From 4d57b2fc6380d45b737c3adc619cef0fbc4c52ab Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 8 Jul 2016 19:28:46 +0200 Subject: [PATCH] http_stat_msg: mpm prefilter engine --- src/detect-engine-hsmd.c | 62 ++++++++++++++++++---------------------- src/detect-engine-hsmd.h | 4 +-- src/detect-engine-mpm.c | 4 ++- src/detect.c | 5 ---- 4 files changed, 33 insertions(+), 42 deletions(-) diff --git a/src/detect-engine-hsmd.c b/src/detect-engine-hsmd.c index 46d3e4fe00..b0d12e67b1 100644 --- a/src/detect-engine-hsmd.c +++ b/src/detect-engine-hsmd.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation +/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -25,6 +25,7 @@ * \file * * \author Anoop Saldanha + * \author Victor Julien */ #include "suricata-common.h" @@ -38,6 +39,7 @@ #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" +#include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" @@ -55,52 +57,44 @@ #include "app-layer-protos.h" #include "util-validate.h" -/** - * \brief Http stat msg match -- searches for one pattern per signature. - * - * \param det_ctx Detection engine thread ctx. - * \param stat_msg Stat msg to inspect. - * \param stat_msg_len Stat msg length. +/** \brief HTTP Status Message Mpm prefilter callback * - * \retval ret Number of matches. + * \param det_ctx detection engine thread ctx + * \param p packet to inspect + * \param f flow to inspect + * \param txv tx to inspect + * \param pectx inspection context */ -static inline uint32_t HttpStatMsgPatternSearch(DetectEngineThreadCtx *det_ctx, - const uint8_t *stat_msg, const uint32_t stat_msg_len) +static void PrefilterTxHttpStatMsg(DetectEngineThreadCtx *det_ctx, + const void *pectx, + Packet *p, Flow *f, void *txv, + const uint64_t idx, const uint8_t flags) { SCEnter(); - uint32_t ret = 0; + const MpmCtx *mpm_ctx = (MpmCtx *)pectx; + htp_tx_t *tx = (htp_tx_t *)txv; - DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hsmd_ctx_tc == NULL); + if (tx->response_message == NULL) + return; - if (stat_msg_len >= det_ctx->sgh->mpm_hsmd_ctx_tc->minlen) { - ret = mpm_table[det_ctx->sgh->mpm_hsmd_ctx_tc->mpm_type]. - Search(det_ctx->sgh->mpm_hsmd_ctx_tc, &det_ctx->mtcu, - &det_ctx->pmq, stat_msg, stat_msg_len); - } + const uint32_t buffer_len = bstr_len(tx->response_message); + const uint8_t *buffer = bstr_ptr(tx->response_message); - SCReturnUInt(ret); + if (buffer != NULL && buffer_len >= mpm_ctx->minlen) { + (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, + &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); + } } -/** - * \brief Run the mpm against http stat msg. - * - * \retval cnt Number of matches reported by the mpm algo. - */ -int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, void *txv) +int PrefilterTxHttpStatMsgRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); - uint32_t cnt = 0; - htp_tx_t *tx = (htp_tx_t *)txv; - if (tx->response_message == NULL) - goto end; - - cnt = HttpStatMsgPatternSearch(det_ctx, - (const uint8_t *)bstr_ptr(tx->response_message), - bstr_len(tx->response_message)); -end: - SCReturnInt(cnt); + return PrefilterAppendTxEngine(sgh, PrefilterTxHttpStatMsg, + ALPROTO_HTTP, + HTP_RESPONSE_LINE+1, /* inspect when response line completely parsed */ + mpm_ctx, NULL); } /** diff --git a/src/detect-engine-hsmd.h b/src/detect-engine-hsmd.h index 9faa2064f8..2feddd3bdc 100644 --- a/src/detect-engine-hsmd.h +++ b/src/detect-engine-hsmd.h @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation +/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -25,7 +25,7 @@ #include "app-layer-htp.h" -int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, void *txv); +int PrefilterTxHttpStatMsgRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); int DetectEngineInspectHttpStatMsg(ThreadVars *tv, DetectEngineCtx *de_ctx, diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 481c77ddc6..a8a3a3de3d 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -56,6 +56,7 @@ #include "detect-engine-hua.h" #include "detect-engine-hhhd.h" #include "detect-engine-hrhhd.h" +#include "detect-engine-hsmd.h" #include "detect-engine-dns.h" #include "stream.h" @@ -109,7 +110,8 @@ AppLayerMpms app_mpms[] = { { "file_data", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_FD_SMTP, NULL, 8}, /* smtp */ { "file_data", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_HSBD, NULL, 9}, /* http server body */ - { "http_stat_msg", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSMDMATCH, SIG_GROUP_HEAD_MPM_HSMD, NULL, 10}, + { "http_stat_msg", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSMDMATCH, + SIG_GROUP_HEAD_MPM_HSMD, PrefilterTxHttpStatMsgRegister, 10}, { "http_stat_code", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSCDMATCH, SIG_GROUP_HEAD_MPM_HSCD, NULL, 11}, { "http_client_body", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCBDMATCH, SIG_GROUP_HEAD_MPM_HCBD, NULL, 12}, diff --git a/src/detect.c b/src/detect.c index 6e524fd06a..7216425cec 100644 --- a/src/detect.c +++ b/src/detect.c @@ -929,11 +929,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx, tx_progress = AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags); if (tx_progress > HTP_RESPONSE_LINE) { - if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSMD) { - PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSMD); - DetectEngineRunHttpStatMsgMpm(det_ctx, tx); - PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSMD); - } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSCD) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSCD); DetectEngineRunHttpStatCodeMpm(det_ctx, tx);