23105300094

Committed 15 Mar 2026 06:48AM UTC coverage: 75.784% (-0.7%) from 76.495%

Build # 23105300094

Build Type

push

github

Committed by

jasonish

Commit Message

github-ci: ubuntu minimal build fixups

- Don't run on the GitHub provided VM, it contains a newer Rust than
  stock Ubuntu does.

Coverage Stats

252836 of 333628 relevant lines covered (75.78%)

1978514.46 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

78.49

/src/detect-http-raw-header.c

/* Copyright (C) 2007-2022 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \ingroup httplayer
 *
 * @{
 */


/**
 * \file
 *
 * \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
 *
 * Implements support for http_raw_header keyword.
 */

#include "suricata-common.h"
#include "threads.h"
#include "decode.h"

#include "detect.h"
#include "detect-parse.h"
#include "detect-engine.h"
#include "detect-engine-buffer.h"
#include "detect-engine-mpm.h"
#include "detect-engine-prefilter.h"
#include "detect-content.h"

#include "flow.h"
#include "flow-var.h"
#include "flow-util.h"

#include "util-debug.h"
#include "util-profiling.h"

#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "detect-http-raw-header.h"

static int DetectHttpRawHeaderSetup(DetectEngineCtx *, Signature *, const char *);
static int DetectHttpRawHeaderSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str);
#ifdef UNITTESTS
static void DetectHttpRawHeaderRegisterTests(void);
#endif
static bool DetectHttpRawHeaderValidateCallback(
        const Signature *s, const char **sigerror, const DetectBufferType *dbt);
static int g_http_raw_header_buffer_id = 0;
static int g_http2_thread_id = 0;

static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
        const DetectEngineTransforms *transforms, Flow *_f,
        const uint8_t flow_flags, void *txv, const int list_id);
static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t flow_flags, void *txv,
        const int list_id);

static int PrefilterMpmHttpHeaderRawRequestRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
        MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id);
static int PrefilterMpmHttpHeaderRawResponseRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
        MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id);

/**
 * \brief Registers the keyword handlers for the "http_raw_header" keyword.
 */
void DetectHttpRawHeaderRegister(void)
{
    /* http_raw_header content modifier */
    sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].name = "http_raw_header";
    sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].desc =
            "content modifier to match the raw HTTP header buffer";
    sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].url =
            "/rules/http-keywords.html#http-header-and-http-raw-header";
    sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].Setup = DetectHttpRawHeaderSetup;
#ifdef UNITTESTS
    sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].RegisterTests = DetectHttpRawHeaderRegisterTests;
#endif
    sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].flags |=
            SIGMATCH_NOOPT | SIGMATCH_INFO_CONTENT_MODIFIER;
    sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].alternative = DETECT_HTTP_RAW_HEADER;

    /* http.header.raw sticky buffer */
    sigmatch_table[DETECT_HTTP_RAW_HEADER].name = "http.header.raw";
    sigmatch_table[DETECT_HTTP_RAW_HEADER].desc = "sticky buffer to match the raw HTTP header buffer";
    sigmatch_table[DETECT_HTTP_RAW_HEADER].url = "/rules/http-keywords.html#http-header-and-http-raw-header";
    sigmatch_table[DETECT_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetupSticky;
    sigmatch_table[DETECT_HTTP_RAW_HEADER].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

    DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
            HTP_REQUEST_PROGRESS_HEADERS + 1, DetectEngineInspectBufferGeneric, GetData);
    DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
            HTP_RESPONSE_PROGRESS_HEADERS + 1, DetectEngineInspectBufferGeneric, GetData);

    DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOSERVER, 2,
            PrefilterMpmHttpHeaderRawRequestRegister, NULL, ALPROTO_HTTP1,
            0); /* progress handled in register */
    DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOCLIENT, 2,
            PrefilterMpmHttpHeaderRawResponseRegister, NULL, ALPROTO_HTTP1,
            0); /* progress handled in register */

    DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
    DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2);

    DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
            GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);
    DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
            GetData2, ALPROTO_HTTP2, HTTP2StateDataServer);

    DetectBufferTypeSetDescriptionByName("http_raw_header",
            "raw http headers");

