From: Victor Julien Date: Sat, 24 Nov 2018 10:16:26 +0000 (+0100) Subject: detect: add http.user_agent sticky buffer X-Git-Tag: suricata-5.0.0-beta1~290 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=123ebb2c41849e10a386cef199978d762866a3d2;p=thirdparty%2Fsuricata.git detect: add http.user_agent sticky buffer --- diff --git a/src/detect-engine-hua.c b/src/detect-engine-hua.c index 1e9cd0c934..613c3bc940 100644 --- a/src/detect-engine-hua.c +++ b/src/detect-engine-hua.c @@ -61,97 +61,6 @@ #include "detect-engine-hua.h" #include "util-validate.h" -/** \brief HTTP UA Mpm prefilter callback - * - * \param det_ctx detection engine thread ctx - * \param p packet to inspect - * \param f flow to inspect - * \param txv tx to inspect - * \param pectx inspection context - */ -static void PrefilterTxUA(DetectEngineThreadCtx *det_ctx, const void *pectx, - Packet *p, Flow *f, void *txv, - const uint64_t idx, const uint8_t flags) -{ - SCEnter(); - - const MpmCtx *mpm_ctx = (MpmCtx *)pectx; - htp_tx_t *tx = (htp_tx_t *)txv; - - if (tx->request_headers == NULL) - return; - - htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, - "User-Agent"); - if (h == NULL || h->value == NULL) { - SCLogDebug("HTTP UA header not present in this request"); - return; - } - - const uint32_t buffer_len = bstr_len(h->value); - const uint8_t *buffer = bstr_ptr(h->value); - - if (buffer_len >= mpm_ctx->minlen) { - (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, - &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); - } -} - -int PrefilterTxUARegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx) -{ - SCEnter(); - - return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxUA, - ALPROTO_HTTP, HTP_REQUEST_HEADERS, - mpm_ctx, NULL, "http_user_agent"); -} - -/** - * \brief Do the http_user_agent content inspection for a signature. - * - * \param de_ctx Detection engine context. - * \param det_ctx Detection engine thread context. - * \param s Signature to inspect. - * \param f Flow. - * \param flags App layer flags. - * \param state App layer state. - * - * \retval 0 No match. - * \retval 1 Match. - */ -int DetectEngineInspectHttpUA(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) -{ - htp_tx_t *tx = (htp_tx_t *)txv; - htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, - "User-Agent"); - if (h == NULL) { - SCLogDebug("HTTP user agent header not present in this request"); - goto end; - } - - det_ctx->buffer_offset = 0; - det_ctx->discontinue_matching = 0; - det_ctx->inspection_recursion_counter = 0; - int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd, - f, - (uint8_t *)bstr_ptr(h->value), - bstr_len(h->value), - 0, DETECT_CI_FLAGS_SINGLE, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); - if (r == 1) - return DETECT_ENGINE_INSPECT_SIG_MATCH; - - end: - if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_REQUEST_HEADERS) - return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; - else - return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; -} - /***********************************Unittests**********************************/ #ifdef UNITTESTS diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index e9585ef38b..462e87332b 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -133,6 +133,7 @@ enum { DETECT_AL_HTTP_STAT_MSG, DETECT_AL_HTTP_STAT_CODE, DETECT_AL_HTTP_USER_AGENT, + DETECT_HTTP_UA, DETECT_AL_HTTP_HOST, DETECT_AL_HTTP_RAW_HOST, DETECT_AL_HTTP_REQUEST_LINE, diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c index 1e43f48ee8..30432c7c17 100644 --- a/src/detect-http-ua.c +++ b/src/detect-http-ua.c @@ -39,6 +39,7 @@ #include "detect-engine.h" #include "detect-engine-mpm.h" #include "detect-engine-state.h" +#include "detect-engine-prefilter.h" #include "detect-content.h" #include "detect-pcre.h" @@ -62,26 +63,39 @@ static int DetectHttpUASetup(DetectEngineCtx *, Signature *, const char *); static void DetectHttpUARegisterTests(void); static int g_http_ua_buffer_id = 0; +static int DetectHttpUserAgentSetup(DetectEngineCtx *, Signature *, const char *); +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, + Flow *_f, const uint8_t _flow_flags, + void *txv, const int list_id); /** * \brief Registers the keyword handlers for the "http_user_agent" keyword. */ void DetectHttpUARegister(void) { + /* http_user_agent content modifier */ sigmatch_table[DETECT_AL_HTTP_USER_AGENT].name = "http_user_agent"; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].desc = "content modifier to match only on the HTTP User-Agent header"; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-user-agent"; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].Setup = DetectHttpUASetup; sigmatch_table[DETECT_AL_HTTP_USER_AGENT].RegisterTests = DetectHttpUARegisterTests; - sigmatch_table[DETECT_AL_HTTP_USER_AGENT].flags |= SIGMATCH_NOOPT; - DetectAppLayerMpmRegister("http_user_agent", SIG_FLAG_TOSERVER, 2, - PrefilterTxUARegister); + /* http.user_agent sticky buffer */ + sigmatch_table[DETECT_HTTP_UA].name = "http.user_agent"; + sigmatch_table[DETECT_HTTP_UA].desc = "sticky buffer to match specifically and only on the HTTP User Agent buffer"; + sigmatch_table[DETECT_HTTP_UA].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-user-agent"; + sigmatch_table[DETECT_HTTP_UA].Setup = DetectHttpUserAgentSetup; + sigmatch_table[DETECT_HTTP_UA].flags |= SIGMATCH_NOOPT; + + DetectAppLayerInspectEngineRegister2("http_user_agent", ALPROTO_HTTP, + SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS, + DetectEngineInspectBufferGeneric, GetData); - DetectAppLayerInspectEngineRegister("http_user_agent", - ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS, - DetectEngineInspectHttpUA); + DetectAppLayerMpmRegister2("http_user_agent", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP, + HTP_REQUEST_HEADERS); DetectBufferTypeSetDescriptionByName("http_user_agent", "http user agent"); @@ -110,6 +124,51 @@ int DetectHttpUASetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg) ALPROTO_HTTP); } +/** + * \brief this function setup the http.user_agent keyword used in the rule + * + * \param de_ctx Pointer to the Detection Engine Context + * \param s Pointer to the Signature to which the current keyword belongs + * \param str Should hold an empty string always + * + * \retval 0 On success + */ +static int DetectHttpUserAgentSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str) +{ + if (DetectBufferSetActiveList(s, g_http_ua_buffer_id) < 0) + return -1; + if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0) + return -1; + return 0; +} + +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id) +{ + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + htp_tx_t *tx = (htp_tx_t *)txv; + + if (tx->request_headers == NULL) + return NULL; + + htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, + "User-Agent"); + if (h == NULL || h->value == NULL) { + SCLogDebug("HTTP UA header not present in this request"); + return NULL; + } + + const uint32_t data_len = bstr_len(h->value); + const uint8_t *data = bstr_ptr(h->value); + + InspectionBufferSetup(buffer, data, data_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + + return buffer; +} /************************************Unittests*********************************/ #ifdef UNITTESTS