detect/file: register http/2 with sub-state

src/detect-file-data.c

@@ -71,7 +71,9 @@ typedef struct {
     int direction;
     AppProto alproto;
     uint8_t progress_ts;
+    uint8_t sub_state_ts;
     uint8_t progress_tc;
+    uint8_t sub_state_tc;
 } DetectFileHandlerProtocol;
 
 /* Table with all filehandler registrations */
@@ -89,10 +91,14 @@ DetectFileHandlerProtocol al_protocols[ALPROTO_WITHFILES_MAX] = {
             .direction = SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT,
             .progress_tc = HTP_RESPONSE_PROGRESS_BODY,
             .progress_ts = HTP_REQUEST_PROGRESS_BODY },
-    { .alproto = ALPROTO_HTTP2,
+    {
+            .alproto = ALPROTO_HTTP2,
             .direction = SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT,
             .progress_tc = HTTP2ProgData,
-            .progress_ts = HTTP2ProgData },
+            .sub_state_tc = HTTP2TxTypeStream,
+            .progress_ts = HTTP2ProgData,
+            .sub_state_ts = HTTP2TxTypeStream,
+    },
     { .alproto = ALPROTO_SMTP, .direction = SIG_FLAG_TOSERVER, .progress_ts = SMTP_REQUEST_DATA },
     { .alproto = ALPROTO_UNKNOWN }
 };
@@ -119,24 +125,24 @@ void DetectFileRegisterProto(
 void DetectFileRegisterFileProtocols(DetectFileHandlerTableElmt *reg)
 {
     for (size_t i = 0; i < g_alproto_max; i++) {
-        if (al_protocols[i].alproto == ALPROTO_UNKNOWN) {
+        DetectFileHandlerProtocol *p = &al_protocols[i];
+        if (p->alproto == ALPROTO_UNKNOWN) {
             break;
         }
-        int direction = al_protocols[i].direction == 0
-                                ? (int)(SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT)
-                                : al_protocols[i].direction;
+        int direction =
+                p->direction == 0 ? (int)(SIG_FLAG_TOSERVER | SIG_FLAG_TOCLIENT) : p->direction;
 
         if (direction & SIG_FLAG_TOCLIENT) {
-            DetectAppLayerMpmRegister(reg->name, SIG_FLAG_TOCLIENT, reg->priority, reg->PrefilterFn,
-                    NULL, al_protocols[i].alproto, al_protocols[i].progress_tc);
-            DetectAppLayerInspectEngineRegister(reg->name, al_protocols[i].alproto,
-                    SIG_FLAG_TOCLIENT, al_protocols[i].progress_tc, reg->Callback, NULL);
+            DetectAppLayerMpmRegisterSubState(reg->name, SIG_FLAG_TOCLIENT, reg->priority,
+                    reg->PrefilterFn, NULL, p->alproto, p->sub_state_tc, p->progress_tc);
+            DetectAppLayerInspectEngineRegisterSubState(reg->name, p->alproto, SIG_FLAG_TOCLIENT,
+                    p->sub_state_tc, p->progress_tc, reg->Callback, NULL);
         }
         if (direction & SIG_FLAG_TOSERVER) {
-            DetectAppLayerMpmRegister(reg->name, SIG_FLAG_TOSERVER, reg->priority, reg->PrefilterFn,
-                    NULL, al_protocols[i].alproto, al_protocols[i].progress_ts);
-            DetectAppLayerInspectEngineRegister(reg->name, al_protocols[i].alproto,
-                    SIG_FLAG_TOSERVER, al_protocols[i].progress_ts, reg->Callback, NULL);
+            DetectAppLayerMpmRegisterSubState(reg->name, SIG_FLAG_TOSERVER, reg->priority,
+                    reg->PrefilterFn, NULL, p->alproto, p->sub_state_ts, p->progress_ts);
+            DetectAppLayerInspectEngineRegisterSubState(reg->name, p->alproto, SIG_FLAG_TOSERVER,
+                    p->sub_state_ts, p->progress_ts, reg->Callback, NULL);
         }
     }
 }
@@ -596,8 +602,8 @@ int PrefilterMpmFiledataRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, Mpm
     pectx->mpm_ctx = mpm_ctx;
     pectx->transforms = &mpm_reg->transforms;
 
-    return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxFiledata,
-            mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
+    return PrefilterAppendTxEngineSubState(de_ctx, sgh, PrefilterTxFiledata,
+            mpm_reg->app_v2.alproto, mpm_reg->app_v2.sub_state, mpm_reg->app_v2.tx_min_progress,
             pectx, PrefilterMpmFiledataFree, mpm_reg->pname);
 }
 

src/detect-filemagic.c

@@ -405,8 +405,8 @@ static int PrefilterMpmFilemagicRegister(DetectEngineCtx *de_ctx, SigGroupHead *
     pectx->mpm_ctx = mpm_ctx;
     pectx->transforms = &mpm_reg->transforms;
 
-    return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxFilemagic,
-            mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
+    return PrefilterAppendTxEngineSubState(de_ctx, sgh, PrefilterTxFilemagic,
+            mpm_reg->app_v2.alproto, mpm_reg->app_v2.sub_state, mpm_reg->app_v2.tx_min_progress,
             pectx, PrefilterMpmFilemagicFree, mpm_reg->pname);
 }
 

src/detect-filename.c

@@ -342,8 +342,8 @@ static int PrefilterMpmFilenameRegister(DetectEngineCtx *de_ctx, SigGroupHead *s
     pectx->mpm_ctx = mpm_ctx;
     pectx->transforms = &mpm_reg->transforms;
 
-    return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxFilename,
-            mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
+    return PrefilterAppendTxEngineSubState(de_ctx, sgh, PrefilterTxFilename,
+            mpm_reg->app_v2.alproto, mpm_reg->app_v2.sub_state, mpm_reg->app_v2.tx_min_progress,
             pectx, PrefilterMpmFilenameFree, mpm_reg->pname);
 }