http_server_body / file_data: mpm prefilter engine

src/detect-engine-hsbd.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2010 Open Information Security Foundation
+/* Copyright (C) 2007-2016 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -42,6 +42,7 @@
 #include "detect-parse.h"
 #include "detect-engine-state.h"
 #include "detect-engine-content-inspection.h"
+#include "detect-engine-prefilter.h"
 
 #include "flow-util.h"
 #include "util-debug.h"
@@ -217,58 +218,49 @@ static const uint8_t *DetectEngineHSBDGetBufferForTX(htp_tx_t *tx, uint64_t tx_i
     return buffer;
 }
 
-/** \brief Http server body pattern match -- searches for one pattern per
- *         signature.
+/** \brief HTTP Server Body Mpm prefilter callback
  *
- *  \param det_ctx  Detection engine thread ctx.
- *  \param body     The request body to inspect.
- *  \param body_len Body length.
- *
- *  \retval ret Number of matches.
+ *  \param det_ctx detection engine thread ctx
+ *  \param p packet to inspect
+ *  \param f flow to inspect
+ *  \param txv tx to inspect
+ *  \param pectx inspection context
  */
-static inline uint32_t HttpServerBodyPatternSearch(DetectEngineThreadCtx *det_ctx,
-        const uint8_t *body, const uint32_t body_len,
-        const uint8_t flags)
+static void PrefilterTxHttpResponseBody(DetectEngineThreadCtx *det_ctx,
+        const void *pectx,
+        Packet *p, Flow *f, void *txv,
+        const uint64_t idx, const uint8_t flags)
 {
     SCEnter();
 
-    uint32_t ret = 0;
-
-    DEBUG_VALIDATE_BUG_ON(!(flags & STREAM_TOCLIENT));
-    DEBUG_VALIDATE_BUG_ON(det_ctx->sgh->mpm_hsbd_ctx_tc == NULL);
-
-    if (body_len >= det_ctx->sgh->mpm_hsbd_ctx_tc->minlen) {
-        ret = mpm_table[det_ctx->sgh->mpm_hsbd_ctx_tc->mpm_type].
-            Search(det_ctx->sgh->mpm_hsbd_ctx_tc, &det_ctx->mtcu,
-                    &det_ctx->pmq, body, body_len);
-    }
-
-    SCReturnUInt(ret);
-}
-
-int DetectEngineRunHttpServerBodyMpm(DetectEngineCtx *de_ctx,
-                                     DetectEngineThreadCtx *det_ctx, Flow *f,
-                                     HtpState *htp_state, uint8_t flags,
-                                     void *tx, uint64_t idx)
-{
-    uint32_t cnt = 0;
+    const MpmCtx *mpm_ctx = (MpmCtx *)pectx;
+    htp_tx_t *tx = (htp_tx_t *)txv;
+    HtpState *htp_state = f->alstate;
     uint32_t buffer_len = 0;
     uint32_t stream_start_offset = 0;
     const uint8_t *buffer = DetectEngineHSBDGetBufferForTX(tx, idx,
-                                                     de_ctx, det_ctx,
+                                                     NULL, det_ctx,
                                                      f, htp_state,
                                                      flags,
                                                      &buffer_len,
                                                      &stream_start_offset);
-    if (buffer_len == 0)
-        goto end;
 
-    cnt = HttpServerBodyPatternSearch(det_ctx, (uint8_t *)buffer, buffer_len, flags);
+    if (buffer_len >= mpm_ctx->minlen) {
+        (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
+                &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len);
+    }
+}
 
- end:
-    return cnt;
+int PrefilterTxHttpResponseBodyRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx)
+{
+    SCEnter();
+
+    return PrefilterAppendTxEngine(sgh, PrefilterTxHttpResponseBody,
+        ALPROTO_HTTP, HTP_RESPONSE_BODY,
+        mpm_ctx, NULL);
 }
 
+
 int DetectEngineInspectHttpServerBody(ThreadVars *tv,
                                       DetectEngineCtx *de_ctx,
                                       DetectEngineThreadCtx *det_ctx,

src/detect-engine-hsbd.h

@@ -27,10 +27,8 @@
 
 #include "app-layer-htp.h"
 
-int DetectEngineRunHttpServerBodyMpm(DetectEngineCtx *de_ctx,
-                                     DetectEngineThreadCtx *det_ctx, Flow *f,
-                                     HtpState *htp_state, uint8_t flags,
-                                     void *tx, uint64_t idx);
+int PrefilterTxHttpResponseBodyRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx);
+
 int DetectEngineInspectHttpServerBody(ThreadVars *tv,
                                       DetectEngineCtx *de_ctx,
                                       DetectEngineThreadCtx *det_ctx,

src/detect-engine-mpm.c

@@ -60,6 +60,7 @@
 #include "detect-engine-hsmd.h"
 #include "detect-engine-hscd.h"
 #include "detect-engine-hcbd.h"
+#include "detect-engine-hsbd.h"
 #include "detect-engine-dns.h"
 
 #include "stream.h"
@@ -113,7 +114,8 @@ AppLayerMpms app_mpms[] = {
         SIG_GROUP_HEAD_MPM_HMD, PrefilterTxMethodRegister, 7},
 
     { "file_data", 0, SIG_FLAG_TOSERVER, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_FD_SMTP, NULL, 8}, /* smtp */
-    { "file_data", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEDATA, SIG_GROUP_HEAD_MPM_HSBD, NULL, 9}, /* http server body */
+    { "file_data", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_FILEDATA,
+        SIG_GROUP_HEAD_MPM_HSBD, PrefilterTxHttpResponseBodyRegister, 9}, /* http server body */
 
     { "http_stat_msg", 0, SIG_FLAG_TOCLIENT, DETECT_SM_LIST_HSMDMATCH,
         SIG_GROUP_HEAD_MPM_HSMD, PrefilterTxHttpStatMsgRegister, 10},

src/detect.c

@@ -920,14 +920,6 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
                             PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HRHD);
                         }
                     }
-
-                    if (tx_progress >= HTP_RESPONSE_BODY) {
-                        if (det_ctx->sgh->flags & SIG_GROUP_HEAD_MPM_HSBD) {
-                            PACKET_PROFILING_DETECT_START(p, PROF_DETECT_MPM_HSBD);
-                            DetectEngineRunHttpServerBodyMpm(de_ctx, det_ctx, p->flow, alstate, flags, tx, idx);
-                            PACKET_PROFILING_DETECT_END(p, PROF_DETECT_MPM_HSBD);
-                        }
-                    }
                 }
             } /* for */
         } else if (alproto == ALPROTO_TLS && has_state) {