22550902417

Committed 01 Mar 2026 07:32PM UTC coverage: 68.401% (-5.3%) from 73.687%

Build # 22550902417

Build Type

Pull #14922

github

Committed by

web-flow

Commit Message

github-actions: bump actions/upload-artifact from 6.0.0 to 7.0.0

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Pull Request Pull Request #14922: github-actions: bump actions/upload-artifact from 6.0.0 to 7.0.0

Run Details

218243 of 319063 relevant lines covered (68.4%)

3284926.58 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

57.61

/src/detect-http-protocol.c

/* Copyright (C) 2007-2017 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \ingroup httplayer
 *
 * @{
 */


/**
 * \file
 *
 * \author Victor Julien <victor@inliniac.net>
 *
 * Implements support http_protocol sticky buffer
 */

#include "suricata-common.h"
#include "threads.h"
#include "decode.h"

#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-content.h"
#include "detect-pcre.h"
#include "detect-http-header-common.h"
#include "detect-http-protocol.h"

#include "flow.h"
#include "flow-var.h"
#include "flow-util.h"

#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-spm.h"
#include "util-print.h"

#include "app-layer.h"
#include "app-layer-parser.h"

#include "app-layer-htp.h"
#include "detect-http-header.h"
#include "stream-tcp.h"

#define KEYWORD_NAME "http.protocol"
#define KEYWORD_NAME_LEGACY "http_protocol"
#define KEYWORD_DOC "http-keywords.html#http-protocol"
#define BUFFER_NAME "http_protocol"
#define BUFFER_DESC "http protocol"
static int g_buffer_id = 0;

static int DetectHttpProtocolSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
{
    if (SCDetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
        return -1;

    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
        return -1;

    return 0;
}

static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
        const DetectEngineTransforms *transforms, Flow *_f,
        const uint8_t flow_flags, void *txv, const int list_id)
{
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
    if (buffer->inspect == NULL) {
        const bstr *str = NULL;
        htp_tx_t *tx = (htp_tx_t *)txv;

        if (flow_flags & STREAM_TOSERVER)
            str = htp_tx_request_protocol(tx);
        else if (flow_flags & STREAM_TOCLIENT)
            str = htp_tx_response_protocol(tx);

        if (str == NULL) {
            SCLogDebug("HTTP protocol not set");
            return NULL;
        }

        uint32_t data_len = (uint32_t)bstr_size(str);
        uint8_t *data = bstr_ptr(str);
        if (data == NULL || data_len == 0) {
            SCLogDebug("HTTP protocol not present");
            return NULL;
        }

        InspectionBufferSetupAndApplyTransforms(
                det_ctx, list_id, buffer, data, data_len, transforms);
    }

    return buffer;
}

static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
        const int list_id)
{
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
    if (buffer->inspect == NULL) {
        InspectionBufferSetupAndApplyTransforms(
                det_ctx, list_id, buffer, (const uint8_t *)"HTTP/2", strlen("HTTP/2"), transforms);
    }

    return buffer;
}

static bool DetectHttpProtocolValidateCallback(
        const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
    for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
        if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
            continue;
        const SigMatch *sm = s->init_data->buffers[x].head;
        for (; sm != NULL; sm = sm->next) {
            if (sm->type != DETECT_CONTENT)
                continue;
            const DetectContentData *cd = (DetectContentData *)sm->ctx;
            for (size_t i = 0; i < cd->content_len; ++i) {
                if (cd->content[i] == ' ') {
                    *sigerror = "Invalid http.protocol string containing a space";
                    SCLogWarning("rule %u: %s", s->id, *sigerror);
                    return false;
                }
            }
        }
    }
    return true;
}