    DetectBufferTypeRegisterValidateCallback("http_raw_header",
            DetectHttpRawHeaderValidateCallback);
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
            "http2.raw_header", SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);

    g_http_raw_header_buffer_id = DetectBufferTypeGetByName("http_raw_header");
}

/**
 * \brief The setup function for the http_raw_header keyword for a signature.
 *
 * \param de_ctx Pointer to the detection engine context.
 * \param s      Pointer to signature for the current Signature being parsed
 *               from the rules.
 * \param m      Pointer to the head of the SigMatchs for the current rule
 *               being parsed.
 * \param arg    Pointer to the string holding the keyword value.
 *
 * \retval  0 On success.
 * \retval -1 On failure.
 */
int DetectHttpRawHeaderSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
{
    return DetectEngineContentModifierBufferSetup(
            de_ctx, s, arg, DETECT_HTTP_RAW_HEADER_CM, g_http_raw_header_buffer_id, ALPROTO_HTTP1);
}

/**
 * \brief this function setup the http.header.raw keyword used in the rule
 *
 * \param de_ctx   Pointer to the Detection Engine Context
 * \param s        Pointer to the Signature to which the current keyword belongs
 * \param str      Should hold an empty string always
 *
 * \retval 0       On success
 */
static int DetectHttpRawHeaderSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str)
{
    if (SCDetectBufferSetActiveList(de_ctx, s, g_http_raw_header_buffer_id) < 0)
        return -1;
    if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
        return -1;
    return 0;
}

static bool DetectHttpRawHeaderValidateCallback(
        const Signature *s, const char **sigerror, const DetectBufferType *dbt)
{
    if ((s->flags & (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) == (SIG_FLAG_TOCLIENT|SIG_FLAG_TOSERVER)) {
        *sigerror = "http_raw_header signature "
                "without a flow direction. Use flow:to_server for "
                "inspecting request headers or flow:to_client for "
                "inspecting response headers.";

        SCLogError("%s", *sigerror);
        SCReturnInt(false);
    }
    return true;
}

static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
        const DetectEngineTransforms *transforms, Flow *_f,
        const uint8_t flow_flags, void *txv, const int list_id)
{
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
    if (buffer->inspect == NULL) {
        htp_tx_t *tx = (htp_tx_t *)txv;

        HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);

        const bool ts = ((flow_flags & STREAM_TOSERVER) != 0);
        const uint8_t *data = ts ?
            tx_ud->request_headers_raw : tx_ud->response_headers_raw;
        if (data == NULL)
            return NULL;
        const uint32_t data_len = ts ?
            tx_ud->request_headers_raw_len : tx_ud->response_headers_raw_len;

        InspectionBufferSetupAndApplyTransforms(
                det_ctx, list_id, buffer, data, data_len, transforms);
    }

    return buffer;
}

static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t flow_flags, void *txv,
        const int list_id)
{
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
    if (buffer->inspect == NULL) {
        uint32_t b_len = 0;
        const uint8_t *b = NULL;

        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
        if (thread_buf == NULL)
            return NULL;
        if (SCHttp2TxGetHeadersRaw(txv, flow_flags, &b, &b_len, thread_buf) != 1)
            return NULL;
        if (b == NULL || b_len == 0)
            return NULL;

        InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
    }

    return buffer;
}

typedef struct PrefilterMpmHttpHeaderRawCtx {
    int list_id;
    const MpmCtx *mpm_ctx;
    const DetectEngineTransforms *transforms;
} PrefilterMpmHttpHeaderRawCtx;

/** \brief Generic Mpm prefilter callback
 *
 *  \param det_ctx detection engine thread ctx
 *  \param p packet to inspect
 *  \param f flow to inspect
 *  \param txv tx to inspect
 *  \param pectx inspection context
 */
static void PrefilterMpmHttpHeaderRaw(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
        Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
{
    SCEnter();

    const PrefilterMpmHttpHeaderRawCtx *ctx = pectx;
    const MpmCtx *mpm_ctx = ctx->mpm_ctx;
    SCLogDebug("running on list %d", ctx->list_id);

    const int list_id = ctx->list_id;

    InspectionBuffer *buffer = GetData(det_ctx, ctx->transforms, f,
            flags, txv, list_id);
    if (buffer == NULL)
        return;

    const uint32_t data_len = buffer->inspect_len;
    const uint8_t *data = buffer->inspect;

