"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "src/preprocessors/HttpInspect/server/hi_server.c" between
snort-2.9.16.1.tar.gz and snort-2.9.17.tar.gz

About: Snort is a network intrusion prevention and detection system (IDS/IPS) combining the benefits of signature, protocol and anomaly-based inspection.

hi_server.c  (snort-2.9.16.1):hi_server.c  (snort-2.9.17)
skipping to change at line 86 skipping to change at line 86
#define HTTPRESP_HEADER_LENGTH__GZIP 4 #define HTTPRESP_HEADER_LENGTH__GZIP 4
#define HTTPRESP_HEADER_LENGTH__XGZIP 6 #define HTTPRESP_HEADER_LENGTH__XGZIP 6
#define HTTPRESP_HEADER_NAME__DEFLATE "deflate" #define HTTPRESP_HEADER_NAME__DEFLATE "deflate"
#define HTTPRESP_HEADER_LENGTH__DEFLATE 7 #define HTTPRESP_HEADER_LENGTH__DEFLATE 7
#define HTTPRESP_HEADER_NAME__CONTENT_LENGTH "Content-length" #define HTTPRESP_HEADER_NAME__CONTENT_LENGTH "Content-length"
#define HTTPRESP_HEADER_LENGTH__CONTENT_LENGTH 14 #define HTTPRESP_HEADER_LENGTH__CONTENT_LENGTH 14
#define HTTPRESP_HEADER_NAME__CONTENT_TYPE "Content-Type" #define HTTPRESP_HEADER_NAME__CONTENT_TYPE "Content-Type"
#define HTTPRESP_HEADER_LENGTH__CONTENT_TYPE 12 #define HTTPRESP_HEADER_LENGTH__CONTENT_TYPE 12
#define HTTPRESP_HEADER_NAME__TRANSFER_ENCODING "Transfer-Encoding" #define HTTPRESP_HEADER_NAME__TRANSFER_ENCODING "Transfer-Encoding"
#define HTTPRESP_HEADER_LENGTH__TRANSFER_ENCODING 17 #define HTTPRESP_HEADER_LENGTH__TRANSFER_ENCODING 17
#define HTTPRESP_HEADER_NAME__CONTENT_RANGE "Content-Range"
#define HTTPRESP_HEADER_LENGTH__CONTENT_RANGE 13
#define HTTPRESP_HEADER_NAME__ACCEPT_RANGES "Accept-Ranges"
#define HTTPRESP_HEADER_LENGTH__ACCEPT_RANGES 13
#if defined(FEAT_OPEN_APPID) #if defined(FEAT_OPEN_APPID)
#define HEADER_NAME__VIA "Via" #define HEADER_NAME__VIA "Via"
#define HEADER_LENGTH__VIA sizeof(HEADER_NAME__VIA)-1 #define HEADER_LENGTH__VIA sizeof(HEADER_NAME__VIA)-1
#define HEADER_NAME__SERVER "Server" #define HEADER_NAME__SERVER "Server"
#define HEADER_LENGTH__SERVER sizeof(HEADER_NAME__SERVER)-1 #define HEADER_LENGTH__SERVER sizeof(HEADER_NAME__SERVER)-1
#define HEADER_NAME__X_WORKING_WITH "X-Working-With" #define HEADER_NAME__X_WORKING_WITH "X-Working-With"
#define HEADER_LENGTH__X_WORKING_WITH sizeof(HEADER_NAME__X_WORKING_WITH)-1 #define HEADER_LENGTH__X_WORKING_WITH sizeof(HEADER_NAME__X_WORKING_WITH)-1
#endif /* defined(FEAT_OPEN_APPID) */ #endif /* defined(FEAT_OPEN_APPID) */
extern fd_config_t hi_fd_conf; extern fd_config_t hi_fd_conf;
skipping to change at line 757 skipping to change at line 761
return end; return end;
} }
} }
} }
if(!p || !hi_util_in_bounds(start, end, p)) if(!p || !hi_util_in_bounds(start, end, p))
p = end; p = end;
return p; return p;
} }
/*
* extract_http_content_range() will extract required data from content-range
* field. Focus is for, when the units is "bytes".
