• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

OISF / suricata / 22550902417

01 Mar 2026 07:32PM UTC coverage: 68.401% (-5.3%) from 73.687%
22550902417

Pull #14922

github

web-flow
github-actions: bump actions/upload-artifact from 6.0.0 to 7.0.0

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Pull Request #14922: github-actions: bump actions/upload-artifact from 6.0.0 to 7.0.0

218243 of 319063 relevant lines covered (68.4%)

3284926.58 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

72.94
/src/detect-http2.c
1
/* Copyright (C) 2020-2022 Open Information Security Foundation
2
 *
3
 * You can copy, redistribute or modify this Program under the terms of
4
 * the GNU General Public License version 2 as published by the Free
5
 * Software Foundation.
6
 *
7
 * This program is distributed in the hope that it will be useful,
8
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
10
 * GNU General Public License for more details.
11
 *
12
 * You should have received a copy of the GNU General Public License
13
 * version 2 along with this program; if not, write to the Free Software
14
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
 * 02110-1301, USA.
16
 */
17

18
/**
19
 * \file
20
 *
21
 * \author Philippe Antoine <p.antoine@catenacyber.fr>
22
 *
23
 */
24

25
#include "suricata-common.h"
26

27
#include "detect.h"
28
#include "detect-parse.h"
29
#include "detect-content.h"
30

31
#include "detect-engine.h"
32
#include "detect-engine-buffer.h"
33
#include "detect-engine-uint.h"
34
#include "detect-engine-mpm.h"
35
#include "detect-engine-prefilter.h"
36
#include "detect-engine-content-inspection.h"
37
#include "detect-engine-helper.h"
38

39
#include "detect-http2.h"
40
#include "util-byte.h"
41
#include "rust.h"
42
#include "util-profiling.h"
43

44
#ifdef UNITTESTS
45
void DetectHTTP2frameTypeRegisterTests (void);
46
void DetectHTTP2errorCodeRegisterTests (void);
47
void DetectHTTP2priorityRegisterTests (void);
48
void DetectHTTP2windowRegisterTests (void);
49
void DetectHTTP2settingsRegisterTests (void);
50
void DetectHTTP2sizeUpdateRegisterTests (void);
51
#endif
52

53
/* prototypes */
54
static int DetectHTTP2frametypeMatch(DetectEngineThreadCtx *det_ctx,
55
                                     Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
56
                                     const SigMatchCtx *ctx);
57
static int DetectHTTP2frametypeSetup (DetectEngineCtx *, Signature *, const char *);
58
void DetectHTTP2frametypeFree (DetectEngineCtx *, void *);
59

60
static int DetectHTTP2errorcodeMatch(DetectEngineThreadCtx *det_ctx,
61
                                     Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
62
                                     const SigMatchCtx *ctx);
63
static int DetectHTTP2errorcodeSetup (DetectEngineCtx *, Signature *, const char *);
64
void DetectHTTP2errorcodeFree (DetectEngineCtx *, void *);
65

66
static int DetectHTTP2priorityMatch(DetectEngineThreadCtx *det_ctx,
67
                                     Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
68
                                     const SigMatchCtx *ctx);
69
static int DetectHTTP2prioritySetup (DetectEngineCtx *, Signature *, const char *);
70
void DetectHTTP2priorityFree (DetectEngineCtx *, void *);
71

72
static int DetectHTTP2windowMatch(DetectEngineThreadCtx *det_ctx,
73
                                     Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
74
                                     const SigMatchCtx *ctx);
75
static int DetectHTTP2windowSetup (DetectEngineCtx *, Signature *, const char *);
76
void DetectHTTP2windowFree (DetectEngineCtx *, void *);
77

78
static int DetectHTTP2sizeUpdateMatch(DetectEngineThreadCtx *det_ctx,
79
                                     Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
80
                                     const SigMatchCtx *ctx);
81
static int DetectHTTP2sizeUpdateSetup (DetectEngineCtx *, Signature *, const char *);
82
void DetectHTTP2sizeUpdateFree (DetectEngineCtx *, void *);
83

84
static int DetectHTTP2settingsMatch(DetectEngineThreadCtx *det_ctx,
85
                                     Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
86
                                     const SigMatchCtx *ctx);
87
static int DetectHTTP2settingsSetup (DetectEngineCtx *, Signature *, const char *);
88
void DetectHTTP2settingsFree (DetectEngineCtx *, void *);
89

