http2: http.uri keyword now works for HTTP2

cf #4067

(cherry picked from commit a98d0fe6edcd6bd5af460c067caca3021f543587)

diff --git a/rust/src/http2/detect.rs b/rust/src/http2/detect.rs
index 59180263231e2c7cccd07fe85e5346cb0680cc3b..7d339f2b1c738f61dc19aa1958c545631ba25f27 100644 (file)
--- a/rust/src/http2/detect.rs
+++ b/rust/src/http2/detect.rs
@@ -478,6 +478,56 @@ pub unsafe extern "C" fn rs_http2_tx_get_header_name(
     return 0;
 }
 
+fn http2_blocks_get_header_value<'a>(
+    blocks: &'a Vec<parser::HTTP2FrameHeaderBlock>, name: &str,
+) -> Result<&'a [u8], ()> {
+    for j in 0..blocks.len() {
+        if blocks[j].name == name.as_bytes().to_vec() {
+            return Ok(&blocks[j].value);
+        }
+    }
+    return Err(());
+}
+
+fn http2_frames_get_header_value<'a>(
+    frames: &'a Vec<HTTP2Frame>, name: &str,
+) -> Result<&'a [u8], ()> {
+    for i in 0..frames.len() {
+        match &frames[i].data {
+            HTTP2FrameTypeData::HEADERS(hd) => {
+                if let Ok(value) = http2_blocks_get_header_value(&hd.blocks, name) {
+                    return Ok(value);
+                }
+            }
+            HTTP2FrameTypeData::PUSHPROMISE(hd) => {
+                if let Ok(value) = http2_blocks_get_header_value(&hd.blocks, name) {
+                    return Ok(value);
+                }
+            }
+            HTTP2FrameTypeData::CONTINUATION(hd) => {
+                if let Ok(value) = http2_blocks_get_header_value(&hd.blocks, name) {
+                    return Ok(value);
+                }
+            }
+            _ => {}
+        }
+    }
+
+    return Err(());
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn rs_http2_tx_get_uri(
+    tx: &mut HTTP2Transaction, buffer: *mut *const u8, buffer_len: *mut u32,
+) -> u8 {
+    if let Ok(value) = http2_frames_get_header_value(&tx.frames_ts, ":path") {
+        *buffer = value.as_ptr(); //unsafe
+        *buffer_len = value.len() as u32;
+        return 1;
+    }
+    return 0;
+}
+
 fn http2_escape_header(hd: &parser::HTTP2FrameHeaders, i: u32) -> Vec<u8> {
     //minimum size + 2 for escapes
     let normalsize = hd.blocks[i as usize].value.len() + 2 + hd.blocks[i as usize].name.len() + 2;

diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c
index 3264f93861fa78fab1ce32136ac8bbda63f28b11..d2bccf2bdf5244eaf9a2c9a43abe221e8f48e694 100644 (file)
--- a/src/detect-http-uri.c
+++ b/src/detect-http-uri.c
@@ -68,6 +68,9 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const DetectEngineTransforms *transforms,
         Flow *_f, const uint8_t _flow_flags,
         void *txv, const int list_id);
+static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
+        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
+        const int list_id);
 static int DetectHttpUriSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str);
 static int DetectHttpRawUriSetup(DetectEngineCtx *, Signature *, const char *);
 static void DetectHttpRawUriSetupCallback(const DetectEngineCtx *de_ctx,
@@ -114,6 +117,12 @@ void DetectHttpUriRegister (void)
             PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP,
             HTP_REQUEST_LINE);
 
+    DetectAppLayerInspectEngineRegister2("http_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
+            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
+
+    DetectAppLayerMpmRegister2("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
+            GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);
+
     DetectBufferTypeSetDescriptionByName("http_uri",
             "http request uri");
 
@@ -235,6 +244,29 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
     return buffer;
 }
 
+static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
+        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
+        const int list_id)
+{
+    SCEnter();
+
+    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
+    if (buffer->inspect == NULL) {
+        uint32_t b_len = 0;
+        const uint8_t *b = NULL;
+
+        if (rs_http2_tx_get_uri(txv, &b, &b_len) != 1)
+            return NULL;
+        if (b == NULL || b_len == 0)
+            return NULL;
+
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
+        InspectionBufferApplyTransforms(buffer, transforms);
+    }
+
+    return buffer;
+}
+
 /**
  * \brief Sets up the http_raw_uri modifier keyword.
  *