suricata
detect-http-host.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup httplayer
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
29  *
30  * Implements support for the http_host keyword.
31  */
32 
33 #include "suricata-common.h"
34 #include "threads.h"
35 #include "decode.h"
36 
37 #include "detect.h"
38 #include "detect-parse.h"
39 #include "detect-engine.h"
40 #include "detect-engine-mpm.h"
42 #include "detect-content.h"
43 #include "detect-pcre.h"
44 
45 #include "flow.h"
46 #include "flow-var.h"
47 #include "flow-util.h"
48 
49 #include "util-debug.h"
50 #include "util-unittest.h"
51 #include "util-unittest-helper.h"
52 #include "util-spm.h"
53 
54 #include "app-layer.h"
55 #include "app-layer-parser.h"
56 
57 #include "app-layer-htp.h"
58 #include "stream-tcp.h"
59 #include "detect-http-host.h"
60 
61 static int DetectHttpHHSetup(DetectEngineCtx *, Signature *, const char *);
62 #ifdef UNITTESTS
63 static void DetectHttpHHRegisterTests(void);
64 #endif
65 static bool DetectHttpHostValidateCallback(
66  const Signature *s, const char **sigerror, const DetectBufferType *dbt);
67 static int DetectHttpHostSetup(DetectEngineCtx *, Signature *, const char *);
68 static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
69  const DetectEngineTransforms *transforms,
70  Flow *_f, const uint8_t _flow_flags,
71  void *txv, const int list_id);
72 static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
73  const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
74  const int list_id);
75 static int DetectHttpHRHSetup(DetectEngineCtx *, Signature *, const char *);
76 static int g_http_raw_host_buffer_id = 0;
77 static int DetectHttpHostRawSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str);
78 static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
79  const DetectEngineTransforms *transforms, Flow *_f,
80  const uint8_t _flow_flags, void *txv, const int list_id);
81 static InspectionBuffer *GetRawData2(DetectEngineThreadCtx *det_ctx,
82  const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
83  const int list_id);
84 static int g_http_host_buffer_id = 0;
85 
86 /**
87  * \brief Registers the keyword handlers for the "http_host" keyword.
88  */
90 {
91  /* http_host content modifier */
93  sigmatch_table[DETECT_HTTP_HOST_CM].desc = "content modifier to match on the HTTP hostname";
95  "/rules/http-keywords.html#http-host-and-http-raw-host";
96  sigmatch_table[DETECT_HTTP_HOST_CM].Setup = DetectHttpHHSetup;
97 #ifdef UNITTESTS
99 #endif
102 
103  /* http.host sticky buffer */
104  sigmatch_table[DETECT_HTTP_HOST].name = "http.host";
105  sigmatch_table[DETECT_HTTP_HOST].desc = "sticky buffer to match on the HTTP Host buffer";
106  sigmatch_table[DETECT_HTTP_HOST].url = "/rules/http-keywords.html#http-host-and-http-raw-host";
107  sigmatch_table[DETECT_HTTP_HOST].Setup = DetectHttpHostSetup;
109 
111  HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetData);
112 
114  GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);
115 
117  HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
118 
120  GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);
121 
123  DetectHttpHostValidateCallback);
124 
126  "http host");
127 
128  g_http_host_buffer_id = DetectBufferTypeGetByName("http_host");
129 
130  /* http_raw_host content modifier */
131  sigmatch_table[DETECT_HTTP_RAW_HOST].name = "http_raw_host";
132  sigmatch_table[DETECT_HTTP_RAW_HOST].desc = "content modifier to match on the HTTP host header "
133  "or the raw hostname from the HTTP uri";
135  "/rules/http-keywords.html#http-host-and-http-raw-host";
136  sigmatch_table[DETECT_HTTP_RAW_HOST].Setup = DetectHttpHRHSetup;
139 
140  /* http.host sticky buffer */
141  sigmatch_table[DETECT_HTTP_HOST_RAW].name = "http.host.raw";
142  sigmatch_table[DETECT_HTTP_HOST_RAW].desc = "sticky buffer to match on the HTTP host header or the raw hostname from the HTTP uri";
143  sigmatch_table[DETECT_HTTP_HOST_RAW].url = "/rules/http-keywords.html#http-host-and-http-raw-host";
144  sigmatch_table[DETECT_HTTP_HOST_RAW].Setup = DetectHttpHostRawSetupSticky;
146 
148  HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetRawData);
149 
151  GetRawData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);
152 
154  HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRawData2);
155 
157  GetRawData2, ALPROTO_HTTP2, HTTP2StateDataClient);
158 
159  DetectBufferTypeSetDescriptionByName("http_raw_host",
160  "http raw host header");
161 
162  g_http_raw_host_buffer_id = DetectBufferTypeGetByName("http_raw_host");
163 }
164 
165 /**
166  * \brief The setup function for the http_host keyword for a signature.