    SCLogDebug("mpm'ing buffer:");
    //PrintRawDataFp(stdout, data, data_len);

    if (data != NULL && data_len >= mpm_ctx->minlen) {
        (void)mpm_table[mpm_ctx->mpm_type].Search(
                mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, data, data_len);
        PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);
    }
}

static void PrefilterMpmHttpTrailerRaw(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
        Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
{
    SCEnter();

    htp_tx_t *tx = txv;
    const HtpTxUserData *htud = (const HtpTxUserData *)htp_tx_get_user_data(tx);
    /* if the request wasn't flagged as having a trailer, we skip */
    if (((flags & STREAM_TOSERVER) && !htud->request_has_trailers) ||
            ((flags & STREAM_TOCLIENT) && !htud->response_has_trailers)) {
        SCReturn;
    }
    PrefilterMpmHttpHeaderRaw(det_ctx, pectx, p, f, txv, idx, _txd, flags);
    SCReturn;
}

static void PrefilterMpmHttpHeaderRawFree(void *ptr)
{
    SCFree(ptr);
}

static int PrefilterMpmHttpHeaderRawRequestRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
        MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
{
    SCEnter();

    /* header */
    PrefilterMpmHttpHeaderRawCtx *pectx = SCCalloc(1, sizeof(*pectx));
    if (pectx == NULL)
        return -1;
    pectx->list_id = list_id;
    pectx->mpm_ctx = mpm_ctx;
    pectx->transforms = &mpm_reg->transforms;

    int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpHeaderRaw, mpm_reg->app_v2.alproto,
            HTP_REQUEST_PROGRESS_HEADERS + 1, pectx, PrefilterMpmHttpHeaderRawFree, mpm_reg->pname);
    if (r != 0) {
        SCFree(pectx);
        return r;
    }

    /* trailer */
    pectx = SCCalloc(1, sizeof(*pectx));
    if (pectx == NULL)
        return -1;
    pectx->list_id = list_id;
    pectx->mpm_ctx = mpm_ctx;
    pectx->transforms = &mpm_reg->transforms;

    r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpTrailerRaw, mpm_reg->app_v2.alproto,
            HTP_REQUEST_PROGRESS_TRAILER + 1, pectx, PrefilterMpmHttpHeaderRawFree, mpm_reg->pname);
    if (r != 0) {
        SCFree(pectx);
    }
    return r;
}

static int PrefilterMpmHttpHeaderRawResponseRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
        MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
{
    SCEnter();

    /* header */
    PrefilterMpmHttpHeaderRawCtx *pectx = SCCalloc(1, sizeof(*pectx));
    if (pectx == NULL)
        return -1;
    pectx->list_id = list_id;
    pectx->mpm_ctx = mpm_ctx;
    pectx->transforms = &mpm_reg->transforms;

    int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpHeaderRaw, mpm_reg->app_v2.alproto,
            HTP_RESPONSE_PROGRESS_HEADERS, pectx, PrefilterMpmHttpHeaderRawFree, mpm_reg->pname);
    if (r != 0) {
        SCFree(pectx);
        return r;
    }

    /* trailer */
    pectx = SCCalloc(1, sizeof(*pectx));
    if (pectx == NULL)
        return -1;
    pectx->list_id = list_id;
    pectx->mpm_ctx = mpm_ctx;
    pectx->transforms = &mpm_reg->transforms;

    r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpTrailerRaw, mpm_reg->app_v2.alproto,
            HTP_RESPONSE_PROGRESS_TRAILER, pectx, PrefilterMpmHttpHeaderRawFree, mpm_reg->pname);
    if (r != 0) {
        SCFree(pectx);
    }
    return r;
}