/**
 * \brief Registers the keyword handlers for the "http.protocol" keyword.
 */
void DetectHttpProtocolRegister(void)
{
    sigmatch_table[DETECT_HTTP_PROTOCOL].name = KEYWORD_NAME;
    sigmatch_table[DETECT_HTTP_PROTOCOL].alias = KEYWORD_NAME_LEGACY;
    sigmatch_table[DETECT_HTTP_PROTOCOL].desc = BUFFER_NAME " sticky buffer";
    sigmatch_table[DETECT_HTTP_PROTOCOL].url = "/rules/" KEYWORD_DOC;
    sigmatch_table[DETECT_HTTP_PROTOCOL].Setup = DetectHttpProtocolSetup;
    sigmatch_table[DETECT_HTTP_PROTOCOL].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_NOOPT;

    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
            GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE);
    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
            GetData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_LINE);
    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
            HTP_REQUEST_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);
    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
            HTP_RESPONSE_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);

    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
            GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);
    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2);
    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
            GetData2, ALPROTO_HTTP2, HTTP2StateDataServer);

    DetectBufferTypeSetDescriptionByName(BUFFER_NAME,
            BUFFER_DESC);
    DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectHttpProtocolValidateCallback);

    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
}

1	/* Copyright (C) 2007-2017 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \ingroup httplayer
20	*
21	* @{
22	*/
23
24
25	/**
26	* \file
27	*
28	* \author Victor Julien <victor@inliniac.net>
29	*
30	* Implements support http_protocol sticky buffer
31	*/
32
33	#include "suricata-common.h"
34	#include "threads.h"
35	#include "decode.h"
36
37	#include "detect.h"
38	#include "detect-parse.h"
39	#include "detect-engine.h"
40	#include "detect-engine-buffer.h"
41	#include "detect-engine-mpm.h"
42	#include "detect-engine-state.h"
43	#include "detect-engine-prefilter.h"
44	#include "detect-engine-content-inspection.h"
45	#include "detect-content.h"
46	#include "detect-pcre.h"
47	#include "detect-http-header-common.h"
48	#include "detect-http-protocol.h"
49
50	#include "flow.h"
51	#include "flow-var.h"
52	#include "flow-util.h"
53
54	#include "util-debug.h"
55	#include "util-unittest.h"
56	#include "util-unittest-helper.h"
57	#include "util-spm.h"
58	#include "util-print.h"
59
60	#include "app-layer.h"
61	#include "app-layer-parser.h"
62
63	#include "app-layer-htp.h"
64	#include "detect-http-header.h"
65	#include "stream-tcp.h"
66
67	#define KEYWORD_NAME "http.protocol"	37✔
68	#define KEYWORD_NAME_LEGACY "http_protocol"	37✔
69	#define KEYWORD_DOC "http-keywords.html#http-protocol"	37✔
70	#define BUFFER_NAME "http_protocol"	444✔
71	#define BUFFER_DESC "http protocol"	37✔
72	static int g_buffer_id = 0;
73
74	static int DetectHttpProtocolSetup(DetectEngineCtx de_ctx, Signature s, const char *arg)
75	{	37✔
76	if (SCDetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)	37✔
77	return -1;	×
78
79	if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)	37✔
80	return -1;	×
81
82	return 0;	37✔
83	}	37✔
84
85	static InspectionBuffer GetData(DetectEngineThreadCtx det_ctx,
86	const DetectEngineTransforms transforms, Flow _f,
87	const uint8_t flow_flags, void *txv, const int list_id)
88	{	×
89	InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);	×
90	if (buffer->inspect == NULL) {	×
91	const bstr *str = NULL;	×
92	htp_tx_t tx = (htp_tx_t )txv;	×
93
94	if (flow_flags & STREAM_TOSERVER)	×
95	str = htp_tx_request_protocol(tx);	×
96	else if (flow_flags & STREAM_TOCLIENT)	×
