http_stat_msg: mpm prefilter engine

src/detect-engine-hsmd.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
+/* Copyright (C) 2007-2016 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -25,6 +25,7 @@
  * \file
  *
  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
+ * \author Victor Julien <victor@inliniac.net>
  */
 
 #include "suricata-common.h"
@@ -38,6 +39,7 @@
 #include "detect-parse.h"
 #include "detect-engine-state.h"
 #include "detect-engine-content-inspection.h"
+#include "detect-engine-prefilter.h"
 
 #include "flow-util.h"
 #include "util-debug.h"
@@ -55,52 +57,44 @@
 #include "app-layer-protos.h"
 #include "util-validate.h"
 
-/**
- * \brief Http stat msg match -- searches for one pattern per signature.
- *
- * \param det_ctx      Detection engine thread ctx.
- * \param stat_msg     Stat msg to inspect.
- * \param stat_msg_len Stat msg length.
+/** \brief HTTP Status Message Mpm prefilter callback
  *
- *  \retval ret Number of matches.
+ *  \param det_ctx detection engine thread ctx
+ *  \param p packet to inspect
+ *  \param f flow to inspect
+ *  \param txv tx to inspect
+ *  \param pectx inspection context
  */
-static inline uint32_t HttpStatMsgPatternSearch(DetectEngineThreadCtx *det_ctx,
-        const uint8_t *stat_msg, const uint32_t stat_msg_len)
+static void PrefilterTxHttpStatMsg(DetectEngineThreadCtx *det_ctx,
+        const void *pectx,
+        Packet *p, Flow *f, void *txv,
+        const uint64_t idx, const uint8_t flags)
 {
     SCEnter();
 
-    uint32_t ret = 0;
+    const MpmCtx *mpm_ctx = (MpmCtx *)pectx;
+    htp_tx_t *tx = (htp_tx_t *)txv;
 
-    DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hsmd_ctx_tc == NULL);
+    if (tx->response_message == NULL)
+        return;
 
-    if (stat_msg_len >= det_ctx->sgh->mpm_hsmd_ctx_tc->minlen) {
-        ret = mpm_table[det_ctx->sgh->mpm_hsmd_ctx_tc->mpm_type].
-            Search(det_ctx->sgh->mpm_hsmd_ctx_tc, &det_ctx->mtcu,
-                    &det_ctx->pmq, stat_msg, stat_msg_len);
-    }
+    const uint32_t buffer_len = bstr_len(tx->response_message);
+    const uint8_t *buffer = bstr_ptr(tx->response_message);
 
-    SCReturnUInt(ret);
+    if (buffer != NULL && buffer_len >= mpm_ctx->minlen) {
+        (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
+                &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len);
+    }
 }
 
-/**
- * \brief Run the mpm against http stat msg.
- *
- * \retval cnt Number of matches reported by the mpm algo.
- */
-int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, void *txv)
+int PrefilterTxHttpStatMsgRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx)
 {
     SCEnter();
 
-    uint32_t cnt = 0;
-    htp_tx_t *tx = (htp_tx_t *)txv;
-    if (tx->response_message == NULL)
-        goto end;
-
-    cnt = HttpStatMsgPatternSearch(det_ctx,
-                                   (const uint8_t *)bstr_ptr(tx->response_message),
-                                   bstr_len(tx->response_message));
-end:
-    SCReturnInt(cnt);
+    return PrefilterAppendTxEngine(sgh, PrefilterTxHttpStatMsg,
+        ALPROTO_HTTP,
+        HTP_RESPONSE_LINE+1, /* inspect when response line completely parsed */
+        mpm_ctx, NULL);
 }
 
 /**

src/detect-engine-hsmd.h

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
+/* Copyright (C) 2007-2016 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -25,7 +25,7 @@
 
 #include "app-layer-htp.h"
 
-int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, void *txv);
+int PrefilterTxHttpStatMsgRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx);
 
 int DetectEngineInspectHttpStatMsg(ThreadVars *tv,
                                    DetectEngineCtx *de_ctx,

src/detect-engine-mpm.c

@@ -56,6 +56,7 @@
 #include "detect-engine-hua.h"
 #include "detect-engine-hhhd.h"
 #include "detect-engine-hrhhd.h"
+#include "detect-engine-hsmd.h"
 #include "detect-engine-dns.h"
 
 #include "stream.h"
@@ -109,7 +110,8 @@ AppLayerMpms app_mpms[] = {
     { "file_data", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_FD_SMTP, NULL, 8}, /* smtp */
     { "file_data", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_HSBD, NULL, 9}, /* http server body */
 
-    { "http_stat_msg", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSMDMATCH, SIG_GROUP_HEAD_MPM_HSMD, NULL, 10},
+    { "http_stat_msg", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSMDMATCH,
+        SIG_GROUP_HEAD_MPM_HSMD, PrefilterTxHttpStatMsgRegister, 10},
     { "http_stat_code", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSCDMATCH, SIG_GROUP_HEAD_MPM_HSCD, NULL, 11},
 
     { "http_client_body", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCBDMATCH, SIG_GROUP_HEAD_MPM_HCBD, NULL, 12},

src/detect.c

@@ -929,11 +929,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
                     tx_progress = AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags);
 
                     if (tx_progress > HTP_RESPONSE_LINE) {
-                        if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSMD) {
-                            PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSMD);
-                            DetectEngineRunHttpStatMsgMpm(det_ctx, tx);
-                            PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSMD);
-                        }
                         if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSCD) {
                             PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSCD);
                             DetectEngineRunHttpStatCodeMpm(det_ctx, tx);