/************************************Unittests*********************************/

#ifdef UNITTESTS
#include "tests/detect-http-raw-header.c"
#endif

/**
 * @}
 */

1	/* Copyright (C) 2007-2022 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \ingroup httplayer
20	*
21	* @{
22	*/
23
24
25	/**
26	* \file
27	*
28	* \author Pablo Rincon <pablo.rincon.crespo@gmail.com>
29	*
30	* Implements support for http_raw_header keyword.
31	*/
32
33	#include "suricata-common.h"
34	#include "threads.h"
35	#include "decode.h"
36
37	#include "detect.h"
38	#include "detect-parse.h"
39	#include "detect-engine.h"
40	#include "detect-engine-buffer.h"
41	#include "detect-engine-mpm.h"
42	#include "detect-engine-prefilter.h"
43	#include "detect-content.h"
44
45	#include "flow.h"
46	#include "flow-var.h"
47	#include "flow-util.h"
48
49	#include "util-debug.h"
50	#include "util-profiling.h"
51
52	#include "app-layer.h"
53	#include "app-layer-parser.h"
54	#include "app-layer-htp.h"
55	#include "detect-http-raw-header.h"
56
57	static int DetectHttpRawHeaderSetup(DetectEngineCtx , Signature , const char *);
58	static int DetectHttpRawHeaderSetupSticky(DetectEngineCtx de_ctx, Signature s, const char *str);
59	#ifdef UNITTESTS
60	static void DetectHttpRawHeaderRegisterTests(void);
61	#endif
62	static bool DetectHttpRawHeaderValidateCallback(
63	const Signature s, const char sigerror, const DetectBufferType dbt);
64	static int g_http_raw_header_buffer_id = 0;
65	static int g_http2_thread_id = 0;
66
67	static InspectionBuffer GetData(DetectEngineThreadCtx det_ctx,
68	const DetectEngineTransforms transforms, Flow _f,
69	const uint8_t flow_flags, void *txv, const int list_id);
70	static InspectionBuffer GetData2(DetectEngineThreadCtx det_ctx,
71	const DetectEngineTransforms transforms, Flow _f, const uint8_t flow_flags, void *txv,
72	const int list_id);
73
74	static int PrefilterMpmHttpHeaderRawRequestRegister(DetectEngineCtx de_ctx, SigGroupHead sgh,
75	MpmCtx mpm_ctx, const DetectBufferMpmRegistry mpm_reg, int list_id);
76	static int PrefilterMpmHttpHeaderRawResponseRegister(DetectEngineCtx de_ctx, SigGroupHead sgh,
77	MpmCtx mpm_ctx, const DetectBufferMpmRegistry mpm_reg, int list_id);
78
79	/**
80	* \brief Registers the keyword handlers for the "http_raw_header" keyword.
81	*/
82	void DetectHttpRawHeaderRegister(void)
83	{	2,192✔
84	/* http_raw_header content modifier */
85	sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].name = "http_raw_header";	2,192✔
86	sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].desc =	2,192✔
87	"content modifier to match the raw HTTP header buffer";	2,192✔
88	sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].url =	2,192✔
89	"/rules/http-keywords.html#http-header-and-http-raw-header";	2,192✔
90	sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].Setup = DetectHttpRawHeaderSetup;	2,192✔
91	#ifdef UNITTESTS	3✔
92	sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].RegisterTests = DetectHttpRawHeaderRegisterTests;	3✔
93	#endif	3✔
94	sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].flags \|=	2,192✔
95	SIGMATCH_NOOPT \| SIGMATCH_INFO_CONTENT_MODIFIER;	2,192✔
96	sigmatch_table[DETECT_HTTP_RAW_HEADER_CM].alternative = DETECT_HTTP_RAW_HEADER;	2,192✔
97
98	/* http.header.raw sticky buffer */
99	sigmatch_table[DETECT_HTTP_RAW_HEADER].name = "http.header.raw";	2,192✔
100	sigmatch_table[DETECT_HTTP_RAW_HEADER].desc = "sticky buffer to match the raw HTTP header buffer";	2,192✔
101	sigmatch_table[DETECT_HTTP_RAW_HEADER].url = "/rules/http-keywords.html#http-header-and-http-raw-header";	2,192✔
102	sigmatch_table[DETECT_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetupSticky;	2,192✔
103	sigmatch_table[DETECT_HTTP_RAW_HEADER].flags \|= SIGMATCH_NOOPT\|SIGMATCH_INFO_STICKY_BUFFER;	2,192✔
104
105	DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,	2,192✔
106	HTP_REQUEST_PROGRESS_HEADERS + 1, DetectEngineInspectBufferGeneric, GetData);	2,192✔
107	DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,	2,192✔
108	HTP_RESPONSE_PROGRESS_HEADERS + 1, DetectEngineInspectBufferGeneric, GetData);	2,192✔
109
110	DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOSERVER, 2,	2,192✔
111	PrefilterMpmHttpHeaderRawRequestRegister, NULL, ALPROTO_HTTP1,	2,192✔
112	0); /* progress handled in register */	2,192✔
113	DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOCLIENT, 2,	2,192✔
114	PrefilterMpmHttpHeaderRawResponseRegister, NULL, ALPROTO_HTTP1,	2,192✔
115	0); /* progress handled in register */	2,192✔
116
117	DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,	2,192✔
118	HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);	2,192✔
119	DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,	2,192✔
120	HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2);	2,192✔
121
122	DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,	2,192✔
123	GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);	2,192✔
124	DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,	2,192✔
125	GetData2, ALPROTO_HTTP2, HTTP2StateDataServer);	2,192✔
126
127	DetectBufferTypeSetDescriptionByName("http_raw_header",	2,192✔
128	"raw http headers");	2,192✔
129
130	DetectBufferTypeRegisterValidateCallback("http_raw_header",	2,192✔
131	DetectHttpRawHeaderValidateCallback);	2,192✔
132	g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(	2,192✔
133	"http2.raw_header", SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);	2,192✔
134
135	g_http_raw_header_buffer_id = DetectBufferTypeGetByName("http_raw_header");	2,192✔
136	}	2,192✔
137
138	/**
139	* \brief The setup function for the http_raw_header keyword for a signature.
140	*
141	* \param de_ctx Pointer to the detection engine context.
142	* \param s Pointer to signature for the current Signature being parsed
143	* from the rules.
144	* \param m Pointer to the head of the SigMatchs for the current rule
145	* being parsed.
146	* \param arg Pointer to the string holding the keyword value.
147	*
148	* \retval 0 On success.
149	* \retval -1 On failure.
150	*/
151	int DetectHttpRawHeaderSetup(DetectEngineCtx de_ctx, Signature s, const char *arg)
152	{	55✔
153	return DetectEngineContentModifierBufferSetup(	55✔
154	de_ctx, s, arg, DETECT_HTTP_RAW_HEADER_CM, g_http_raw_header_buffer_id, ALPROTO_HTTP1);	55✔
155	}	55✔
156
157	/**
158	* \brief this function setup the http.header.raw keyword used in the rule
159	*
160	* \param de_ctx Pointer to the Detection Engine Context
161	* \param s Pointer to the Signature to which the current keyword belongs
162	* \param str Should hold an empty string always
163	*
164	* \retval 0 On success
165	*/
166	static int DetectHttpRawHeaderSetupSticky(DetectEngineCtx de_ctx, Signature s, const char *str)
167	{	33✔
168	if (SCDetectBufferSetActiveList(de_ctx, s, g_http_raw_header_buffer_id) < 0)	33✔
169	return -1;	×
170	if (SCDetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)	33✔
171	return -1;	1✔
172	return 0;	32✔
173	}	33✔
174
175	static bool DetectHttpRawHeaderValidateCallback(
176	const Signature s, const char sigerror, const DetectBufferType dbt)
