detect/http_raw_host: move raw into regular host logic

src/Makefile.am

@@ -134,7 +134,6 @@ detect-engine-filedata.c detect-engine-filedata.h \
 detect-engine-hcbd.c detect-engine-hcbd.h \
 detect-engine-hcd.c detect-engine-hcd.h \
 detect-engine-hrhd.c detect-engine-hrhd.h \
-detect-engine-hrhhd.c detect-engine-hrhhd.h \
 detect-engine-hsbd.c detect-engine-hsbd.h \
 detect-engine-hscd.c detect-engine-hscd.h \
 detect-engine-hsmd.c detect-engine-hsmd.h \
@@ -188,7 +187,6 @@ detect-http-headers.c detect-http-headers.h detect-http-headers-stub.h \
 detect-http-header-common.c detect-http-header-common.h \
 detect-http-header-names.c detect-http-header-names.h \
 detect-http-hh.c detect-http-hh.h \
-detect-http-hrh.c detect-http-hrh.h \
 detect-http-method.c detect-http-method.h \
 detect-http-protocol.c detect-http-protocol.h \
 detect-http-raw-header.c detect-http-raw-header.h \

src/detect-engine-hrhhd.h

@@ -1,38 +0,0 @@
-/* Copyright (C) 2007-2013 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/** \file
- *
- * \author Anoop Saldanha <anoopsaldanha@gmail.com>
- */
-
-#ifndef __DETECT_ENGINE_HRHHD_H__
-#define __DETECT_ENGINE_HRHHD_H__
-
-#include "app-layer-htp.h"
-
-int PrefilterTxHostnameRawRegister(DetectEngineCtx *de_ctx,
-        SigGroupHead *sgh, MpmCtx *mpm_ctx);
-
-int DetectEngineInspectHttpHRH(ThreadVars *tv,
-        DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
-        const Signature *s, const SigMatchData *smd,
-        Flow *f, uint8_t flags, void *alstate, void *tx, uint64_t tx_id);
-
-void DetectEngineHttpHRHRegisterTests(void);
-
-#endif /* __DETECT_ENGINE_HRHHD_H__ */

src/detect-engine-mpm.c

@@ -52,7 +52,6 @@
 #include "detect-engine-payload.h"
 #include "detect-engine-hrhd.h"
 #include "detect-engine-hcd.h"
-#include "detect-engine-hrhhd.h"
 #include "detect-engine-hsmd.h"
 #include "detect-engine-hscd.h"
 #include "detect-engine-hcbd.h"

src/detect-engine-register.c

@@ -61,7 +61,6 @@
 #include "detect-http-method.h"
 #include "detect-http-ua.h"
 #include "detect-http-hh.h"
-#include "detect-http-hrh.h"
 
 #include "detect-nfs-procedure.h"
 #include "detect-nfs-version.h"
@@ -160,7 +159,6 @@
 #include "detect-engine-hcd.h"
 #include "detect-engine-hsmd.h"
 #include "detect-engine-hscd.h"
-#include "detect-engine-hrhhd.h"
 #include "detect-byte-extract.h"
 #include "detect-file-data.h"
 #include "detect-pkt-data.h"
@@ -426,7 +424,6 @@ void SigTableSetup(void)
 
     DetectHttpUARegister();
     DetectHttpHHRegister();
-    DetectHttpHRHRegister();
 
     DetectHttpStatMsgRegister();
     DetectHttpStatCodeRegister();

src/detect-http-hh.c

@@ -68,6 +68,11 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const DetectEngineTransforms *transforms,
         Flow *_f, const uint8_t _flow_flags,
         void *txv, const int list_id);
+static int DetectHttpHRHSetup(DetectEngineCtx *, Signature *, const char *);
+static int g_http_raw_host_buffer_id = 0;
+static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
+        const DetectEngineTransforms *transforms, Flow *_f,
+        const uint8_t _flow_flags, void *txv, const int list_id);
 static int g_http_host_buffer_id = 0;
 
 /**
@@ -106,6 +111,25 @@ void DetectHttpHHRegister(void)
             "http host");
 
     g_http_host_buffer_id = DetectBufferTypeGetByName("http_host");
+
+    /* http_raw_host content modifier */
+    sigmatch_table[DETECT_AL_HTTP_RAW_HOST].name = "http_raw_host";
+    sigmatch_table[DETECT_AL_HTTP_RAW_HOST].desc = "content modifier to match only on the HTTP host header or the raw hostname from the HTTP uri";
+    sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Setup = DetectHttpHRHSetup;
+    sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_NOOPT ;
+
+    DetectAppLayerInspectEngineRegister2("http_raw_host", ALPROTO_HTTP,
+            SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
+            DetectEngineInspectBufferGeneric, GetRawData);
+
+    DetectAppLayerMpmRegister2("http_raw_host", SIG_FLAG_TOSERVER, 2,
+            PrefilterGenericMpmRegister, GetRawData, ALPROTO_HTTP,
+            HTP_REQUEST_HEADERS);
+
+    DetectBufferTypeSetDescriptionByName("http_raw_host",
+            "http raw host header");
+
+    g_http_raw_host_buffer_id = DetectBufferTypeGetByName("http_raw_host");
 }
 
 /**
@@ -202,6 +226,61 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
     return buffer;
 }
 
+/**
+ * \brief The setup function for the http_raw_host keyword for a signature.
+ *
+ * \param de_ctx Pointer to the detection engine context.
+ * \param s      Pointer to the signature for the current Signature being
+ *               parsed from the rules.
+ * \param m      Pointer to the head of the SigMatch for the current rule
+ *               being parsed.
+ * \param arg    Pointer to the string holding the keyword value.
+ *
+ * \retval  0 On success
+ * \retval -1 On failure
+ */
+int DetectHttpHRHSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
+{
+    return DetectEngineContentModifierBufferSetup(de_ctx, s, arg,
+                                                  DETECT_AL_HTTP_RAW_HOST,
+                                                  g_http_raw_host_buffer_id,
+                                                  ALPROTO_HTTP);
+}
+
+static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
+        const DetectEngineTransforms *transforms, Flow *_f,
+        const uint8_t _flow_flags, void *txv, const int list_id)
+{
+    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
+    if (buffer->inspect == NULL) {
+        htp_tx_t *tx = (htp_tx_t *)txv;
+
+        const uint8_t *data = NULL;
+        uint32_t data_len = 0;
+
+        if (tx->parsed_uri == NULL || tx->parsed_uri->hostname == NULL) {
+            if (tx->request_headers == NULL)
+                return NULL;
+
+            htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
+                    "Host");
+            if (h == NULL || h->value == NULL)
+                return NULL;
+
+            data = (const uint8_t *)bstr_ptr(h->value);
+            data_len = bstr_len(h->value);
+        } else {
+            data = (const uint8_t *)bstr_ptr(tx->parsed_uri->hostname);
+            data_len = bstr_len(tx->parsed_uri->hostname);
+        }
+
+        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferApplyTransforms(buffer, transforms);
+    }
+
+    return buffer;
+}
+
 /************************************Unittests*********************************/
 
 #ifdef UNITTESTS

src/detect-http-hrh.h

@@ -1,29 +0,0 @@
-/* Copyright (C) 2007-2013 Open Information Security Foundation
- *
- * You can copy, redistribute or modify this Program under the terms of
- * the GNU General Public License version 2 as published by the Free
- * Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * version 2 along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- */
-
-/**
- * \file
- *
- * \author Anoop Saldanha <anoopsaldanha@gmail.com>
- */
-
-#ifndef __DETECT_HTTP_HRH_H__
-#define __DETECT_HTTP_HRH_H__
-
-void DetectHttpHRHRegister(void);
-
-#endif /* __DETECT_HTTP_HRH_H__ */

src/runmode-unittests.c

@@ -42,7 +42,6 @@
 #include "detect-engine-hcd.h"
 #include "detect-engine-hsmd.h"
 #include "detect-engine-hscd.h"
-#include "detect-engine-hrhhd.h"
 #include "detect-engine-state.h"
 #include "detect-engine-tag.h"
 #include "detect-engine-modbus.h"
@@ -201,7 +200,6 @@ static void RegisterUnittests(void)
     DetectEngineHttpCookieRegisterTests();
     DetectEngineHttpStatMsgRegisterTests();
     DetectEngineHttpStatCodeRegisterTests();
-    DetectEngineHttpHRHRegisterTests();
     DetectEngineInspectModbusRegisterTests();
     DetectEngineRegisterTests();
     DetectEngineSMTPFiledataRegisterTests();