suricata
detect-http2.c
Go to the documentation of this file.
1 /* Copyright (C) 2020-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Philippe Antoine <p.antoine@catenacyber.fr>
22  *
23  */
24 
25 #include "suricata-common.h"
26 
27 #include "detect.h"
28 #include "detect-parse.h"
29 #include "detect-content.h"
30 
31 #include "detect-engine.h"
32 #include "detect-engine-uint.h"
33 #include "detect-engine-mpm.h"
34 #include "detect-engine-prefilter.h"
35 #include "detect-engine-content-inspection.h"
36 
37 #include "detect-http2.h"
38 #include "util-byte.h"
39 #include "rust.h"
40 #include "util-profiling.h"
41 
42 #ifdef UNITTESTS
43 void DetectHTTP2frameTypeRegisterTests (void);
44 void DetectHTTP2errorCodeRegisterTests (void);
45 void DetectHTTP2priorityRegisterTests (void);
46 void DetectHTTP2windowRegisterTests (void);
47 void DetectHTTP2settingsRegisterTests (void);
48 void DetectHTTP2sizeUpdateRegisterTests (void);
49 #endif
50 
51 /* prototypes */
52 static int DetectHTTP2frametypeMatch(DetectEngineThreadCtx *det_ctx,
53  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
54  const SigMatchCtx *ctx);
55 static int DetectHTTP2frametypeSetup (DetectEngineCtx *, Signature *, const char *);
56 void DetectHTTP2frametypeFree (DetectEngineCtx *, void *);
57 
58 static int DetectHTTP2errorcodeMatch(DetectEngineThreadCtx *det_ctx,
59  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
60  const SigMatchCtx *ctx);
61 static int DetectHTTP2errorcodeSetup (DetectEngineCtx *, Signature *, const char *);
62 void DetectHTTP2errorcodeFree (DetectEngineCtx *, void *);
63 
64 static int DetectHTTP2priorityMatch(DetectEngineThreadCtx *det_ctx,
65  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
66  const SigMatchCtx *ctx);
67 static int DetectHTTP2prioritySetup (DetectEngineCtx *, Signature *, const char *);
68 void DetectHTTP2priorityFree (DetectEngineCtx *, void *);
69 
70 static int DetectHTTP2windowMatch(DetectEngineThreadCtx *det_ctx,
71  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
72  const SigMatchCtx *ctx);
73 static int DetectHTTP2windowSetup (DetectEngineCtx *, Signature *, const char *);
74 void DetectHTTP2windowFree (DetectEngineCtx *, void *);
75 
76 static int DetectHTTP2sizeUpdateMatch(DetectEngineThreadCtx *det_ctx,
77  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
78  const SigMatchCtx *ctx);
79 static int DetectHTTP2sizeUpdateSetup (DetectEngineCtx *, Signature *, const char *);
80 void DetectHTTP2sizeUpdateFree (DetectEngineCtx *, void *);
81 
82 static int DetectHTTP2settingsMatch(DetectEngineThreadCtx *det_ctx,
83  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
84  const SigMatchCtx *ctx);
85 static int DetectHTTP2settingsSetup (DetectEngineCtx *, Signature *, const char *);
86 void DetectHTTP2settingsFree (DetectEngineCtx *, void *);
87 
88 static int DetectHTTP2headerNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg);
89 static int PrefilterMpmHttp2HeaderNameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
90  MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id);
91 static uint8_t DetectEngineInspectHttp2HeaderName(DetectEngineCtx *de_ctx,
92  DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine,
93  const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id);
94 
95 #ifdef UNITTESTS
96 void DetectHTTP2RegisterTests (void);
97 #endif
98 
99 static int g_http2_match_buffer_id = 0;
100 static int g_http2_header_name_buffer_id = 0;
101 
102 /**
103  * \brief Registration function for HTTP2 keywords
104  */
105 
106 void DetectHttp2Register(void)
107 {
108  sigmatch_table[DETECT_HTTP2_FRAMETYPE].name = "http2.frametype";
109  sigmatch_table[DETECT_HTTP2_FRAMETYPE].desc = "match on HTTP2 frame type field";
110  sigmatch_table[DETECT_HTTP2_FRAMETYPE].url = "/rules/http2-keywords.html#frametype";
111  sigmatch_table[DETECT_HTTP2_FRAMETYPE].Match = NULL;
112  sigmatch_table[DETECT_HTTP2_FRAMETYPE].AppLayerTxMatch = DetectHTTP2frametypeMatch;
113  sigmatch_table[DETECT_HTTP2_FRAMETYPE].Setup = DetectHTTP2frametypeSetup;
114  sigmatch_table[DETECT_HTTP2_FRAMETYPE].Free = DetectHTTP2frametypeFree;
