22553492142

Committed 01 Mar 2026 09:48PM UTC coverage: 70.74% (-2.9%) from 73.687%

Build # 22553492142

Build Type

Pull #14920

github

Committed by

web-flow

Commit Message

Merge e15a765bc into 90823fa90

Pull Request Pull Request #14920: draft: rust based configuration file parser and loader - v4

Run Details

38209 of 77306 branches covered (49.43%)

Branch coverage included in aggregate %.

533 of 779 new or added lines in 5 files covered. (68.42%)

11924 existing lines in 491 files now uncovered.

252429 of 333548 relevant lines covered (75.68%)

2403268.06 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

80.16

/src/detect-http-protocol.c

/* Copyright (C) 2007-2017 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \ingroup httplayer
 *
 * @{
 */


/**
 * \file
 *
 * \author Victor Julien <victor@inliniac.net>
 *
 * Implements support http_protocol sticky buffer
 */

#include "suricata-common.h"
#include "threads.h"
#include "decode.h"

#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-state.h"
#include "detect-engine-prefilter.h"
#include "detect-engine-content-inspection.h"
#include "detect-content.h"
#include "detect-pcre.h"
#include "detect-http-header-common.h"
#include "detect-http-protocol.h"

#include "flow.h"
#include "flow-var.h"
#include "flow-util.h"

#include "util-debug.h"
#include "util-unittest.h"
#include "util-unittest-helper.h"
#include "util-spm.h"
#include "util-print.h"

#include "app-layer.h"
#include "app-layer-parser.h"

#include "app-layer-htp.h"
#include "detect-http-header.h"
#include "stream-tcp.h"

#define KEYWORD_NAME "http.protocol"
#define KEYWORD_NAME_LEGACY "http_protocol"
#define KEYWORD_DOC "http-keywords.html#http-protocol"
#define BUFFER_NAME "http_protocol"
#define BUFFER_DESC "http protocol"
static int g_buffer_id = 0;

static int DetectHttpProtocolSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
{
    if (SCDetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
        return -1;

    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
        return -1;

    return 0;
}

static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
        const DetectEngineTransforms *transforms, Flow *_f,
        const uint8_t flow_flags, void *txv, const int list_id)
{
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
    if (buffer->inspect == NULL) {
        const bstr *str = NULL;
        htp_tx_t *tx = (htp_tx_t *)txv;

        if (flow_flags & STREAM_TOSERVER)
            str = htp_tx_request_protocol(tx);
        else if (flow_flags & STREAM_TOCLIENT)
            str = htp_tx_response_protocol(tx);

        if (str == NULL) {
            SCLogDebug("HTTP protocol not set");
            return NULL;
        }

        uint32_t data_len = (uint32_t)bstr_size(str);
        uint8_t *data = bstr_ptr(str);
        if (data == NULL || data_len == 0) {
            SCLogDebug("HTTP protocol not present");
            return NULL;
        }

        InspectionBufferSetupAndApplyTransforms(
                det_ctx, list_id, buffer, data, data_len, transforms);
    }

    return buffer;
}

static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
        const int list_id)
{
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
    if (buffer->inspect == NULL) {
        InspectionBufferSetupAndApplyTransforms(
                det_ctx, list_id, buffer, (const uint8_t *)"HTTP/2", strlen("HTTP/2"), transforms);
    }

    return buffer;
}

static bool DetectHttpProtocolValidateCallback(
        const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
    for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
        if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
            continue;
        const SigMatch *sm = s->init_data->buffers[x].head;
        for (; sm != NULL; sm = sm->next) {
            if (sm->type != DETECT_CONTENT)
                continue;
            const DetectContentData *cd = (DetectContentData *)sm->ctx;
            for (size_t i = 0; i < cd->content_len; ++i) {
                if (cd->content[i] == ' ') {
                    *sigerror = "Invalid http.protocol string containing a space";
                    SCLogWarning("rule %u: %s", s->id, *sigerror);
                    return false;
                }
            }
        }
    }
    return true;
}

/**
 * \brief Registers the keyword handlers for the "http.protocol" keyword.
 */
void DetectHttpProtocolRegister(void)
{
    sigmatch_table[DETECT_HTTP_PROTOCOL].name = KEYWORD_NAME;
    sigmatch_table[DETECT_HTTP_PROTOCOL].alias = KEYWORD_NAME_LEGACY;
    sigmatch_table[DETECT_HTTP_PROTOCOL].desc = BUFFER_NAME " sticky buffer";
    sigmatch_table[DETECT_HTTP_PROTOCOL].url = "/rules/" KEYWORD_DOC;
    sigmatch_table[DETECT_HTTP_PROTOCOL].Setup = DetectHttpProtocolSetup;
    sigmatch_table[DETECT_HTTP_PROTOCOL].flags |= SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_NOOPT;

    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
            GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE);
    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
            GetData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_LINE);
    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
            HTP_REQUEST_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);
    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
            HTP_RESPONSE_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);

    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
            GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);
    DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2);
    DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
            GetData2, ALPROTO_HTTP2, HTTP2StateDataServer);

    DetectBufferTypeSetDescriptionByName(BUFFER_NAME,
            BUFFER_DESC);
    DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectHttpProtocolValidateCallback);

    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
}

1	/* Copyright (C) 2007-2017 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \ingroup httplayer
20	*
21	* @{
22	*/
23
24
25	/**
26	* \file
27	*
28	* \author Victor Julien <victor@inliniac.net>
29	*
30	* Implements support http_protocol sticky buffer
31	*/
32
33	#include "suricata-common.h"
34	#include "threads.h"
35	#include "decode.h"
36
37	#include "detect.h"
38	#include "detect-parse.h"
39	#include "detect-engine.h"
40	#include "detect-engine-buffer.h"
41	#include "detect-engine-mpm.h"
42	#include "detect-engine-state.h"
43	#include "detect-engine-prefilter.h"
44	#include "detect-engine-content-inspection.h"
45	#include "detect-content.h"
46	#include "detect-pcre.h"
47	#include "detect-http-header-common.h"
48	#include "detect-http-protocol.h"
49
50	#include "flow.h"
51	#include "flow-var.h"
52	#include "flow-util.h"
53
54	#include "util-debug.h"
55	#include "util-unittest.h"
56	#include "util-unittest-helper.h"
57	#include "util-spm.h"
58	#include "util-print.h"
59
60	#include "app-layer.h"
61	#include "app-layer-parser.h"
62
63	#include "app-layer-htp.h"
64	#include "detect-http-header.h"
65	#include "stream-tcp.h"
66
67	#define KEYWORD_NAME "http.protocol"	2,159✔
68	#define KEYWORD_NAME_LEGACY "http_protocol"	2,159✔
69	#define KEYWORD_DOC "http-keywords.html#http-protocol"	2,159✔
70	#define BUFFER_NAME "http_protocol"	25,908✔
71	#define BUFFER_DESC "http protocol"	2,159✔
72	static int g_buffer_id = 0;
73
74	static int DetectHttpProtocolSetup(DetectEngineCtx de_ctx, Signature s, const char *arg)
75	{	42✔
76	if (SCDetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)	42!
UNCOV 77	return -1;	×
78
79	if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)	42!
UNCOV 80	return -1;	×
81
82	return 0;	42✔
83	}	42✔
84
85	static InspectionBuffer GetData(DetectEngineThreadCtx det_ctx,
86	const DetectEngineTransforms transforms, Flow _f,
87	const uint8_t flow_flags, void *txv, const int list_id)
88	{	6✔
89	InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);	6✔
90	if (buffer->inspect == NULL) {	6✔
91	const bstr *str = NULL;	2✔
92	htp_tx_t tx = (htp_tx_t )txv;	2✔
93
94	if (flow_flags & STREAM_TOSERVER)	2✔
95	str = htp_tx_request_protocol(tx);	1✔
96	else if (flow_flags & STREAM_TOCLIENT)	1!
97	str = htp_tx_response_protocol(tx);	1✔
