From: Russ Combs Date: Mon, 22 Jun 2015 15:45:56 +0000 (-0400) Subject: Squashed commit of the following: X-Git-Tag: 3.0.0-233~942 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f2c1f042597f0db31454a59a4874ff125dcd5ca6;p=thirdparty%2Fsnort3.git Squashed commit of the following: commit 6763e931ecd25c3e7b68fec434f340919cb58169 Author: huica Date: Mon Jun 22 08:27:12 2015 -0400 replace packet pointer with flow --- diff --git a/src/file_api/file_api.h b/src/file_api/file_api.h index 4913546e3..b8f45f442 100644 --- a/src/file_api/file_api.h +++ b/src/file_api/file_api.h @@ -180,10 +180,10 @@ struct MimeDataPafInfo MimeBoundaryState boundary_state; }; -typedef int (*Handle_header_line_func)(void* conf, void* pkt, const uint8_t* ptr, +typedef int (*Handle_header_line_func)(void* conf, const uint8_t* ptr, const uint8_t* eol, int max_header_len, void* mime_ssn); -typedef int (*Normalize_data_func)(void* conf, void* pkt, const uint8_t* ptr, +typedef int (*Normalize_data_func)(void* conf, const uint8_t* ptr, const uint8_t* data_end); typedef void (*Decode_alert_func)(void* decode_state); typedef void (*Reset_state_func)(void* ssn); @@ -240,8 +240,8 @@ typedef File_Verdict (*File_signature_callback_func)(Packet* p, Flow* flow, typedef void (*Log_file_action_func)(Flow* flow, int action); // FIXIT-L constify file_data et al -typedef int (*File_process_func)( - Packet* p, uint8_t* file_data, int data_size, FilePosition, +typedef bool (*File_process_func)( + Flow* flow, uint8_t* file_data, int data_size, FilePosition, bool upload, bool suspend_block_verdict); typedef int (*Get_file_name_func)(Flow* flow, uint8_t** file_name, uint32_t* name_len); @@ -271,9 +271,9 @@ typedef void (*Set_mime_log_config_defaults_func)(MAIL_LogConfig* log_config); typedef int (*Parse_mime_decode_args_func)(DecodeConfig* decode_conf, char* arg, const char* preproc_name); typedef void (*Check_decode_config_func)(DecodeConfig* decode_conf); -typedef const uint8_t* (*Process_mime_data_func)(void* packet, const uint8_t* start, const +typedef const uint8_t* (*Process_mime_data_func)(Flow* flow, const uint8_t* start, const uint8_t* end, - MimeState* mime_ssn, bool upload, bool paf_enabled); + MimeState* mime_ssn, bool upload, FilePosition position); typedef void (*Free_mime_session_func)(MimeState* mime_ssn); typedef bool (*Is_decoding_enabled_func)(DecodeConfig* decode_conf); typedef bool (*Is_decoding_conf_changed_func)(DecodeConfig* configNext, DecodeConfig* config, @@ -302,9 +302,7 @@ typedef uint32_t (*Get_new_file_instance)(Flow*); typedef struct FileContext* (*Create_file_context_func)(Flow*); typedef struct FileContext* (*Get_file_context_func)(Flow*); typedef bool (*Set_file_context_func)(Flow*, FileContext*); -typedef int (*Process_file_func)(FileContext* ctx, Packet* p, - uint8_t* file_data, int data_size, FilePosition position, - bool suspend_block_verdict); + typedef int64_t (*Get_max_file_capture_size)(Flow* flow); typedef struct _file_api @@ -348,8 +346,8 @@ typedef struct _file_api * uint8_t **file_name: address for file name to be saved * uint32_t *name_len: address to save file name length * Returns - * 1: file name available, - * 0: file name is unavailable + * true: file name available, + * false: file name is unavailable */ Get_file_name_func get_file_name; @@ -629,20 +627,6 @@ typedef struct _file_api */ Get_file_context_func get_main_file_context; - /* Process file function, called by preprocessors that provides file data - * - * Arguments: - * void* ctx: file context that will be processed - * void* p: packet pointer - * uint8_t* file_data: file data - * int data_size: file data size - * FilePosition: file position - * bool suspend_block_verdict: used for smb to allow file pass - * Returns: - * 1: continue processing/log/block this file - * 0: ignore this file (no further processing needed) - */ - Process_file_func process_file; /* Return a unique file instance number * diff --git a/src/file_api/file_mime_process.cc b/src/file_api/file_mime_process.cc index 6e17f31a1..a857be9c9 100644 --- a/src/file_api/file_mime_process.cc +++ b/src/file_api/file_mime_process.cc @@ -410,7 +410,7 @@ static inline void setup_decode(const char* data, int size, bool cnt_xf, MimeSta * @return i index into p->payload where we stopped looking at data */ static const uint8_t* process_mime_header( - Packet* p, const uint8_t* ptr, + const uint8_t* ptr, const uint8_t* data_end_marker, MimeState* mime_ssn) { const uint8_t* eol = data_end_marker; @@ -555,7 +555,7 @@ static const uint8_t* process_mime_header( if (mime_ssn->methods && mime_ssn->methods->handle_header_line) { - int ret = mime_ssn->methods->handle_header_line(mime_ssn->config, p, ptr, eol, max_header_name_len, + int ret = mime_ssn->methods->handle_header_line(mime_ssn->config, ptr, eol, max_header_name_len, mime_ssn); if (ret < 0) return NULL; @@ -690,7 +690,7 @@ static const uint8_t* GetDataEnd(const uint8_t* data_start, * @param i index into p->payload buffer to start looking at data * @return i index into p->payload where we stopped looking at data */ -static const uint8_t* process_mime_body(Packet*, const uint8_t* ptr, +static const uint8_t* process_mime_body(const uint8_t* ptr, const uint8_t* data_end, MimeState* mime_ssn, bool is_data_end) { Email_DecodeState* decode_state = (Email_DecodeState*)(mime_ssn->decode_state); @@ -745,15 +745,14 @@ static void reset_mime_state(MimeState* mime_ssn) * * This should be called when mime data is available */ -const uint8_t* process_mime_data_paf(void* packet, const uint8_t* start, const uint8_t* end, +const uint8_t* process_mime_data_paf(Flow* flow, const uint8_t* start, const uint8_t* end, MimeState* mime_ssn, bool upload, FilePosition position) { - Packet* p = (Packet*)packet; bool done_data = false; if (mime_ssn->methods && mime_ssn->methods->is_end_of_data) { - done_data = mime_ssn->methods->is_end_of_data(p->flow); + done_data = mime_ssn->methods->is_end_of_data(flow); } /* if we've just entered the data state, check for a dot + end of line @@ -776,7 +775,7 @@ const uint8_t* process_mime_data_paf(void* packet, const uint8_t* start, const u * and dot to alt buffer */ if (mime_ssn->methods && mime_ssn->methods->normalize_data) { - if (mime_ssn->methods->normalize_data(mime_ssn->config, p, start, end) < 0) + if (mime_ssn->methods->normalize_data(mime_ssn->config, start, end) < 0) return NULL; } @@ -818,14 +817,14 @@ const uint8_t* process_mime_data_paf(void* packet, const uint8_t* start, const u } #endif - start = process_mime_header(p, start, end, mime_ssn); + start = process_mime_header(start, end, mime_ssn); if (start == NULL) return NULL; } if (mime_ssn->methods && mime_ssn->methods->normalize_data) { - if (mime_ssn->methods->normalize_data(mime_ssn->config, p, start, end) < 0) + if (mime_ssn->methods->normalize_data(mime_ssn->config, start, end) < 0) return NULL; } /* now we shouldn't have to worry about copying any data to the alt buffer @@ -837,11 +836,11 @@ const uint8_t* process_mime_data_paf(void* packet, const uint8_t* start, const u { case STATE_MIME_HEADER: DEBUG_WRAP(DebugMessage(DEBUG_FILE, "MIME HEADER STATE ~~~~~~~~~~~~~~~~~~~~~~\n"); ); - start = process_mime_header(p, start, end, mime_ssn); + start = process_mime_header(start, end, mime_ssn); break; case STATE_DATA_BODY: DEBUG_WRAP(DebugMessage(DEBUG_FILE, "DATA BODY STATE ~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); - start = process_mime_body(p, start, end, mime_ssn, isFileEnd(position) ); + start = process_mime_body(start, end, mime_ssn, isFileEnd(position) ); break; } } @@ -860,11 +859,11 @@ const uint8_t* process_mime_data_paf(void* packet, const uint8_t* start, const u } /*Process file type/file signature*/ - if (file_api->file_process(p, (uint8_t*)ds->decodePtr, + if (file_api->file_process(flow, (uint8_t*)ds->decodePtr, (uint16_t)ds->decoded_bytes, position, upload, false) && (isFileStart(position))&& mime_ssn->log_state) { - set_file_name_from_log(&(mime_ssn->log_state->file_log), p->flow); + set_file_name_from_log(&(mime_ssn->log_state->file_log), flow); } ResetDecodedBytes((Email_DecodeState*)(mime_ssn->decode_state)); } @@ -875,7 +874,7 @@ const uint8_t* process_mime_data_paf(void* packet, const uint8_t* start, const u { reset_mime_state(mime_ssn); if (mime_ssn->methods && mime_ssn->methods->reset_state) - mime_ssn->methods->reset_state(p->flow); + mime_ssn->methods->reset_state(flow); } return end; @@ -886,23 +885,21 @@ const uint8_t* process_mime_data_paf(void* packet, const uint8_t* start, const u * * * * This should be called when mime data is available * */ -const uint8_t* process_mime_data(void* packet, const uint8_t* start, - const uint8_t* data_end_marker, MimeState* mime_ssn, bool upload, bool paf_enabled) +const uint8_t* process_mime_data(Flow* flow, const uint8_t* start, + const uint8_t* data_end_marker, MimeState* mime_ssn, bool upload, FilePosition position) { const uint8_t* attach_start = start; const uint8_t* attach_end; - Packet* p = (Packet*)packet; - FilePosition position = SNORT_FILE_START; - if (paf_enabled) + if (position != SNORT_FILE_POSITION_UNKNOWN) { - position = file_api->get_file_position(p); - process_mime_data_paf(packet, attach_start, data_end_marker, + //FilePosition position = file_api->get_file_position(p); + process_mime_data_paf(flow, attach_start, data_end_marker, mime_ssn, upload, position); return data_end_marker; } - initFilePosition(&position, file_api->get_file_processed_size(p->flow)); + initFilePosition(&position, file_api->get_file_processed_size(flow)); /* look for boundary */ while (start < data_end_marker) { @@ -911,7 +908,7 @@ const uint8_t* process_mime_data(void* packet, const uint8_t* start, { attach_end = start; finalFilePosition(&position); - process_mime_data_paf(packet, attach_start, attach_end, + process_mime_data_paf(flow, attach_start, attach_end, mime_ssn, upload, position); position = SNORT_FILE_START; attach_start = start + 1; @@ -922,8 +919,8 @@ const uint8_t* process_mime_data(void* packet, const uint8_t* start, if ((start == data_end_marker) && (attach_start < data_end_marker)) { - updateFilePosition(&position, file_api->get_file_processed_size(p->flow)); - process_mime_data_paf(packet, attach_start, data_end_marker, + updateFilePosition(&position, file_api->get_file_processed_size(flow)); + process_mime_data_paf(flow, attach_start, data_end_marker, mime_ssn, upload, position); } diff --git a/src/file_api/file_mime_process.h b/src/file_api/file_mime_process.h index 2dfb6572b..9533dab1a 100644 --- a/src/file_api/file_mime_process.h +++ b/src/file_api/file_mime_process.h @@ -63,8 +63,8 @@ int log_file_name(const uint8_t* start, int length, FILE_LogState* log_state, bo int set_log_buffers(MAIL_LogState** log_state, MAIL_LogConfig* conf); void init_mime(void); void free_mime(void); -const uint8_t* process_mime_data(void *packet, const uint8_t *start, const uint8_t *end, - MimeState *mime_ssn, bool upload, bool paf_enabled); +const uint8_t* process_mime_data(Flow *flow, const uint8_t *start, const uint8_t *end, + MimeState *mime_ssn, bool upload, FilePosition position); void free_mime_session(MimeState* mime_ssn); void finalize_mime_position(Flow* flow, void* decode_state, FilePosition* position); void reset_mime_paf_state(MimeDataPafInfo *data_info); diff --git a/src/file_api/file_service.cc b/src/file_api/file_service.cc index 438d96feb..1e151c8d5 100644 --- a/src/file_api/file_service.cc +++ b/src/file_api/file_service.cc @@ -77,7 +77,7 @@ File_signature_callback_func file_signature_cb = NULL; Log_file_action_func log_file_action = NULL; /*Main File Processing functions */ -static int file_process(Packet* p, uint8_t* file_data, int data_size, +static bool file_process(Flow* flow, uint8_t* file_data, int data_size, FilePosition position, bool upload, bool suspend_block_verdict); /*File properties*/ @@ -115,7 +115,7 @@ static uint32_t get_new_file_instance(Flow* flow); FileContext* create_file_context(Flow* flow); bool set_current_file_context(Flow* flow, FileContext* ctx); FileContext* get_main_file_context(Flow* flow); -static int process_file_context(FileContext* ctx, Packet* p, uint8_t* file_data, +static bool process_file_context(FileContext* ctx, Packet* p, uint8_t* file_data, int data_size, FilePosition position, bool suspend_block_verdict); static FilePosition get_file_position(Packet* pkt); static bool check_paf_abort(Flow* flow); @@ -201,7 +201,6 @@ void init_fileAPI(void) fileAPI.set_current_file_context = &set_current_file_context; fileAPI.get_current_file_context = &get_current_file_context; fileAPI.get_main_file_context = &get_main_file_context; - fileAPI.process_file = &process_file_context; fileAPI.get_file_position = &get_file_position; fileAPI.reset_mime_paf_state = &reset_mime_paf_state; fileAPI.process_mime_paf_data = &process_mime_paf_data; @@ -360,12 +359,11 @@ FileContext* create_file_context(Flow* flow) return context; } -static inline FileContext* find_main_file_context(Packet* p, FilePosition position, +static inline FileContext* find_main_file_context(Flow* flow, FilePosition position, bool upload) { FileContext* context = NULL; - Packet* pkt = (Packet*)p; - Flow* flow = pkt->flow; + FileSession* file_session = get_file_session (flow); /* Attempt to get a previously allocated context. */ @@ -375,25 +373,14 @@ static inline FileContext* find_main_file_context(Packet* p, FilePosition positi if (context and ((position == SNORT_FILE_MIDDLE)or (position == SNORT_FILE_END))) return context; - else if (context) + else if ((context) && (context->verdict != FILE_VERDICT_PENDING)) { - /*Push file event when there is another file in the same packet*/ - if (pkt->packet_flags & PKT_FILE_EVENT_SET) - { - SnortEventqLog(pkt); - SnortEventqReset(); - pkt->packet_flags &= ~PKT_FILE_EVENT_SET; - } - - if (context->verdict != FILE_VERDICT_PENDING) - { - /* Reuse the same context */ - file_context_reset(context); - file_stats.files_total++; - init_file_context(flow, upload, context); - context->file_id = file_session->max_file_id++; - return context; - } + /* Reuse the same context */ + file_context_reset(context); + file_stats.files_total++; + init_file_context(flow, upload, context); + context->file_id = file_session->max_file_id++; + return context; } context = create_file_context(flow); @@ -540,6 +527,9 @@ static inline void _file_signature_lookup(FileContext* context, { File_Verdict verdict = FILE_VERDICT_UNKNOWN; + if (!pkt) + return; + if (file_signature_cb) { verdict = file_signature_cb(pkt, pkt->flow, context->sha256, @@ -716,22 +706,19 @@ static bool is_file_service_enabled() /* * Return: - * 1: continue processing/log/block this file - * 0: ignore this file + * true: continue processing/log/block this file + * false: ignore this file */ -static int process_file_context(FileContext* context, Packet* pkt, uint8_t* file_data, - int data_size, FilePosition position, bool suspend_block_verdict) +static bool process_file_context(FileContext* context, Packet* pkt, Flow* flow, uint8_t* file_data, + int data_size, FilePosition position, bool suspend_block_verdict) { if ( FileConfig::trace_stream ) { DumpHex(stdout, file_data, data_size); - DEBUG_WRAP(DebugMessage(DEBUG_FILE, "stream pointer %p\n", pkt->flow); ); } - Flow* flow = pkt->flow; - if (!context) - return 0; + return false; set_current_file_context(flow, context); file_stats.file_data_total += data_size; @@ -739,7 +726,7 @@ static int process_file_context(FileContext* context, Packet* pkt, uint8_t* file if ((!context->file_type_enabled)and (!context->file_signature_enabled)) { updateFileSize(context, data_size, position); - return 0; + return false; } /* if file config is changed, update it*/ @@ -754,11 +741,11 @@ static int process_file_context(FileContext* context, Packet* pkt, uint8_t* file context->file_type_context = NULL; } - if (check_http_partial_content(pkt)) + if (pkt and check_http_partial_content(pkt)) { context->file_type_enabled = false; context->file_signature_enabled = false; - return 0; + return false; } /*file type id*/ @@ -775,12 +762,12 @@ static int process_file_context(FileContext* context, Packet* pkt, uint8_t* file context->file_signature_enabled = false; updateFileSize(context, data_size, position); file_capture_stop(context); - return 0; + return false; } if (context->file_type_id != SNORT_FILE_TYPE_CONTINUE) { - if (file_type_cb) + if (pkt and file_type_cb) { verdict = file_type_cb(pkt, pkt->flow, context->file_type_id, context->upload, context->file_id); @@ -796,7 +783,6 @@ static int process_file_context(FileContext* context, Packet* pkt, uint8_t* file file_eventq_add(GENERATOR_FILE_TYPE, context->file_type_id, RULE_TYPE__ALERT); context->file_signature_enabled = false; - pkt->packet_flags |= PKT_FILE_EVENT_SET; } else if (verdict == FILE_VERDICT_BLOCK) { @@ -804,17 +790,21 @@ static int process_file_context(FileContext* context, Packet* pkt, uint8_t* file RULE_TYPE__DROP); updateFileSize(context, data_size, position); context->file_signature_enabled = false; - add_file_to_block(pkt, verdict, context->file_type_id, NULL); + if (pkt) + add_file_to_block(pkt, verdict, context->file_type_id, NULL); return 1; } else if (verdict == FILE_VERDICT_REJECT) { file_eventq_add(GENERATOR_FILE_TYPE, context->file_type_id, RULE_TYPE__DROP); - ActionManager::queue_reject(pkt); - updateFileSize(context, data_size, position); - context->file_signature_enabled = false; - add_file_to_block(pkt, verdict, context->file_type_id, NULL); + if (pkt) + { + ActionManager::queue_reject(pkt); + updateFileSize(context, data_size, position); + context->file_signature_enabled = false; + add_file_to_block(pkt, verdict, context->file_type_id, NULL); + } return 1; } else if (verdict == FILE_VERDICT_STOP) @@ -860,29 +850,29 @@ static int process_file_context(FileContext* context, Packet* pkt, uint8_t* file { updateFileSize(context, data_size, position); } - return 1; + return true; } /* * Return: - * 1: continue processing/log/block this file - * 0: ignore this file + * true: continue processing/log/block this file + * false: ignore this file */ -static int file_process(Packet* p, uint8_t* file_data, int data_size, +static bool file_process(Flow* flow, uint8_t* file_data, int data_size, FilePosition position, bool upload, bool suspend_block_verdict) { FileContext* context; - + Packet* p = NULL; /* if both disabled, return immediately*/ if (!is_file_service_enabled()) - return 0; + return false; if (position == SNORT_FILE_POSITION_UNKNOWN) - return 0; + return false; - context = find_main_file_context(p, position, upload); + context = find_main_file_context(flow, position, upload); - return process_file_context(context, p, file_data, data_size, position, + return process_file_context(context, p, flow, file_data, data_size, position, suspend_block_verdict); } diff --git a/src/service_inspectors/ftp_telnet/ftp_data.cc b/src/service_inspectors/ftp_telnet/ftp_data.cc index 12b68a86d..a3bb1a6ee 100644 --- a/src/service_inspectors/ftp_telnet/ftp_data.cc +++ b/src/service_inspectors/ftp_telnet/ftp_data.cc @@ -71,7 +71,7 @@ static void FTPDataProcess( set_file_data((uint8_t*)p->data, p->dsize); - status = file_api->file_process(p, file_data, data_length, + status = file_api->file_process(p->flow, file_data, data_length, data_ssn->position, data_ssn->direction, false); /* Filename needs to be set AFTER the first call to file_process( ) */ diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc index 8909db0b7..b09cdaf8b 100644 --- a/src/service_inspectors/http_inspect/hi_main.cc +++ b/src/service_inspectors/http_inspect/hi_main.cc @@ -653,11 +653,12 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) if (hsd->mime_ssn) { uint8_t* end = ( uint8_t*)(p->data) + p->dsize; - file_api->process_mime_data(p, p->data, end, hsd->mime_ssn, 1, false); + file_api->process_mime_data(p->flow, p->data, end, hsd->mime_ssn, 1, + SNORT_FILE_POSITION_UNKNOWN); } else if (file_api->get_file_processed_size(p->flow) >0) { - file_api->file_process(p, (uint8_t*)p->data, p->dsize, getFilePoistion(p), + file_api->file_process(p->flow, (uint8_t*)p->data, p->dsize, getFilePoistion(p), true, false); } } @@ -785,11 +786,13 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) end = (uint8_t*)(session->client.request.post_raw + session->client.request.post_raw_size); - file_api->process_mime_data(p, start, end, hsd->mime_ssn, 1, false); + file_api->process_mime_data(p->flow, start, end, hsd->mime_ssn, 1, + SNORT_FILE_POSITION_UNKNOWN); } else { - if (file_api->file_process(p,(uint8_t*)session->client.request.post_raw, + if (file_api->file_process(p->flow, + (uint8_t*)session->client.request.post_raw, (uint16_t)session->client.request.post_raw_size, getFilePoistion(p), true, false)) { @@ -821,11 +824,13 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) if (hsd->mime_ssn) { uint8_t* end = ( uint8_t*)(p->data) + p->dsize; - file_api->process_mime_data(p, p->data, end, hsd->mime_ssn, 1, false); + file_api->process_mime_data(p->flow, p->data, end, hsd->mime_ssn, 1, + SNORT_FILE_POSITION_UNKNOWN); } else if (file_api->get_file_processed_size(p->flow) >0) { - file_api->file_process(p, (uint8_t*)p->data, p->dsize, getFilePoistion(p), + file_api->file_process(p->flow, (uint8_t*)p->data, p->dsize, + getFilePoistion(p), true, false); } } @@ -1074,7 +1079,8 @@ int HttpInspectMain(HTTPINSPECT_CONF* conf, Packet* p) } if (p->has_paf_payload() - && file_api->file_process(p,(uint8_t*)session->server.response.body, + && file_api->file_process(p->flow, + (uint8_t*)session->server.response.body, (uint16_t)session->server.response.body_size, getFilePoistion(p), false, false)) { diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc index da62f26f8..a9252cce5 100644 --- a/src/service_inspectors/imap/imap.cc +++ b/src/service_inspectors/imap/imap.cc @@ -550,7 +550,10 @@ static void IMAP_ProcessServerPacket(Packet* p, IMAPData* imap_ssn) } else data_end = ptr + len; - ptr = file_api->process_mime_data(p, ptr, end, &(imap_ssn->mime_ssn), 0, true); + + FilePosition position = file_api->get_file_position(p); + ptr = file_api->process_mime_data(p->flow, ptr, end, &(imap_ssn->mime_ssn), 0, + position); if ( ptr < data_end) len = len - (data_end - ptr); diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc index 4000400ce..5ebe16390 100644 --- a/src/service_inspectors/pop/pop.cc +++ b/src/service_inspectors/pop/pop.cc @@ -516,7 +516,9 @@ static void POP_ProcessServerPacket(Packet* p, POPData* pop_ssn) { DEBUG_WRAP(DebugMessage(DEBUG_POP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); //ptr = POP_HandleData(p, ptr, end); - ptr = file_api->process_mime_data(p, ptr, end, &(pop_ssn->mime_ssn), 0, true); + FilePosition position = file_api->get_file_position(p); + ptr = file_api->process_mime_data(p->flow, ptr, end, &(pop_ssn->mime_ssn), 0, + position); continue; } POP_GetEOL(ptr, end, &eol, &eolm); diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc index 355ce6a20..fbaf21891 100644 --- a/src/service_inspectors/smtp/smtp.cc +++ b/src/service_inspectors/smtp/smtp.cc @@ -163,9 +163,9 @@ static void snort_smtp(SMTP_PROTO_CONF* GlobalConf, Packet* p); static void SMTP_ResetState(void*); void SMTP_DecodeAlert(void* ds); -static int SMTP_HandleHeaderLine(void* conf, void* pkt, const uint8_t* ptr, const uint8_t* eol, +static int SMTP_HandleHeaderLine(void* conf, const uint8_t* ptr, const uint8_t* eol, int max_header_len, void* ssn); -static int SMTP_NormalizeData(void* conf, void* pkt, const uint8_t* ptr, const uint8_t* data_end); +static int SMTP_NormalizeData(void* conf, const uint8_t* ptr, const uint8_t* data_end); MimeMethods smtp_mime_methods = { SMTP_HandleHeaderLine, SMTP_NormalizeData, SMTP_DecodeAlert, SMTP_ResetState, smtp_is_data_end }; @@ -912,7 +912,7 @@ static const uint8_t* SMTP_HandleCommand(SMTP_PROTO_CONF* config, Packet* p, SMT /* if normalizing, copy line to alt buffer */ if (smtp_normalizing) { - ret = SMTP_CopyToAltBuffer(p, ptr, eol - ptr); + ret = SMTP_CopyToAltBuffer(ptr, eol - ptr); if (ret == -1) return NULL; } @@ -1133,7 +1133,7 @@ static const uint8_t* SMTP_HandleCommand(SMTP_PROTO_CONF* config, Packet* p, SMT } else if (smtp_normalizing) /* Already normalizing */ { - ret = SMTP_CopyToAltBuffer(p, ptr, eol - ptr); + ret = SMTP_CopyToAltBuffer(ptr, eol - ptr); if (ret == -1) return NULL; } @@ -1141,33 +1141,32 @@ static const uint8_t* SMTP_HandleCommand(SMTP_PROTO_CONF* config, Packet* p, SMT return eol; } -static int SMTP_NormalizeData(void* conf, void* pkt, const uint8_t* ptr, const uint8_t* data_end) +static int SMTP_NormalizeData(void* conf, const uint8_t* ptr, const uint8_t* data_end) { - Packet* p = (Packet*)pkt; SMTP_PROTO_CONF* config = (SMTP_PROTO_CONF*)conf; /* if we're ignoring data and not already normalizing, copy everything * up to here into alt buffer so detection engine doesn't have * to look at the data; otherwise, if we're normalizing and not * ignoring data, copy all of the data into the alt buffer */ - if (config->decode_conf.ignore_data && !smtp_normalizing) + /*if (config->decode_conf.ignore_data && !smtp_normalizing) { - return SMTP_CopyToAltBuffer(p, p->data, ptr - p->data); + return SMTP_CopyToAltBuffer(p->data, ptr - p->data); } - else if (!config->decode_conf.ignore_data && smtp_normalizing) + else */ + if (!config->decode_conf.ignore_data && smtp_normalizing) { - return SMTP_CopyToAltBuffer(p, ptr, data_end - ptr); + return SMTP_CopyToAltBuffer(ptr, data_end - ptr); } return 0; } -static int SMTP_HandleHeaderLine(void* conf, void* pkt, const uint8_t* ptr, const uint8_t* eol, +static int SMTP_HandleHeaderLine(void* conf, const uint8_t* ptr, const uint8_t* eol, int max_header_len, void* ssn) { int ret; int header_line_len; - Packet* p = (Packet*)pkt; SMTP_PROTO_CONF* config = (SMTP_PROTO_CONF*)conf; MimeState* mime_ssn = (MimeState*)ssn; /* get length of header line */ @@ -1194,7 +1193,7 @@ static int SMTP_HandleHeaderLine(void* conf, void* pkt, const uint8_t* ptr, cons * currently the code does not normalize headers */ if (smtp_normalizing) { - ret = SMTP_CopyToAltBuffer(p, ptr, eol - ptr); + ret = SMTP_CopyToAltBuffer(ptr, eol - ptr); if (ret == -1) return (-1); } @@ -1224,6 +1223,7 @@ static void SMTP_ProcessClientPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat const uint8_t* ptr = p->data; const uint8_t* end = p->data + p->dsize; + if (smtp_ssn->state == STATE_CONNECT) { smtp_ssn->state = STATE_COMMAND; @@ -1231,6 +1231,7 @@ static void SMTP_ProcessClientPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat while ((ptr != NULL) && (ptr < end)) { + FilePosition position; switch (smtp_ssn->state) { case STATE_COMMAND: @@ -1240,12 +1241,14 @@ static void SMTP_ProcessClientPacket(SMTP_PROTO_CONF* config, Packet* p, SMTPDat case STATE_DATA: case STATE_BDATA: DEBUG_WRAP(DebugMessage(DEBUG_SMTP, "DATA STATE ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n"); ); - ptr = file_api->process_mime_data(p, ptr, end, &(smtp_ssn->mime_ssn), 1, true); + position = file_api->get_file_position(p); + ptr = file_api->process_mime_data(p->flow, ptr, end, &(smtp_ssn->mime_ssn), 1, + position); //ptr = SMTP_HandleData(p, ptr, end, &(smtp_ssn->mime_ssn)); break; case STATE_XEXCH50: if (smtp_normalizing) - SMTP_CopyToAltBuffer(p, ptr, end - ptr); + SMTP_CopyToAltBuffer(ptr, end - ptr); if (smtp_is_data_end (p->flow)) smtp_ssn->state = STATE_COMMAND; return; diff --git a/src/service_inspectors/smtp/smtp_normalize.cc b/src/service_inspectors/smtp/smtp_normalize.cc index dcd834809..3f57ac27e 100644 --- a/src/service_inspectors/smtp/smtp_normalize.cc +++ b/src/service_inspectors/smtp/smtp_normalize.cc @@ -127,13 +127,13 @@ int SMTP_NormalizeCmd(Packet* p, const uint8_t* ptr, const uint8_t* eolm, const * line into the alt buffer */ if (!smtp_normalizing) { - ret = SMTP_CopyToAltBuffer(p, p->data, ptr - p->data); + ret = SMTP_CopyToAltBuffer(p->data, ptr - p->data); if (ret == -1) return -1; } /* copy the command into the alt buffer */ - ret = SMTP_CopyToAltBuffer(p, cmd_start, cmd_end - cmd_start); + ret = SMTP_CopyToAltBuffer(cmd_start, cmd_end - cmd_start); if (ret == -1) return -1; @@ -141,17 +141,17 @@ int SMTP_NormalizeCmd(Packet* p, const uint8_t* ptr, const uint8_t* eolm, const if (args_start != args_end) { /* copy a 'pure' space */ - ret = SMTP_CopyToAltBuffer(p, space, 1); + ret = SMTP_CopyToAltBuffer(space, 1); if (ret == -1) return -1; - ret = SMTP_CopyToAltBuffer(p, args_start, args_end - args_start); + ret = SMTP_CopyToAltBuffer(args_start, args_end - args_start); if (ret == -1) return -1; } /* copy the end of line marker into the alt buffer */ - ret = SMTP_CopyToAltBuffer(p, eolm, eol - eolm); + ret = SMTP_CopyToAltBuffer(eolm, eol - eolm); if (ret == -1) return -1; } @@ -159,7 +159,7 @@ int SMTP_NormalizeCmd(Packet* p, const uint8_t* ptr, const uint8_t* eolm, const { /* if we're already normalizing and didn't need to normalize this line, just * copy it into the alt buffer */ - ret = SMTP_CopyToAltBuffer(p, ptr, eol - ptr); + ret = SMTP_CopyToAltBuffer(ptr, eol - ptr); if (ret == -1) return -1; } diff --git a/src/service_inspectors/smtp/smtp_util.cc b/src/service_inspectors/smtp/smtp_util.cc index ca9313069..b57579cd3 100644 --- a/src/service_inspectors/smtp/smtp_util.cc +++ b/src/service_inspectors/smtp/smtp_util.cc @@ -96,7 +96,7 @@ void SMTP_ResetAltBuffer(void) DecodeBuf.len = 0; } -int SMTP_CopyToAltBuffer(Packet* p, const uint8_t* start, int length) +int SMTP_CopyToAltBuffer(const uint8_t* start, int length) { uint8_t* alt_buf; int alt_size; @@ -119,7 +119,7 @@ int SMTP_CopyToAltBuffer(Packet* p, const uint8_t* start, int length) if (ret != SAFEMEM_SUCCESS) { - SetDetectLimit(p, 0); + //SetDetectLimit(p, 0); smtp_normalizing = 0; return -1; } diff --git a/src/service_inspectors/smtp/smtp_util.h b/src/service_inspectors/smtp/smtp_util.h index 8314186ab..1f9540623 100644 --- a/src/service_inspectors/smtp/smtp_util.h +++ b/src/service_inspectors/smtp/smtp_util.h @@ -32,7 +32,7 @@ #include "protocols/packet.h" void SMTP_GetEOL(const uint8_t*, const uint8_t*, const uint8_t**, const uint8_t**); -int SMTP_CopyToAltBuffer(Packet*, const uint8_t*, int); +int SMTP_CopyToAltBuffer(const uint8_t*, int); int SMTP_CopyEmailHdrs(const uint8_t*, int, MAIL_LogState* log_state); int SMTP_CopyEmailID(const uint8_t*, int, int, MAIL_LogState* log_state); void SMTP_LogFuncs(SMTP_PROTO_CONF* config, Packet* p, MimeState* mime_ssn); diff --git a/src/stream/file/file_session.cc b/src/stream/file/file_session.cc index 9c705a7da..9582e327c 100644 --- a/src/stream/file/file_session.cc +++ b/src/stream/file/file_session.cc @@ -73,7 +73,7 @@ int FileSession::process(Packet* p) MODULE_PROFILE_START(file_ssn_stats); StreamFileConfig* c = get_file_cfg(p->flow->ssn_server); - file_api->file_process(p, (uint8_t*)p->data, p->dsize, position(p), c->upload, false); + file_api->file_process(p->flow, (uint8_t*)p->data, p->dsize, position(p), c->upload, false); set_file_data((uint8_t*)p->data, p->dsize); MODULE_PROFILE_END(file_ssn_stats);