From: Victor Julien Date: Mon, 26 Nov 2018 12:02:12 +0000 (+0100) Subject: detect/http_stat_code: use inspect v2 api X-Git-Tag: suricata-5.0.0-beta1~267 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=382fa2e81d5457841322cb0b0d497d3dba1672bd;p=thirdparty%2Fsuricata.git detect/http_stat_code: use inspect v2 api --- diff --git a/src/detect-engine-hscd.c b/src/detect-engine-hscd.c index 1fcd21251c..1507e84e8b 100644 --- a/src/detect-engine-hscd.c +++ b/src/detect-engine-hscd.c @@ -57,88 +57,6 @@ #include "app-layer-protos.h" #include "util-validate.h" -/** \brief HTTP Status Code Mpm prefilter callback - * - * \param det_ctx detection engine thread ctx - * \param p packet to inspect - * \param f flow to inspect - * \param txv tx to inspect - * \param pectx inspection context - */ -static void PrefilterTxHttpStatCode(DetectEngineThreadCtx *det_ctx, - const void *pectx, - Packet *p, Flow *f, void *txv, - const uint64_t idx, const uint8_t flags) -{ - SCEnter(); - - const MpmCtx *mpm_ctx = (MpmCtx *)pectx; - htp_tx_t *tx = (htp_tx_t *)txv; - - if (tx->response_status == NULL) - return; - - const uint32_t buffer_len = bstr_len(tx->response_status); - const uint8_t *buffer = bstr_ptr(tx->response_status); - - if (buffer != NULL && buffer_len >= mpm_ctx->minlen) { - (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, - &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); - } -} - -int PrefilterTxHttpStatCodeRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx) -{ - SCEnter(); - - return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxHttpStatCode, - ALPROTO_HTTP, - HTP_RESPONSE_LINE+1, /* inspect when response line completely parsed */ - mpm_ctx, NULL, "http_stat_code"); -} - -/** - * \brief Do the http_stat_code content inspection for a signature. - * - * \param de_ctx Detection engine context. - * \param det_ctx Detection engine thread context. - * \param s Signature to inspect. - * \param f Flow. - * \param flags App layer flags. - * \param state App layer state. - * - * \retval 0 No match. - * \retval 1 Match. - */ -int DetectEngineInspectHttpStatCode(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id) -{ - htp_tx_t *tx = (htp_tx_t *)txv; - if (tx->response_status == NULL) { - if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) > HTP_RESPONSE_LINE) - return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; - else - return DETECT_ENGINE_INSPECT_SIG_NO_MATCH; - } - - det_ctx->discontinue_matching = 0; - det_ctx->buffer_offset = 0; - det_ctx->inspection_recursion_counter = 0; - int r = DetectEngineContentInspection(de_ctx, det_ctx, s, smd, - f, - (uint8_t *)bstr_ptr(tx->response_status), - bstr_len(tx->response_status), - 0, DETECT_CI_FLAGS_SINGLE, - DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE, NULL); - if (r == 1) - return DETECT_ENGINE_INSPECT_SIG_MATCH; - else - return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH; -} - /***********************************Unittests**********************************/ #ifdef UNITTESTS diff --git a/src/detect-engine-hscd.h b/src/detect-engine-hscd.h index 1a3e066157..90fb9d71df 100644 --- a/src/detect-engine-hscd.h +++ b/src/detect-engine-hscd.h @@ -23,16 +23,6 @@ #ifndef __DETECT_ENGINE_HSCD_H__ #define __DETECT_ENGINE_HSCD_H__ -#include "app-layer-htp.h" - -int PrefilterTxHttpStatCodeRegister(DetectEngineCtx *de_ctx, - SigGroupHead *sgh, MpmCtx *mpm_ctx); - -int DetectEngineInspectHttpStatCode(ThreadVars *tv, - DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, - const Signature *s, const SigMatchData *smd, - Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id); - void DetectEngineHttpStatCodeRegisterTests(void); #endif /* __DETECT_ENGINE_HSCD_H__ */ diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c index 4827796090..a2ef823eb1 100644 --- a/src/detect-http-stat-code.c +++ b/src/detect-http-stat-code.c @@ -42,6 +42,7 @@ #include "detect-content.h" #include "detect-pcre.h" #include "detect-engine-mpm.h" +#include "detect-engine-prefilter.h" #include "flow.h" #include "flow-var.h" @@ -67,6 +68,10 @@ static int DetectHttpStatCodeSetup(DetectEngineCtx *, Signature *, const char *) static void DetectHttpStatCodeRegisterTests(void); static int g_http_stat_code_buffer_id = 0; +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id); + /** * \brief Registration function for keyword: http_stat_code */ @@ -80,12 +85,13 @@ void DetectHttpStatCodeRegister (void) sigmatch_table[DETECT_AL_HTTP_STAT_CODE].flags |= SIGMATCH_NOOPT; - DetectAppLayerMpmRegister("http_stat_code", SIG_FLAG_TOCLIENT, 4, - PrefilterTxHttpStatCodeRegister); + DetectAppLayerInspectEngineRegister2("http_stat_code", ALPROTO_HTTP, + SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE, + DetectEngineInspectBufferGeneric, GetData); - DetectAppLayerInspectEngineRegister("http_stat_code", - ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE, - DetectEngineInspectHttpStatCode); + DetectAppLayerMpmRegister2("http_stat_code", SIG_FLAG_TOCLIENT, 4, + PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP, + HTP_RESPONSE_LINE); DetectBufferTypeSetDescriptionByName("http_stat_code", "http response status code"); @@ -112,6 +118,29 @@ static int DetectHttpStatCodeSetup(DetectEngineCtx *de_ctx, Signature *s, const ALPROTO_HTTP); } +static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, + const uint8_t _flow_flags, void *txv, const int list_id) +{ + SCEnter(); + + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + htp_tx_t *tx = (htp_tx_t *)txv; + + if (tx->response_status == NULL) + return NULL; + + const uint32_t data_len = bstr_len(tx->response_status); + const uint8_t *data = bstr_ptr(tx->response_status); + + InspectionBufferSetup(buffer, data, data_len); + InspectionBufferApplyTransforms(buffer, transforms); + } + + return buffer; +} + #ifdef UNITTESTS /**