* The possible syntax as follows,
* content-range: <units> <start_pos>-<end_pos>/<total_len>
* content-range: <units> * /<total_len>
* content-range: <units> <start_pos>-<end_pos>/ *
*/
static const u_char *extract_http_content_range(HI_SESSION *Session,
const u_char *p, const u_char *start, const u_char *end,
HEADER_PTR *header_ptr)
{
u_char *crlf = NULL;
const u_char *unit_start = NULL;
int is_byte_range = false;
SkipBlankSpace(start,end,&p);
if (hi_util_in_bounds(start, end, p) && *p == ':')
{
p++;
CheckSkipAlertMultipleColon(Session, start, end, &p, HI_SI_SERVER_MODE);
while (hi_util_in_bounds(start, end, p))
{
if ((*p == ' ') || (*p == '\t'))
{
p++;
break;
}
p++;
}
if (hi_util_in_bounds(start, end, p))
{
/* extract unit */
unit_start = p;
while (hi_util_in_bounds(start, end, p) && ( *p != ' '))
{
p++;
}
if (*p != ' ')
{
if (hi_eo_generate_event(Session, HI_EO_SERVER_INVALID_CONTENT_R
ANGE_UNIT_FMT))
{
hi_eo_server_event_log(Session, HI_EO_SERVER_INVALID_CONTENT
_RANGE_UNIT_FMT, NULL, NULL);
}
header_ptr->range_flag = RANGE_WITH_RESP_ERROR;
return end;
}
/* Set flag, when unit is bytes. Based on unit, flow will change */
if (!strncasecmp((const char *)unit_start, RANGE_UNIT_BYTE, 5))
{
is_byte_range = true;
}
else
{
is_byte_range = false;
}
p++;
if (hi_util_in_bounds(start, end, p))
{
if (is_byte_range == true)
{
if (isdigit((int)*p))
{
/*if start with digit, then expectation is
"<start_pos>-<end_pos>/<total_len>" or "<start_pos>-<e
nd_pos>/ *"
There is no whitespace between / and * To make it comm
ent added the space
pattern other than above mentioned format will flag as
error */
uint64_t start_range = 0;
uint64_t end_range = 0;
uint64_t len = 0;
const u_char *start_ptr = NULL;
const u_char *end_ptr = NULL;
const u_char *len_ptr = NULL;
const u_char *ret_ptr = NULL;
int is_valid_range = false;
int delim_1 = false;
int delim_2 = false;
int assign = false;
start_ptr = p;
p++;
while (hi_util_in_bounds(start, end, p))
{
if (!isdigit((int)*p))
{
if (*p == '-')
{
if ((delim_2 == true) || (delim_1 == true))
{
break;
}
delim_1 = true;
assign = true;
p++;
continue;
}
else if (*p == '/')
{
if ((delim_1 == false) || (delim_2 == true))
{
break;
}
delim_2 = true;
assign = true;
p++;
continue;
}
else if ((*p == '*') || (*p == '\r') || (*p == '
\n'))
{
if ((delim_1 == false) || (delim_2 == false)
)
{
break;
}
is_valid_range = true;
break;
}
break;
}
/* Here digit only come */
if (assign == true)
{
if ((delim_2 == false) && (delim_1 == true))
{
end_ptr = p;
}
else if ((delim_1 == true) && (delim_2 == true))
{
len_ptr = p;
}
else
{
assign = false;
break;
}
assign = false;
}
p++;
}
if (is_valid_range == true)
{
/* Now check total_len, * means set the flag accordi
ngly
or convert str to value and flag as full content
when differnce between start_pos and end_pos and
sum with 1
equals to total_len, otherwise partial flag set *
/
if (*p == '*')
{
header_ptr->range_flag = RANGE_WITH_RESP_UNKNOWN
