From dd5c156d9e033cfa1bcd9b12f2e22f6704289992 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Mon, 4 Mar 2019 13:25:46 +0100 Subject: [PATCH] http: backport new events --- rules/http-events.rules | 28 ++++++++++++++++++++++++- src/app-layer-htp.c | 45 +++++++++++++++++++++++++++++++++++++++++ src/app-layer-htp.h | 15 ++++++++++++++ 3 files changed, 87 insertions(+), 1 deletion(-) diff --git a/rules/http-events.rules b/rules/http-events.rules index cbc9f74587..279f0eea6d 100644 --- a/rules/http-events.rules +++ b/rules/http-events.rules @@ -52,7 +52,33 @@ alert http any any -> any any (msg:"SURICATA HTTP Request line with leading whit alert http any any -> any any (msg:"SURICATA HTTP Request too many encoding layers"; flow:established,to_server; app-layer-event:http.too_many_encoding_layers; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221032; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP Request abnormal Content-Encoding header"; flow:established,to_server; app-layer-event:http.abnormal_ce_header; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221033; rev:1;) +alert http any any -> any any (msg:"SURICATA HTTP Request unrecognized authorization method"; flow:established,to_server; app-layer-event:http.request_auth_unrecognized; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221034; rev:1;) + +alert http any any -> any any (msg:"SURICATA HTTP Request excessive header repetition"; flow:established,to_server; app-layer-event:http.request_header_repetition; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221035; rev:1;) +alert http any any -> any any (msg:"SURICATA HTTP Response excessive header repetition"; flow:established,to_client; app-layer-event:http.response_header_repetition; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221036; rev:1;) + +# This is a suricata limitation rather than anomaly traffic +# alert http any any -> any any (msg:"SURICATA HTTP Response multipart/byteranges"; flow:established,to_client; app-layer-event:http.response_multipart_byteranges; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221037; rev:1;) + +alert http any any -> any any (msg:"SURICATA HTTP Response abnormal chunked for transfer-encoding"; flow:established,to_client; app-layer-event:http.response_abnormal_transfer_encoding; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221038; rev:1;) + +alert http any any -> any any (msg:"SURICATA HTTP Response chunked with HTTP 0.9 or 1.0"; flow:established,to_client; app-layer-event:http.response_chunked_old_proto; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221039; rev:1;) + +alert http any any -> any any (msg:"SURICATA HTTP Response invalid protocol"; flow:established,to_client; app-layer-event:http.response_invalid_protocol; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221040; rev:1;) +alert http any any -> any any (msg:"SURICATA HTTP Response invalid status"; flow:established,to_client; app-layer-event:http.response_invalid_status; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221041; rev:1;) + +alert http any any -> any any (msg:"SURICATA HTTP Request line incomplete"; flow:established,to_server; app-layer-event:http.request_line_incomplete; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221042; rev:1;) + +alert http any any -> any any (msg:"SURICATA HTTP Request double encoded URI"; flow:established,to_server; app-layer-event:http.double_encoded_uri; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221043; rev:1;) + +alert http any any -> any any (msg:"SURICATA HTTP Invalid Request line"; flow:established,to_server; app-layer-event:http.request_line_invalid; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221044; rev:1;) +alert