suricata
app-layer-http2.c
Go to the documentation of this file.
1 /* Copyright (C) 2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <p.antoine@catenacyber.fr>
22  *
23  * Parser for HTTP2, RFC 7540
24  */
25 
26 #include "suricata-common.h"
27 #include "stream.h"
28 #include "conf.h"
29 
30 #include "util-unittest.h"
31 
32 #include "app-layer-detect-proto.h"
33 #include "app-layer-parser.h"
34 
35 #include "app-layer-htp.h"
36 #include "app-layer-http2.h"
37 #include "rust.h"
38 
39 static int HTTP2RegisterPatternsForProtocolDetection(void)
40 {
41  /* Using the 24 bytes pattern makes AppLayerTest09 fail/leak
42  * The complete pattern is "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"
43  */
45  "PRI * HTTP/2.0\r\n",
46  16, 0, STREAM_TOSERVER) < 0)
47  {
48  return -1;
49  }
50  return 0;
51 }
52 
54 static SuricataFileContext sfc = { &sbcfg };
55 
57 {
58  const char *proto_name = "http2";
59 
60  if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", proto_name)) {
62  if (HTTP2RegisterPatternsForProtocolDetection() < 0)
63  return;
64 
65  rs_http2_init(&sfc);
66  rs_http2_register_parser();
67  }
68 
69 #ifdef UNITTESTS
70  //TODOask HTTP2ParserRegisterTests();
71 #endif
72 }
73 
74 void HTTP2MimicHttp1Request(void *alstate_orig, void *h2s)
75 {
76  htp_tx_t *h1tx = HtpGetTxForH2(alstate_orig);
77  if (h2s == NULL || h1tx == NULL) {
78  return;
79  }
80 
81  rs_http2_tx_set_method(h2s, bstr_ptr(h1tx->request_method), bstr_len(h1tx->request_method));
82  rs_http2_tx_set_uri(h2s, bstr_ptr(h1tx->request_uri), bstr_len(h1tx->request_uri));
83  size_t nbheaders = htp_table_size(h1tx->request_headers);
84  for (size_t i = 0; i < nbheaders; i++) {
85  htp_header_t *h = htp_table_get_index(h1tx->request_headers, i, NULL);
86  if (h != NULL) {
87  rs_http2_tx_add_header(h2s, bstr_ptr(h->name), bstr_len(h->name), bstr_ptr(h->value),
88  bstr_len(h->value));
89  }
90  }
91 }
AppLayerProtoDetectPMRegisterPatternCI
int AppLayerProtoDetectPMRegisterPatternCI(uint8_t ipproto, AppProto alproto, const char *pattern, uint16_t depth, uint16_t offset, uint8_t direction)
Registers a case-insensitive pattern for protocol detection.
Definition: app-layer-detect-proto.c:1800
STREAMING_BUFFER_CONFIG_INITIALIZER
#define STREAMING_BUFFER_CONFIG_INITIALIZER
Definition: util-streaming-buffer.h:77
HtpGetTxForH2
void * HtpGetTxForH2(void *alstate)
Definition: app-layer-htp.c:2970
rust.h
app-layer-http2.h
util-unittest.h
app-layer-detect-proto.h
app-layer-htp.h
STREAM_TOSERVER
#define STREAM_TOSERVER
Definition: stream.h:31
app-layer-parser.h
stream.h
conf.h
AppLayerProtoDetectRegisterProtocol
void AppLayerProtoDetectRegisterProtocol(AppProto alproto, const char *alproto_name)
Registers a protocol for protocol detection phase.
Definition: app-layer-detect-proto.c:1875
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:59
suricata-common.h
StreamingBufferConfig_
Definition: util-streaming-buffer.h:67
SuricataFileContext_
Definition: rust-context.h:53
HTTP2MimicHttp1Request
void HTTP2MimicHttp1Request(void *alstate_orig, void *h2s)
Definition: app-layer-http2.c:74
RegisterHTTP2Parsers
void RegisterHTTP2Parsers(void)
Definition: app-layer-http2.c:56
AppLayerProtoDetectConfProtoDetectionEnabled
int AppLayerProtoDetectConfProtoDetectionEnabled(const char *ipproto, const char *alproto)
Given a protocol name, checks if proto detection is enabled in the conf file.
Definition: app-layer-detect-proto.c:1938