aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

modify detection engine to run hrhd mpm before building the match array

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 16 years ago committed by Victor Julien
parent ea3fd38291
commit 93fa7ea828
3 changed files with 119 additions and 91 deletions
Show Stats Download Patch File Download Diff File

180
src/detect-engine-hrhd.c
Unescape Escape View File

@ -255,35 +255,63 @@ match:
* stores them away in detection context. Also calls the mpm on the * stores them away in detection context. Also calls the mpm on the
* buffers. * buffers.
* *
* \param de_ctx Detection engine ctx.
* \param det_ctx Detection engine thread ctx. * \param det_ctx Detection engine thread ctx.
* \param f Pointer to the flow. * \param f Pointer to the flow.
* \param htp_state http state. * \param htp_state http state.
* *
* \retval cnt The match count from the mpm call.
*
* \warning Make sure the flow is locked. * \warning Make sure the flow is locked.
*/ */
static uint32_t DetectEngineInspectHttpRawHeaderMpmInspect(DetectEngineThreadCtx *det_ctx, void DetectEngineBufferHttpRawHeaders(DetectEngineThreadCtx *det_ctx,
Signature *s, Flow *f, Flow *f, HtpState *htp_state)
HtpState *htp_state)
{ {
uint32_t cnt = 0;
size_t idx = 0; size_t idx = 0;
htp_tx_t *tx = NULL; htp_tx_t *tx = NULL;
int i = 0; int i = 0;
for (idx = AppLayerTransactionGetInspectId(f); /* locking the flow, we will inspect the htp state */
i < det_ctx->hrhd_buffers_list_len; idx++, i++) { SCMutexLock(&f->m);
/* if the buffer already exists, use it */ if (htp_state->connp == NULL || htp_state->connp->conn == NULL) {
if (det_ctx->hrhd_buffers[i] != NULL) { SCLogDebug("HTP state has no conn(p)");
if (s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT) { goto end;
cnt += HttpRawHeaderPatternSearch(det_ctx, }
det_ctx->hrhd_buffers[i],
det_ctx->hrhd_buffers_len[i]); /* it is either the first entry into this function. If it is not,
} * then we just don't have any http transactions */
continue; if (det_ctx->hrhd_buffers_list_len == 0) {
/* get the transaction id */
int tmp_idx = AppLayerTransactionGetInspectId(f);
/* error! get out of here */
if (tmp_idx == -1)
goto end;
/* let's get the transaction count. We need this to hold the header
* buffer for each transaction */
det_ctx->hrhd_buffers_list_len = list_size(htp_state->connp->conn->transactions) - tmp_idx;
/* no transactions?! cool. get out of here */
if (det_ctx->hrhd_buffers_list_len == 0)
goto end;
/* assign space to hold buffers. Each per transaction */
det_ctx->hrhd_buffers = SCMalloc(det_ctx->hrhd_buffers_list_len * sizeof(uint8_t *));
if (det_ctx->hrhd_buffers == NULL) {
goto end;
}
memset(det_ctx->hrhd_buffers, 0, det_ctx->hrhd_buffers_list_len * sizeof(uint8_t *));
det_ctx->hrhd_buffers_len = SCMalloc(det_ctx->hrhd_buffers_list_len * sizeof(uint32_t));
if (det_ctx->hrhd_buffers_len == NULL) {
goto end;
} }
memset(det_ctx->hrhd_buffers_len, 0, det_ctx->hrhd_buffers_list_len * sizeof(uint32_t));
} else {
goto end;
} /* else -if (det_ctx->hrhd_buffers_list_len == 0) */
for (idx = AppLayerTransactionGetInspectId(f);
i < det_ctx->hrhd_buffers_list_len; idx++, i++) {
tx = list_get(htp_state->connp->conn->transactions, idx); tx = list_get(htp_state->connp->conn->transactions, idx);
if (tx == NULL) if (tx == NULL)
@ -297,13 +325,31 @@ static uint32_t DetectEngineInspectHttpRawHeaderMpmInspect(DetectEngineThreadCtx
det_ctx->hrhd_buffers[i] = (uint8_t *)bstr_ptr(raw_headers); det_ctx->hrhd_buffers[i] = (uint8_t *)bstr_ptr(raw_headers);
det_ctx->hrhd_buffers_len[i] = bstr_len(raw_headers); det_ctx->hrhd_buffers_len[i] = bstr_len(raw_headers);
/* carry out the mpm */
if (s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT)
cnt += HttpRawHeaderPatternSearch(det_ctx, det_ctx->hrhd_buffers[i],
det_ctx->hrhd_buffers_len[i]);
} /* for (idx = AppLayerTransactionGetInspectId(f); .. */ } /* for (idx = AppLayerTransactionGetInspectId(f); .. */
SCReturnUInt(cnt); end:
SCMutexUnlock(&f->m);
return;
}
int DetectEngineRunHttpRawHeaderMpm(DetectEngineThreadCtx *det_ctx, Flow *f)
{
int i;
uint32_t cnt = 0;
/* we need to lock because the buffers are not actually true buffers
* but are ones that point to a buffer given by libhtp */
SCMutexLock(&f->m);
for (i = 0; i < det_ctx->hrhd_buffers_list_len; i++) {
cnt += HttpRawHeaderPatternSearch(det_ctx,
det_ctx->hrhd_buffers[i],
det_ctx->hrhd_buffers_len[i]);
}
SCMutexUnlock(&f->m);
return cnt;
} }
/** /**
@ -335,73 +381,40 @@ int DetectEngineInspectHttpRawHeader(DetectEngineCtx *de_ctx,
SCReturnInt(0); SCReturnInt(0);
} }
/* locking the flow, we will inspect the htp state */
SCMutexLock(&f->m);
if (htp_state->connp == NULL || htp_state->connp->conn == NULL) { if (htp_state->connp == NULL || htp_state->connp->conn == NULL) {
SCLogDebug("HTP state has no conn(p)"); SCLogDebug("HTP state has no conn(p)");
goto end; goto end;
} }
/* it is either the first entry into this function. If it is not, DetectEngineBufferHttpRawHeaders(det_ctx, f, htp_state);
* then we just don't have any http transactions */
if (det_ctx->hrhd_buffers_list_len == 0) { //if (s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT) {
/* get the transaction id */ // if (det_ctx->de_mpm_scanned_hrhd == FALSE) {
int tmp_idx = AppLayerTransactionGetInspectId(f); // uint32_t cnt = DetectEngineInspectHttpRawHeaderMpmInspect(det_ctx, s,
/* error! get out of here */ // f, htp_state);
if (tmp_idx == -1) // if (cnt <= 0)
goto end; // det_ctx->de_have_hrhd = FALSE;
//
/* let's get the transaction count. We need this to hold the header // det_ctx->de_mpm_scanned_hrhd = TRUE;
* buffer for each transaction */ // }
det_ctx->hrhd_buffers_list_len = list_size(htp_state->connp->conn->transactions) - tmp_idx; //} else {
/* no transactions?! cool. get out of here */ // DetectEngineInspectHttpRawHeaderMpmInspect(det_ctx, s, f, htp_state);
if (det_ctx->hrhd_buffers_list_len == 0) //}
goto end;
//if (det_ctx->de_have_hrhd == FALSE &&
/* assign space to hold buffers. Each per transaction */ // s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT &&
det_ctx->hrhd_buffers = SCMalloc(det_ctx->hrhd_buffers_list_len * sizeof(uint8_t *)); // !(s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT_NEG)) {
if (det_ctx->hrhd_buffers == NULL) { // SCLogDebug("mpm results failure for http raw headers. Get out of here");
r = 0; // goto end;
goto end; //}
} //
memset(det_ctx->hrhd_buffers, 0, det_ctx->hrhd_buffers_list_len * sizeof(uint8_t *)); //if ((s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT) && (det_ctx->de_mpm_scanned_hrhd == TRUE)) {
// /* filter out the sig that needs a match, but have no matches */
det_ctx->hrhd_buffers_len = SCMalloc(det_ctx->hrhd_buffers_list_len * sizeof(uint32_t)); // if (!(s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT_NEG) &&
if (det_ctx->hrhd_buffers_len == NULL) { // !(det_ctx->pmq.pattern_id_bitarray[(s->mpm_hrhdpattern_id / 8)] & (1 << (s->mpm_hrhdpattern_id % 8)))) {
r = 0; // goto end;
goto end; // }
} //}
memset(det_ctx->hrhd_buffers_len, 0, det_ctx->hrhd_buffers_list_len * sizeof(uint32_t));
} /* if (det_ctx->hrhd_buffers_list_len == 0) */
if (s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT) {
if (det_ctx->de_mpm_scanned_hrhd == FALSE) {
uint32_t cnt = DetectEngineInspectHttpRawHeaderMpmInspect(det_ctx, s,
f, htp_state);
if (cnt <= 0)
det_ctx->de_have_hrhd = FALSE;
det_ctx->de_mpm_scanned_hrhd = TRUE;
}
} else {
DetectEngineInspectHttpRawHeaderMpmInspect(det_ctx, s, f, htp_state);
}
if (det_ctx->de_have_hrhd == FALSE &&
s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT &&
!(s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT_NEG)) {
SCLogDebug("mpm results failure for http raw headers. Get out of here");
goto end;
}
if ((s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT) && (det_ctx->de_mpm_scanned_hrhd == TRUE)) {
/* filter out the sig that needs a match, but have no matches */
if (!(s->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT_NEG) &&
!(det_ctx->pmq.pattern_id_bitarray[(s->mpm_hrhdpattern_id / 8)] & (1 << (s->mpm_hrhdpattern_id % 8)))) {
goto end;
}
}
for (i = 0; i < det_ctx->hrhd_buffers_list_len; i++) { for (i = 0; i < det_ctx->hrhd_buffers_list_len; i++) {
uint8_t *hrhd_buffer = det_ctx->hrhd_buffers[i]; uint8_t *hrhd_buffer = det_ctx->hrhd_buffers[i];
@ -418,7 +431,6 @@ int DetectEngineInspectHttpRawHeader(DetectEngineCtx *de_ctx,
} }
end: end:
SCMutexUnlock(&f->m);
SCReturnInt(r); SCReturnInt(r);
} }