167  *
168  * \param de_ctx Pointer to the detection engine context.
169  * \param s Pointer to the signature for the current Signature being
170  * parsed from the rules.
171  * \param m Pointer to the head of the SigMatch for the current rule
172  * being parsed.
173  * \param arg Pointer to the string holding the keyword value.
174  *
175  * \retval 0 On success
176  * \retval -1 On failure
177  */
178 static int DetectHttpHHSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
179 {
181  de_ctx, s, arg, DETECT_HTTP_HOST_CM, g_http_host_buffer_id, ALPROTO_HTTP1);
182 }
183 
184 static bool DetectHttpHostValidateCallback(
185  const Signature *s, const char **sigerror, const DetectBufferType *dbt)
186 {
187  for (uint32_t x = 0; x < s->init_data->buffer_index; x++) {
188  if (s->init_data->buffers[x].id != (uint32_t)dbt->id)
189  continue;
190  const SigMatch *sm = s->init_data->buffers[x].head;
191  for (; sm != NULL; sm = sm->next) {
192  if (sm->type == DETECT_CONTENT) {
194  if (cd->flags & DETECT_CONTENT_NOCASE) {
195  *sigerror = "http.host keyword "
196  "specified along with \"nocase\". "
197  "The hostname buffer is normalized "
198  "to lowercase, specifying "
199  "nocase is redundant.";
200  SCLogWarning("rule %u: %s", s->id, *sigerror);
201  return false;
202  } else {
203  uint32_t u;
204  for (u = 0; u < cd->content_len; u++) {
205  if (isupper(cd->content[u]))
206  break;
207  }
208  if (u != cd->content_len) {
209  *sigerror = "A pattern with "
210  "uppercase characters detected for http.host. "
211  "The hostname buffer is normalized to lowercase, "
212  "please specify a lowercase pattern.";
213  SCLogWarning("rule %u: %s", s->id, *sigerror);
214  return false;
215  }
216  }
217  }
218  }
219  }
220 
221  return true;
222 }
223 
224 /**
225  * \brief this function setup the http.host keyword used in the rule
226  *
227  * \param de_ctx Pointer to the Detection Engine Context
228  * \param s Pointer to the Signature to which the current keyword belongs
229  * \param str Should hold an empty string always
230  *
231  * \retval 0 On success
232  */
233 static int DetectHttpHostSetup(DetectEngineCtx *de_ctx, Signature *s, const char *str)
234 {
235  if (DetectBufferSetActiveList(de_ctx, s, g_http_host_buffer_id) < 0)
236  return -1;
238  return -1;
239  return 0;
240 }
241 
242 static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
243  const DetectEngineTransforms *transforms, Flow *_f,
244  const uint8_t _flow_flags, void *txv, const int list_id)
245 {
246  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
247  if (buffer->inspect == NULL) {
248  htp_tx_t *tx = (htp_tx_t *)txv;
249 
250  if (htp_tx_request_hostname(tx) == NULL)
251  return NULL;
252 
253  const uint32_t data_len = bstr_len(htp_tx_request_hostname(tx));
254  const uint8_t *data = bstr_ptr(htp_tx_request_hostname(tx));
255 
257  det_ctx, list_id, buffer, data, data_len, transforms);
258  }
259 
260  return buffer;
261 }
262 
263 static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx,
264  const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
265  const int list_id)
266 {
267  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
268  if (buffer->inspect == NULL) {
269  uint32_t b_len = 0;
270  const uint8_t *b = NULL;
271 
272  if (rs_http2_tx_get_host_norm(txv, &b, &b_len) != 1)
273  return NULL;
274  if (b == NULL || b_len == 0)
275  return NULL;
276 
277  InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
278  }
279 
280  return buffer;
281 }
282 
283 static InspectionBuffer *GetRawData2(DetectEngineThreadCtx *det_ctx,
284  const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
285  const int list_id)
286 {
287  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
288  if (buffer->inspect == NULL) {
289  uint32_t b_len = 0;
290  const uint8_t *b = NULL;
291 
292  if (rs_http2_tx_get_host(txv, &b, &b_len) != 1)
293  return NULL;
294  if (b == NULL || b_len == 0)
295  return NULL;
296 
297  InspectionBufferSetupAndApplyTransforms(det_ctx, list_id, buffer, b, b_len, transforms);
298  }
299 
300  return buffer;
301 }
302 
303 /**
304  * \brief The setup function for the http_raw_host keyword for a signature.
