From a43a69305ddaf543daeef8f86317f74506287465 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 8 Jul 2016 17:01:48 +0200 Subject: [PATCH] http_cookie: mpm prefilter engine --- src/detect-engine-hcd.c | 128 ++++++++++++++++++++++++---------------- src/detect-engine-hcd.h | 6 +- src/detect-engine-mpm.c | 7 ++- src/detect.c | 10 ---- 4 files changed, 84 insertions(+), 67 deletions(-) diff --git a/src/detect-engine-hcd.c b/src/detect-engine-hcd.c index 5372a4686d..7f04da0ede 100644 --- a/src/detect-engine-hcd.c +++ b/src/detect-engine-hcd.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2010 Open Information Security Foundation +/* Copyright (C) 2007-2016 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -25,6 +25,7 @@ /** \file * * \author Anoop Saldanha + * \author Victor Julien * * \brief Handle HTTP cookie match * @@ -41,6 +42,7 @@ #include "detect-parse.h" #include "detect-engine-state.h" #include "detect-engine-content-inspection.h" +#include "detect-engine-prefilter.h" #include "flow-util.h" #include "util-debug.h" @@ -58,74 +60,96 @@ #include "app-layer-protos.h" #include "util-validate.h" -/** - * \brief Http cookie match -- searches for one pattern per signature. - * - * \param det_ctx Detection engine thread ctx. - * \param cookie Cookie to inspect. - * \param cookie_len Cookie length. +/** \brief HTTP Cookie Mpm prefilter callback * - * \retval ret Number of matches. + * \param det_ctx detection engine thread ctx + * \param p packet to inspect + * \param f flow to inspect + * \param txv tx to inspect + * \param pectx inspection context */ -static inline uint32_t HttpCookiePatternSearch(DetectEngineThreadCtx *det_ctx, - const uint8_t *cookie, const uint32_t cookie_len, - const uint8_t flags) +static void PrefilterTxRequestCookie(DetectEngineThreadCtx *det_ctx, + const void *pectx, + Packet *p, Flow *f, void *txv, + const uint64_t idx, const uint8_t flags) { SCEnter(); - uint32_t ret = 0; + const MpmCtx *mpm_ctx = (MpmCtx *)pectx; + htp_tx_t *tx = (htp_tx_t *)txv; - if (flags & STREAM_TOSERVER) { - DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hcd_ctx_ts == NULL); + if (tx->request_headers == NULL) + return; - if (cookie_len >= det_ctx->sgh->mpm_hcd_ctx_ts->minlen) { - ret = mpm_table[det_ctx->sgh->mpm_hcd_ctx_ts->mpm_type]. - Search(det_ctx->sgh->mpm_hcd_ctx_ts, &det_ctx->mtcu, - &det_ctx->pmq, cookie, cookie_len); - } - } else { - DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hcd_ctx_tc == NULL); + htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers, + "Cookie"); + if (h == NULL || h->value == NULL) { + SCLogDebug("HTTP cookie header not present in this request"); + return; + } - if (cookie_len >= det_ctx->sgh->mpm_hcd_ctx_tc->minlen) { - ret = mpm_table[det_ctx->sgh->mpm_hcd_ctx_tc->mpm_type]. - Search(det_ctx->sgh->mpm_hcd_ctx_tc, &det_ctx->mtcu, - &det_ctx->pmq, cookie, cookie_len); - } + const uint32_t buffer_len = bstr_len(h->value); + const uint8_t *buffer = bstr_ptr(h->value); + + if (buffer_len >= mpm_ctx->minlen) { + (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, + &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } +} - SCReturnUInt(ret); +int PrefilterTxRequestCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) +{ + SCEnter(); + + return PrefilterAppendTxEngine(sgh, PrefilterTxRequestCookie, + ALPROTO_HTTP, HTP_REQUEST_HEADERS, + mpm_ctx, NULL); } -int DetectEngineRunHttpCookieMpm(DetectEngineThreadCtx *det_ctx, - uint8_t flags, void *txv) +/** \brief HTTP Cookie Mpm prefilter callback + * + * \param det_ctx detection engine thread ctx + * \param p packet to inspect + * \param f flow to inspect + * \param txv tx to inspect + * \param pectx inspection context + */ +static void PrefilterTxResponseCookie(DetectEngineThreadCtx *det_ctx, + const void *pectx, + Packet *p, Flow *f, void *txv, + const uint64_t idx, const uint8_t flags) { - uint32_t cnt = 0; + SCEnter(); + + const MpmCtx *mpm_ctx = (MpmCtx *)pectx; htp_tx_t *tx = (htp_tx_t *)txv; - if (tx->request_headers == NULL) - goto end; - htp_header_t *h = NULL; - if (flags & STREAM_TOSERVER) { - h = (htp_header_t *)htp_table_get_c(tx->request_headers, - "Cookie"); - if (h == NULL) { - SCLogDebug("HTTP cookie header not present in this request"); - goto end; - } - } else { - h = (htp_header_t *)htp_table_get_c(tx->response_headers, - "Set-Cookie"); - if (h == NULL) { - SCLogDebug("HTTP Set-Cookie header not present in this request"); - goto end; - } + if (tx->response_headers == NULL) + return; + + htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers, + "Set-Cookie"); + if (h == NULL || h->value == NULL) { + SCLogDebug("HTTP cookie header not present in this request"); + return; } - cnt = HttpCookiePatternSearch(det_ctx, - (uint8_t *)bstr_ptr(h->value), - bstr_len(h->value), flags); - end: - return cnt; + const uint32_t buffer_len = bstr_len(h->value); + const uint8_t *buffer = bstr_ptr(h->value); + + if (buffer_len >= mpm_ctx->minlen) { + (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx, + &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); + } +} + +int PrefilterTxResponseCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) +{ + SCEnter(); + + return PrefilterAppendTxEngine(sgh, PrefilterTxResponseCookie, + ALPROTO_HTTP, HTP_RESPONSE_HEADERS, + mpm_ctx, NULL); } /** diff --git a/src/detect-engine-hcd.h b/src/detect-engine-hcd.h index a3853c23d9..f5c23514d8 100644 --- a/src/detect-engine-hcd.h +++ b/src/detect-engine-hcd.h @@ -25,6 +25,9 @@ #include "app-layer-htp.h" +int PrefilterTxRequestCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); +int PrefilterTxResponseCookieRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx); + int DetectEngineInspectHttpCookie(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, @@ -32,9 +35,6 @@ int DetectEngineInspectHttpCookie(ThreadVars *tv, void *alstate, void *tx, uint64_t tx_id); -int DetectEngineRunHttpCookieMpm(DetectEngineThreadCtx *det_ctx, - uint8_t flags, void *tx); - void DetectEngineHttpCookieRegisterTests(void); #endif /* __DETECT_ENGINE_HCD_H__ */ diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index 9402e2099e..9e640191cc 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -52,6 +52,7 @@ #include "detect-engine-uri.h" #include "detect-engine-hrud.h" #include "detect-engine-hmd.h" +#include "detect-engine-hcd.h" #include "detect-engine-dns.h" #include "stream.h" @@ -112,8 +113,10 @@ AppLayerMpms app_mpms[] = { { "http_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HHHDMATCH, SIG_GROUP_HEAD_MPM_HHHD, NULL, 13}, { "http_raw_host", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HRHHDMATCH, SIG_GROUP_HEAD_MPM_HRHHD, NULL, 14}, - { "http_cookie", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCDMATCH, SIG_GROUP_HEAD_MPM_HCD, NULL, 15}, - { "http_cookie", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HCDMATCH, SIG_GROUP_HEAD_MPM_HCD, NULL, 16}, + { "http_cookie", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_HCDMATCH, + SIG_GROUP_HEAD_MPM_HCD, PrefilterTxRequestCookieRegister, 15}, + { "http_cookie", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HCDMATCH, + SIG_GROUP_HEAD_MPM_HCD, PrefilterTxResponseCookieRegister, 16}, { "dns_query", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_DNSQUERYNAME_MATCH, SIG_GROUP_HEAD_MPM_DNSQUERY, PrefilterTxDnsQueryRegister, 17}, diff --git a/src/detect.c b/src/detect.c index 0788c6fe55..0eac7d725b 100644 --- a/src/detect.c +++ b/src/detect.c @@ -913,11 +913,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx, DetectEngineRunHttpHRHMpm(det_ctx, tx); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRHHD); } - if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HCD) { - PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HCD); - DetectEngineRunHttpCookieMpm(det_ctx, flags, tx); - PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HCD); - } if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HUAD) { PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HUAD); DetectEngineRunHttpUAMpm(det_ctx, tx); @@ -967,11 +962,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx, DetectEngineRunHttpHeaderMpm(det_ctx, p->flow, alstate, flags, tx, idx); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HHD); } - if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HCD) { - PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HCD); - DetectEngineRunHttpCookieMpm(det_ctx, flags, tx); - PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HCD); - } } if (tx_progress > HTP_RESPONSE_HEADERS) {