suricata
app-layer-http2.c
Go to the documentation of this file.
1 /* Copyright (C) 2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <p.antoine@catenacyber.fr>
22  *
23  * Parser for HTTP2, RFC 7540
24  */
25 
26 #include "suricata-common.h"
27 #include "stream.h"
28 #include "conf.h"
29 
30 #include "util-unittest.h"
31 
32 #include "app-layer-detect-proto.h"
33 #include "app-layer-parser.h"
34 
35 #include "app-layer-htp.h"
36 #include "app-layer-http2.h"
37 #include "rust.h"
38 
39 static int HTTP2RegisterPatternsForProtocolDetection(void)
40 {
41  /* Using the 24 bytes pattern makes AppLayerTest09 fail/leak
42  * The complete pattern is "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"
43  */
45  IPPROTO_TCP, ALPROTO_HTTP2, "PRI * HTTP/2.0\r\n", 16, 0, STREAM_TOSERVER) < 0) {
46  return -1;
47  }
48  return 0;
49 }
50 
52 static SuricataFileContext sfc = { &sbcfg };
53 
55 {
56  const char *proto_name = "http2";
57 
58  if (SCAppLayerProtoDetectConfProtoDetectionEnabledDefault("tcp", proto_name, true)) {
60  if (HTTP2RegisterPatternsForProtocolDetection() < 0)
61  return;
62 
63  SCHttp2Init(&sfc);
64  SCRegisterHttp2Parser();
65  }
66 
67 #ifdef UNITTESTS
68  //TODOask HTTP2ParserRegisterTests();
69 #endif
70 }
71 
72 void HTTP2MimicHttp1Request(void *alstate_orig, void *h2s)
73 {
74  htp_tx_t *h1tx = HtpGetTxForH2(alstate_orig);
75  if (h2s == NULL || h1tx == NULL) {
76  return;
77  }
78  if (htp_tx_request_method(h1tx) == NULL) {
79  // may happen if we only got the reply, not the HTTP1 request
80  return;
81  }
82  // else
83  SCHttp2TxSetMethod(h2s, bstr_ptr(htp_tx_request_method(h1tx)),
84  (uint32_t)bstr_len(htp_tx_request_method(h1tx)));
85  if (htp_tx_request_uri(h1tx) != NULL) {
86  // A request line without spaces gets interpreted as a request_method
87  // and has request_uri=NULL
88  SCHttp2TxSetUri(h2s, bstr_ptr(htp_tx_request_uri(h1tx)),
89  (uint32_t)bstr_len(htp_tx_request_uri(h1tx)));
90  }
91  size_t nbheaders = htp_tx_request_headers_size(h1tx);
92  for (size_t i = 0; i < nbheaders; i++) {
93  const htp_header_t *h = htp_tx_request_header_index(h1tx, i);
94  SCHttp2TxAddHeader(h2s, htp_header_name_ptr(h), (uint32_t)htp_header_name_len(h),
95  htp_header_value_ptr(h), (uint32_t)htp_header_value_len(h));
96  }
97 }
SCAppLayerProtoDetectPMRegisterPatternCI
int SCAppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1649
STREAMING_BUFFER_CONFIG_INITIALIZER
#define STREAMING_BUFFER_CONFIG_INITIALIZER
Definition: util-streaming-buffer.h:74
HtpGetTxForH2
void * HtpGetTxForH2(void *alstate)
Definition: app-layer-htp.c:2511
rust.h
app-layer-http2.h
util-unittest.h
app-layer-detect-proto.h
app-layer-htp.h
app-layer-parser.h
stream.h
conf.h
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1742
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
suricata-common.h
StreamingBufferConfig_
Definition: util-streaming-buffer.h:65
SuricataFileContext_
Definition: rust-context.h:66
HTTP2MimicHttp1Request
void HTTP2MimicHttp1Request(void *alstate_orig, void *h2s)
Definition: app-layer-http2.c:72
SCAppLayerProtoDetectConfProtoDetectionEnabledDefault
int SCAppLayerProtoDetectConfProtoDetectionEnabledDefault(const char *ipproto, const char *alproto, bool default_enabled)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1872
RegisterHTTP2Parsers
void RegisterHTTP2Parsers(void)
Definition: app-layer-http2.c:54