177	{	74✔
178	if ((s->flags & (SIG_FLAG_TOCLIENT\|SIG_FLAG_TOSERVER)) == (SIG_FLAG_TOCLIENT\|SIG_FLAG_TOSERVER)) {	74✔
179	*sigerror = "http_raw_header signature "	×
180	"without a flow direction. Use flow:to_server for "	×
181	"inspecting request headers or flow:to_client for "	×
182	"inspecting response headers.";	×
183
184	SCLogError("%s", *sigerror);	×
185	SCReturnInt(false);	×
186	}	×
187	return true;	74✔
188	}	74✔
189
190	static InspectionBuffer GetData(DetectEngineThreadCtx det_ctx,
191	const DetectEngineTransforms transforms, Flow _f,
192	const uint8_t flow_flags, void *txv, const int list_id)
193	{	74✔
194	InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);	74✔
195	if (buffer->inspect == NULL) {	74✔
196	htp_tx_t tx = (htp_tx_t )txv;	40✔
197
198	HtpTxUserData *tx_ud = htp_tx_get_user_data(tx);	40✔
199
200	const bool ts = ((flow_flags & STREAM_TOSERVER) != 0);	40✔
201	const uint8_t *data = ts ?	40✔
202	tx_ud->request_headers_raw : tx_ud->response_headers_raw;	37✔
203	if (data == NULL)	40✔
204	return NULL;	×
205	const uint32_t data_len = ts ?	40✔
206	tx_ud->request_headers_raw_len : tx_ud->response_headers_raw_len;	37✔
207
208	InspectionBufferSetupAndApplyTransforms(	40✔
209	det_ctx, list_id, buffer, data, data_len, transforms);	40✔
210	}	40✔
211
212	return buffer;	74✔
213	}	74✔
214
215	static InspectionBuffer GetData2(DetectEngineThreadCtx det_ctx,
216	const DetectEngineTransforms transforms, Flow _f, const uint8_t flow_flags, void *txv,
217	const int list_id)
218	{	×
219	InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);	×
220	if (buffer->inspect == NULL) {	×
221	uint32_t b_len = 0;	×
222	const uint8_t *b = NULL;	×
223
224	void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);	×
225	if (thread_buf == NULL)	×
226	return NULL;	×
227	if (SCHttp2TxGetHeadersRaw(txv, flow_flags, &b, &b_len, thread_buf) != 1)	×
228	return NULL;	×
229	if (b == NULL \|\| b_len == 0)	×
230	return NULL;	×
231
232	InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);	×
233	}	×
234
235	return buffer;	×
236	}	×
237
238	typedef struct PrefilterMpmHttpHeaderRawCtx {
239	int list_id;
240	const MpmCtx *mpm_ctx;
241	const DetectEngineTransforms *transforms;
242	} PrefilterMpmHttpHeaderRawCtx;
243
244	/** \brief Generic Mpm prefilter callback
245	*
246	* \param det_ctx detection engine thread ctx
247	* \param p packet to inspect
248	* \param f flow to inspect
249	* \param txv tx to inspect
250	* \param pectx inspection context
251	*/
252	static void PrefilterMpmHttpHeaderRaw(DetectEngineThreadCtx det_ctx, const void pectx, Packet *p,
253	Flow f, void txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
254	{	33✔
255	SCEnter();	33✔
256
257	const PrefilterMpmHttpHeaderRawCtx *ctx = pectx;	33✔
258	const MpmCtx *mpm_ctx = ctx->mpm_ctx;	33✔
259	SCLogDebug("running on list %d", ctx->list_id);	33✔
260
261	const int list_id = ctx->list_id;	33✔
262
263	InspectionBuffer *buffer = GetData(det_ctx, ctx->transforms, f,	33✔
264	flags, txv, list_id);	33✔
265	if (buffer == NULL)	33✔
266	return;	×
267
268	const uint32_t data_len = buffer->inspect_len;	33✔
269	const uint8_t *data = buffer->inspect;	33✔
270
271	SCLogDebug("mpm'ing buffer:");	33✔
272	//PrintRawDataFp(stdout, data, data_len);
273
274	if (data != NULL && data_len >= mpm_ctx->minlen) {	33✔
275	(void)mpm_table[mpm_ctx->mpm_type].Search(	33✔
276	mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, data, data_len);	33✔
277	PREFILTER_PROFILING_ADD_BYTES(det_ctx, data_len);	33✔
278	}	33✔
279	}	33✔
280