90
static int DetectHTTP2headerNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg);
91

92
#ifdef UNITTESTS
93
void DetectHTTP2RegisterTests (void);
94
#endif
95

96
static int g_http2_match_buffer_id = 0;
97
static int g_http2_complete_buffer_id = 0;
98
static int g_http2_header_name_buffer_id = 0;
99

100
/**
101
 * \brief Registration function for HTTP2 keywords
102
 */
103

104
void DetectHttp2Register(void)
105
{
37✔
106
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].name = "http2.frametype";
37✔
107
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].desc = "match on HTTP2 frame type field";
37✔
108
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].url = "/rules/http2-keywords.html#frametype";
37✔
109
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].Match = NULL;
37✔
110
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].AppLayerTxMatch = DetectHTTP2frametypeMatch;
37✔
111
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].Setup = DetectHTTP2frametypeSetup;
37✔
112
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].Free = DetectHTTP2frametypeFree;
37✔
113
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].flags =
37✔
114
            SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_ENUM_UINT;
37✔
115
#ifdef UNITTESTS
3✔
116
    sigmatch_table[DETECT_HTTP2_FRAMETYPE].RegisterTests = DetectHTTP2frameTypeRegisterTests;
3✔
117
#endif
3✔
118

119
    sigmatch_table[DETECT_HTTP2_ERRORCODE].name = "http2.errorcode";
37✔
120
    sigmatch_table[DETECT_HTTP2_ERRORCODE].desc = "match on HTTP2 error code field";
37✔
121
    sigmatch_table[DETECT_HTTP2_ERRORCODE].url = "/rules/http2-keywords.html#errorcode";
37✔
122
    sigmatch_table[DETECT_HTTP2_ERRORCODE].Match = NULL;
37✔
123
    sigmatch_table[DETECT_HTTP2_ERRORCODE].AppLayerTxMatch = DetectHTTP2errorcodeMatch;
37✔
124
    sigmatch_table[DETECT_HTTP2_ERRORCODE].Setup = DetectHTTP2errorcodeSetup;
37✔
125
    sigmatch_table[DETECT_HTTP2_ERRORCODE].Free = DetectHTTP2errorcodeFree;
37✔
126
    sigmatch_table[DETECT_HTTP2_ERRORCODE].flags =
37✔
127
            SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT | SIGMATCH_INFO_ENUM_UINT;
37✔
128
#ifdef UNITTESTS
3✔
129
    sigmatch_table[DETECT_HTTP2_ERRORCODE].RegisterTests = DetectHTTP2errorCodeRegisterTests;
3✔
130
#endif
3✔
131

132
    sigmatch_table[DETECT_HTTP2_PRIORITY].name = "http2.priority";
37✔
133
    sigmatch_table[DETECT_HTTP2_PRIORITY].desc = "match on HTTP2 priority weight field";
37✔
134
    sigmatch_table[DETECT_HTTP2_PRIORITY].url = "/rules/http2-keywords.html#priority";
37✔
135
    sigmatch_table[DETECT_HTTP2_PRIORITY].Match = NULL;
37✔
136
    sigmatch_table[DETECT_HTTP2_PRIORITY].AppLayerTxMatch = DetectHTTP2priorityMatch;
37✔
137
    sigmatch_table[DETECT_HTTP2_PRIORITY].Setup = DetectHTTP2prioritySetup;
37✔
138
    sigmatch_table[DETECT_HTTP2_PRIORITY].Free = DetectHTTP2priorityFree;
37✔
139
    sigmatch_table[DETECT_HTTP2_PRIORITY].flags = SIGMATCH_INFO_UINT8 | SIGMATCH_INFO_MULTI_UINT;
37✔
140
#ifdef UNITTESTS
3✔
141
    sigmatch_table[DETECT_HTTP2_PRIORITY].RegisterTests = DetectHTTP2priorityRegisterTests;
3✔
142
#endif
3✔
143