_CONTENT_SIZE;
}
else if ((start_ptr) && (end_ptr) && (len_ptr))
{
int error = false;
start_range = (uint64_t)SnortStrtol((char *)star
t_ptr, (char**)&ret_ptr, 10);
if ((errno == ERANGE) || (start_ptr == ret_ptr)
|| (start_range > 0xFFFFFFFF))
{
error = true;
}
ret_ptr = NULL;
end_range = (uint64_t)SnortStrtol((char *)end_pt
r, (char**)&ret_ptr, 10);
if ((errno == ERANGE) || (end_ptr == ret_ptr) ||
(end_range > 0xFFFFFFFF))
{
error = true;
}
ret_ptr = NULL;
len = (uint64_t)SnortStrtol((char *)len_ptr, (ch
ar**)&ret_ptr, 10);
if ((errno == ERANGE) || (len_ptr == ret_ptr) ||
(len > 0xFFFFFFFF))
{
error = true;
}
if (error == false)
{
if (((end_range - start_range) + 1) == len)
{
header_ptr->range_flag = RANGE_WITH_RESP
_FULL_CONTENT;
}
else
{
header_ptr->range_flag = RANGE_WITH_RESP
_PARTIAL_CONTENT;
}
}
else
{
header_ptr->range_flag = RANGE_WITH_RESP_ERR
OR;
}
}
else
{
header_ptr->range_flag = RANGE_WITH_RESP_ERROR;
}
crlf = (u_char *)SnortStrnStr((const char *)p, end -
p, "\n");
if (crlf)
{
return p;
}
else
{
header_ptr->header.uri_end = end;
return end;
}
}
}
else if (*p == '*')
{
/* To check pattern, "* /<total_len>" and set flag accor
dingly */
header_ptr->range_flag = RANGE_WITH_UNKNOWN_CONTENT_RANG
E;
p++;
if (hi_util_in_bounds(start, end, p))
{
if (*p == '/')
{
p++;
if (hi_util_in_bounds(start, end, p))
{
if (isdigit((int)*p))
{
p++;
while (hi_util_in_bounds(start, end, p))
{
if (isdigit((int)*p))
{
p++;
continue;
}
else if ((*p == '\r') || (*p == '\n'
)) /* digit followed by \r or \n */
{
crlf = (u_char *)SnortStrnStr((c
onst char *)p, end - p, "\n");
if (crlf)
{
return p;
}
else
{
header_ptr->header.uri_end =
end;
return end;
}
}
}
}
}
}
}
}
header_ptr->range_flag = RANGE_WITH_RESP_ERROR;
crlf = (u_char *)SnortStrnStr((const char *)p, end - p, "\n"
);
if (crlf)
{
p = crlf;
return p;
}
else
{
header_ptr->header.uri_end = end;
return end;
}
}
else
{
/* other than byte range is out of scope for snort */
while (hi_util_in_bounds(start, end, p))
{
if ((*p == '\r') || (*p == '\n'))
{
header_ptr->range_flag = RANGE_WITH_RESP_NON_BYTE;
crlf = (u_char *)SnortStrnStr((const char *)p, end -
p, "\n");
if (crlf)
{
p = crlf;
return p;
}
else
{
header_ptr->header.uri_end = end;
return end;
}
}
p++;
}
}
}
}
}
header_ptr->range_flag = RANGE_WITH_RESP_ERROR;
crlf = (u_char *)SnortStrnStr((const char *)p, end - p, "\n");
if (crlf)
{
p = crlf;
return p;
}
else
{
header_ptr->header.uri_end = end;
return end;
}
}
/* extract_http_accept_ranges will extract and set flag based on bytes unit */
static const u_char *extract_http_accept_ranges(HI_SESSION *Session,
const u_char *p, const u_char *start, const u_char *end,
HEADER_PTR *header_ptr, uint16_t *accept_range_flag)
{
const u_char *start_ptr = NULL;
const u_char *end_ptr = NULL;
u_char *crlf = NULL;
int len = 0;
*accept_range_flag = ACCEPT_RANGE_UNKNOWN;
SkipBlankSpace(start,end,&p);