281	static void PrefilterMpmHttpTrailerRaw(DetectEngineThreadCtx det_ctx, const void pectx, Packet *p,
282	Flow f, void txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
283	{	25✔
284	SCEnter();	25✔
285
286	htp_tx_t *tx = txv;	25✔
287	const HtpTxUserData htud = (const HtpTxUserData )htp_tx_get_user_data(tx);	25✔
288	/* if the request wasn't flagged as having a trailer, we skip */
289	if (((flags & STREAM_TOSERVER) && !htud->request_has_trailers) \|\|	25✔
290	((flags & STREAM_TOCLIENT) && !htud->response_has_trailers)) {	25✔
291	SCReturn;	23✔
292	}	23✔
293	PrefilterMpmHttpHeaderRaw(det_ctx, pectx, p, f, txv, idx, _txd, flags);	2✔
294	SCReturn;	2✔
295	}	25✔
296
297	static void PrefilterMpmHttpHeaderRawFree(void *ptr)
298	{	237✔
299	SCFree(ptr);	237✔
300	}	237✔
301
302	static int PrefilterMpmHttpHeaderRawRequestRegister(DetectEngineCtx de_ctx, SigGroupHead sgh,
303	MpmCtx mpm_ctx, const DetectBufferMpmRegistry mpm_reg, int list_id)
304	{	65✔
305	SCEnter();	65✔
306
307	/* header */
308	PrefilterMpmHttpHeaderRawCtx pectx = SCCalloc(1, sizeof(pectx));	65✔
309	if (pectx == NULL)	65✔
310	return -1;	×
311	pectx->list_id = list_id;	65✔
312	pectx->mpm_ctx = mpm_ctx;	65✔
313	pectx->transforms = &mpm_reg->transforms;	65✔
314
315	int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpHeaderRaw, mpm_reg->app_v2.alproto,	65✔
316	HTP_REQUEST_PROGRESS_HEADERS + 1, pectx, PrefilterMpmHttpHeaderRawFree, mpm_reg->pname);	65✔
317	if (r != 0) {	65✔
318	SCFree(pectx);	×
319	return r;	×
320	}	×
321
322	/* trailer */
323	pectx = SCCalloc(1, sizeof(*pectx));	65✔
324	if (pectx == NULL)	65✔
325	return -1;	×
326	pectx->list_id = list_id;	65✔
327	pectx->mpm_ctx = mpm_ctx;	65✔
328	pectx->transforms = &mpm_reg->transforms;	65✔
329
330	r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpTrailerRaw, mpm_reg->app_v2.alproto,	65✔
331	HTP_REQUEST_PROGRESS_TRAILER + 1, pectx, PrefilterMpmHttpHeaderRawFree, mpm_reg->pname);	65✔
332	if (r != 0) {	65✔
333	SCFree(pectx);	×
334	}	×
335	return r;	65✔
336	}	65✔
337
338	static int PrefilterMpmHttpHeaderRawResponseRegister(DetectEngineCtx de_ctx, SigGroupHead sgh,
339	MpmCtx mpm_ctx, const DetectBufferMpmRegistry mpm_reg, int list_id)
340	{	24✔
341	SCEnter();	24✔
342
343	/* header */
344	PrefilterMpmHttpHeaderRawCtx pectx = SCCalloc(1, sizeof(pectx));	24✔
345	if (pectx == NULL)	24✔
346	return -1;	×
347	pectx->list_id = list_id;	24✔
348	pectx->mpm_ctx = mpm_ctx;	24✔
349	pectx->transforms = &mpm_reg->transforms;	24✔
350
351	int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpHeaderRaw, mpm_reg->app_v2.alproto,	24✔
352	HTP_RESPONSE_PROGRESS_HEADERS, pectx, PrefilterMpmHttpHeaderRawFree, mpm_reg->pname);	24✔
353	if (r != 0) {	24✔
354	SCFree(pectx);	×
355	return r;	×
356	}	×
357
358	/* trailer */
359	pectx = SCCalloc(1, sizeof(*pectx));	24✔
360	if (pectx == NULL)	24✔
361	return -1;	×
362	pectx->list_id = list_id;	24✔
363	pectx->mpm_ctx = mpm_ctx;	24✔
364	pectx->transforms = &mpm_reg->transforms;	24✔
365
366	r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpTrailerRaw, mpm_reg->app_v2.alproto,	24✔
367	HTP_RESPONSE_PROGRESS_TRAILER, pectx, PrefilterMpmHttpHeaderRawFree, mpm_reg->pname);	24✔
368	if (r != 0) {	24✔
369	SCFree(pectx);	×
370	}	×
371	return r;	24✔
372	}	24✔
373
374	/**********************************Unittests*******************************/
375
376	#ifdef UNITTESTS
377	#include "tests/detect-http-raw-header.c"
378	#endif
379
380	/**
381	* @}
382	*/

jasonish / suricata / 23105300094

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous