aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix HTTP state and raw stream not being inspected at the same time. Adds an exception to transaction id handling for HTTP.

Browse Source
remotes/origin/master-1.2.x
Victor Julien 15 years ago
parent 16cfae2f51
commit f084874998
3 changed files with 74 additions and 130 deletions
Show Stats Download Patch File Download Diff File

7
src/app-layer-parser.c
Unescape Escape View File

@ -1167,10 +1167,13 @@ int AppLayerTransactionUpdateInspectId(Flow *f, char direction)
SCLogDebug("avail_id %"PRIu16", inspect_id %"PRIu16,
parser_state_store->avail_id, parser_state_store->inspect_id);
if (direction == STREAM_TOSERVER)
if (direction == STREAM_TOSERVER) {
SCLogDebug("toserver");
parser_state_store->id_flags |= APP_LAYER_TRANSACTION_TOSERVER;
else
} else {
SCLogDebug("toclient");
parser_state_store->id_flags |= APP_LAYER_TRANSACTION_TOCLIENT;
}
if ((parser_state_store->inspect_id+1) < parser_state_store->avail_id &&
(parser_state_store->id_flags & APP_LAYER_TRANSACTION_TOCLIENT) &&

154
src/detect-http-server-body.c
Unescape Escape View File

@ -1435,7 +1435,7 @@ static int DetectHttpServerBodyTest14(void) {
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
@ -1449,12 +1449,12 @@ static int DetectHttpServerBodyTest14(void) {
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Mozilla\"; http_header; content:\"dummy1\"; http_cookie; content:\"one\"; http_server_body; sid:1; rev:1;)");
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; content:\"one\"; http_server_body; sid:1; rev:1;)");
if (s == NULL) {
printf("sig parse failed: ");
goto end;
}
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; content:\"two\"; http_server_body; sid:2; rev:1;)");
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; content:\"two\"; http_server_body; sid:2; rev:1;)");
if (s == NULL) {
printf("sig2 parse failed: ");
goto end;
@ -1463,22 +1463,15 @@ static int DetectHttpServerBodyTest14(void) {
SigGroupBuild(de_ctx);
DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
SCLogDebug("add chunk 1");
int r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER|STREAM_START, httpbuf1, httplen1);
if (r != 0) {
printf("toserver chunk 1 returned %" PRId32 ", expected 0: ", r);
goto end;
}
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 alerted (tx 1): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
SCLogDebug("add chunk 2");
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2);
if (r != 0) {
@ -1486,6 +1479,8 @@ static int DetectHttpServerBodyTest14(void) {
goto end;
}
SCLogDebug("inspect chunk 1");
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (!(PacketAlertCheck(p, 1))) {
@ -1494,8 +1489,7 @@ static int DetectHttpServerBodyTest14(void) {
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOCLIENT;
p->flowflags |= FLOW_PKT_TOSERVER;
SCLogDebug("add chunk 3");
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3);
if (r != 0) {
@ -1503,20 +1497,7 @@ static int DetectHttpServerBodyTest14(void) {
goto end;
}
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 matched, but shouldn't have (tx 2): ");
goto end;
}
if ((PacketAlertCheck(p, 2))) {
printf("sig 2 alerted (tx 2): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
SCLogDebug("add chunk 4");
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOCLIENT|STREAM_EOF, httpbuf4, httplen4);
if (r != 0) {
@ -1524,6 +1505,8 @@ static int DetectHttpServerBodyTest14(void) {
goto end;
}
SCLogDebug("inspect chunk 4");
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if ((PacketAlertCheck(p, 1))) {
@ -1608,7 +1591,7 @@ static int DetectHttpServerBodyTest15(void) {
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
@ -1622,12 +1605,12 @@ static int DetectHttpServerBodyTest15(void) {
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"index1\"; http_uri; content:\"Mozilla\"; http_header; content:\"dummy1\"; http_cookie; content:\"one\"; http_server_body; sid:1; rev:1;)");
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; content:\"one\"; http_server_body; sid:1; rev:1;)");
if (s == NULL) {
printf("sig parse failed: ");
goto end;
}
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"index2\"; http_uri; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; content:\"two\"; http_server_body; sid:2; rev:1;)");
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; content:\"two\"; http_server_body; sid:2; rev:1;)");
if (s == NULL) {
printf("sig2 parse failed: ");
goto end;
@ -1642,17 +1625,6 @@ static int DetectHttpServerBodyTest15(void) {
goto end;
}
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 alerted (tx 1): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2);
if (r != 0) {
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
@ -1665,32 +1637,18 @@ static int DetectHttpServerBodyTest15(void) {
printf("sig 1 didn't alert (tx 1): ");
goto end;
}
if (PacketAlertCheck(p, 2)) {
printf("sig 2 alerted (tx 1): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOCLIENT;
p->flowflags |= FLOW_PKT_TOSERVER;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3);