if (hi_util_in_bounds(start, end, p) && (*p == ':'))
{
p++;
CheckSkipAlertMultipleColon(Session, start, end, &p, HI_SI_SERVER_MODE);
while (hi_util_in_bounds(start, end, p))
{
if ((*p == ' ') || (*p == '\t') || (*p == ','))
{
p++;
break;
}
p++;
}
if (hi_util_in_bounds(start, end, p))
{
start_ptr = p;
while (hi_util_in_bounds(start, end, p))
{
if ((*p == '\r') || (*p == '\n'))
{
end_ptr = (p - 1);
break;
}
p++;
}
if (start_ptr && end_ptr)
{
len = end_ptr - start_ptr;
if ((len >= 5) && (SnortStrcasestr((const char *)start, len, "by
tes")))
{
*accept_range_flag = ACCEPT_RANGE_BYTES;
}
else if ((len >= 4) && (!strncasecmp((const char *)start, "none"
, 4)))
{
*accept_range_flag = ACCEPT_RANGE_NONE;
}
else
{
*accept_range_flag = ACCEPT_RANGE_OTHER;
}
}
}
}
crlf = (u_char *)SnortStrnStr((const char *)p, end - p, "\n");
if (crlf)
{
p = crlf;
return p;
}
else
{
header_ptr->header.uri_end = end;
return end;
}
}
const u_char *extract_http_transfer_encoding(HI_SESSION *Session, HttpSessionDat a *hsd, const u_char *extract_http_transfer_encoding(HI_SESSION *Session, HttpSessionDat a *hsd,
const u_char *p, const u_char *start, const u_char *end, const u_char *p, const u_char *start, const u_char *end,
HEADER_PTR *header_ptr, int iInspectMode) HEADER_PTR *header_ptr, int iInspectMode)
{ {
uint8_t unfold_buf[DECODE_BLEN]; uint8_t unfold_buf[DECODE_BLEN];
uint32_t unfold_size =0; uint32_t unfold_size =0;
const u_char *start_ptr, *end_ptr, *cur_ptr; const u_char *start_ptr, *end_ptr, *cur_ptr;
SkipBlankSpace(start,end,&p); SkipBlankSpace(start,end,&p);
skipping to change at line 924 skipping to change at line 1304
parse_cont_encoding) parse_cont_encoding)
{ {
p = extract_http_content_encoding(ServerConf, p, start, end, header_ ptr, header_field_ptr,Session); p = extract_http_content_encoding(ServerConf, p, start, end, header_ ptr, header_field_ptr,Session);
} }
else if ( IsHeaderFieldName(p, end, HTTPRESP_HEADER_NAME__CONTENT_LENGTH , else if ( IsHeaderFieldName(p, end, HTTPRESP_HEADER_NAME__CONTENT_LENGTH ,
HTTPRESP_HEADER_LENGTH__CONTENT_LENGTH) ) HTTPRESP_HEADER_LENGTH__CONTENT_LENGTH) )
{ {
if(hsd && !hsd->resp_state.last_pkt_chunked) if(hsd && !hsd->resp_state.last_pkt_chunked)
p = extract_http_content_length(Session, ServerConf, p, start, e nd, header_ptr, header_field_ptr, HI_SI_SERVER_MODE ); p = extract_http_content_length(Session, ServerConf, p, start, e nd, header_ptr, header_field_ptr, HI_SI_SERVER_MODE );
} }
else if (IsHeaderFieldName(p, end, HTTPRESP_HEADER_NAME__CONTENT_RANGE,
HTTPRESP_HEADER_LENGTH__CONTENT_RANGE))
{
p = p + HTTPRESP_HEADER_LENGTH__CONTENT_RANGE;
p = extract_http_content_range(Session, p, start, end, header_ptr);
}
} }
else if (((p - offset) == 0) && ((*p == 'T') || (*p == 't'))) else if (((p - offset) == 0) && ((*p == 'T') || (*p == 't')))
{ {
if ( IsHeaderFieldName(p, end, HTTPRESP_HEADER_NAME__TRANSFER_ENCODING, if ( IsHeaderFieldName(p, end, HTTPRESP_HEADER_NAME__TRANSFER_ENCODING,
