From 988cc8468eae8995b599e473319b7fde8a3e1a0f Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 27 Nov 2018 11:43:24 +0100 Subject: [PATCH] detect/http_cookie: switch to inspect v2 api --- src/detect-engine-hcd.c | 153 --------------------------------------- src/detect-engine-hcd.h | 12 --- src/detect-http-cookie.c | 89 ++++++++++++++++++++--- 3 files changed, 78 insertions(+), 176 deletions(-) diff --git a/src/detect-engine-hcd.c b/src/detect-engine-hcd.c index 29790f03a3..39504d0f0d 100644 --- a/src/detect-engine-hcd.c +++ b/src/detect-engine-hcd.c @@ -60,159 +60,6 @@ #include "app-layer-protos.h" #include "util-validate.h" -/** \brief HTTP Cookie Mpm prefilter callback - * - * \param det_ctx detection engine thread ctx - * \param p packet to inspect - * \param f flow to inspect - * \param txv tx to inspect - * \param pectx inspection context - */ -static void PrefilterTxRequestCookie(DetectEngineThreadCtx *det_ctx, - const void *pectx, - Packet *p, Flow *f, void *txv, - const uint64_t idx, const uint8_t flags) -{ - SCEnter(); - - const MpmCtx *mpm_ctx = (MpmCtx *)pectx; - htp_tx_t *tx = (htp_tx_t *)txv; - - if (tx->request_headers == NULL) - return; - - htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, - "Cookie"); - if (h == NULL || h->value == NULL) { - SCLogDebug("HTTP cookie header not present in this request"); - return; - } - - const uint32_t buffer_len = bstr_len(h->value); - const uint8_t *buffer = bstr_ptr(h->value); - - if (buffer_len >= mpm_ctx->minlen) { - (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, - &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); - } -} - -int PrefilterTxRequestCookieRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx) -{ - SCEnter(); - - return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxRequestCookie, - ALPROTO_HTTP, HTP_REQUEST_HEADERS, - mpm_ctx, NULL, "http_cookie (request)"); -} - -/** \brief HTTP Cookie Mpm prefilter callback - * - * \param det_ctx detection engine thread ctx - * \param p packet to inspect - * \param f flow to inspect - * \param txv tx to inspect - * \param pectx inspection context - */ -static void PrefilterTxResponseCookie(DetectEngineThreadCtx *det_ctx, - const void *pectx, - Packet *p, Flow *f, void *txv, - const uint64_t idx, const uint8_t flags) -{ - SCEnter(); - - const MpmCtx *mpm_ctx = (MpmCtx *)pectx; - htp_tx_t *tx = (htp_tx_t *)txv; - - if (tx->response_headers == NULL) - return; - - htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers, - "Set-Cookie"); - if (h == NULL || h->value == NULL) { - SCLogDebug("HTTP cookie header not present in this request"); - return; - } - - const uint32_t buffer_len = bstr_len(h->value); - const uint8_t *buffer = bstr_ptr(h->value); - - if (buffer_len >= mpm_ctx->minlen) { - (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, - &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); - } -} - -int PrefilterTxResponseCookieRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx) -{ - SCEnter(); - - return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxResponseCookie, - ALPROTO_HTTP, HTP_RESPONSE_HEADERS, - mpm_ctx, NULL, "http_cookie (response)"); -} - -/** - * \brief Do the http_cookie content inspection for a signature. - * - * \param de_ctx Detection engine context. - * \param det_ctx Detection engine thread context. - * \param s Signature to inspect. - * \param f Flow. - * \param flags App layer flags. - * \param state App layer state. - * - * \retval 0 No match. - * \retval 1 Match. - */ -int DetectEngineInspectHttpCookie(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) -{ - htp_tx_t *tx = (htp_tx_t *)txv; - htp_header_t *h = NULL; - if (flags & STREAM_TOSERVER) { - h = (htp_header_t *)htp_table_get_c(tx->request_headers, - "Cookie"); - if (h == NULL) { - SCLogDebug("HTTP cookie header not present in this request"); - goto end; - } - } else { - h = (htp_header_t *)htp_table_get_c(tx->response_headers, - "Set-Cookie"); - if (h == NULL) { - SCLogDebug("HTTP Set-Cookie header not present in this request"); - goto end; - } - } - - det_ctx->buffer_offset = 0; - det_ctx->discontinue_matching = 0; - det_ctx->inspection_recursion_counter = 0; - int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd, - f, - (uint8_t *)bstr_ptr(h->value), - bstr_len(h->value), - 0, DETECT_CI_FLAGS_SINGLE, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); - if (r == 1) - return DETECT_ENGINE_INSPECT_SIG_MATCH; - - end: - if (flags & STREAM_TOSERVER) { - if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_HEADERS) - return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; - } else { - if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_HEADERS) - return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; - } - return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; -} - /***********************************Unittests**********************************/ #ifdef UNITTESTS diff --git a/src/detect-engine-hcd.h b/src/detect-engine-hcd.h index 22a925365a..5206df38dc 100644 --- a/src/detect-engine-hcd.h +++ b/src/detect-engine-hcd.h @@ -23,18 +23,6 @@ #ifndef __DETECT_ENGINE_HCD_H__ #define __DETECT_ENGINE_HCD_H__ -#include "app-layer-htp.h" - -int PrefilterTxRequestCookieRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx); -int PrefilterTxResponseCookieRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx); - -int DetectEngineInspectHttpCookie(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); - void DetectEngineHttpCookieRegisterTests(void); #endif /* __DETECT_ENGINE_HCD_H__ */ diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index f337787479..031562e249 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -39,6 +39,7 @@ #include "detect-parse.h" #include "detect-engine.h" #include "detect-engine-mpm.h" +#include "detect-engine-prefilter.h" #include "detect-content.h" #include "detect-pcre.h" @@ -65,6 +66,15 @@ static int DetectHttpCookieSetup (DetectEngineCtx *, Signature *, const char *); static void DetectHttpCookieRegisterTests(void); static int g_http_cookie_buffer_id = 0; +static InspectionBuffer *GetRequestData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, + Flow *_f, const uint8_t _flow_flags, + void *txv, const int list_id); +static InspectionBuffer *GetResponseData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, + Flow *_f, const uint8_t _flow_flags, + void *txv, const int list_id); + /** * \brief Registration function for keyword: http_cookie */ @@ -75,20 +85,21 @@ void DetectHttpCookieRegister(void) sigmatch_table[DETECT_AL_HTTP_COOKIE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-cookie"; sigmatch_table[DETECT_AL_HTTP_COOKIE].Setup = DetectHttpCookieSetup; sigmatch_table[DETECT_AL_HTTP_COOKIE].RegisterTests = DetectHttpCookieRegisterTests; - sigmatch_table[DETECT_AL_HTTP_COOKIE].flags |= SIGMATCH_NOOPT; - DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOSERVER, 2, - PrefilterTxRequestCookieRegister); - DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOCLIENT, 2, - PrefilterTxResponseCookieRegister); + DetectAppLayerInspectEngineRegister2("http_cookie", ALPROTO_HTTP, + SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS, + DetectEngineInspectBufferGeneric, GetRequestData); + DetectAppLayerInspectEngineRegister2("http_cookie", ALPROTO_HTTP, + SIG_FLAG_TOCLIENT, HTP_REQUEST_HEADERS, + DetectEngineInspectBufferGeneric, GetResponseData); - DetectAppLayerInspectEngineRegister("http_cookie", - ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS, - DetectEngineInspectHttpCookie); - DetectAppLayerInspectEngineRegister("http_cookie", - ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS, - DetectEngineInspectHttpCookie); + DetectAppLayerMpmRegister2("http_cookie", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetRequestData, ALPROTO_HTTP, + HTP_REQUEST_HEADERS); + DetectAppLayerMpmRegister2("http_cookie", SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetResponseData, ALPROTO_HTTP, + HTP_REQUEST_HEADERS); DetectBufferTypeSetDescriptionByName("http_cookie", "http cookie header"); @@ -115,6 +126,62 @@ static int DetectHttpCookieSetup(DetectEngineCtx *de_ctx, Signature *s, const ch ALPROTO_HTTP); } +static InspectionBuffer *GetRequestData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id) +{ + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + htp_tx_t *tx = (htp_tx_t *)txv; + + if (tx->request_headers == NULL) + return NULL; + + htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, + "Cookie"); + if (h == NULL || h->value == NULL) { + SCLogDebug("HTTP cookie header not present in this request"); + return NULL; + } + + const uint32_t data_len = bstr_len(h->value); + const uint8_t *data = bstr_ptr(h->value); + + InspectionBufferSetup(buffer, data, data_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + + return buffer; +} + +static InspectionBuffer *GetResponseData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id) +{ + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + htp_tx_t *tx = (htp_tx_t *)txv; + + if (tx->response_headers == NULL) + return NULL; + + htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers, + "Set-Cookie"); + if (h == NULL || h->value == NULL) { + SCLogDebug("HTTP cookie header not present in this request"); + return NULL; + } + + const uint32_t data_len = bstr_len(h->value); + const uint8_t *data = bstr_ptr(h->value); + + InspectionBufferSetup(buffer, data, data_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + + return buffer; +} + /******************************** UNITESTS **********************************/ #ifdef UNITTESTS