305  *
306  * \param de_ctx Pointer to the detection engine context.
307  * \param s Pointer to the signature for the current Signature being
308  * parsed from the rules.
309  * \param m Pointer to the head of the SigMatch for the current rule
310  * being parsed.
311  * \param arg Pointer to the string holding the keyword value.
312  *
313  * \retval 0 On success
314  * \retval -1 On failure
315  */
316 int DetectHttpHRHSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
317 {
319  de_ctx, s, arg, DETECT_HTTP_RAW_HOST, g_http_raw_host_buffer_id, ALPROTO_HTTP1);
320 }
321 
322 /**
323  * \brief this function setup the http.host keyword used in the rule
324  *
325  * \param de_ctx Pointer to the Detection Engine Context
326  * \param s Pointer to the Signature to which the current keyword belongs
327  * \param str Should hold an empty string always
328  *
329  * \retval 0 On success
330  */
331 static int DetectHttpHostRawSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str)
332 {
333  if (DetectBufferSetActiveList(de_ctx, s, g_http_raw_host_buffer_id) < 0)
334  return -1;
336  return -1;
337  return 0;
338 }
339 
340 static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
341  const DetectEngineTransforms *transforms, Flow *_f,
342  const uint8_t _flow_flags, void *txv, const int list_id)
343 {
344  InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
345  if (buffer->inspect == NULL) {
346  htp_tx_t *tx = (htp_tx_t *)txv;
347 
348  const uint8_t *data = NULL;
349  uint32_t data_len = 0;
350 
351  if (htp_uri_hostname(htp_tx_parsed_uri(tx)) == NULL) {
352  if (htp_tx_request_headers(tx) == NULL)
353  return NULL;
354 
355  const htp_header_t *h = htp_tx_request_header(tx, "Host");
356  if (h == NULL || htp_header_value(h) == NULL)
357  return NULL;
358 
359  data = htp_header_value_ptr(h);
360  data_len = htp_header_value_len(h);
361  } else {
362  data = (const uint8_t *)bstr_ptr(htp_uri_hostname(htp_tx_parsed_uri(tx)));
363  data_len = bstr_len(htp_uri_hostname(htp_tx_parsed_uri(tx)));
364  }
365 
367  det_ctx, list_id, buffer, data, data_len, transforms);
368  }
369 
370  return buffer;
371 }
372 
373 /************************************Unittests*********************************/
374 
375 #ifdef UNITTESTS
376 #include "tests/detect-http-host.c"
377 #endif /* UNITTESTS */
378 
379 /**
380  * @}
381  */
DETECT_CONTENT_NOCASE
#define DETECT_CONTENT_NOCASE
Definition: detect-content.h:29
DetectHttpHHRegister
void DetectHttpHHRegister(void)
Registers the keyword handlers for the "http_host" keyword.
