diff --git a/src/detect-engine-hmd.c b/src/detect-engine-hmd.c index 391a623b11..72f5c43597 100644 --- a/src/detect-engine-hmd.c +++ b/src/detect-engine-hmd.c @@ -41,6 +41,7 @@ #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" +#include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" @@ -58,45 +59,43 @@ #include "app-layer-protos.h" #include "util-validate.h" -/** - * \brief Http method match -- searches for one pattern per signature. +/** \brief HTTP Method Mpm prefilter callback * - * \param det_ctx Detection engine thread ctx. - * \param method Method to inspect. - * \param method_len Method length. + * \param det_ctx detection engine thread ctx + * \param p packet to inspect + * \param f flow to inspect + * \param txv tx to inspect + * \param pectx inspection context * - * \retval ret Number of matches. + * \retval ret number of matches */ -static inline uint32_t HttpMethodPatternSearch(DetectEngineThreadCtx *det_ctx, - const uint8_t *raw_method, const uint32_t raw_method_len) +static void PrefilterTxMethod(DetectEngineThreadCtx *det_ctx, + const void *pectx, + Packet *p, Flow *f, void *txv, + const uint64_t idx, const uint8_t flags) { SCEnter(); - uint32_t ret = 0; + const MpmCtx *mpm_ctx = (MpmCtx *)pectx; + htp_tx_t *tx = (htp_tx_t *)txv; - DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hmd_ctx_ts == NULL); + if (tx->request_method == NULL) + return; - if (raw_method_len >= det_ctx->sgh->mpm_hmd_ctx_ts->minlen) { - ret = mpm_table[det_ctx->sgh->mpm_hmd_ctx_ts->mpm_type]. - Search(det_ctx->sgh->mpm_hmd_ctx_ts, &det_ctx->mtcu, - &det_ctx->pmq, raw_method, raw_method_len); - } + const uint32_t buffer_len = bstr_len(tx->request_method); + const uint8_t *buffer = bstr_ptr(tx->request_method); - SCReturnUInt(ret); + if (buffer_len >= mpm_ctx->minlen) { + (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, + &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); + } } -int DetectEngineRunHttpMethodMpm(DetectEngineThreadCtx *det_ctx, void *txv) +int PrefilterTxMethodRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { - uint32_t cnt = 0; - htp_tx_t *tx = (htp_tx_t *)txv; - if (tx->request_method == NULL) - goto end; - - cnt = HttpMethodPatternSearch(det_ctx, - (const uint8_t *)bstr_ptr(tx->request_method), - bstr_len(tx->request_method)); - end: - return cnt; + return PrefilterAppendTxEngine(sgh, PrefilterTxMethod, + ALPROTO_HTTP, HTP_REQUEST_LINE, + mpm_ctx, NULL); } /** diff --git a/src/detect-engine-hmd.h b/src/detect-engine-hmd.h index c176755a66..e2be754be4 100644 --- a/src/detect-engine-hmd.h +++ b/src/detect-engine-hmd.h @@ -32,7 +32,7 @@ int DetectEngineInspectHttpMethod(ThreadVars *tv, void *alstate, void *tx, uint64_t tx_id); -int DetectEngineRunHttpMethodMpm(DetectEngineThreadCtx *det_ctx, void *txv); +int PrefilterTxMethodRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); void DetectEngineHttpMethodRegisterTests(void); diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 3355e79ce0..0d625b1119 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -49,6 +49,7 @@ #include "detect-content.h" #include "detect-engine-uri.h" +#include "detect-engine-hmd.h" #include "stream.h" @@ -93,7 +94,8 @@ AppLayerMpms app_mpms[] = { { "http_raw_header", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHDMATCH, SIG_GROUP_HEAD_MPM_HRHD, NULL, 5}, { "http_raw_header", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HRHDMATCH, SIG_GROUP_HEAD_MPM_HRHD, NULL, 6}, - { "http_method", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HMDMATCH, SIG_GROUP_HEAD_MPM_HMD, NULL, 7}, + { "http_method", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HMDMATCH, + SIG_GROUP_HEAD_MPM_HMD, PrefilterTxMethodRegister, 7}, { "file_data", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_FD_SMTP, NULL, 8}, /* smtp */ { "file_data", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_HSBD, NULL, 9}, /* http server body */ diff --git a/src/detect.c b/src/detect.c index c863d964e2..e9fc09f063 100644 --- a/src/detect.c +++ b/src/detect.c @@ -908,11 +908,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx, DetectEngineRunHttpRawUriMpm(det_ctx, tx); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRUD); } - if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HMD) { - PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HMD); - DetectEngineRunHttpMethodMpm(det_ctx, tx); - PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HMD); - } } if (tx_progress >= HTP_REQUEST_HEADERS) {