if (r != 0) {
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
goto end;
}
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 matched, but shouldn't have (tx 2): ");
goto end;
}
if ((PacketAlertCheck(p, 2))) {
printf("sig 2 alerted (tx 2): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOCLIENT|STREAM_EOF, httpbuf4, httplen4);
if (r != 0) {
printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r);
@ -3353,7 +3311,7 @@ static int DetectHttpServerBodyFileDataTest06(void)
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
"(msg:\"http client body test\"; "
"(msg:\"http file_data test\"; "
"file_data; content:!\"MaSSaGE\"; nocase; "
"sid:1;)");
if (de_ctx->sig_list == NULL)
@ -3483,7 +3441,7 @@ static int DetectHttpServerBodyFileDataTest07(void)
de_ctx->flags |= DE_QUIET;
de_ctx->sig_list = SigInit(de_ctx,"alert http any any -> any any "
"(msg:\"http client body test\"; "
"(msg:\"http file_data test\"; "
"file_data; content:!\"MeSSaGE\"; nocase; "
"sid:1;)");
if (de_ctx->sig_list == NULL)
@ -3699,7 +3657,7 @@ static int DetectHttpServerBodyFileDataTest09(void) {
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
@ -3713,12 +3671,12 @@ static int DetectHttpServerBodyFileDataTest09(void) {
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Mozilla\"; http_header; content:\"dummy1\"; http_cookie; file_data; content:\"one\"; sid:1; rev:1;)");
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; file_data; content:\"one\"; sid:1; rev:1;)");
if (s == NULL) {
printf("sig parse failed: ");
goto end;
}
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; file_data; content:\"two\"; sid:2; rev:1;)");
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; file_data; content:\"two\"; sid:2; rev:1;)");
if (s == NULL) {
printf("sig2 parse failed: ");
goto end;
@ -3733,17 +3691,6 @@ static int DetectHttpServerBodyFileDataTest09(void) {
goto end;
}
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 alerted (tx 1): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2);
if (r != 0) {
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
@ -3758,30 +3705,12 @@ static int DetectHttpServerBodyFileDataTest09(void) {
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOCLIENT;
p->flowflags |= FLOW_PKT_TOSERVER;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3);
if (r != 0) {
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
goto end;
}
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 matched, but shouldn't have (tx 2): ");
goto end;
}
if ((PacketAlertCheck(p, 2))) {
printf("sig 2 alerted (tx 2): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOCLIENT|STREAM_EOF, httpbuf4, httplen4);
if (r != 0) {
printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r);
@ -3872,7 +3801,7 @@ static int DetectHttpServerBodyFileDataTest10(void) {
f.flags |= FLOW_IPV4;
p->flow = &f;
p->flowflags |= FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
p->flowflags |= FLOW_PKT_ESTABLISHED;
p->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
f.alproto = ALPROTO_HTTP;
@ -3886,12 +3815,12 @@ static int DetectHttpServerBodyFileDataTest10(void) {
de_ctx->flags |= DE_QUIET;
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"index1\"; http_uri; content:\"Mozilla\"; http_header; content:\"dummy1\"; http_cookie; file_data; content:\"one\"; sid:1; rev:1;)");
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; file_data; content:\"one\"; sid:1; rev:1;)");
if (s == NULL) {
printf("sig parse failed: ");
goto end;
}
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (content:\"GET\"; http_method; content:\"index2\"; http_uri; content:\"Firefox\"; http_header; content:\"dummy2\"; http_cookie; file_data; content:\"two\"; sid:2; rev:1;)");
s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (flow:established,to_client; file_data; content:\"two\"; sid:2; rev:1;)");
if (s == NULL) {
printf("sig2 parse failed: ");
goto end;
@ -3906,17 +3835,6 @@ static int DetectHttpServerBodyFileDataTest10(void) {
goto end;
}
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 alerted (tx 1): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOCLIENT, httpbuf2, httplen2);
if (r != 0) {
printf("toserver chunk 2 returned %" PRId32 ", expected 0: ", r);
@ -3931,30 +3849,12 @@ static int DetectHttpServerBodyFileDataTest10(void) {
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOCLIENT;
p->flowflags |= FLOW_PKT_TOSERVER;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOSERVER, httpbuf3, httplen3);
if (r != 0) {
printf("toserver chunk 3 returned %" PRId32 ", expected 0: ", r);
goto end;
}
/* do detect */
SigMatchSignatures(&th_v, de_ctx, det_ctx, p);
if (PacketAlertCheck(p, 1)) {
printf("sig 1 matched, but shouldn't have (tx 2): ");
goto end;
}
if ((PacketAlertCheck(p, 2))) {
printf("sig 2 alerted (tx 2): ");
goto end;
}
p->alerts.cnt = 0;
p->flowflags &= ~FLOW_PKT_TOSERVER;
p->flowflags |= FLOW_PKT_TOCLIENT;
r = AppLayerParse(NULL, &f, ALPROTO_HTTP, STREAM_TOCLIENT|STREAM_EOF, httpbuf4, httplen4);
if (r != 0) {
printf("toserver chunk 4 returned %" PRId32 ", expected 0: ", r);

