diff --git a/src/detect-engine-hscd.c b/src/detect-engine-hscd.c index 40513addc3..016395a372 100644 --- a/src/detect-engine-hscd.c +++ b/src/detect-engine-hscd.c @@ -340,7 +340,7 @@ match: * \retval cnt Number of matches reported by the mpm algo. */ int DetectEngineRunHttpStatCodeMpm(DetectEngineThreadCtx *det_ctx, Flow *f, - HtpState *htp_state) + HtpState *htp_state, uint8_t flags) { SCEnter(); @@ -374,7 +374,7 @@ int DetectEngineRunHttpStatCodeMpm(DetectEngineThreadCtx *det_ctx, Flow *f, cnt += HttpStatCodePatternSearch(det_ctx, (uint8_t *)bstr_ptr(tx->response_status), - bstr_len(tx->response_status)); + bstr_len(tx->response_status), flags); } end: diff --git a/src/detect-engine-hscd.h b/src/detect-engine-hscd.h index aea47f171a..29663f383c 100644 --- a/src/detect-engine-hscd.h +++ b/src/detect-engine-hscd.h @@ -26,7 +26,7 @@ #include "app-layer-htp.h" int DetectEngineRunHttpStatCodeMpm(DetectEngineThreadCtx *, - Flow *f, HtpState *); + Flow *f, HtpState *, uint8_t); int DetectEngineInspectHttpStatCode(DetectEngineCtx *, DetectEngineThreadCtx *, Signature *, Flow *, uint8_t, void *); void DetectEngineHttpStatCodeRegisterTests(void); diff --git a/src/detect-engine-hsmd.c b/src/detect-engine-hsmd.c index 2b156bf1a9..fb7ed6a228 100644 --- a/src/detect-engine-hsmd.c +++ b/src/detect-engine-hsmd.c @@ -340,7 +340,7 @@ match: * \retval cnt Number of matches reported by the mpm algo. */ int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, Flow *f, - HtpState *htp_state) + HtpState *htp_state, uint8_t flags) { SCEnter(); @@ -374,7 +374,7 @@ int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *det_ctx, Flow *f, cnt += HttpStatMsgPatternSearch(det_ctx, (uint8_t *)bstr_ptr(tx->response_message), - bstr_len(tx->response_message)); + bstr_len(tx->response_message), flags); } end: diff --git a/src/detect-engine-hsmd.h b/src/detect-engine-hsmd.h index 90ac871753..e80eb95701 100644 --- a/src/detect-engine-hsmd.h +++ b/src/detect-engine-hsmd.h @@ -26,9 +26,9 @@ #include "app-layer-htp.h" int DetectEngineRunHttpStatMsgMpm(DetectEngineThreadCtx *, - Flow *f, HtpState *); + Flow *f, HtpState *, uint8_t); int DetectEngineInspectHttpStatMsg(DetectEngineCtx *, DetectEngineThreadCtx *, - Signature *, Flow *, uint8_t, void *); + Signature *, Flow *, uint8_t, void *); void DetectEngineHttpStatMsgRegisterTests(void); #endif /* __DETECT_ENGINE_HSMD_H__ */ diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index fb274ef06f..857824cc10 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -534,17 +534,26 @@ uint32_t HttpRawUriPatternSearch(DetectEngineThreadCtx *det_ctx, * \retval ret Number of matches. */ uint32_t HttpStatMsgPatternSearch(DetectEngineThreadCtx *det_ctx, - uint8_t *stat_msg, uint32_t stat_msg_len) + uint8_t *stat_msg, uint32_t stat_msg_len, uint8_t flags) { SCEnter(); - if (det_ctx->sgh->mpm_hsmd_ctx == NULL) - SCReturnUInt(0); - uint32_t ret; - ret = mpm_table[det_ctx->sgh->mpm_hsmd_ctx->mpm_type]. - Search(det_ctx->sgh->mpm_hsmd_ctx, &det_ctx->mtcu, - &det_ctx->pmq, stat_msg, stat_msg_len); + if (flags & STREAM_TOSERVER) { + if (det_ctx->sgh->mpm_hsmd_ctx_ts == NULL) + SCReturnUInt(0); + + ret = mpm_table[det_ctx->sgh->mpm_hsmd_ctx_ts->mpm_type]. + Search(det_ctx->sgh->mpm_hsmd_ctx_ts, &det_ctx->mtcu, + &det_ctx->pmq, stat_msg, stat_msg_len); + } else { + if (det_ctx->sgh->mpm_hsmd_ctx_tc == NULL) + SCReturnUInt(0); + + ret = mpm_table[det_ctx->sgh->mpm_hsmd_ctx_tc->mpm_type]. + Search(det_ctx->sgh->mpm_hsmd_ctx_tc, &det_ctx->mtcu, + &det_ctx->pmq, stat_msg, stat_msg_len); + } SCReturnUInt(ret); } @@ -559,17 +568,26 @@ uint32_t HttpStatMsgPatternSearch(DetectEngineThreadCtx *det_ctx, * \retval ret Number of matches. */ uint32_t HttpStatCodePatternSearch(DetectEngineThreadCtx *det_ctx, - uint8_t *stat_code, uint32_t stat_code_len) + uint8_t *stat_code, uint32_t stat_code_len, uint8_t flags) { SCEnter(); - if (det_ctx->sgh->mpm_hscd_ctx == NULL) - SCReturnUInt(0); - uint32_t ret; - ret = mpm_table[det_ctx->sgh->mpm_hscd_ctx->mpm_type]. - Search(det_ctx->sgh->mpm_hscd_ctx, &det_ctx->mtcu, - &det_ctx->pmq, stat_code, stat_code_len); + if (flags & STREAM_TOSERVER) { + if (det_ctx->sgh->mpm_hscd_ctx_ts == NULL) + SCReturnUInt(0); + + ret = mpm_table[det_ctx->sgh->mpm_hscd_ctx_ts->mpm_type]. + Search(det_ctx->sgh->mpm_hscd_ctx_ts, &det_ctx->mtcu, + &det_ctx->pmq, stat_code, stat_code_len); + } else { + if (det_ctx->sgh->mpm_hscd_ctx_tc == NULL) + SCReturnUInt(0); + + ret = mpm_table[det_ctx->sgh->mpm_hscd_ctx_tc->mpm_type]. + Search(det_ctx->sgh->mpm_hscd_ctx_tc, &det_ctx->mtcu, + &det_ctx->pmq, stat_code, stat_code_len); + } SCReturnUInt(ret); } @@ -1295,11 +1313,17 @@ static void PopulateMpmAddPatternToMpm(DetectEngineCtx *de_ctx, sgh_flags = SIG_GROUP_HEAD_MPM_HRUD; cd_flags = DETECT_CONTENT_HRUD_MPM; } else if (mpm_sm->type == DETECT_AL_HTTP_STAT_MSG) { - mpm_ctx = sgh->mpm_hsmd_ctx; + if (s->flags & SIG_FLAG_TOSERVER) + mpm_ctx_ts = sgh->mpm_hsmd_ctx_ts; + if (s->flags & SIG_FLAG_TOCLIENT) + mpm_ctx_tc = sgh->mpm_hsmd_ctx_tc; sgh_flags = SIG_GROUP_HEAD_MPM_HSMD; cd_flags = DETECT_CONTENT_HSMD_MPM; } else if (mpm_sm->type == DETECT_AL_HTTP_STAT_CODE) { - mpm_ctx = sgh->mpm_hscd_ctx; + if (s->flags & SIG_FLAG_TOSERVER) + mpm_ctx_ts = sgh->mpm_hscd_ctx_ts; + if (s->flags & SIG_FLAG_TOCLIENT) + mpm_ctx_tc = sgh->mpm_hscd_ctx_tc; sgh_flags = SIG_GROUP_HEAD_MPM_HSCD; cd_flags = DETECT_CONTENT_HSCD_MPM; } @@ -1952,37 +1976,45 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) if (sh->flags & SIG_GROUP_HAVEHSMDCONTENT) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hsmd_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hsmd); + sh->mpm_hsmd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hsmd, 0); + sh->mpm_hsmd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hsmd, 1); } else { - sh->mpm_hsmd_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); + sh->mpm_hsmd_ctx_ts = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); + sh->mpm_hsmd_ctx_tc = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1); } - if (sh->mpm_hsmd_ctx == NULL) { + if (sh->mpm_hsmd_ctx_ts == NULL || sh->mpm_hsmd_ctx_tc == NULL) { SCLogDebug("sh->mpm_hsmd_ctx == NULL. This should never happen"); exit(EXIT_FAILURE); } #ifndef __SC_CUDA_SUPPORT__ - MpmInitCtx(sh->mpm_hsmd_ctx, de_ctx->mpm_matcher, -1); + MpmInitCtx(sh->mpm_hsmd_ctx_ts, de_ctx->mpm_matcher, -1); + MpmInitCtx(sh->mpm_hsmd_ctx_tc, de_ctx->mpm_matcher, -1); #else - MpmInitCtx(sh->mpm_hsmd_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle); + MpmInitCtx(sh->mpm_hsmd_ctx_ts, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle); + MpmInitCtx(sh->mpm_hsmd_ctx_tc, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle); #endif } if (sh->flags & SIG_GROUP_HAVEHSCDCONTENT) { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_SINGLE) { - sh->mpm_hscd_ctx = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hscd); + sh->mpm_hscd_ctx_ts = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hscd, 0); + sh->mpm_hscd_ctx_tc = MpmFactoryGetMpmCtxForProfile(de_ctx->sgh_mpm_context_hscd, 1); } else { - sh->mpm_hscd_ctx = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT); + sh->mpm_hscd_ctx_ts = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT, 0); + sh->mpm_hscd_ctx_tc = MpmFactoryGetMpmCtxForProfile(MPM_CTX_FACTORY_UNIQUE_CONTEXT, 1); } - if (sh->mpm_hscd_ctx == NULL) { + if (sh->mpm_hscd_ctx_ts == NULL || sh->mpm_hscd_ctx_tc == NULL) { SCLogDebug("sh->mpm_hscd_ctx == NULL. This should never happen"); exit(EXIT_FAILURE); } #ifndef __SC_CUDA_SUPPORT__ - MpmInitCtx(sh->mpm_hscd_ctx, de_ctx->mpm_matcher, -1); + MpmInitCtx(sh->mpm_hscd_ctx_ts, de_ctx->mpm_matcher, -1); + MpmInitCtx(sh->mpm_hscd_ctx_tc, de_ctx->mpm_matcher, -1); #else - MpmInitCtx(sh->mpm_hscd_ctx, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle); + MpmInitCtx(sh->mpm_hscd_ctx_ts, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle, 0); + MpmInitCtx(sh->mpm_hscd_ctx_tc, de_ctx->mpm_matcher, de_ctx->cuda_rc_mod_handle, 1); #endif } @@ -2299,27 +2331,51 @@ int PatternMatchPrepareGroup(DetectEngineCtx *de_ctx, SigGroupHead *sh) } } } - if (sh->mpm_hsmd_ctx != NULL) { - if (sh->mpm_hsmd_ctx->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(sh->mpm_hsmd_ctx); - sh->mpm_hsmd_ctx = NULL; + if (sh->mpm_hsmd_ctx_ts != NULL) { + if (sh->mpm_hsmd_ctx_ts->pattern_cnt == 0) { + MpmFactoryReClaimMpmCtx(sh->mpm_hsmd_ctx_ts); + sh->mpm_hsmd_ctx_ts = NULL; + } else { + if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL && + sh->flags & SIG_GROUP_HAVEHSMDCONTENT) { + if (mpm_table[sh->mpm_hsmd_ctx_ts->mpm_type].Prepare != NULL) + mpm_table[sh->mpm_hsmd_ctx_ts->mpm_type].Prepare(sh->mpm_hsmd_ctx_ts); + } + } + } + if (sh->mpm_hsmd_ctx_tc != NULL) { + if (sh->mpm_hsmd_ctx_tc->pattern_cnt == 0) { + MpmFactoryReClaimMpmCtx(sh->mpm_hsmd_ctx_tc); + sh->mpm_hsmd_ctx_tc = NULL; } else { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL && sh->flags & SIG_GROUP_HAVEHSMDCONTENT) { - if (mpm_table[sh->mpm_hsmd_ctx->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hsmd_ctx->mpm_type].Prepare(sh->mpm_hsmd_ctx); + if (mpm_table[sh->mpm_hsmd_ctx_tc->mpm_type].Prepare != NULL) + mpm_table[sh->mpm_hsmd_ctx_tc->mpm_type].Prepare(sh->mpm_hsmd_ctx_tc); + } + } + } + if (sh->mpm_hscd_ctx_ts != NULL) { + if (sh->mpm_hscd_ctx_ts->pattern_cnt == 0) { + MpmFactoryReClaimMpmCtx(sh->mpm_hscd_ctx_ts); + sh->mpm_hscd_ctx_ts = NULL; + } else { + if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL && + sh->flags & SIG_GROUP_HAVEHSCDCONTENT) { + if (mpm_table[sh->mpm_hscd_ctx_ts->mpm_type].Prepare != NULL) + mpm_table[sh->mpm_hscd_ctx_ts->mpm_type].Prepare(sh->mpm_hscd_ctx_ts); } } } - if (sh->mpm_hscd_ctx != NULL) { - if (sh->mpm_hscd_ctx->pattern_cnt == 0) { - MpmFactoryReClaimMpmCtx(sh->mpm_hscd_ctx); - sh->mpm_hscd_ctx = NULL; + if (sh->mpm_hscd_ctx_tc != NULL) { + if (sh->mpm_hscd_ctx_tc->pattern_cnt == 0) { + MpmFactoryReClaimMpmCtx(sh->mpm_hscd_ctx_tc); + sh->mpm_hscd_ctx_tc = NULL; } else { if (de_ctx->sgh_mpm_context == ENGINE_SGH_MPM_FACTORY_CONTEXT_FULL && sh->flags & SIG_GROUP_HAVEHSCDCONTENT) { - if (mpm_table[sh->mpm_hscd_ctx->mpm_type].Prepare != NULL) - mpm_table[sh->mpm_hscd_ctx->mpm_type].Prepare(sh->mpm_hscd_ctx); + if (mpm_table[sh->mpm_hscd_ctx_tc->mpm_type].Prepare != NULL) + mpm_table[sh->mpm_hscd_ctx_tc->mpm_type].Prepare(sh->mpm_hscd_ctx_tc); } } } diff --git a/src/detect.c b/src/detect.c index 6594f13906..e33976bf3f 100644 --- a/src/detect.c +++ b/src/detect.c @@ -1212,12 +1212,12 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx, } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSMD) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSMD); - DetectEngineRunHttpStatMsgMpm(det_ctx, p->flow, alstate); + DetectEngineRunHttpStatMsgMpm(det_ctx, p->flow, alstate, flags); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSMD); } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSCD) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSCD); - DetectEngineRunHttpStatCodeMpm(det_ctx, p->flow, alstate); + DetectEngineRunHttpStatCodeMpm(det_ctx, p->flow, alstate, flags); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSCD); } }