115 #ifdef UNITTESTS
116  sigmatch_table[DETECT_HTTP2_FRAMETYPE].RegisterTests = DetectHTTP2frameTypeRegisterTests;
117 #endif
118 
119  sigmatch_table[DETECT_HTTP2_ERRORCODE].name = "http2.errorcode";
120  sigmatch_table[DETECT_HTTP2_ERRORCODE].desc = "match on HTTP2 error code field";
121  sigmatch_table[DETECT_HTTP2_ERRORCODE].url = "/rules/http2-keywords.html#errorcode";
122  sigmatch_table[DETECT_HTTP2_ERRORCODE].Match = NULL;
123  sigmatch_table[DETECT_HTTP2_ERRORCODE].AppLayerTxMatch = DetectHTTP2errorcodeMatch;
124  sigmatch_table[DETECT_HTTP2_ERRORCODE].Setup = DetectHTTP2errorcodeSetup;
125  sigmatch_table[DETECT_HTTP2_ERRORCODE].Free = DetectHTTP2errorcodeFree;
126 #ifdef UNITTESTS
127  sigmatch_table[DETECT_HTTP2_ERRORCODE].RegisterTests = DetectHTTP2errorCodeRegisterTests;
128 #endif
129 
130  sigmatch_table[DETECT_HTTP2_PRIORITY].name = "http2.priority";
131  sigmatch_table[DETECT_HTTP2_PRIORITY].desc = "match on HTTP2 priority weight field";
132  sigmatch_table[DETECT_HTTP2_PRIORITY].url = "/rules/http2-keywords.html#priority";
133  sigmatch_table[DETECT_HTTP2_PRIORITY].Match = NULL;
134  sigmatch_table[DETECT_HTTP2_PRIORITY].AppLayerTxMatch = DetectHTTP2priorityMatch;
135  sigmatch_table[DETECT_HTTP2_PRIORITY].Setup = DetectHTTP2prioritySetup;
136  sigmatch_table[DETECT_HTTP2_PRIORITY].Free = DetectHTTP2priorityFree;
137 #ifdef UNITTESTS
138  sigmatch_table[DETECT_HTTP2_PRIORITY].RegisterTests = DetectHTTP2priorityRegisterTests;
139 #endif
140 
141  sigmatch_table[DETECT_HTTP2_WINDOW].name = "http2.window";
142  sigmatch_table[DETECT_HTTP2_WINDOW].desc = "match on HTTP2 window update size increment field";
143  sigmatch_table[DETECT_HTTP2_WINDOW].url = "/rules/http2-keywords.html#window";
144  sigmatch_table[DETECT_HTTP2_WINDOW].Match = NULL;
145  sigmatch_table[DETECT_HTTP2_WINDOW].AppLayerTxMatch = DetectHTTP2windowMatch;
146  sigmatch_table[DETECT_HTTP2_WINDOW].Setup = DetectHTTP2windowSetup;
147  sigmatch_table[DETECT_HTTP2_WINDOW].Free = DetectHTTP2windowFree;
148 #ifdef UNITTESTS
149  sigmatch_table[DETECT_HTTP2_WINDOW].RegisterTests = DetectHTTP2windowRegisterTests;
150 #endif
151 
152  sigmatch_table[DETECT_HTTP2_SIZEUPDATE].name = "http2.size_update";
153  sigmatch_table[DETECT_HTTP2_SIZEUPDATE].desc = "match on HTTP2 dynamic headers table size update";
154  sigmatch_table[DETECT_HTTP2_SIZEUPDATE].url = "/rules/http2-keywords.html#sizeupdate";
155  sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Match = NULL;
156  sigmatch_table[DETECT_HTTP2_SIZEUPDATE].AppLayerTxMatch = DetectHTTP2sizeUpdateMatch;
157  sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Setup = DetectHTTP2sizeUpdateSetup;
158  sigmatch_table[DETECT_HTTP2_SIZEUPDATE].Free = DetectHTTP2sizeUpdateFree;
159 #ifdef UNITTESTS
160  sigmatch_table[DETECT_HTTP2_SIZEUPDATE].RegisterTests = DetectHTTP2sizeUpdateRegisterTests;
161 #endif
162 
163  sigmatch_table[DETECT_HTTP2_SETTINGS].name = "http2.settings";
164  sigmatch_table[DETECT_HTTP2_SETTINGS].desc = "match on HTTP2 settings identifier and value fields";
165  sigmatch_table[DETECT_HTTP2_SETTINGS].url = "/rules/http2-keywords.html#settings";
166  sigmatch_table[DETECT_HTTP2_SETTINGS].Match = NULL;
167  sigmatch_table[DETECT_HTTP2_SETTINGS].AppLayerTxMatch = DetectHTTP2settingsMatch;
168  sigmatch_table[DETECT_HTTP2_SETTINGS].Setup = DetectHTTP2settingsSetup;
169  sigmatch_table[DETECT_HTTP2_SETTINGS].Free = DetectHTTP2settingsFree;
170 #ifdef UNITTESTS
171  sigmatch_table[DETECT_HTTP2_SETTINGS].RegisterTests = DetectHTTP2settingsRegisterTests;
172 #endif
173 
174  sigmatch_table[DETECT_HTTP2_HEADERNAME].name = "http2.header_name";
175  sigmatch_table[DETECT_HTTP2_HEADERNAME].desc = "sticky buffer to match on one HTTP2 header name";
176  sigmatch_table[DETECT_HTTP2_HEADERNAME].url = "/rules/http2-keywords.html#header_name";
177  sigmatch_table[DETECT_HTTP2_HEADERNAME].Setup = DetectHTTP2headerNameSetup;
178  sigmatch_table[DETECT_HTTP2_HEADERNAME].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
179 
180  DetectAppLayerMpmRegister("http2_header_name", SIG_FLAG_TOCLIENT, 2,
