detect/http2: use DetectThreadBuf fr request/response line

Instead of modifying the tx at detect time

Ticket: 9209

rust/src/http2/detect.rs

@@ -465,20 +465,16 @@ fn http2_frames_get_header_value<'a>(
 }
 
 // we mutate the tx to cache req_line
-fn http2_tx_get_req_line(tx: &mut HTTP2Transaction) {
+fn http2_tx_get_req_line(tx: &HTTP2Transaction, tbuf: &mut DetectThreadBuf) {
-    if !tx.req_line.is_empty() {
-        return;
-    }
     let empty = Vec::new();
-    let mut req_line = Vec::new();
     let method =
         if let Ok(value) = http2_frames_get_header_firstvalue(tx, Direction::ToServer, ":method") {
             value
         } else {
             &empty
         };
-    req_line.extend(method);
+    tbuf.data.extend(method);
-    req_line.push(b' ');
+    tbuf.data.push(b' ');
 
     let uri =
         if let Ok(value) = http2_frames_get_header_firstvalue(tx, Direction::ToServer, ":path") {
@@ -486,47 +482,44 @@ fn http2_tx_get_req_line(tx: &mut HTTP2Transaction) {
         } else {
             &empty
         };
-    req_line.extend(uri);
+    tbuf.data.extend(uri);
-    req_line.extend(b" HTTP/2\r\n");
+    tbuf.data.extend(b" HTTP/2\r\n");
-    tx.req_line.extend(req_line)
 }
 
 #[no_mangle]
 pub unsafe extern "C" fn SCHttp2TxGetRequestLine(
-    tx: &mut HTTP2Transaction, buffer: *mut *const u8, buffer_len: *mut u32,
+    tx: &HTTP2Transaction, buffer: *mut *const u8, buffer_len: *mut u32, tbuf: *mut c_void,
 ) -> u8 {
-    http2_tx_get_req_line(tx);
+    let tbuf = cast_pointer!(tbuf, DetectThreadBuf);
-    *buffer = tx.req_line.as_ptr(); //unsafe
+    tbuf.data.clear();
-    *buffer_len = tx.req_line.len() as u32;
+    http2_tx_get_req_line(tx, tbuf);
+    *buffer = tbuf.data.as_ptr(); //unsafe
+    *buffer_len = tbuf.data.len() as u32;
     return 1;
 }
 
-fn http2_tx_get_resp_line(tx: &mut HTTP2Transaction) {
+fn http2_tx_get_resp_line(tx: &HTTP2Transaction, tbuf: &mut DetectThreadBuf) {
-    if !tx.resp_line.is_empty() {
-        return;
-    }
     let empty = Vec::new();
-    let mut resp_line: Vec<u8> = Vec::new();
-
     let status =
         if let Ok(value) = http2_frames_get_header_firstvalue(tx, Direction::ToClient, ":status") {
             value
         } else {
             &empty
         };
-    resp_line.extend(b"HTTP/2 ");
+    tbuf.data.extend(b"HTTP/2 ");
-    resp_line.extend(status);
+    tbuf.data.extend(status);
-    resp_line.extend(b"\r\n");
+    tbuf.data.extend(b"\r\n");
-    tx.resp_line.extend(resp_line)
 }
 
 #[no_mangle]
 pub unsafe extern "C" fn SCHttp2TxGetResponseLine(
-    tx: &mut HTTP2Transaction, buffer: *mut *const u8, buffer_len: *mut u32,
+    tx: &HTTP2Transaction, buffer: *mut *const u8, buffer_len: *mut u32, tbuf: *mut c_void,
 ) -> u8 {
-    http2_tx_get_resp_line(tx);
+    let tbuf = cast_pointer!(tbuf, DetectThreadBuf);
-    *buffer = tx.resp_line.as_ptr(); //unsafe
+    tbuf.data.clear();
-    *buffer_len = tx.resp_line.len() as u32;
+    http2_tx_get_resp_line(tx, tbuf);
+    *buffer = tbuf.data.as_ptr(); //unsafe
+    *buffer_len = tbuf.data.len() as u32;
     return 1;
 }
 

rust/src/http2/http2.rs

@@ -300,9 +300,6 @@ pub struct HTTP2Transaction {
     pub ft_tc: FileTransferTracker,
     pub ft_ts: FileTransferTracker,
 
-    pub req_line: Vec<u8>,
-    pub resp_line: Vec<u8>,
-
     pub doh: Option<DohHttp2Tx>,
 }
 
@@ -333,8 +330,6 @@ impl HTTP2Transaction {
             tx_data: AppLayerTxData::new(),
             ft_tc: FileTransferTracker::new(),
             ft_ts: FileTransferTracker::new(),
-            req_line: Vec::new(),
-            resp_line: Vec::new(),
             doh: None,
         }
     }

src/detect-http-request-line.c

@@ -69,6 +69,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         Flow *_f, const uint8_t _flow_flags,
         void *txv, const int list_id);
 static int g_http_request_line_buffer_id = 0;
+static int g_http2_thread_id = 0;
 
 static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
         const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
@@ -81,7 +82,11 @@ static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
         uint32_t b_len = 0;
         const uint8_t *b = NULL;
 
-        if (SCHttp2TxGetRequestLine(txv, &b, &b_len) != 1)
+        void *thread_buf = SCDetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
+        if (thread_buf == NULL)
+            return NULL;
+
+        if (SCHttp2TxGetRequestLine(txv, &b, &b_len, thread_buf) != 1)
             return NULL;
         if (b == NULL || b_len == 0)
             return NULL;
@@ -125,6 +130,9 @@ void DetectHttpRequestLineRegister(void)
             "http request line");
 
     g_http_request_line_buffer_id = DetectBufferTypeGetByName("http_request_line");
+
+    g_http2_thread_id = SCDetectRegisterThreadCtxGlobalFuncs(
+            "http.request_line", SCDetectThreadBufDataInit, NULL, SCDetectThreadBufDataFree);
 }
 
 /**

src/detect-http-response-line.c

@@ -69,6 +69,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         Flow *_f, const uint8_t _flow_flags,
         void *txv, const int list_id);
 static int g_http_response_line_id = 0;
+static int g_http2_thread_id = 0;
 
 static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
         const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
@@ -81,7 +82,10 @@ static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
         uint32_t b_len = 0;
         const uint8_t *b = NULL;
 
-        if (SCHttp2TxGetResponseLine(txv, &b, &b_len) != 1)
+        void *thread_buf = SCDetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
+        if (thread_buf == NULL)
+            return NULL;
+        if (SCHttp2TxGetResponseLine(txv, &b, &b_len, thread_buf) != 1)
             return NULL;
         if (b == NULL || b_len == 0)
             return NULL;
@@ -124,6 +128,8 @@ void DetectHttpResponseLineRegister(void)
             "http response line");
 
     g_http_response_line_id = DetectBufferTypeGetByName("http_response_line");
+    g_http2_thread_id = SCDetectRegisterThreadCtxGlobalFuncs(
+            "http.response_line", SCDetectThreadBufDataInit, NULL, SCDetectThreadBufDataFree);
 }
 
 /**