11
src/detect-engine-hrhd.h
Unescape Escape View File

@ -23,8 +23,15 @@
#ifndef __DETECT_ENGINE_HRHD_H__ #ifndef __DETECT_ENGINE_HRHD_H__
#define __DETECT_ENGINE_HRHD_H__ #define __DETECT_ENGINE_HRHD_H__
int DetectEngineInspectHttpRawHeader(DetectEngineCtx *, DetectEngineThreadCtx *, #include "app-layer-htp.h"
Signature *, Flow *, uint8_t, void *);
int DetectEngineInspectHttpRawHeader(DetectEngineCtx *,
DetectEngineThreadCtx *,
Signature *, Flow *, uint8_t,
void *);
void DetectEngineBufferHttpRawHeaders(DetectEngineThreadCtx *det_ctx,
Flow *f, HtpState *);
int DetectEngineRunHttpRawHeaderMpm(DetectEngineThreadCtx *, Flow *);
void DetectEngineCleanHRHDBuffers(DetectEngineThreadCtx *); void DetectEngineCleanHRHDBuffers(DetectEngineThreadCtx *);
void DetectEngineHttpRawHeaderRegisterTests(void); void DetectEngineHttpRawHeaderRegisterTests(void);

19
src/detect.c
Unescape Escape View File

@ -719,6 +719,15 @@ static void SigMatchSignaturesBuildMatchArray(DetectEngineCtx *de_ctx,
} }
} }
if (s->full_sig->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT) {
if (!(det_ctx->pmq.pattern_id_bitarray[(s->full_sig->mpm_hrhdpattern_id / 8)] &
(1 << (s->full_sig->mpm_hrhdpattern_id % 8)))) {
if (!(s->full_sig->mpm_flags & SIG_FLAG_MPM_HRHDCONTENT_NEG)) {
continue;
}
}
}
/* de_state check, filter out all signatures that already had a match before /* de_state check, filter out all signatures that already had a match before
* or just partially match */ * or just partially match */
if (s->flags & SIG_FLAG_AMATCH || s->flags & SIG_FLAG_UMATCH || if (s->flags & SIG_FLAG_AMATCH || s->flags & SIG_FLAG_UMATCH ||
@ -944,11 +953,11 @@ static inline void RunMpmsOnFlow(DetectEngineCtx *de_ctx,
cnt = DetectEngineRunHttpHeaderMpm(det_ctx); cnt = DetectEngineRunHttpHeaderMpm(det_ctx);
SCLogDebug("hhd search: cnt %" PRIu32, cnt); SCLogDebug("hhd search: cnt %" PRIu32, cnt);
} }
//if (sgh->flags & SIG_GROUP_HEAD_MPM_HHD) { if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HRHD) {
// cnt = DetectEngineInspectHttpRawHeaderMpmInspect(det_ctx, f, DetectEngineBufferHttpRawHeaders(det_ctx, p->flow, alstate);
// htp_state); cnt = DetectEngineRunHttpRawHeaderMpm(det_ctx, p->flow);
// SCLogDebug("hrhd search: cnt %" PRIu32, cnt); SCLogDebug("hrhd search: cnt %" PRIu32, cnt);
//} }
} }
return; return;

Write Preview
Loading…
Cancel
Save