Definition: detect-http-host.c:89
SigTableElmt_::url
const char * url
Definition: detect.h:1405
DetectSignatureSetAppProto
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:2218
SignatureInitDataBuffer_::head
SigMatch * head
Definition: detect.h:547
detect-content.h
detect-engine.h
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1616
SigTableElmt_::desc
const char * desc
Definition: detect.h:1404
sigmatch_table
SigTableElmt * sigmatch_table
Definition: detect-parse.c:155
DetectEngineInspectBufferGeneric
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2252
flow-util.h
SIGMATCH_INFO_CONTENT_MODIFIER
#define SIGMATCH_INFO_CONTENT_MODIFIER
Definition: detect.h:1614
DETECT_HTTP_HOST
@ DETECT_HTTP_HOST
Definition: detect-engine-register.h:184
SigTableElmt_::name
const char * name
Definition: detect.h:1402
InspectionBufferSetupAndApplyTransforms
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
Definition: detect-engine.c:1719
stream-tcp.h
DetectEngineTransforms
Definition: detect.h:415
DETECT_CONTENT
@ DETECT_CONTENT
Definition: detect-engine-register.h:69
DetectBufferSetActiveList
int DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
Definition: detect-engine.c:1422
InspectionBuffer
Definition: detect.h:380
threads.h
Flow_
Flow data structure.
Definition: flow.h:356
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1396
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:920
DetectBufferTypeRegisterValidateCallback
void DetectBufferTypeRegisterValidateCallback(const char *name, bool(*ValidateCallback)(const Signature *, const char **sigerror, const DetectBufferType *))
Definition: detect-engine.c:1369
DETECT_HTTP_RAW_HOST
@ DETECT_HTTP_RAW_HOST
Definition: detect-engine-register.h:185
DetectBufferType_
Definition: detect.h:463
DetectContentData_
Definition: detect-content.h:93
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1387
detect-pcre.h
detect-http-host.c
Handle HTTP host header. HHHD - Http Host Header Data.
detect-engine-prefilter.h
util-unittest.h
InspectionBufferGet
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
Definition: detect-engine.c:1578
util-unittest-helper.h
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1157
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:270
app-layer-htp.h
decode.h
util-debug.h
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:18
DetectEngineThreadCtx_
Definition: detect.h:1197
DetectHttpHHRegisterTests
void DetectHttpHHRegisterTests(void)
Definition: detect-http-host.c:2544
detect-engine-mpm.h
detect.h
SigMatch_::next
struct SigMatch_ * next
Definition: detect.h:360
DETECT_HTTP_HOST_RAW
@ DETECT_HTTP_HOST_RAW
Definition: detect-engine-register.h:186
PrefilterGenericMpmRegister
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
Definition: detect-engine-prefilter.c:1547
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
SigTableElmt_::alternative
uint16_t alternative
Definition: detect.h:1400
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Definition: detect-engine-mpm.c:151
app-layer-parser.h
SigMatch_::ctx
SigMatchCtx * ctx
Definition: detect.h:359
DetectEngineContentModifierBufferSetup
int DetectEngineContentModifierBufferSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg, int sm_type, int sm_list, AppProto alproto)
Definition: detect-parse.c:222
DetectContentData_::flags
uint32_t flags
Definition: detect-content.h:104
Signature_::init_data
SignatureInitData * init_data
Definition: detect.h:748
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:69
detect-http-host.h
DetectBufferType_::id
int id
Definition: detect.h:466
suricata-common.h
SigMatch_::type
uint16_t type
Definition: detect.h:357
ALPROTO_HTTP1
@ ALPROTO_HTTP1
Definition: app-layer-protos.h:36
util-spm.h
DetectContentData_::content
uint8_t * content
Definition: detect-content.h:94
SignatureInitData_::buffers
SignatureInitDataBuffer * buffers
Definition: detect.h:648
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:381
str
#define str(s)
Definition: suricata-common.h:300
DETECT_HTTP_HOST_CM
@ DETECT_HTTP_HOST_CM
Definition: detect-engine-register.h:183
Signature_::id
uint32_t id
Definition: detect.h:714
detect-parse.h
SignatureInitDataBuffer_::id
uint32_t id
Definition: detect.h:538
Signature_
Signature container.
Definition: detect.h:669
SigMatch_
a single match condition for a signature
Definition: detect.h:356
ALPROTO_HTTP
@ ALPROTO_HTTP
Definition: app-layer-protos.h:75
DetectContentData_::content_len
uint16_t content_len
Definition: detect-content.h:95
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1592
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
Definition: detect-engine.c:245
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1254
flow.h
SignatureInitData_::buffer_index
uint32_t buffer_index
Definition: detect.h:649
flow-var.h
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1394
app-layer.h