144
    sigmatch_table[DETECT_HTTP2_WINDOW].name = "http2.window";
37✔
145
    sigmatch_table[DETECT_HTTP2_WINDOW].desc = "match on HTTP2 window update size increment field";
37✔
146
    sigmatch_table[DETECT_HTTP2_WINDOW].url = "/rules/http2-keywords.html#window";
37✔
147
    sigmatch_table[DETECT_HTTP2_WINDOW].Match = NULL;
37✔
148
    sigmatch_table[DETECT_HTTP2_WINDOW].AppLayerTxMatch = DetectHTTP2windowMatch;
37✔
149
    sigmatch_table[DETECT_HTTP2_WINDOW].Setup = DetectHTTP2windowSetup;
37✔
150
    sigmatch_table[DETECT_HTTP2_WINDOW].Free = DetectHTTP2windowFree;
37✔
151
    sigmatch_table[DETECT_HTTP2_WINDOW].flags = SIGMATCH_INFO_UINT32 | SIGMATCH_INFO_MULTI_UINT;
37✔
152
#ifdef UNITTESTS
3✔
153
    sigmatch_table[DETECT_HTTP2_WINDOW].RegisterTests = DetectHTTP2windowRegisterTests;
3✔
154
#endif
3✔
155

156
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].name = "http2.size_update";
37✔
157
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].desc = "match on HTTP2 dynamic headers table size update";
37✔
158
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].url = "/rules/http2-keywords.html#sizeupdate";
37✔
159
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Match = NULL;
37✔
160
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].AppLayerTxMatch = DetectHTTP2sizeUpdateMatch;
37✔
161
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Setup = DetectHTTP2sizeUpdateSetup;
37✔
162
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Free = DetectHTTP2sizeUpdateFree;
37✔
163
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].flags = SIGMATCH_INFO_UINT64;
37✔
164
#ifdef UNITTESTS
3✔
165
    sigmatch_table[DETECT_HTTP2_SIZEUPDATE].RegisterTests = DetectHTTP2sizeUpdateRegisterTests;
3✔
166
#endif
3✔
167

168
    sigmatch_table[DETECT_HTTP2_SETTINGS].name = "http2.settings";
37✔
169
    sigmatch_table[DETECT_HTTP2_SETTINGS].desc = "match on HTTP2 settings identifier and value fields";
37✔
170
    sigmatch_table[DETECT_HTTP2_SETTINGS].url = "/rules/http2-keywords.html#settings";
37✔
171
    sigmatch_table[DETECT_HTTP2_SETTINGS].Match = NULL;
37✔
172
    sigmatch_table[DETECT_HTTP2_SETTINGS].AppLayerTxMatch = DetectHTTP2settingsMatch;
37✔
173
    sigmatch_table[DETECT_HTTP2_SETTINGS].Setup = DetectHTTP2settingsSetup;
37✔
174
    sigmatch_table[DETECT_HTTP2_SETTINGS].Free = DetectHTTP2settingsFree;
37✔
175
#ifdef UNITTESTS
3✔
176
    sigmatch_table[DETECT_HTTP2_SETTINGS].RegisterTests = DetectHTTP2settingsRegisterTests;
3✔
177
#endif
3✔
178

179
    sigmatch_table[DETECT_HTTP2_HEADERNAME].name = "http2.header_name";
37✔
180
    sigmatch_table[DETECT_HTTP2_HEADERNAME].desc = "sticky buffer to match on one HTTP2 header name";
37✔
181
    sigmatch_table[DETECT_HTTP2_HEADERNAME].url = "/rules/http2-keywords.html#header_name";
37✔
182
    sigmatch_table[DETECT_HTTP2_HEADERNAME].Setup = DetectHTTP2headerNameSetup;
37✔
183
    sigmatch_table[DETECT_HTTP2_HEADERNAME].flags |=
37✔
184
            SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER;
37✔
185

186
    DetectAppLayerMultiRegister("http2_header_name", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
37✔
187
            HTTP2StateOpen, SCHttp2TxGetHeaderName, 2);
37✔
188
    DetectAppLayerMultiRegister("http2_header_name", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
37✔
189
            HTTP2StateOpen, SCHttp2TxGetHeaderName, 2);
37✔
190

