aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

http_cookie: mpm prefilter engine

Browse Source
pull/2310/head
Victor Julien 10 years ago
parent 7a46364e42
commit a43a69305d
4 changed files with 84 additions and 67 deletions
Show Stats Download Patch File Download Diff File

128
src/detect-engine-hcd.c
Unescape Escape View File

@ -1,4 +1,4 @@
/* Copyright (C) 2007-2010 Open Information Security Foundation
/* Copyright (C) 2007-2016 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
@ -25,6 +25,7 @@
/** \file
*
* \author Anoop Saldanha <anoopsaldanha@gmail.com>
* \author Victor Julien <victor@inliniac.net>
*
* \brief Handle HTTP cookie match
*
@ -41,6 +42,7 @@
#include "detect-parse.h"
#include "detect-engine-state.h"
#include "detect-engine-content-inspection.h"
#include "detect-engine-prefilter.h"
#include "flow-util.h"
#include "util-debug.h"
@ -58,74 +60,96 @@
#include "app-layer-protos.h"
#include "util-validate.h"
/**
* \brief Http cookie match -- searches for one pattern per signature.
*
* \param det_ctx Detection engine thread ctx.
* \param cookie Cookie to inspect.
* \param cookie_len Cookie length.
/** \brief HTTP Cookie Mpm prefilter callback
*
* \retval ret Number of matches.
* \param det_ctx detection engine thread ctx
* \param p packet to inspect
* \param f flow to inspect
* \param txv tx to inspect
* \param pectx inspection context
*/
static inline uint32_t HttpCookiePatternSearch(DetectEngineThreadCtx *det_ctx,
const uint8_t *cookie, const uint32_t cookie_len,
const uint8_t flags)
static void PrefilterTxRequestCookie(DetectEngineThreadCtx *det_ctx,
const void *pectx,
Packet *p, Flow *f, void *txv,
const uint64_t idx, const uint8_t flags)
{
SCEnter();
uint32_t ret = 0;
const MpmCtx *mpm_ctx = (MpmCtx *)pectx;
htp_tx_t *tx = (htp_tx_t *)txv;
if (flags & STREAM_TOSERVER) {
DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hcd_ctx_ts == NULL);
if (tx->request_headers == NULL)
return;
if (cookie_len >= det_ctx->sgh->mpm_hcd_ctx_ts->minlen) {
ret = mpm_table[det_ctx->sgh->mpm_hcd_ctx_ts->mpm_type].
Search(det_ctx->sgh->mpm_hcd_ctx_ts, &det_ctx->mtcu,
&det_ctx->pmq, cookie, cookie_len);
}
} else {
DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hcd_ctx_tc == NULL);
htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
"Cookie");
if (h == NULL || h->value == NULL) {
SCLogDebug("HTTP cookie header not present in this request");
return;
}
if (cookie_len >= det_ctx->sgh->mpm_hcd_ctx_tc->minlen) {
ret = mpm_table[det_ctx->sgh->mpm_hcd_ctx_tc->mpm_type].
Search(det_ctx->sgh->mpm_hcd_ctx_tc, &det_ctx->mtcu,
&det_ctx->pmq, cookie, cookie_len);
}
const uint32_t buffer_len = bstr_len(h->value);
const uint8_t *buffer = bstr_ptr(h->value);
if (buffer_len >= mpm_ctx->minlen) {
(void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
&det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len);
}
}
SCReturnUInt(ret);
int PrefilterTxRequestCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx)
{
SCEnter();
return PrefilterAppendTxEngine(sgh, PrefilterTxRequestCookie,
ALPROTO_HTTP, HTP_REQUEST_HEADERS,
mpm_ctx, NULL);
}
int DetectEngineRunHttpCookieMpm(DetectEngineThreadCtx *det_ctx,
uint8_t flags, void *txv)
/** \brief HTTP Cookie Mpm prefilter callback
*
* \param det_ctx detection engine thread ctx
* \param p packet to inspect
* \param f flow to inspect
* \param txv tx to inspect
* \param pectx inspection context
*/
static void PrefilterTxResponseCookie(DetectEngineThreadCtx *det_ctx,
const void *pectx,
Packet *p, Flow *f, void *txv,
const uint64_t idx, const uint8_t flags)
{
uint32_t cnt = 0;
SCEnter();
const MpmCtx *mpm_ctx = (MpmCtx *)pectx;
htp_tx_t *tx = (htp_tx_t *)txv;
if (tx->request_headers == NULL)
goto end;
htp_header_t *h = NULL;
if (flags & STREAM_TOSERVER) {
h = (htp_header_t *)htp_table_get_c(tx->request_headers,
"Cookie");
if (h == NULL) {
SCLogDebug("HTTP cookie header not present in this request");
goto end;
}
} else {
h = (htp_header_t *)htp_table_get_c(tx->response_headers,
"Set-Cookie");
if (h == NULL) {
SCLogDebug("HTTP Set-Cookie header not present in this request");
goto end;
}
if (tx->response_headers == NULL)
return;
htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers,
"Set-Cookie");
if (h == NULL || h->value == NULL) {
SCLogDebug("HTTP cookie header not present in this request");
return;
}
cnt = HttpCookiePatternSearch(det_ctx,
(uint8_t *)bstr_ptr(h->value),
bstr_len(h->value), flags);
end:
return cnt;
const uint32_t buffer_len = bstr_len(h->value);
const uint8_t *buffer = bstr_ptr(h->value);
if (buffer_len >= mpm_ctx->minlen) {
(void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
&det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len);
}
}
int PrefilterTxResponseCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx)
{
SCEnter();
return PrefilterAppendTxEngine(sgh, PrefilterTxResponseCookie,
ALPROTO_HTTP, HTP_RESPONSE_HEADERS,
mpm_ctx, NULL);
}
/**

6
src/detect-engine-hcd.h
Unescape Escape View File

@ -25,6 +25,9 @@
#include "app-layer-htp.h"
int PrefilterTxRequestCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx);
int PrefilterTxResponseCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx);
int DetectEngineInspectHttpCookie(ThreadVars *tv,
DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx,
@ -32,9 +35,6 @@ int DetectEngineInspectHttpCookie(ThreadVars *tv,
void *alstate,
void *tx, uint64_t tx_id);
int DetectEngineRunHttpCookieMpm(DetectEngineThreadCtx *det_ctx,
uint8_t flags, void *tx);
void DetectEngineHttpCookieRegisterTests(void);
#endif /* __DETECT_ENGINE_HCD_H__ */

7
src/detect-engine-mpm.c
Unescape Escape View File

@ -52,6 +52,7 @@
#include "detect-engine-uri.h"
#include "detect-engine-hrud.h"
#include "detect-engine-hmd.h"
#include "detect-engine-hcd.h"
#include "detect-engine-dns.h"
#include "stream.h"
@ -112,8 +113,10 @@ AppLayerMpms app_mpms[] = {
{ "http_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHHDMATCH, SIG_GROUP_HEAD_MPM_HHHD, NULL, 13},
{ "http_raw_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHHDMATCH, SIG_GROUP_HEAD_MPM_HRHHD, NULL, 14},
{ "http_cookie", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCDMATCH, SIG_GROUP_HEAD_MPM_HCD, NULL, 15},
{ "http_cookie", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HCDMATCH, SIG_GROUP_HEAD_MPM_HCD, NULL, 16},
{ "http_cookie", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCDMATCH,
SIG_GROUP_HEAD_MPM_HCD, PrefilterTxRequestCookieRegister, 15},
{ "http_cookie", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HCDMATCH,
SIG_GROUP_HEAD_MPM_HCD, PrefilterTxResponseCookieRegister, 16},
{ "dns_query", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_DNSQUERYNAME_MATCH,
SIG_GROUP_HEAD_MPM_DNSQUERY, PrefilterTxDnsQueryRegister, 17},

10
src/detect.c
Unescape Escape View File

@ -913,11 +913,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
DetectEngineRunHttpHRHMpm(det_ctx, tx);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRHHD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HCD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HCD);
DetectEngineRunHttpCookieMpm(det_ctx, flags, tx);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HCD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HUAD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HUAD);
DetectEngineRunHttpUAMpm(det_ctx, tx);
@ -967,11 +962,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
DetectEngineRunHttpHeaderMpm(det_ctx, p->flow, alstate, flags, tx, idx);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HHD);
}
if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HCD) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HCD);
DetectEngineRunHttpCookieMpm(det_ctx, flags, tx);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HCD);
}
}
if (tx_progress > HTP_RESPONSE_HEADERS) {

Write Preview
Loading…
Cancel
Save