HTTPRESP_HEADER_LENGTH__TRANSFER_ENCODING) && par se_trans_encoding ) HTTPRESP_HEADER_LENGTH__TRANSFER_ENCODING) && par se_trans_encoding )
{ {
p = p + HTTPRESP_HEADER_LENGTH__TRANSFER_ENCODING; p = p + HTTPRESP_HEADER_LENGTH__TRANSFER_ENCODING;
p = extract_http_transfer_encoding(Session, hsd, p, start, end, head er_ptr, HI_SI_SERVER_MODE); p = extract_http_transfer_encoding(Session, hsd, p, start, end, head er_ptr, HI_SI_SERVER_MODE);
} }
} }
else if (((p - offset) == 0) && ((*p == 'A') || (*p == 'a')))
{
if (IsHeaderFieldName(p, end, HTTPRESP_HEADER_NAME__ACCEPT_RANGES,
HTTPRESP_HEADER_LENGTH__ACCEPT_RANGES))
{
uint16_t accept_range_flag = 0;
p = p + HTTPRESP_HEADER_LENGTH__ACCEPT_RANGES;
p = extract_http_accept_ranges(Session, p, start, end, header_ptr, &
accept_range_flag);
Session->server.response.accept_range_flag = accept_range_flag;
}
}
#if defined(FEAT_OPEN_APPID) #if defined(FEAT_OPEN_APPID)
else if(((p - offset) == 0) && ((*p == 'V') || (*p == 'v'))) else if(((p - offset) == 0) && ((*p == 'V') || (*p == 'v')))
{ {
if((ServerConf->appid_enabled) && (IsHeaderFieldName(p, end, HEADER_NAME __VIA, HEADER_LENGTH__VIA))) if((ServerConf->appid_enabled) && (IsHeaderFieldName(p, end, HEADER_NAME __VIA, HEADER_LENGTH__VIA)))
{ {
p = p + HEADER_LENGTH__VIA; p = p + HEADER_LENGTH__VIA;
p = extract_http_server_header(Session, p, start, end, header_ptr, & header_ptr->via); p = extract_http_server_header(Session, p, start, end, header_ptr, & header_ptr->via);
} }
} }
else if(((p - offset) == 0) && ((*p == 'X') || (*p == 'x'))) else if(((p - offset) == 0) && ((*p == 'X') || (*p == 'x')))
skipping to change at line 1986 skipping to change at line 2382
if ( stat_msg_ptr.uri ) if ( stat_msg_ptr.uri )
{ {
Server->response.status_msg = stat_msg_ptr.uri; Server->response.status_msg = stat_msg_ptr.uri;
Server->response.status_msg_size = stat_msg_ptr.uri_end - st at_msg_ptr.uri; Server->response.status_msg_size = stat_msg_ptr.uri_end - st at_msg_ptr.uri;
if ((int)Server->response.status_msg_size <= 0) if ((int)Server->response.status_msg_size <= 0)
{ {
CLR_SERVER_STAT_MSG(Server); CLR_SERVER_STAT_MSG(Server);
} }
{ {
header_ptr.range_flag = HTTP_RANGE_NONE;
ptr = hi_server_extract_header(Session, ServerConf, &he ader_ptr, ptr = hi_server_extract_header(Session, ServerConf, &he ader_ptr,
stat_msg_ptr.uri_end , end, parse_co nt_encoding, parse_trans_encoding, sd ); stat_msg_ptr.uri_end , end, parse_co nt_encoding, parse_trans_encoding, sd );
if (header_ptr.range_flag != HTTP_RANGE_NONE)
{
Server->response.range_flag = header_ptr.range_flag;
}
else
{
Server->response.range_flag = HTTP_RESP_RANGE_NONE;
}
} }
} }
else else
{ {
CLR_SERVER_STAT(Server); CLR_SERVER_STAT(Server);
} }
} }
if (header_ptr.header.uri) if (header_ptr.header.uri)
{ {
 End of changes. 6 change blocks. 
0 lines changed or deleted 438 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)