http any any -> any any (msg:"SURICATA HTTP Unexpected Request body"; flow:established,to_server; app-layer-event:http.request_body_unexpected; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221045; rev:1;) alert http any any -> any any (msg:"SURICATA HTTP LZMA reached its memory limit"; flow:established; app-layer-event:http.lzma_memlimit_reached; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221046; rev:1;) -# next sid 2221047 +alert http any any -> any any (msg:"SURICATA HTTP duplicate content length field in request"; flow:established,to_server; app-layer-event:http.duplicate_content_length_field_in_request; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221047; rev:1;) +alert http any any -> any any (msg:"SURICATA HTTP duplicate content length field in response"; flow:established,to_client; app-layer-event:http.duplicate_content_length_field_in_response; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221048; rev:1;) + +alert http any any -> any any (msg:"SURICATA HTTP compression bomb"; flow:established; app-layer-event:http.compression_bomb; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221049; rev:1;) + +# next sid 2221050 diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c index 8681a77217..fc508c87f1 100644 --- a/src/app-layer-htp.c +++ b/src/app-layer-htp.c @@ -114,6 +114,10 @@ SCEnumCharMap http_decoder_event_table[ ] = { HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST}, { "INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE", HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE}, + { "DUPLICATE_CONTENT_LENGTH_FIELD_IN_REQUEST", + HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_REQUEST}, + { "DUPLICATE_CONTENT_LENGTH_FIELD_IN_RESPONSE", + HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_RESPONSE}, { "100_CONTINUE_ALREADY_SEEN", HTTP_DECODER_EVENT_100_CONTINUE_ALREADY_SEEN}, { "UNABLE_TO_MATCH_RESPONSE_TO_REQUEST", @@ -138,12 +142,24 @@ SCEnumCharMap http_decoder_event_table[ ] = { HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG}, { "RESPONSE_FIELD_TOO_LONG", HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG}, + { "REQUEST_LINE_INVALID", + HTTP_DECODER_EVENT_REQUEST_LINE_INVALID}, + { "REQUEST_BODY_UNEXPECTED", + HTTP_DECODER_EVENT_REQUEST_BODY_UNEXPECTED}, { "REQUEST_SERVER_PORT_TCP_PORT_MISMATCH", HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH}, { "REQUEST_URI_HOST_INVALID", HTTP_DECODER_EVENT_URI_HOST_INVALID}, { "REQUEST_HEADER_HOST_INVALID", HTTP_DECODER_EVENT_HEADER_HOST_INVALID}, + { "REQUEST_AUTH_UNRECOGNIZED", + HTTP_DECODER_EVENT_AUTH_UNRECOGNIZED}, + { "REQUEST_HEADER_REPETITION", + HTTP_DECODER_EVENT_REQUEST_HEADER_REPETITION}, + { "RESPONSE_HEADER_REPETITION", + HTTP_DECODER_EVENT_RESPONSE_HEADER_REPETITION}, + { "DOUBLE_ENCODED_URI", + HTTP_DECODER_EVENT_DOUBLE_ENCODED_URI}, { "URI_DELIM_NON_COMPLIANT", HTTP_DECODER_EVENT_URI_DELIM_NON_COMPLIANT}, { "METHOD_DELIM_NON_COMPLIANT", @@ -154,6 +170,23 @@ SCEnumCharMap http_decoder_event_table[ ] = { HTTP_DECODER_EVENT_TOO_MANY_ENCODING_LAYERS}, { "ABNORMAL_CE_HEADER", HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER}, + { "RESPONSE_MULTIPART_BYTERANGES", + HTTP_DECODER_EVENT_RESPONSE_MULTIPART_BYTERANGES}, + { "RESPONSE_ABNORMAL_TRANSFER_ENCODING", + HTTP_DECODER_EVENT_RESPONSE_ABNORMAL_TRANSFER_ENCODING}, + { "RESPONSE_CHUNKED_OLD_PROTO", + HTTP_DECODER_EVENT_RESPONSE_CHUNKED_OLD_PROTO}, + { "RESPONSE_INVALID_PROTOCOL", + HTTP_DECODER_EVENT_RESPONSE_INVALID_PROTOCOL}, + { "RESPONSE_INVALID_STATUS", + HTTP_DECODER_EVENT_RESPONSE_INVALID_STATUS}, + { "REQUEST_LINE_INCOMPLETE", + HTTP_DECODER_EVENT_REQUEST_LINE_INCOMPLETE}, + + { "LZMA_MEMLIMIT_REACHED", + HTTP_DECODER_EVENT_LZMA_MEMLIMIT_REACHED}, + { "COMPRESSION_BOMB", + HTTP_DECODER_EVENT_COMPRESSION_BOMB}, { "LZMA_MEMLIMIT_REACHED", HTTP_DECODER_EVENT_LZMA_MEMLIMIT_REACHED}, @@ -488,6 +521,8 @@ struct { /* { "Invalid authority port", HTTP_DECODER_EVENT_INVALID_AUTHORITY_PORT}, htp no longer returns this error */ { "Request buffer over", HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG}, { "Response buffer over", HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG}, + { "C-T multipart/byteranges in responses not supported", HTTP_DECODER_EVENT_RESPONSE_MULTIPART_BYTERANGES}, + { "Compression bomb:", HTTP_DECODER_EVENT_COMPRESSION_BOMB}, }; struct { @@ -514,7 +549,17 @@ struct { { "C-E gzip has abnormal value", HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER}, { "C-E deflate has abnormal value", HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER}, { "C-E unknown setting", HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER}, + { "Excessive request header repetitions", HTTP_DECODER_EVENT_REQUEST_HEADER_REPETITION}, + { "Excessive response header repetitions", HTTP_DECODER_EVENT_RESPONSE_HEADER_REPETITION}, + { "Transfer-encoding has abnormal chunked value", HTTP_DECODER_EVENT_RESPONSE_ABNORMAL_TRANSFER_ENCODING}, + { "Chunked transfer-encoding on HTTP/0.9 or HTTP/1.0", HTTP_DECODER_EVENT_RESPONSE_CHUNKED_OLD_PROTO}, + { "Invalid response line: invalid protocol", HTTP_DECODER_EVENT_RESPONSE_INVALID_PROTOCOL}, + { "Invalid response line: invalid response status", HTTP_DECODER_EVENT_RESPONSE_INVALID_STATUS}, + { "Request line incomplete", HTTP_DECODER_EVENT_REQUEST_LINE_INCOMPLETE}, + { "Unexpected request body", HTTP_DECODER_EVENT_REQUEST_BODY_UNEXPECTED}, { "LZMA decompressor: memory limit reached", HTTP_DECODER_EVENT_LZMA_MEMLIMIT_REACHED}, + { "Ambiguous request C-L value", HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_REQUEST}, + { "Ambiguous response C-L value", HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_RESPONSE}, }; #define HTP_ERROR_MAX (sizeof(htp_errors) / sizeof(htp_errors[0])) diff --git a/src/app-layer-htp.h b/src/app-layer-htp.h index 681a7aae22..54afdd9422 100644 --- a/src/app-layer-htp.h +++ b/src/app-layer-htp.h @@ -89,6 +89,8 @@ enum { HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_RESPONSE, HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST, HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE, + HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_REQUEST, + HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_RESPONSE, HTTP_DECODER_EVENT_100_CONTINUE_ALREADY_SEEN, HTTP_DECODER_EVENT_UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, HTTP_DECODER_EVENT_INVALID_SERVER_PORT_IN_REQUEST, @@ -109,8 +111,21 @@ enum { HTTP_DECODER_EVENT_REQUEST_LINE_LEADING_WHITESPACE, HTTP_DECODER_EVENT_TOO_MANY_ENCODING_LAYERS, HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER, + HTTP_DECODER_EVENT_AUTH_UNRECOGNIZED, + HTTP_DECODER_EVENT_REQUEST_HEADER_REPETITION, + HTTP_DECODER_EVENT_RESPONSE_HEADER_REPETITION, + HTTP_DECODER_EVENT_RESPONSE_MULTIPART_BYTERANGES, + HTTP_DECODER_EVENT_RESPONSE_ABNORMAL_TRANSFER_ENCODING, + HTTP_DECODER_EVENT_RESPONSE_CHUNKED_OLD_PROTO, + HTTP_DECODER_EVENT_RESPONSE_INVALID_PROTOCOL, + HTTP_DECODER_EVENT_RESPONSE_INVALID_STATUS, + HTTP_DECODER_EVENT_REQUEST_LINE_INCOMPLETE, + HTTP_DECODER_EVENT_DOUBLE_ENCODED_URI, + HTTP_DECODER_EVENT_REQUEST_LINE_INVALID, + HTTP_DECODER_EVENT_REQUEST_BODY_UNEXPECTED, HTTP_DECODER_EVENT_LZMA_MEMLIMIT_REACHED, + HTTP_DECODER_EVENT_COMPRESSION_BOMB, /* suricata errors/warnings */ HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR, -- 2.47.2