_stats.signatures_processed[context->get_file_type()][context->get_file_direction()]++; } } diff --cc src/file_api/file_stats.cc index 9df2852a6,4250bbf4e..29fdb2f09 --- a/src/file_api/file_stats.cc +++ b/src/file_api/file_stats.cc @@@ -292,6 -349,7 +292,8 @@@ void print_file_stats( LogMessage("Total file signature max: " FMTu64( "-10") " \n", file_stats.files_sig_depth); - file_capture_mem_usage(); + FileCapture::print_mem_usage(); + #endif ++ }