191
    DetectBufferTypeSupportsMultiInstance("http2_header_name");
37✔
192
    DetectBufferTypeSetDescriptionByName("http2_header_name",
37✔
193
                                         "HTTP2 header name");
37✔
194
    g_http2_header_name_buffer_id = DetectBufferTypeGetByName("http2_header_name");
37✔
195

196
    DetectAppLayerInspectEngineRegister(
37✔
197
            "http2", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, 0, DetectEngineInspectGenericList, NULL);
37✔
198
    DetectAppLayerInspectEngineRegister(
37✔
199
            "http2", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, 0, DetectEngineInspectGenericList, NULL);
37✔
200

201
    g_http2_match_buffer_id = DetectBufferTypeRegister("http2");
37✔
202

203
    DetectAppLayerInspectEngineRegister("http2_complete", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
37✔
204
            HTTP2StateClosed, DetectEngineInspectGenericList, NULL);
37✔
205
    DetectAppLayerInspectEngineRegister("http2_complete", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
37✔
206
            HTTP2StateClosed, DetectEngineInspectGenericList, NULL);
37✔
207

208
    g_http2_complete_buffer_id = DetectBufferTypeRegister("http2_complete");
37✔
209
}
37✔
210

211
/**
212
 * \brief This function is used to match HTTP2 frame type rule option on a transaction with those passed via http2.frametype:
213
 *
214
 * \retval 0 no match
215
 * \retval 1 match
216
 */
217
static int DetectHTTP2frametypeMatch(DetectEngineThreadCtx *det_ctx,
218
                               Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
219
                               const SigMatchCtx *ctx)
220

221
{
×
222
    return SCHttp2TxHasFrametype(txv, flags, ctx);
×
223
}
×
224

225
/**
226
 * \brief this function is used to attach the parsed http2.frametype data into the current signature
227
 *
228
 * \param de_ctx pointer to the Detection Engine Context
229
 * \param s pointer to the Current Signature
230
 * \param str pointer to the user provided http2.frametype options
231
 *
232
 * \retval 0 on Success
233
 * \retval -1 on Failure
234
 */
235
static int DetectHTTP2frametypeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
236
{
1✔
237
    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
1✔
238
        return -1;
×
239

240
    void *dua8 = SCHttp2ParseFrametype(str);
1✔
241
    if (dua8 == NULL) {
1✔
242
        SCLogError("Invalid http2.frametype: %s", str);
×
243
        return -1;
×
244
    }
×
245

246
    if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_FRAMETYPE, (SigMatchCtx *)dua8,
1✔
247
                g_http2_match_buffer_id) == NULL) {
1✔
248
        DetectHTTP2frametypeFree(NULL, dua8);
×
249
        return -1;
×
250
    }
×
251

252
    return 0;
1✔
253
}
1✔
254

255
/**
256
 * \brief this function will free memory associated with uint8_t
257
 *
258
 * \param ptr pointer to uint8_t
259
 */
260
void DetectHTTP2frametypeFree(DetectEngineCtx *de_ctx, void *ptr)
261
{
1✔
262
    SCDetectU8ArrayFree(ptr);
1✔
263
}
1✔
264

265
/**
266
 * \brief This function is used to match HTTP2 error code rule option on a transaction with those passed via http2.errorcode:
267
 *
268
 * \retval 0 no match
269
 * \retval 1 match
270
 */
271
static int DetectHTTP2errorcodeMatch(DetectEngineThreadCtx *det_ctx,
272
                               Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
273
                               const SigMatchCtx *ctx)
274

275
{
×
276
    return SCHttp2TxHasErrorCode(txv, flags, ctx);
×
277
}
×
278

279
/**
280
 * \brief this function is used to attach the parsed http2.errorcode data into the current signature
281
 *
282
 * \param de_ctx pointer to the Detection Engine Context
283
 * \param s pointer to the Current Signature
284
 * \param str pointer to the user provided http2.errorcode options
285
 *
286
 * \retval 0 on Success
287
 * \retval -1 on Failure
288
 */
289
static int DetectHTTP2errorcodeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
290
{
1✔
291
    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
1✔
292
        return -1;
×
293

294
    void *dua32 = SCHttp2ParseErrorCode(str);
1✔
295
    if (dua32 == NULL) {
1✔
296
        SCLogError("Invalid http2.errorcode: %s", str);
×
297
        return -1;
×
298
    }
×
299

300
    if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_ERRORCODE, (SigMatchCtx *)dua32,
1✔
301
                g_http2_match_buffer_id) == NULL) {
1✔
302
        DetectHTTP2errorcodeFree(NULL, dua32);
×
303
        return -1;
×
304
    }
×
305

306
    return 0;
1✔
307
}
1✔
308

309
/**
310
 * \brief this function will free memory associated with uint32_t
311
 *
312
 * \param ptr pointer to uint32_t
313
 */
314
void DetectHTTP2errorcodeFree(DetectEngineCtx *de_ctx, void *ptr)
315
{
1✔
316
    SCDetectU32ArrayFree(ptr);
1✔
317
}
1✔
318

319
/**
320
 * \brief This function is used to match HTTP2 error code rule option on a transaction with those passed via http2.priority:
321
 *
322
 * \retval 0 no match
323
 * \retval 1 match
324
 */
325
static int DetectHTTP2priorityMatch(DetectEngineThreadCtx *det_ctx,
326
                               Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
327
                               const SigMatchCtx *ctx)
328

329
{
×
330
    return SCHttp2PriorityMatch(txv, flags, ctx);
×
331
}
×
332

333
/**
334
 * \brief this function is used to attach the parsed http2.priority data into the current signature
335
 *
336
 * \param de_ctx pointer to the Detection Engine Context
337
 * \param s pointer to the Current Signature
338
 * \param str pointer to the user provided http2.priority options
339
 *
340
 * \retval 0 on Success
341
 * \retval -1 on Failure
342
 */
343
static int DetectHTTP2prioritySetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
344
{
1✔
345
    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
1✔
346
        return -1;
×
347

348
    void *prio = SCDetectU8ArrayParse(str);
1✔
349
    if (prio == NULL)
1✔
350
        return -1;
×
351

352
    if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_PRIORITY, (SigMatchCtx *)prio,
1✔
353
                g_http2_match_buffer_id) == NULL) {
1✔
354
        DetectHTTP2priorityFree(NULL, prio);
×
355
        return -1;
×
356
    }
×
357

358
    return 0;
1✔
359
}
1✔
360

361
/**
362
 * \brief this function will free memory associated with uint32_t
363
 *
364
 * \param ptr pointer to DetectU8Data
365
 */
366
void DetectHTTP2priorityFree(DetectEngineCtx *de_ctx, void *ptr)
367
{
1✔
368
    SCDetectU8ArrayFree(ptr);
1✔
369
}
1✔
370

371
/**
372
 * \brief This function is used to match HTTP2 window rule option on a transaction with those passed via http2.window:
373
 *
374
 * \retval 0 no match
375
 * \retval 1 match
376
 */
377
static int DetectHTTP2windowMatch(DetectEngineThreadCtx *det_ctx,
378
                               Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
379
                               const SigMatchCtx *ctx)
380

381
{
×
382
    return SCHttp2WindowMatch(txv, flags, ctx);
×
383
}
×
384

385
/**
386
 * \brief this function is used to attach the parsed http2.window data into the current signature
387
 *
388
 * \param de_ctx pointer to the Detection Engine Context
389
 * \param s pointer to the Current Signature
390
 * \param str pointer to the user provided http2.window options
391
 *
392
 * \retval 0 on Success
393
 * \retval -1 on Failure
394
 */
395
static int DetectHTTP2windowSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
396
{
1✔
397
    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
1✔
398
        return -1;
×
399

400
    void *wu = SCDetectU32ArrayParse(str);
1✔
401
    if (wu == NULL)
1✔
402
        return -1;
×
403

404
    // use g_http2_complete_buffer_id as we may have window changes in any state
405
    if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_WINDOW, (SigMatchCtx *)wu,
1✔
406
                g_http2_complete_buffer_id) == NULL) {
1✔
407
        DetectHTTP2windowFree(NULL, wu);
×
408
        return -1;
×
409
    }
×
410

411
    return 0;
1✔
412
}
1✔
413

414
/**
415
 * \brief this function will free memory associated with uint32_t
416
 *
417
 * \param ptr pointer to DetectU8Data
418
 */
419
void DetectHTTP2windowFree(DetectEngineCtx *de_ctx, void *ptr)
420
{
1✔
421
    SCDetectU32ArrayFree(ptr);
1✔
422
}
1✔
423