43
src/detect.c
Unescape Escape View File

@ -1191,6 +1191,22 @@ static inline void DetectMpmPrefilter(DetectEngineCtx *de_ctx,
}
}
#ifdef DEBUG
static void DebugInspectIds(Packet *p, Flow *f, StreamMsg *smsg)
{
AppLayerParserStateStore *parser_state_store = f->alparser;
if (parser_state_store != NULL) {
SCLogDebug("pcap_cnt %02"PRIu64", %s, %12s, avail_id %u, inspect_id %u, inspecting %u, smsg %s",
p->pcap_cnt, p->flowflags & FLOW_PKT_TOSERVER ? "toserver" : "toclient",
p->flags & PKT_STREAM_EST ? "established" : "stateless",
parser_state_store->avail_id, parser_state_store->inspect_id,
parser_state_store->inspect_id+1, smsg?"yes":"no");
//if (smsg)
// PrintRawDataFp(stdout,smsg->data.data, smsg->data.data_len);
}
}
#endif
/**
* \brief Signature match function
@ -1293,6 +1309,22 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
}
SCLogDebug("p->flowflags 0x%02x", p->flowflags);
/* see if we need to increment the inspect_id and reset the de_state */
if (alstate != NULL && alproto == ALPROTO_HTTP) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL);
SCLogDebug("getting de_state_status");
int de_state_status = DeStateUpdateInspectTransactionId(p->flow,
(flags & STREAM_TOSERVER) ? STREAM_TOSERVER : STREAM_TOCLIENT);
SCLogDebug("de_state_status %d", de_state_status);
if (de_state_status == 2) {
SCMutexLock(&p->flow->de_state_m);
DetectEngineStateReset(p->flow->de_state);
SCMutexUnlock(&p->flow->de_state_m);
}
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_STATEFUL);
}
if ((p->flowflags & FLOW_PKT_TOSERVER && !(p->flowflags & FLOW_PKT_TOSERVER_IPONLY_SET)) ||
(p->flowflags & FLOW_PKT_TOCLIENT && !(p->flowflags & FLOW_PKT_TOCLIENT_IPONLY_SET)))
{
@ -1331,6 +1363,14 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
det_ctx->sgh = SigMatchSignaturesGetSgh(de_ctx, det_ctx, p);
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_GETSGH);
}
#ifdef DEBUG
if (p->flow) {
SCMutexLock(&p->flow->m);
DebugInspectIds(p, p->flow, smsg);
SCMutexUnlock(&p->flow->m);
}
#endif
} else { /* p->flags & PKT_HAS_FLOW */
/* no flow */
@ -1614,7 +1654,8 @@ next:
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_RULES);
end:
if (alstate != NULL) {
/* see if we need to increment the inspect_id and reset the de_state */
if (alstate != NULL && alproto != ALPROTO_HTTP) {
PACKET_PROFILING_DETECT_START(p, PROF_DETECT_STATEFUL);
SCLogDebug("getting de_state_status");
int de_state_status = DeStateUpdateInspectTransactionId(p->flow,

Write Preview
Loading…
Cancel
Save