98
99	if (str == NULL) {	2!
UNCOV 100	SCLogDebug("HTTP protocol not set");	×
UNCOV 101	return NULL;	×
UNCOV 102	}	×
103
104	uint32_t data_len = (uint32_t)bstr_size(str);	2✔
105	uint8_t *data = bstr_ptr(str);	2✔
106	if (data == NULL \|\| data_len == 0) {	2!
107	SCLogDebug("HTTP protocol not present");	×
108	return NULL;	×
109	}	×
110
111	InspectionBufferSetupAndApplyTransforms(	2✔
112	det_ctx, list_id, buffer, data, data_len, transforms);	2✔
113	}	2✔
114
115	return buffer;	6✔
116	}	6✔
117
118	static InspectionBuffer GetData2(DetectEngineThreadCtx det_ctx,
119	const DetectEngineTransforms transforms, Flow _f, const uint8_t _flow_flags, void *txv,
120	const int list_id)
121	{	24✔
122	InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);	24✔
123	if (buffer->inspect == NULL) {	24✔
124	InspectionBufferSetupAndApplyTransforms(	12✔
125	det_ctx, list_id, buffer, (const uint8_t *)"HTTP/2", strlen("HTTP/2"), transforms);	12✔
126	}	12✔
127
128	return buffer;	24✔
129	}	24✔
130
131	static bool DetectHttpProtocolValidateCallback(
132	const Signature s, const char sigerror, const DetectBufferType dbt)
133	{	42✔
134	for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {	205✔
135	if (s->init_data->buffers[x].id != (uint32_t)dbt->id)	163✔
136	continue;	121✔
137	const SigMatch *sm = s->init_data->buffers[x].head;	42✔
138	for (; sm != NULL; sm = sm->next) {	84✔
139	if (sm->type != DETECT_CONTENT)	42!
UNCOV 140	continue;	×
141	const DetectContentData cd = (DetectContentData )sm->ctx;	42✔
142	for (size_t i = 0; i < cd->content_len; ++i) {	361✔
143	if (cd->content[i] == ' ') {	319!
UNCOV 144	*sigerror = "Invalid http.protocol string containing a space";	×
UNCOV 145	SCLogWarning("rule %u: %s", s->id, *sigerror);	×
UNCOV 146	return false;	×
UNCOV 147	}	×
148	}	319✔
149	}	42✔
150	}	42✔
151	return true;	42✔
152	}	42✔
153
154	/**
155	* \brief Registers the keyword handlers for the "http.protocol" keyword.
156	*/
157	void DetectHttpProtocolRegister(void)
158	{	2,159✔
159	sigmatch_table[DETECT_HTTP_PROTOCOL].name = KEYWORD_NAME;	2,159✔
160	sigmatch_table[DETECT_HTTP_PROTOCOL].alias = KEYWORD_NAME_LEGACY;	2,159✔
161	sigmatch_table[DETECT_HTTP_PROTOCOL].desc = BUFFER_NAME " sticky buffer";	2,159✔
162	sigmatch_table[DETECT_HTTP_PROTOCOL].url = "/rules/" KEYWORD_DOC;	2,159✔
163	sigmatch_table[DETECT_HTTP_PROTOCOL].Setup = DetectHttpProtocolSetup;	2,159✔
164	sigmatch_table[DETECT_HTTP_PROTOCOL].flags \|= SIGMATCH_INFO_STICKY_BUFFER \| SIGMATCH_NOOPT;	2,159✔
165
166	DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,	2,159✔
167	GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE);	2,159✔
168	DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,	2,159✔
169	GetData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_LINE);	2,159✔
170	DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,	2,159✔
171	HTP_REQUEST_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);	2,159✔
172	DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,	2,159✔
173	HTP_RESPONSE_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);	2,159✔
174
175	DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,	2,159✔
176	HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);	2,159✔
177	DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,	2,159✔
178	GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);	2,159✔
179	DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,	2,159✔
180	HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2);	2,159✔
181	DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,	2,159✔
182	GetData2, ALPROTO_HTTP2, HTTP2StateDataServer);	2,159✔
183
184	DetectBufferTypeSetDescriptionByName(BUFFER_NAME,	2,159✔
185	BUFFER_DESC);	2,159✔
186	DetectBufferTypeRegisterValidateCallback(BUFFER_NAME, DetectHttpProtocolValidateCallback);	2,159✔
187
188	g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);	2,159✔
189	}	2,159✔

OISF / suricata / 22553492142

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous