Pull request #5161: appid: refine ssh event id handling

Merge in SNORT/snort3 from ~OSTEPANO/snort3:ssh_flow_data to master

Squashed commit of the following:

commit 6c1d1ab07da00ab1668e08e7f3acb3950b30621f
Author: Oleksandr Stepanov <ostepano@cisco.com>
Date:   Fri Feb 6 09:54:04 2026 -0500

    appid: refine ssh event id handling

diff --git a/src/network_inspectors/appid/appid_inspector.cc b/src/network_inspectors/appid/appid_inspector.cc
index 2da70273586d35ea0d28bec55bf2a6ebfc4de3e6..9f899f941cd5d47b12a2d1cec7bbae0875432602 100644 (file)
--- a/src/network_inspectors/appid/appid_inspector.cc
+++ b/src/network_inspectors/appid/appid_inspector.cc
@@ -286,6 +286,7 @@ static void mod_dtor(Module* m)
 static void appid_inspector_pinit()
 {
     AppIdSession::init();
+    SshEventFlowData::init();
     TPLibHandler::get();
     AppIdPegCounts::init_peg_info();
 }

diff --git a/src/network_inspectors/appid/appid_ssh_event_handler.cc b/src/network_inspectors/appid/appid_ssh_event_handler.cc
index ebd974d591c989ff946d7c1f1dad8cfa3cbe6a5b..1ed5508e036228f5a238c679002fedcf3408bd16 100644 (file)
--- a/src/network_inspectors/appid/appid_ssh_event_handler.cc
+++ b/src/network_inspectors/appid/appid_ssh_event_handler.cc
@@ -141,7 +141,7 @@ static void handle_success(SshEventFlowData& data, const SshEvent& event,
     APPID_LOG(CURRENT_PACKET, TRACE_DEBUG_LEVEL, "SSH event handler service detected\n");
 }
 
-unsigned int SshEventHandler::id;
+unsigned int SshEventFlowData::id = 0;
 
 void SshEventHandler::handle(DataEvent& event, Flow* flow)
 {
@@ -163,7 +163,7 @@ void SshEventHandler::handle(DataEvent& event, Flow* flow)
     if (is_appid_cpu_profiling_running)
         per_appid_event_cpu_timer.start();
     
-    SshEventFlowData* data = (SshEventFlowData* )asd->get_flow_data(id);
+    SshEventFlowData* data = (SshEventFlowData* )asd->get_flow_data(SshEventFlowData::get_id());
     Packet* p = DetectionEngine::get_current_packet();
 
     if (data and data->failed)
@@ -175,7 +175,7 @@ void SshEventHandler::handle(DataEvent& event, Flow* flow)
     if (!data)
     {
         data = new SshEventFlowData;
-        asd->add_flow_data(data, id);
+        asd->add_flow_data(data, SshEventFlowData::get_id());
     }
 
     SshEvent& ssh_event = (SshEvent&)event;

diff --git a/src/network_inspectors/appid/appid_ssh_event_handler.h b/src/network_inspectors/appid/appid_ssh_event_handler.h
index ad70f51f8b92bd7841e4dd2411c2cdc981257599..4cba4a7bf0aeb8b4f2bf04f599891671c7258ae5 100644 (file)
--- a/src/network_inspectors/appid/appid_ssh_event_handler.h
+++ b/src/network_inspectors/appid/appid_ssh_event_handler.h
@@ -29,12 +29,9 @@ class SshEventHandler : public snort::DataHandler
 {
 public:
     SshEventHandler() : snort::DataHandler(MOD_NAME)
-    { id = snort::FlowData::create_flow_data_id(); }
+    { }
 
     void handle(snort::DataEvent &, snort::Flow *) override;
-
-private:
-    static unsigned int id;
 };
 
 struct SshAppIdInfo
@@ -51,6 +48,15 @@ public:
     SshAppIdInfo service_info;
     SshAppIdInfo client_info;
     bool failed = false;
+
+    static void init()
+    { id = snort::FlowData::create_flow_data_id(); }
+
+    static unsigned int get_id()
+    { return id; }
+
+private:
+    static unsigned int id;
 };
 
 #endif

diff --git a/src/network_inspectors/appid/test/CMakeLists.txt b/src/network_inspectors/appid/test/CMakeLists.txt
index 77dbe7495fa8e3c21dfd7c8bef242c0ac06389d8..df69a08c185482efdb7263bc6853e711512ce71d 100644 (file)
--- a/src/network_inspectors/appid/test/CMakeLists.txt
+++ b/src/network_inspectors/appid/test/CMakeLists.txt
@@ -52,6 +52,12 @@ add_cpputest( user_data_map_test
     SOURCES ../user_data_map.cc
 )
 
+add_cpputest( appid_ssh_event_handler_test
+    SOURCES
+        appid_ssh_event_handler_test.cc
+        $<TARGET_OBJECTS:appid_cpputest_deps>
+)
+
 add_cpputest( tp_lib_handler_test
     SOURCES
         tp_lib_handler_test.cc

diff --git a/src/network_inspectors/appid/test/appid_ssh_event_handler_test.cc b/src/network_inspectors/appid/test/appid_ssh_event_handler_test.cc
new file mode 100644 (file)
index 0000000..3eb1a91
--- /dev/null
+++ b/src/network_inspectors/appid/test/appid_ssh_event_handler_test.cc
@@ -0,0 +1,85 @@
+//--------------------------------------------------------------------------
+// Copyright (C) 2026-2026 Cisco and/or its affiliates. All rights reserved.
+//
+// This program is free software; you can redistribute it and/or modify it
+// under the terms of the GNU General Public License Version 2 as published
+// by the Free Software Foundation.  You may not use, modify or distribute
+// this program under any other version of the GNU General Public License.
+//
+// This program is distributed in the hope that it will be useful, but
+// WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+// General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+//--------------------------------------------------------------------------
+
+// appid_ssh_event_handler_test.cc author Cisco
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include <string>
+
+#include "../appid_ssh_event_handler.h"
+
+#include <CppUTest/CommandLineTestRunner.h>
+#include <CppUTest/TestHarness.h>
+#include <CppUTestExt/MockSupport.h>
+
+namespace snort
+{
+unsigned FlowData::flow_data_id = 0;
+void LogLabel(const char*, FILE*) {}
+void LogText(const char*, FILE*) {}
+char* snort_strdup(const char* str)
+{
+    assert(str);
+    size_t n = strlen(str) + 1;
+    char* p = (char*)snort_alloc(n);
+    memcpy(p, str, n);
+    return p;
+}
+char* snort_strndup(const char* src, size_t)
+{
+    return snort_strdup(src);
+}
+}
+
+unsigned int SshEventFlowData::id = 0;
+
+THREAD_LOCAL AppIdDebug* appidDebug = nullptr;
+THREAD_LOCAL bool appid_trace_enabled = false;
+void appid_log(const snort::Packet*, unsigned char, char const*, ...) { }
+
+TEST_GROUP(appid_ssh_event_handler_tests)
+{
+    void setup() override
+    {
+    }
+
+    void teardown() override
+    {
+    }
+};
+
+TEST(appid_ssh_event_handler_tests, verify_flow_id_persistance)
+{
+    SshEventFlowData::init();
+
+    SshEventFlowData data1;
+    SshEventFlowData data2;
+    SshEventFlowData data3;
+
+    CHECK_EQUAL(data1.get_id(),data2.get_id());
+    CHECK_EQUAL(data1.get_id(),data3.get_id());
+}
+
+int main(int argc, char** argv)
+{
+    int rc = CommandLineTestRunner::RunAllTests(argc, argv);
+    return rc;
+}
\ No newline at end of file