97	str = htp_tx_response_protocol(tx);	×
98
99	if (str == NULL) {	×
100	SCLogDebug("HTTP protocol not set");	×
101	return NULL;	×
102	}	×
103
104	uint32_t data_len = (uint32_t)bstr_size(str);	×
105	uint8_t *data = bstr_ptr(str);	×
106	if (data == NULL \|\| data_len == 0) {	×
107	SCLogDebug("HTTP protocol not present");	×
108	return NULL;	×
109	}	×
110
111	InspectionBufferSetupAndApplyTransforms(	×
112	det_ctx, list_id, buffer, data, data_len, transforms);	×
113	}	×
114
115	return buffer;	×
116	}	×
117
118	static InspectionBuffer GetData2(DetectEngineThreadCtx det_ctx,
119	const DetectEngineTransforms transforms, Flow _f, const uint8_t _flow_flags, void *txv,
120	const int list_id)
121	{	×
122	InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);	×
123	if (buffer->inspect == NULL) {	×
124	InspectionBufferSetupAndApplyTransforms(	×
125	det_ctx, list_id, buffer, (const uint8_t *)"HTTP/2", strlen("HTTP/2"), transforms);	×
126	}	×
127
128	return buffer;	×
129	}	×
130
131	static bool DetectHttpProtocolValidateCallback(
132	const Signature s, const char sigerror, const DetectBufferType dbt)
133	{	37✔
134	for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {	195✔
135	if (s->init_data->buffers[x].id != (uint32_t)dbt->id)	158✔
136	continue;	121✔
137	const SigMatch *sm = s->init_data->buffers[x].head;	37✔
138	for (; sm != NULL; sm = sm->next) {	74✔
139	if (sm->type != DETECT_CONTENT)	37✔
140	continue;	×
141	const DetectContentData cd = (DetectContentData )sm->ctx;	37✔
142	for (size_t i = 0; i < cd->content_len; ++i) {	318✔
143	if (cd->content[i] == ' ') {	281✔
144	*sigerror = "Invalid http.protocol string containing a space";	×
145	SCLogWarning("rule %u: %s", s->id, *sigerror);	×
146	return false;	×
147	}	×
148	}	281✔
149	}	37✔
150	}	37✔
151	return true;	37✔
152	}	37✔
153
154	/**
155	* \brief Registers the keyword handlers for the "http.protocol" keyword.
156	*/
157	void DetectHttpProtocolRegister(void)
158	{	37✔
159	sigmatch_table[DETECT_HTTP_PROTOCOL].name = KEYWORD_NAME;	37✔
160	sigmatch_table[DETECT_HTTP_PROTOCOL].alias = KEYWORD_NAME_LEGACY;	37✔
161	sigmatch_table[DETECT_HTTP_PROTOCOL].desc = BUFFER_NAME " sticky buffer";	37✔
162	sigmatch_table[DETECT_HTTP_PROTOCOL].url = "/rules/" KEYWORD_DOC;	37✔
163	sigmatch_table[DETECT_HTTP_PROTOCOL].Setup = DetectHttpProtocolSetup;	37✔
164	sigmatch_table[DETECT_HTTP_PROTOCOL].flags \|= SIGMATCH_INFO_STICKY_BUFFER \| SIGMATCH_NOOPT;	37✔
165
166	DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,	37✔
167	GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE);	37✔
168	DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,	37✔
169	GetData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_LINE);	37✔
170	DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,	37✔
171	HTP_REQUEST_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);	37✔
172	DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,	37✔
173	HTP_RESPONSE_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);	37✔
174
175	DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,	37✔
176	HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);	37✔
177	DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,	37✔
178	GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);	37✔
179	DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,	37✔
180	HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2);	37✔
181	DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,	37✔
182	GetData2, ALPROTO_HTTP2, HTTP2StateDataServer);	37✔
183
184	DetectBufferTypeSetDescriptionByName(BUFFER_NAME,	37✔
185	BUFFER_DESC);	37✔
186	DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectHttpProtocolValidateCallback);	37✔
187
188	g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);	37✔
189	}	37✔

OISF / suricata / 22550902417

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous