From e40775d68af382d6d90a0f352af59f7fbe110a00 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Fri, 3 Apr 2026 09:15:27 +0200 Subject: [PATCH] detect/http2: fix progress for headers Ticket: 8451 Do not wait to see a data frame to run detection on http2 headers (cherry picked from commit 40c862018472bbb7304428a3e870f1895596f3d3) --- src/detect-http-cookie.c | 4 ++-- src/detect-http-header-names.c | 4 ++-- src/detect-http-header.c | 4 ++-- src/detect-http-headers-stub.h | 4 ++-- src/detect-http-host.c | 8 ++++---- src/detect-http-method.c | 4 ++-- src/detect-http-protocol.c | 4 ++-- src/detect-http-raw-header.c | 4 ++-- src/detect-http-request-line.c | 4 ++-- src/detect-http-ua.c | 4 ++-- src/detect-http-uri.c | 8 ++++---- 11 files changed, 26 insertions(+), 26 deletions(-) diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index e4a66c0353..0644e58076 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -120,12 +120,12 @@ void DetectHttpCookieRegister(void) GetResponseData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetRequestData2); DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2); DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetRequestData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer); diff --git a/src/detect-http-header-names.c b/src/detect-http-header-names.c index 6bfbb9a4dd..e1bf0c0a07 100644 --- a/src/detect-http-header-names.c +++ b/src/detect-http-header-names.c @@ -236,12 +236,12 @@ void DetectHttpHeaderNamesRegister(void) /* http2 */ DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2StateDataClient); + GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2StateOpen); DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2StateDataServer); DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); diff --git a/src/detect-http-header.c b/src/detect-http-header.c index c1a41dae57..3021dd7459 100644 --- a/src/detect-http-header.c +++ b/src/detect-http-header.c @@ -441,9 +441,9 @@ void DetectHttpHeaderRegister(void) 0); /* not used, registered twice: HEADERS/TRAILER */ DetectAppLayerInspectEngineRegister("http_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); DetectAppLayerMpmRegister("http_header", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2StateDataClient); + GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2StateOpen); DetectAppLayerInspectEngineRegister("http_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); diff --git a/src/detect-http-headers-stub.h b/src/detect-http-headers-stub.h index 641adb61c9..4b7f62ff2b 100644 --- a/src/detect-http-headers-stub.h +++ b/src/detect-http-headers-stub.h @@ -198,7 +198,7 @@ static void DetectHttpHeadersRegisterStub(void) DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetRequestData2, ALPROTO_HTTP2, HTTP2StateOpen); #endif #ifdef KEYWORD_TOCLIENT DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, @@ -210,7 +210,7 @@ static void DetectHttpHeadersRegisterStub(void) DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER, HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData); DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetRequestData2); #endif #ifdef KEYWORD_TOCLIENT DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT, diff --git a/src/detect-http-host.c b/src/detect-http-host.c index 1a95ccb314..a9fe3562e4 100644 --- a/src/detect-http-host.c +++ b/src/detect-http-host.c @@ -117,10 +117,10 @@ void DetectHttpHHRegister(void) GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); DetectAppLayerInspectEngineRegister("http_host", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister("http_host", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectBufferTypeRegisterValidateCallback("http_host", DetectHttpHostValidateCallback); @@ -157,10 +157,10 @@ void DetectHttpHHRegister(void) GetRawData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); DetectAppLayerInspectEngineRegister("http_raw_host", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRawData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetRawData2); DetectAppLayerMpmRegister("http_raw_host", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetRawData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetRawData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectBufferTypeSetDescriptionByName("http_raw_host", "http raw host header"); diff --git a/src/detect-http-method.c b/src/detect-http-method.c index 6e6cdf34bd..3c321829ff 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -107,10 +107,10 @@ void DetectHttpMethodRegister(void) GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE); DetectAppLayerInspectEngineRegister("http_method", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister("http_method", SIG_FLAG_TOSERVER, 4, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectBufferTypeSetDescriptionByName("http_method", "http request method"); diff --git a/src/detect-http-protocol.c b/src/detect-http-protocol.c index 16316f6307..c5c5dcfd57 100644 --- a/src/detect-http-protocol.c +++ b/src/detect-http-protocol.c @@ -173,9 +173,9 @@ void DetectHttpProtocolRegister(void) HTP_RESPONSE_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c index 7054ff4b35..d99334b4de 100644 --- a/src/detect-http-raw-header.c +++ b/src/detect-http-raw-header.c @@ -115,12 +115,12 @@ void DetectHttpRawHeaderRegister(void) 0); /* progress handled in register */ DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2StateDataServer); diff --git a/src/detect-http-request-line.c b/src/detect-http-request-line.c index b68fc6e4bf..d38d1d3376 100644 --- a/src/detect-http-request-line.c +++ b/src/detect-http-request-line.c @@ -117,9 +117,9 @@ void DetectHttpRequestLineRegister(void) PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE); DetectAppLayerInspectEngineRegister("http_request_line", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister("http_request_line", SIG_FLAG_TOSERVER, 2, - PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectBufferTypeSetDescriptionByName("http_request_line", "http request line"); diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c index 5db4d39f78..4115eb1b59 100644 --- a/src/detect-http-ua.c +++ b/src/detect-http-ua.c @@ -108,10 +108,10 @@ void DetectHttpUARegister(void) GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); DetectAppLayerInspectEngineRegister("http_user_agent", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister("http_user_agent", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectBufferTypeSetDescriptionByName("http_user_agent", "http user agent"); diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index ef66d933f9..70ee97a3eb 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -112,10 +112,10 @@ void DetectHttpUriRegister (void) GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE); DetectAppLayerInspectEngineRegister("http_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectBufferTypeSetDescriptionByName("http_uri", "http request uri"); @@ -150,10 +150,10 @@ void DetectHttpUriRegister (void) // no difference between raw and decoded uri for HTTP2 DetectAppLayerInspectEngineRegister("http_raw_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + HTTP2StateOpen, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister("http_raw_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + GetData2, ALPROTO_HTTP2, HTTP2StateOpen); DetectBufferTypeSetDescriptionByName("http_raw_uri", "raw http uri");