aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

http: backport new events

Browse Source
pull/4230/head
Philippe Antoine 7 years ago
parent 16c2bff6e1
commit dd5c156d9e
3 changed files with 87 additions and 1 deletions
Show Stats Download Patch File Download Diff File

28
rules/http-events.rules
Unescape Escape View File

@ -52,7 +52,33 @@ alert http any any -> any any (msg:"SURICATA HTTP Request line with leading whit
alert http any any -> any any (msg:"SURICATA HTTP Request too many encoding layers"; flow:established,to_server; app-layer-event:http.too_many_encoding_layers; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221032; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Request abnormal Content-Encoding header"; flow:established,to_server; app-layer-event:http.abnormal_ce_header; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221033; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Request unrecognized authorization method"; flow:established,to_server; app-layer-event:http.request_auth_unrecognized; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221034; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Request excessive header repetition"; flow:established,to_server; app-layer-event:http.request_header_repetition; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221035; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Response excessive header repetition"; flow:established,to_client; app-layer-event:http.response_header_repetition; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221036; rev:1;)
# This is a suricata limitation rather than anomaly traffic
# alert http any any -> any any (msg:"SURICATA HTTP Response multipart/byteranges"; flow:established,to_client; app-layer-event:http.response_multipart_byteranges; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221037; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Response abnormal chunked for transfer-encoding"; flow:established,to_client; app-layer-event:http.response_abnormal_transfer_encoding; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221038; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Response chunked with HTTP 0.9 or 1.0"; flow:established,to_client; app-layer-event:http.response_chunked_old_proto; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221039; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Response invalid protocol"; flow:established,to_client; app-layer-event:http.response_invalid_protocol; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221040; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Response invalid status"; flow:established,to_client; app-layer-event:http.response_invalid_status; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221041; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Request line incomplete"; flow:established,to_server; app-layer-event:http.request_line_incomplete; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221042; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Request double encoded URI"; flow:established,to_server; app-layer-event:http.double_encoded_uri; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221043; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Invalid Request line"; flow:established,to_server; app-layer-event:http.request_line_invalid; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221044; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP Unexpected Request body"; flow:established,to_server; app-layer-event:http.request_body_unexpected; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221045; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP LZMA reached its memory limit"; flow:established; app-layer-event:http.lzma_memlimit_reached; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221046; rev:1;)
# next sid 2221047
alert http any any -> any any (msg:"SURICATA HTTP duplicate content length field in request"; flow:established,to_server; app-layer-event:http.duplicate_content_length_field_in_request; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221047; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP duplicate content length field in response"; flow:established,to_client; app-layer-event:http.duplicate_content_length_field_in_response; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221048; rev:1;)
alert http any any -> any any (msg:"SURICATA HTTP compression bomb"; flow:established; app-layer-event:http.compression_bomb; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221049; rev:1;)
# next sid 2221050

45
src/app-layer-htp.c
Unescape Escape View File

@ -114,6 +114,10 @@ SCEnumCharMap http_decoder_event_table[ ] = {
HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST},
{ "INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE",
HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE},
{ "DUPLICATE_CONTENT_LENGTH_FIELD_IN_REQUEST",
HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_REQUEST},
{ "DUPLICATE_CONTENT_LENGTH_FIELD_IN_RESPONSE",
HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_RESPONSE},
{ "100_CONTINUE_ALREADY_SEEN",
HTTP_DECODER_EVENT_100_CONTINUE_ALREADY_SEEN},
{ "UNABLE_TO_MATCH_RESPONSE_TO_REQUEST",
@ -138,12 +142,24 @@ SCEnumCharMap http_decoder_event_table[ ] = {
HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG},
{ "RESPONSE_FIELD_TOO_LONG",
HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG},
{ "REQUEST_LINE_INVALID",
HTTP_DECODER_EVENT_REQUEST_LINE_INVALID},
{ "REQUEST_BODY_UNEXPECTED",
HTTP_DECODER_EVENT_REQUEST_BODY_UNEXPECTED},
{ "REQUEST_SERVER_PORT_TCP_PORT_MISMATCH",
HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH},
{ "REQUEST_URI_HOST_INVALID",
HTTP_DECODER_EVENT_URI_HOST_INVALID},
{ "REQUEST_HEADER_HOST_INVALID",
HTTP_DECODER_EVENT_HEADER_HOST_INVALID},
{ "REQUEST_AUTH_UNRECOGNIZED",
HTTP_DECODER_EVENT_AUTH_UNRECOGNIZED},
{ "REQUEST_HEADER_REPETITION",
HTTP_DECODER_EVENT_REQUEST_HEADER_REPETITION},
{ "RESPONSE_HEADER_REPETITION",
HTTP_DECODER_EVENT_RESPONSE_HEADER_REPETITION},
{ "DOUBLE_ENCODED_URI",
HTTP_DECODER_EVENT_DOUBLE_ENCODED_URI},
{ "URI_DELIM_NON_COMPLIANT",
HTTP_DECODER_EVENT_URI_DELIM_NON_COMPLIANT},
{ "METHOD_DELIM_NON_COMPLIANT",
@ -154,6 +170,23 @@ SCEnumCharMap http_decoder_event_table[ ] = {
HTTP_DECODER_EVENT_TOO_MANY_ENCODING_LAYERS},
{ "ABNORMAL_CE_HEADER",
HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER},
{ "RESPONSE_MULTIPART_BYTERANGES",
HTTP_DECODER_EVENT_RESPONSE_MULTIPART_BYTERANGES},
{ "RESPONSE_ABNORMAL_TRANSFER_ENCODING",
HTTP_DECODER_EVENT_RESPONSE_ABNORMAL_TRANSFER_ENCODING},
{ "RESPONSE_CHUNKED_OLD_PROTO",
HTTP_DECODER_EVENT_RESPONSE_CHUNKED_OLD_PROTO},
{ "RESPONSE_INVALID_PROTOCOL",
HTTP_DECODER_EVENT_RESPONSE_INVALID_PROTOCOL},
{ "RESPONSE_INVALID_STATUS",
HTTP_DECODER_EVENT_RESPONSE_INVALID_STATUS},
{ "REQUEST_LINE_INCOMPLETE",
HTTP_DECODER_EVENT_REQUEST_LINE_INCOMPLETE},
{ "LZMA_MEMLIMIT_REACHED",
HTTP_DECODER_EVENT_LZMA_MEMLIMIT_REACHED},
{ "COMPRESSION_BOMB",
HTTP_DECODER_EVENT_COMPRESSION_BOMB},
{ "LZMA_MEMLIMIT_REACHED",
HTTP_DECODER_EVENT_LZMA_MEMLIMIT_REACHED},
@ -488,6 +521,8 @@ struct {
/* { "Invalid authority port", HTTP_DECODER_EVENT_INVALID_AUTHORITY_PORT}, htp no longer returns this error */
{ "Request buffer over", HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG},
{ "Response buffer over", HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG},
{ "C-T multipart/byteranges in responses not supported", HTTP_DECODER_EVENT_RESPONSE_MULTIPART_BYTERANGES},
{ "Compression bomb:", HTTP_DECODER_EVENT_COMPRESSION_BOMB},
};
struct {
@ -514,7 +549,17 @@ struct {
{ "C-E gzip has abnormal value", HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER},
{ "C-E deflate has abnormal value", HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER},
{ "C-E unknown setting", HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER},
{ "Excessive request header repetitions", HTTP_DECODER_EVENT_REQUEST_HEADER_REPETITION},
{ "Excessive response header repetitions", HTTP_DECODER_EVENT_RESPONSE_HEADER_REPETITION},
{ "Transfer-encoding has abnormal chunked value", HTTP_DECODER_EVENT_RESPONSE_ABNORMAL_TRANSFER_ENCODING},
{ "Chunked transfer-encoding on HTTP/0.9 or HTTP/1.0", HTTP_DECODER_EVENT_RESPONSE_CHUNKED_OLD_PROTO},
{ "Invalid response line: invalid protocol", HTTP_DECODER_EVENT_RESPONSE_INVALID_PROTOCOL},
{ "Invalid response line: invalid response status", HTTP_DECODER_EVENT_RESPONSE_INVALID_STATUS},
{ "Request line incomplete", HTTP_DECODER_EVENT_REQUEST_LINE_INCOMPLETE},
{ "Unexpected request body", HTTP_DECODER_EVENT_REQUEST_BODY_UNEXPECTED},
{ "LZMA decompressor: memory limit reached", HTTP_DECODER_EVENT_LZMA_MEMLIMIT_REACHED},
{ "Ambiguous request C-L value", HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_REQUEST},
{ "Ambiguous response C-L value", HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_RESPONSE},
};
#define HTP_ERROR_MAX (sizeof(htp_errors) / sizeof(htp_errors[0]))

15
src/app-layer-htp.h
Unescape Escape View File

@ -89,6 +89,8 @@ enum {
HTTP_DECODER_EVENT_INVALID_TRANSFER_ENCODING_VALUE_IN_RESPONSE,
HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_REQUEST,
HTTP_DECODER_EVENT_INVALID_CONTENT_LENGTH_FIELD_IN_RESPONSE,
HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_REQUEST,
HTTP_DECODER_EVENT_DUPLICATE_CONTENT_LENGTH_FIELD_IN_RESPONSE,
HTTP_DECODER_EVENT_100_CONTINUE_ALREADY_SEEN,
HTTP_DECODER_EVENT_UNABLE_TO_MATCH_RESPONSE_TO_REQUEST,
HTTP_DECODER_EVENT_INVALID_SERVER_PORT_IN_REQUEST,
@ -109,8 +111,21 @@ enum {
HTTP_DECODER_EVENT_REQUEST_LINE_LEADING_WHITESPACE,
HTTP_DECODER_EVENT_TOO_MANY_ENCODING_LAYERS,
HTTP_DECODER_EVENT_ABNORMAL_CE_HEADER,
HTTP_DECODER_EVENT_AUTH_UNRECOGNIZED,
HTTP_DECODER_EVENT_REQUEST_HEADER_REPETITION,
HTTP_DECODER_EVENT_RESPONSE_HEADER_REPETITION,
HTTP_DECODER_EVENT_RESPONSE_MULTIPART_BYTERANGES,
HTTP_DECODER_EVENT_RESPONSE_ABNORMAL_TRANSFER_ENCODING,
HTTP_DECODER_EVENT_RESPONSE_CHUNKED_OLD_PROTO,
HTTP_DECODER_EVENT_RESPONSE_INVALID_PROTOCOL,
HTTP_DECODER_EVENT_RESPONSE_INVALID_STATUS,
HTTP_DECODER_EVENT_REQUEST_LINE_INCOMPLETE,
HTTP_DECODER_EVENT_DOUBLE_ENCODED_URI,
HTTP_DECODER_EVENT_REQUEST_LINE_INVALID,
HTTP_DECODER_EVENT_REQUEST_BODY_UNEXPECTED,
HTTP_DECODER_EVENT_LZMA_MEMLIMIT_REACHED,
HTTP_DECODER_EVENT_COMPRESSION_BOMB,
/* suricata errors/warnings */
HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR,

Write Preview
Loading…
Cancel
Save