424
/**
425
 * \brief This function is used to match HTTP2 size update rule option on a transaction with those passed via http2.size_update:
426
 *
427
 * \retval 0 no match
428
 * \retval 1 match
429
 */
430
static int DetectHTTP2sizeUpdateMatch(DetectEngineThreadCtx *det_ctx,
431
                               Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
432
                               const SigMatchCtx *ctx)
433

434
{
×
435
    return SCHttp2DetectSizeUpdateCtxMatch(ctx, txv, flags);
×
436
}
×
437

438
/**
439
 * \brief this function is used to attach the parsed http2.size_update data into the current signature
440
 *
441
 * \param de_ctx pointer to the Detection Engine Context
442
 * \param s pointer to the Current Signature
443
 * \param str pointer to the user provided http2.size_update options
444
 *
445
 * \retval 0 on Success
446
 * \retval -1 on Failure
447
 */
448
static int DetectHTTP2sizeUpdateSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
449
{
1✔
450
    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
1✔
451
        return -1;
×
452

453
    DetectU64Data *su = SCDetectU64Parse(str);
1✔
454
    if (su == NULL)
1✔
455
        return -1;
×
456

457
    if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_SIZEUPDATE, (SigMatchCtx *)su,
1✔
458
                g_http2_match_buffer_id) == NULL) {
1✔
459
        DetectHTTP2sizeUpdateFree(NULL, su);
×
460
        return -1;
×
461
    }
×
462

463
    return 0;
1✔
464
}
1✔
465

466
/**
467
 * \brief this function will free memory associated with uint32_t
468
 *
469
 * \param ptr pointer to DetectU8Data
470
 */
471
void DetectHTTP2sizeUpdateFree(DetectEngineCtx *de_ctx, void *ptr)
472
{
1✔
473
    SCDetectU64Free(ptr);
1✔
474
}
1✔
475

476
/**
477
 * \brief This function is used to match HTTP2 error code rule option on a transaction with those passed via http2.settings:
478
 *
479
 * \retval 0 no match
480
 * \retval 1 match
481
 */
482
static int DetectHTTP2settingsMatch(DetectEngineThreadCtx *det_ctx,
483
                               Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
484
                               const SigMatchCtx *ctx)
485

486
{
×
487
    return SCHttp2DetectSettingsCtxMatch(ctx, txv, flags);
×
488
}
×
489

490
/**
491
 * \brief this function is used to attach the parsed http2.settings data into the current signature
492
 *
493
 * \param de_ctx pointer to the Detection Engine Context
494
 * \param s pointer to the Current Signature
495
 * \param str pointer to the user provided http2.settings options
496
 *
497
 * \retval 0 on Success
498
 * \retval -1 on Failure
499
 */
500
static int DetectHTTP2settingsSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
501
{
1✔
502
    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
1✔
503
        return -1;
×
504

505
    void *http2set = SCHttp2DetectSettingsCtxParse(str);
1✔
506
    if (http2set == NULL)
1✔
507
        return -1;
×
508

509
    if (SCSigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_SETTINGS, (SigMatchCtx *)http2set,
1✔
510
                g_http2_match_buffer_id) == NULL) {
1✔
511
        DetectHTTP2settingsFree(NULL, http2set);
×
512
        return -1;
×
513
    }
×
514

515
    return 0;
1✔
516
}
1✔
517

518
/**
519
 * \brief this function will free memory associated with rust signature context
520
 *
521
 * \param ptr pointer to rust signature context
522
 */
523
void DetectHTTP2settingsFree(DetectEngineCtx *de_ctx, void *ptr)
524
{
1✔
525
    SCHttp2DetectSettingsCtxFree(ptr);
1✔
526
}
1✔
527

528
static int DetectHTTP2headerNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
529
{
×
530
    if (SCDetectBufferSetActiveList(de_ctx, s, g_http2_header_name_buffer_id) < 0)
×
531
        return -1;
×
532

533
    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
×
534
        return -1;
×
535

536
    return 0;
×
537
}
×
538

539
#ifdef UNITTESTS
540
#include "tests/detect-http2.c"
541
#endif
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc