aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

http_raw_host: mpm prefilter engine

Browse Source
pull/2310/head
Victor Julien 10 years ago
parent 5218849213
commit 86d303e32b
4 changed files with 41 additions and 52 deletions
Show Stats Download Patch File Download Diff File

80
src/detect-engine-hrhhd.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2013 Open Information Security Foundation
/* Copyright (C) 2007-2016 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
@ -25,6 +25,7 @@
/** \file
*
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
* \author Victor Julien <victor@inliniac.net>
*
* \brief Handle HTTP host header.
* HRHHD - Http Raw Host Header Data
@ -41,6 +42,7 @@
#include "detect-parse.h"
#include "detect-engine-state.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-prefilter.h"
#include "flow-util.h"
#include "util-debug.h"
@ -60,65 +62,55 @@
#include "detect-engine-hrhhd.h"
#include "util-validate.h"
/**
* \brief Http raw host header match -- searches for one pattern per signature.
*
* \param det_ctx Detection engine thread ctx.
* \param hrh Raw hostname to inspect.
* \param hrh_len Raw hostname buffer length.
/** \brief HTTP Host (Raw) Mpm prefilter callback
*
* \retval ret Number of matches.
* \param det_ctx detection engine thread ctx
* \param p packet to inspect
* \param f flow to inspect
* \param txv tx to inspect
* \param pectx inspection context
*/
static inline uint32_t HttpHRHPatternSearch(DetectEngineThreadCtx *det_ctx,
const uint8_t *hrh, const uint32_t hrh_len)
static void PrefilterTxHostnameRaw(DetectEngineThreadCtx *det_ctx,
const void *pectx,
Packet *p, Flow *f, void *txv,
const uint64_t idx, const uint8_t flags)
{
SCEnter();
uint32_t ret = 0;
DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hrhhd_ctx_ts == NULL);
if (hrh_len >= det_ctx->sgh->mpm_hrhhd_ctx_ts->minlen) {
ret = mpm_table[det_ctx->sgh->mpm_hrhhd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hrhhd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, hrh, hrh_len);
}
SCReturnUInt(ret);
}
int DetectEngineRunHttpHRHMpm(DetectEngineThreadCtx *det_ctx, void *txv)
{
uint32_t cnt = 0;
const MpmCtx *mpm_ctx = (MpmCtx *)pectx;
htp_tx_t *tx = (htp_tx_t *)txv;
const uint8_t *hname = NULL;
uint32_t hname_len = 0;
if (tx->parsed_uri == NULL || tx->parsed_uri->hostname == NULL) {
if (tx->request_headers == NULL)
goto end;
htp_header_t *h = NULL;
h = (htp_header_t *)htp_table_get_c(tx->request_headers, "Host");
if (h != NULL) {
hname = (const uint8_t *)bstr_ptr(h->value);
if (hname != NULL)
hname_len = bstr_len(h->value);
} else {
SCLogDebug("HTTP host header not present in this request");
goto end;
}
return;
htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
"Host");
if (h == NULL || h->value == NULL)
return;
hname = (const uint8_t *)bstr_ptr(h->value);
hname_len = bstr_len(h->value);
} else {
hname = (uint8_t *)bstr_ptr(tx->parsed_uri->hostname);
if (hname != NULL)
hname_len = bstr_len(tx->parsed_uri->hostname);
hname = (const uint8_t *)bstr_ptr(tx->parsed_uri->hostname);
hname_len = bstr_len(tx->parsed_uri->hostname);
}
if (hname != NULL) {
cnt = HttpHRHPatternSearch(det_ctx, hname, hname_len);
if (hname != NULL && hname_len >= mpm_ctx->minlen) {
(void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
&det_ctx->mtcu, &det_ctx->pmq, hname, hname_len);
}
}
end:
return cnt;
int PrefilterTxHostnameRawRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx)
{
SCEnter();
return PrefilterAppendTxEngine(sgh, PrefilterTxHostnameRaw,
ALPROTO_HTTP, HTP_REQUEST_HEADERS,
mpm_ctx, NULL);
}
/**

4
src/detect-engine-hrhhd.h
Unescape Escape View File

@ -25,6 +25,8 @@
#include "app-layer-htp.h"
int PrefilterTxHostnameRawRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx);
int DetectEngineInspectHttpHRH(ThreadVars *tv,
DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
@ -32,8 +34,6 @@ int DetectEngineInspectHttpHRH(ThreadVars *tv,
void *alstate,
void *tx, uint64_t tx_id);
int DetectEngineRunHttpHRHMpm(DetectEngineThreadCtx *det_ctx, void *txv);
void DetectEngineHttpHRHRegisterTests(void);
#endif /* __DETECT_ENGINE_HRHHD_H__ */

4
src/detect-engine-mpm.c
Unescape Escape View File

@ -55,6 +55,7 @@
#include "detect-engine-hcd.h"
#include "detect-engine-hua.h"
#include "detect-engine-hhhd.h"
#include "detect-engine-hrhhd.h"
#include "detect-engine-dns.h"
#include "stream.h"
@ -115,7 +116,8 @@ AppLayerMpms app_mpms[] = {
{ "http_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHHDMATCH,
SIG_GROUP_HEAD_MPM_HHHD, PrefilterTxHostnameRegister, 13},
{ "http_raw_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHHDMATCH, SIG_GROUP_HEAD_MPM_HRHHD, NULL, 14},
{ "http_raw_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHHDMATCH,
SIG_GROUP_HEAD_MPM_HRHHD, PrefilterTxHostnameRawRegister, 14},
{ "http_cookie", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCDMATCH,
SIG_GROUP_HEAD_MPM_HCD, PrefilterTxRequestCookieRegister, 15},

5
src/detect.c
Unescape Escape View File

@ -903,11 +903,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
tx_progress = AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags);
if (tx_progress >= HTP_REQUEST_HEADERS) {
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HRHHD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HRHHD);
DetectEngineRunHttpHRHMpm(det_ctx, tx);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRHHD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HHD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HHD);
DetectEngineRunHttpHeaderMpm(det_ctx, p->flow, alstate, flags, tx, idx);

Write Preview
Loading…
Cancel
Save