From 9b9cf2cc5f84431814be807c8b07109aa680baba Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 26 Nov 2018 11:38:35 +0100 Subject: [PATCH] detect/http_stat_msg: switch to inspect v2 --- src/detect-engine-hsmd.c | 82 -------------------------------------- src/detect-engine-hsmd.h | 10 ----- src/detect-http-stat-msg.c | 41 ++++++++++++++++--- 3 files changed, 35 insertions(+), 98 deletions(-) diff --git a/src/detect-engine-hsmd.c b/src/detect-engine-hsmd.c index 05609c0821..62c98b14df 100644 --- a/src/detect-engine-hsmd.c +++ b/src/detect-engine-hsmd.c @@ -57,88 +57,6 @@ #include "app-layer-protos.h" #include "util-validate.h" -/** \brief HTTP Status Message Mpm prefilter callback - * - * \param det_ctx detection engine thread ctx - * \param p packet to inspect - * \param f flow to inspect - * \param txv tx to inspect - * \param pectx inspection context - */ -static void PrefilterTxHttpStatMsg(DetectEngineThreadCtx *det_ctx, - const void *pectx, - Packet *p, Flow *f, void *txv, - const uint64_t idx, const uint8_t flags) -{ - SCEnter(); - - const MpmCtx *mpm_ctx = (MpmCtx *)pectx; - htp_tx_t *tx = (htp_tx_t *)txv; - - if (tx->response_message == NULL) - return; - - const uint32_t buffer_len = bstr_len(tx->response_message); - const uint8_t *buffer = bstr_ptr(tx->response_message); - - if (buffer != NULL && buffer_len >= mpm_ctx->minlen) { - (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, - &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); - } -} - -int PrefilterTxHttpStatMsgRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx) -{ - SCEnter(); - - return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxHttpStatMsg, - ALPROTO_HTTP, - HTP_RESPONSE_LINE+1, /* inspect when response line completely parsed */ - mpm_ctx, NULL, "http_stat_msg"); -} - -/** - * \brief Do the http_stat_msg content inspection for a signature. - * - * \param de_ctx Detection engine context. - * \param det_ctx Detection engine thread context. - * \param s Signature to inspect. - * \param f Flow. - * \param flags App layer flags. - * \param state App layer state. - * - * \retval 0 No match. - * \retval 1 Match. - */ -int DetectEngineInspectHttpStatMsg(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) -{ - htp_tx_t *tx = (htp_tx_t *)txv; - if (tx->response_message == NULL) { - if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_LINE) - return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; - else - return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; - } - - det_ctx->discontinue_matching = 0; - det_ctx->buffer_offset = 0; - det_ctx->inspection_recursion_counter = 0; - int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd, - f, - (uint8_t *)bstr_ptr(tx->response_message), - bstr_len(tx->response_message), - 0, DETECT_CI_FLAGS_SINGLE, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); - if (r == 1) - return DETECT_ENGINE_INSPECT_SIG_MATCH; - else - return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; -} - /***********************************Unittests**********************************/ #ifdef UNITTESTS diff --git a/src/detect-engine-hsmd.h b/src/detect-engine-hsmd.h index df6b1208f2..c56cd73f38 100644 --- a/src/detect-engine-hsmd.h +++ b/src/detect-engine-hsmd.h @@ -23,16 +23,6 @@ #ifndef __DETECT_ENGINE_HSMD_H__ #define __DETECT_ENGINE_HSMD_H__ -#include "app-layer-htp.h" - -int PrefilterTxHttpStatMsgRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx); - -int DetectEngineInspectHttpStatMsg(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); - void DetectEngineHttpStatMsgRegisterTests(void); #endif /* __DETECT_ENGINE_HSMD_H__ */ diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c index cf8b2f022f..aba7fe407f 100644 --- a/src/detect-http-stat-msg.c +++ b/src/detect-http-stat-msg.c @@ -42,6 +42,7 @@ #include "detect-content.h" #include "detect-pcre.h" #include "detect-engine-mpm.h" +#include "detect-engine-prefilter.h" #include "flow.h" #include "flow-var.h" @@ -59,13 +60,15 @@ #include "app-layer-htp.h" #include "detect-http-stat-msg.h" -#include "detect-engine-hsmd.h" #include "stream-tcp-private.h" #include "stream-tcp.h" static int DetectHttpStatMsgSetup(DetectEngineCtx *, Signature *, const char *); static void DetectHttpStatMsgRegisterTests(void); static int g_http_stat_msg_buffer_id = 0; +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id); /** * \brief Registration function for keyword: http_stat_msg @@ -76,15 +79,18 @@ void DetectHttpStatMsgRegister (void) sigmatch_table[DETECT_AL_HTTP_STAT_MSG].desc = "content modifier to match on HTTP stat-msg-buffer"; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-stat-msg"; sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Setup = DetectHttpStatMsgSetup; +#ifdef UNITTESTS sigmatch_table[DETECT_AL_HTTP_STAT_MSG].RegisterTests = DetectHttpStatMsgRegisterTests; +#endif sigmatch_table[DETECT_AL_HTTP_STAT_MSG].flags |= SIGMATCH_NOOPT; - DetectAppLayerMpmRegister("http_stat_msg", SIG_FLAG_TOCLIENT, 3, - PrefilterTxHttpStatMsgRegister); + DetectAppLayerInspectEngineRegister2("http_stat_msg", ALPROTO_HTTP, + SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE, + DetectEngineInspectBufferGeneric, GetData); - DetectAppLayerInspectEngineRegister("http_stat_msg", - ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE, - DetectEngineInspectHttpStatMsg); + DetectAppLayerMpmRegister2("http_stat_msg", SIG_FLAG_TOCLIENT, 3, + PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP, + HTP_RESPONSE_LINE); DetectBufferTypeSetDescriptionByName("http_stat_msg", "http response status message"); @@ -111,6 +117,29 @@ static int DetectHttpStatMsgSetup(DetectEngineCtx *de_ctx, Signature *s, const c ALPROTO_HTTP); } +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id) +{ + SCEnter(); + + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + htp_tx_t *tx = (htp_tx_t *)txv; + + if (tx->response_message == NULL) + return NULL; + + const uint32_t data_len = bstr_len(tx->response_message); + const uint8_t *data = bstr_ptr(tx->response_message); + + InspectionBufferSetup(buffer, data, data_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + + return buffer; +} + #ifdef UNITTESTS /**