http_user_agent: mpm prefilter engine

src/detect-engine-hua.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2012 Open Information Security Foundation
+/* Copyright (C) 2007-2016 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -25,6 +25,7 @@
 /** \file
  *
  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
+ * \author Victor Julien <victor@inliniac.net>
  *
  * \brief Handle HTTP user agent match
  *
@@ -40,6 +41,7 @@
 #include "detect-parse.h"
 #include "detect-engine-state.h"
 #include "detect-engine-content-inspection.h"
+#include "detect-engine-prefilter.h"
 
 #include "flow-util.h"
 #include "util-debug.h"
@@ -59,51 +61,49 @@
 #include "detect-engine-hua.h"
 #include "util-validate.h"
 
-/**
- * \brief Http user agent match -- searches for one pattern per signature.
- *
- * \param det_ctx    Detection engine thread ctx.
- * \param ua         User-Agent to inspect.
- * \param ua_len     User-Agent buffer length.
+/** \brief HTTP UA Mpm prefilter callback
  *
- *  \retval ret Number of matches.
+ *  \param det_ctx detection engine thread ctx
+ *  \param p packet to inspect
+ *  \param f flow to inspect
+ *  \param txv tx to inspect
+ *  \param pectx inspection context
  */
-static inline uint32_t HttpUAPatternSearch(DetectEngineThreadCtx *det_ctx,
-        const uint8_t *ua, const uint32_t ua_len)
+static void PrefilterTxUA(DetectEngineThreadCtx *det_ctx, const void *pectx,
+        Packet *p, Flow *f, void *txv,
+        const uint64_t idx, const uint8_t flags)
 {
     SCEnter();
 
-    uint32_t ret = 0;
+    const MpmCtx *mpm_ctx = (MpmCtx *)pectx;
+    htp_tx_t *tx = (htp_tx_t *)txv;
 
-    DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_huad_ctx_ts == NULL);
+    if (tx->request_headers == NULL)
+        return;
 
-    if (ua_len >= det_ctx->sgh->mpm_huad_ctx_ts->minlen) {
-        ret = mpm_table[det_ctx->sgh->mpm_huad_ctx_ts->mpm_type].
-            Search(det_ctx->sgh->mpm_huad_ctx_ts, &det_ctx->mtcu,
-                    &det_ctx->pmq, ua, ua_len);
+    htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
+                                                      "User-Agent");
+    if (h == NULL || h->value == NULL) {
+        SCLogDebug("HTTP UA header not present in this request");
+        return;
     }
 
-    SCReturnUInt(ret);
+    const uint32_t buffer_len = bstr_len(h->value);
+    const uint8_t *buffer = bstr_ptr(h->value);
+
+    if (buffer_len >= mpm_ctx->minlen) {
+        (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
+                &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len);
+    }
 }
 
-int DetectEngineRunHttpUAMpm(DetectEngineThreadCtx *det_ctx, void *txv)
+int PrefilterTxUARegister(SigGroupHead *sgh, MpmCtx *mpm_ctx)
 {
-    uint32_t cnt = 0;
-    htp_tx_t *tx = (htp_tx_t *)txv;
-    if (tx->request_headers == NULL)
-        goto end;
+    SCEnter();
 
-    htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
-                                                      "User-Agent");
-    if (h == NULL) {
-        SCLogDebug("HTTP user agent header not present in this request");
-        goto end;
-    }
-    cnt = HttpUAPatternSearch(det_ctx,
-                              (const uint8_t *)bstr_ptr(h->value),
-                              bstr_len(h->value));
- end:
-    return cnt;
+    return PrefilterAppendTxEngine(sgh, PrefilterTxUA,
+        ALPROTO_HTTP, HTP_REQUEST_HEADERS,
+        mpm_ctx, NULL);
 }
 
 /**

src/detect-engine-hua.h

@@ -25,6 +25,8 @@
 
 #include "app-layer-htp.h"
 
+int PrefilterTxUARegister(SigGroupHead *sgh, MpmCtx *mpm_ctx);
+
 int DetectEngineInspectHttpUA(ThreadVars *tv,
                               DetectEngineCtx *de_ctx,
                               DetectEngineThreadCtx *det_ctx,
@@ -32,8 +34,6 @@ int DetectEngineInspectHttpUA(ThreadVars *tv,
                               void *alstate,
                               void *tx, uint64_t tx_id);
 
-int DetectEngineRunHttpUAMpm(DetectEngineThreadCtx *det_ctx, void *txv);
-
 void DetectEngineHttpUARegisterTests(void);
 
 #endif /* __DETECT_ENGINE_HUA_H__ */

src/detect-engine-mpm.c

@@ -53,6 +53,7 @@
 #include "detect-engine-hrud.h"
 #include "detect-engine-hmd.h"
 #include "detect-engine-hcd.h"
+#include "detect-engine-hua.h"
 #include "detect-engine-dns.h"
 
 #include "stream.h"
@@ -94,7 +95,8 @@ AppLayerMpms app_mpms[] = {
     { "http_header", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHDMATCH, SIG_GROUP_HEAD_MPM_HHD, NULL, 2},
     { "http_header", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HHDMATCH, SIG_GROUP_HEAD_MPM_HHD, NULL, 3},
 
-    { "http_user_agent", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HUADMATCH, SIG_GROUP_HEAD_MPM_HUAD, NULL, 4},
+    { "http_user_agent", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HUADMATCH,
+        SIG_GROUP_HEAD_MPM_HUAD, PrefilterTxUARegister, 4},
 
     { "http_raw_header", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHDMATCH, SIG_GROUP_HEAD_MPM_HRHD, NULL, 5},
     { "http_raw_header", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HRHDMATCH, SIG_GROUP_HEAD_MPM_HRHD, NULL, 6},

src/detect.c

@@ -913,11 +913,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
                             DetectEngineRunHttpHRHMpm(det_ctx, tx);
                             PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRHHD);
                         }
-                        if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HUAD) {
-                            PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HUAD);
-                            DetectEngineRunHttpUAMpm(det_ctx, tx);
-                            PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HUAD);
-                        }
                         if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HHD) {
                             PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HHD);
                             DetectEngineRunHttpHeaderMpm(det_ctx, p->flow, alstate, flags, tx, idx);