From: Tom Peters (thopeter) <thopeter@cisco.com>
Date: Mon, 27 Mar 2017 15:23:44 +0000 (-0400)
Subject: Merge pull request #846 in SNORT/snort3 from nhttp68 to master
X-Git-Tag: 3.0.0-233~37
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d189c6735a2d6ccdb28021941bc0aa14ddaa40b6;p=thirdparty%2Fsnort3.git

Merge pull request #846 in SNORT/snort3 from nhttp68 to master

Squashed commit of the following:

commit 5285027596f1c21bb700a05933ff9cf7639568f7
Author: Tom Peters <thopeter@cisco.com>
Date:   Wed Mar 22 16:46:50 2017 -0400

    New feature for test tool used to investigate chunk reassembly problem
---

diff --git a/src/service_inspectors/http_inspect/http_enum.h b/src/service_inspectors/http_inspect/http_enum.h
index dc7bc0da6..f72b01a2c 100644
--- a/src/service_inspectors/http_inspect/http_enum.h
+++ b/src/service_inspectors/http_inspect/http_enum.h
@@ -238,7 +238,7 @@ enum EventSid
     EVENT_DOUBLE_DECODE,
     EVENT_U_ENCODE,
     EVENT_BARE_BYTE,
-    EVENT_OBSOLETE_1,
+    EVENT_OBSOLETE_1,       // Previously used, do not reuse this number
     EVENT_UTF_8,
     EVENT_IIS_UNICODE,
     EVENT_MULTI_SLASH,
@@ -270,12 +270,12 @@ enum EventSid
     EVENT_PIPELINE_MAX,
     EVENT_ANOM_SERVER,
     EVENT_INVALID_STATCODE,
-    EVENT_NO_CONTLEN,
+    EVENT_UNUSED_1,
     EVENT_UTF_NORM_FAIL,
     EVENT_UTF7,
     EVENT_DECOMPR_FAILED,
     EVENT_CONSECUTIVE_SMALL_CHUNKS_S,
-    EVENT_MSG_SIZE_EXCEPTION,
+    EVENT_UNUSED_2,
     EVENT_JS_OBFUSCATION_EXCD,
     EVENT_JS_EXCESS_WS,
     EVENT_MIXED_ENCODINGS,
diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc
index b695cb6b9..238ddeadf 100644
--- a/src/service_inspectors/http_inspect/http_inspect.cc
+++ b/src/service_inspectors/http_inspect/http_inspect.cc
@@ -51,6 +51,7 @@ HttpInspect::HttpInspect(const HttpParaList* params_) : params(params_)
     HttpTestManager::set_print_amount(params->print_amount);
     HttpTestManager::set_print_hex(params->print_hex);
     HttpTestManager::set_show_pegs(params->show_pegs);
+    HttpTestManager::set_show_scan(params->show_scan);
 #endif
 }
 
diff --git a/src/service_inspectors/http_inspect/http_module.cc b/src/service_inspectors/http_inspect/http_module.cc
index fd144a607..bd7dfbb07 100644
--- a/src/service_inspectors/http_inspect/http_module.cc
+++ b/src/service_inspectors/http_inspect/http_module.cc
@@ -81,6 +81,7 @@ const Parameter HttpModule::http_params[] =
     { "print_hex", Parameter::PT_BOOL, nullptr, "false",
       "nonprinting characters printed in [HH] format instead of using an asterisk" },
     { "show_pegs", Parameter::PT_BOOL, nullptr, "true", "display peg counts with test output" },
+    { "show_scan", Parameter::PT_BOOL, nullptr, "false", "display scanned segments" },
 #endif
     { nullptr, Parameter::PT_MAX, nullptr, nullptr, nullptr }
 };
@@ -209,6 +210,10 @@ bool HttpModule::set(const char*, Value& val, SnortConfig*)
     {
         params->show_pegs = val.get_bool();
     }
+    else if (val.is("show_scan"))
+    {
+        params->show_scan = val.get_bool();
+    }
 #endif
     else
     {
diff --git a/src/service_inspectors/http_inspect/http_module.h b/src/service_inspectors/http_inspect/http_module.h
index 44e2abfc3..9f6bc7e0e 100644
--- a/src/service_inspectors/http_inspect/http_module.h
+++ b/src/service_inspectors/http_inspect/http_module.h
@@ -80,6 +80,7 @@ public:
     long print_amount;
     bool print_hex;
     bool show_pegs;
+    bool show_scan;
 #endif
 };
 
diff --git a/src/service_inspectors/http_inspect/http_msg_head_shared.cc b/src/service_inspectors/http_inspect/http_msg_head_shared.cc
index 6541837a4..ef5abd5c7 100644
--- a/src/service_inspectors/http_inspect/http_msg_head_shared.cc
+++ b/src/service_inspectors/http_inspect/http_msg_head_shared.cc
@@ -106,7 +106,6 @@ void HttpMsgHeadShared::parse_header_block()
     }
     if (bytes_used < msg_text.length())
     {
-        // FIXIT-M eventually need to separate max header alert from internal maximum
         infractions += INF_TOO_MANY_HEADERS;
         events.create_event(EVENT_MAX_HEADERS);
     }
diff --git a/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc b/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
index b43edcfbd..b799348f2 100644
--- a/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
+++ b/src/service_inspectors/http_inspect/http_stream_splitter_scan.cc
@@ -118,6 +118,10 @@ StreamSplitter::Status HttpStreamSplitter::scan(Flow* flow, const uint8_t* data,
             " direction %d length %u client port %u server port %u\n", session_data->seq_num,
             source_id, length, flow->client_port, flow->server_port);
         fflush(stdout);
+        if (HttpTestManager::get_show_scan())
+        {
+            Field(length, data).print(stdout, "Scan segment");
+        }
     }
 #endif
 
diff --git a/src/service_inspectors/http_inspect/http_tables.cc b/src/service_inspectors/http_inspect/http_tables.cc
index 3e169319e..7b9005e2c 100644
--- a/src/service_inspectors/http_inspect/http_tables.cc
+++ b/src/service_inspectors/http_inspect/http_tables.cc
@@ -305,12 +305,12 @@ const RuleMap HttpModule::http_events[] =
     { EVENT_PIPELINE_MAX,               "too many pipelined requests" },
     { EVENT_ANOM_SERVER,                "anomalous http server on undefined HTTP port" },
     { EVENT_INVALID_STATCODE,           "invalid status code in HTTP response" },
-    { EVENT_NO_CONTLEN,                 "no content-length or transfer-encoding in HTTP response" },
+    { EVENT_UNUSED_1,                   "unused event number--should not appear" },
     { EVENT_UTF_NORM_FAIL,              "HTTP response has UTF charset which failed to normalize" },
     { EVENT_UTF7,                       "HTTP response has UTF-7 charset" },
     { EVENT_DECOMPR_FAILED,             "HTTP response gzip decompression failed" },
     { EVENT_CONSECUTIVE_SMALL_CHUNKS_S, "server consecutive small chunk sizes" },
-    { EVENT_MSG_SIZE_EXCEPTION,         "invalid content-length or chunk size" },
+    { EVENT_UNUSED_2,                   "unused event number--should not appear" },
     { EVENT_JS_OBFUSCATION_EXCD,        "javascript obfuscation levels exceeds 1" },
     { EVENT_JS_EXCESS_WS,               "javascript whitespaces exceeds max allowed" },
     { EVENT_MIXED_ENCODINGS,            "multiple encodings within javascript obfuscated data" },
diff --git a/src/service_inspectors/http_inspect/http_test_manager.cc b/src/service_inspectors/http_inspect/http_test_manager.cc
index 7b6f2573e..0d0e82928 100644
--- a/src/service_inspectors/http_inspect/http_test_manager.cc
+++ b/src/service_inspectors/http_inspect/http_test_manager.cc
@@ -38,6 +38,7 @@ FILE* HttpTestManager::test_out = nullptr;
 long HttpTestManager::print_amount = 1200;
 bool HttpTestManager::print_hex = false;
 bool HttpTestManager::show_pegs = true;
+bool HttpTestManager::show_scan = false;
 
 void HttpTestManager::update_test_number(int64_t new_test_number)
 {
diff --git a/src/service_inspectors/http_inspect/http_test_manager.h b/src/service_inspectors/http_inspect/http_test_manager.h
index 5a23c5e54..0dd9d2c4b 100644
--- a/src/service_inspectors/http_inspect/http_test_manager.h
+++ b/src/service_inspectors/http_inspect/http_test_manager.h
@@ -48,6 +48,8 @@ public:
     static bool get_print_hex() { return print_hex; }
     static void set_show_pegs(bool show_pegs_) { show_pegs = show_pegs_; }
     static bool get_show_pegs() { return show_pegs; }
+    static void set_show_scan(bool show_scan_) { show_scan = show_scan_; }
+    static bool get_show_scan() { return show_scan; }
 
 private:
     HttpTestManager() = delete;
@@ -63,6 +65,7 @@ private:
     static long print_amount;
     static bool print_hex;
     static bool show_pegs;
+    static bool show_scan;
 };
 
 #endif