From 0dca8cc79696b44181821163873a001977bcbb5e Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Mon, 3 Apr 2023 10:26:36 +0200
Subject: [PATCH] detect: http_request_line support for HTTP2

Ticket: #4067

Synthetized as <METHOD> <URI> HTTP/2\r\n
---
 rust/src/http2/detect.rs       | 42 ++++++++++++++++++++++++++++++++--
 rust/src/http2/http2.rs        |  2 ++
 src/detect-http-request-line.c | 30 +++++++++++++++++++++++-
 3 files changed, 71 insertions(+), 3 deletions(-)

diff --git a/rust/src/http2/detect.rs b/rust/src/http2/detect.rs
index 9685bfa764..1634880904 100644
--- a/rust/src/http2/detect.rs
+++ b/rust/src/http2/detect.rs
@@ -265,7 +265,7 @@ fn http2_detect_settingsctx_match(
 ) -> std::os::raw::c_int {
     if direction == Direction::ToServer {
         for i in 0..tx.frames_ts.len() {
-            if let HTTP2FrameTypeData::SETTINGS(set ) = &tx.frames_ts[i].data {
+            if let HTTP2FrameTypeData::SETTINGS(set) = &tx.frames_ts[i].data {
                 if http2_detect_settings_match(set, ctx) != 0 {
                     return 1;
                 }
@@ -296,7 +296,9 @@ fn http2_detect_sizeupdate_match(
     blocks: &[parser::HTTP2FrameHeaderBlock], ctx: &DetectUintData<u64>,
 ) -> std::os::raw::c_int {
     for block in blocks.iter() {
-        if block.error == parser::HTTP2HeaderDecodeStatus::HTTP2HeaderDecodeSizeUpdate && detect_match_uint(ctx, block.sizeupdate) {
+        if block.error == parser::HTTP2HeaderDecodeStatus::HTTP2HeaderDecodeSizeUpdate
+            && detect_match_uint(ctx, block.sizeupdate)
+        {
             return 1;
         }
     }
@@ -494,6 +496,42 @@ fn http2_frames_get_header_value<'a>(
     }
 }
 
+fn http2_tx_get_req_line(tx: &mut HTTP2Transaction) {
+    if !tx.req_line.is_empty() {
+        return;
+    }
+    let empty = Vec::new();
+    let mut req_line = Vec::new();
+    let method =
+        if let Ok(value) = http2_frames_get_header_firstvalue(tx, Direction::ToServer, ":method") {
+            value
+        } else {
+            &empty
+        };
+    req_line.extend(method);
+    req_line.push(b' ');
+
+    let uri =
+        if let Ok(value) = http2_frames_get_header_firstvalue(tx, Direction::ToServer, ":path") {
+            value
+        } else {
+            &empty
+        };
+    req_line.extend(uri);
+    req_line.extend(b" HTTP/2\r\n");
+    tx.req_line.extend(req_line)
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_http2_tx_get_request_line(
+    tx: &mut HTTP2Transaction, buffer: *mut *const u8, buffer_len: *mut u32,
+) -> u8 {
+    http2_tx_get_req_line(tx);
+    *buffer = tx.req_line.as_ptr(); //unsafe
+    *buffer_len = tx.req_line.len() as u32;
+    return 1;
+}
+
 #[no_mangle]
 pub unsafe extern "C" fn rs_http2_tx_get_uri(
     tx: &mut HTTP2Transaction, buffer: *mut *const u8, buffer_len: *mut u32,
diff --git a/rust/src/http2/http2.rs b/rust/src/http2/http2.rs
index 6da6715323..cf1433f55d 100644
--- a/rust/src/http2/http2.rs
+++ b/rust/src/http2/http2.rs
@@ -142,6 +142,7 @@ pub struct HTTP2Transaction {
     //temporary escaped header for detection
     //must be attached to transaction for memory management (be freed at the right time)
     pub escaped: Vec<Vec<u8>>,
+    pub req_line: Vec<u8>,
 }
 
 impl Transaction for HTTP2Transaction {
@@ -171,6 +172,7 @@ impl HTTP2Transaction {
             ft_tc: FileTransferTracker::new(),
             ft_ts: FileTransferTracker::new(),
             escaped: Vec::with_capacity(16),
+            req_line: Vec::new(),
         }
     }
 
diff --git a/src/detect-http-request-line.c b/src/detect-http-request-line.c
index d124118aaa..89d38cbd0a 100644
--- a/src/detect-http-request-line.c
+++ b/src/detect-http-request-line.c
@@ -70,6 +70,29 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         void *txv, const int list_id);
 static int g_http_request_line_buffer_id = 0;
 
+static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
+        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
+        const int list_id)
+{
+    SCEnter();
+
+    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
+    if (buffer->inspect == NULL) {
+        uint32_t b_len = 0;
+        const uint8_t *b = NULL;
+
+        if (rs_http2_tx_get_request_line(txv, &b, &b_len) != 1)
+            return NULL;
+        if (b == NULL || b_len == 0)
+            return NULL;
+
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
+        InspectionBufferApplyTransforms(buffer, transforms);
+    }
+
+    return buffer;
+}
+
 /**
  * \brief Registers the keyword handlers for the "http_request_line" keyword.
  */
@@ -92,6 +115,11 @@ void DetectHttpRequestLineRegister(void)
     DetectAppLayerMpmRegister2("http_request_line", SIG_FLAG_TOSERVER, 2,
             PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_REQUEST_LINE);
 
+    DetectAppLayerInspectEngineRegister2("http_request_line", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
+            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
+    DetectAppLayerMpmRegister2("http_request_line", SIG_FLAG_TOSERVER, 2,
+            PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);
+
     DetectBufferTypeSetDescriptionByName("http_request_line",
             "http request line");
 
@@ -116,7 +144,7 @@ static int DetectHttpRequestLineSetup(DetectEngineCtx *de_ctx, Signature *s, con
     if (DetectBufferSetActiveList(de_ctx, s, g_http_request_line_buffer_id) < 0)
         return -1;
 
-    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP1) < 0)
+    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
         return -1;
 
     return 0;