181  PrefilterMpmHttp2HeaderNameRegister, NULL, ALPROTO_HTTP2, HTTP2StateOpen);
182  DetectAppLayerInspectEngineRegister("http2_header_name", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
183  HTTP2StateOpen, DetectEngineInspectHttp2HeaderName, NULL);
184  DetectAppLayerMpmRegister("http2_header_name", SIG_FLAG_TOSERVER, 2,
185  PrefilterMpmHttp2HeaderNameRegister, NULL, ALPROTO_HTTP2, HTTP2StateOpen);
186  DetectAppLayerInspectEngineRegister("http2_header_name", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
187  HTTP2StateOpen, DetectEngineInspectHttp2HeaderName, NULL);
188  DetectBufferTypeSupportsMultiInstance("http2_header_name");
189  DetectBufferTypeSetDescriptionByName("http2_header_name",
190  "HTTP2 header name");
191  g_http2_header_name_buffer_id = DetectBufferTypeGetByName("http2_header_name");
192 
193  DetectAppLayerInspectEngineRegister(
194  "http2", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, 0, DetectEngineInspectGenericList, NULL);
195  DetectAppLayerInspectEngineRegister(
196  "http2", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, 0, DetectEngineInspectGenericList, NULL);
197 
198  g_http2_match_buffer_id = DetectBufferTypeRegister("http2");
199  return;
200 }
201 
202 /**
203  * \brief This function is used to match HTTP2 frame type rule option on a transaction with those passed via http2.frametype:
204  *
205  * \retval 0 no match
206  * \retval 1 match
207  */
208 static int DetectHTTP2frametypeMatch(DetectEngineThreadCtx *det_ctx,
209  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
210  const SigMatchCtx *ctx)
211 
212 {
213  uint8_t *detect = (uint8_t *)ctx;
214 
215  return rs_http2_tx_has_frametype(txv, flags, *detect);
216 }
217 
218 static int DetectHTTP2FuncParseFrameType(const char *str, uint8_t *ft)
219 {
220  // first parse numeric value
221  if (ByteExtractStringUint8(ft, 10, (uint16_t)strlen(str), str) >= 0) {
222  return 1;
223  }
224 
225  // it it failed so far, parse string value from enumeration
226  int r = rs_http2_parse_frametype(str);
227  if (r >= 0 && r <= UINT8_MAX) {
228  *ft = (uint8_t)r;
229  return 1;
230  }
231 
232  return 0;
233 }
234 
235 /**
236  * \brief this function is used to attach the parsed http2.frametype data into the current signature
237  *
238  * \param de_ctx pointer to the Detection Engine Context
239  * \param s pointer to the Current Signature
240  * \param str pointer to the user provided http2.frametype options
241  *
242  * \retval 0 on Success
243  * \retval -1 on Failure
244  */
245 static int DetectHTTP2frametypeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
246 {
247  uint8_t frame_type;
248 
249  if (DetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
250  return -1;
251 
252  if (!DetectHTTP2FuncParseFrameType(str, &frame_type)) {
253  SCLogError("Invalid argument \"%s\" supplied to http2.frametype keyword.", str);
254  return -1;
255  }
256 
257  uint8_t *http2ft = SCCalloc(1, sizeof(uint8_t));
258  if (http2ft == NULL)
259  return -1;
260  *http2ft = frame_type;
261 
262  if (SigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_FRAMETYPE, (SigMatchCtx *)http2ft,
263  g_http2_match_buffer_id) == NULL) {
264  DetectHTTP2frametypeFree(NULL, http2ft);
265  return -1;
266  }
267 
268  return 0;
269 }
270 
271 /**
272  * \brief this function will free memory associated with uint8_t
273  *
274  * \param ptr pointer to uint8_t
275  */
276 void DetectHTTP2frametypeFree(DetectEngineCtx *de_ctx, void *ptr)
277 {
278  SCFree(ptr);
279 }
280 
281 /**
282  * \brief This function is used to match HTTP2 error code rule option on a transaction with those passed via http2.errorcode:
283  *
284  * \retval 0 no match
285  * \retval 1 match
286  */
287 static int DetectHTTP2errorcodeMatch(DetectEngineThreadCtx *det_ctx,
288  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
289  const SigMatchCtx *ctx)
290 
291 {
292  uint32_t *detect = (uint32_t *)ctx;
293 
294  return rs_http2_tx_has_errorcode(txv, flags, *detect);
295  //TODOask handle negation rules
296 }
297 
298 static int DetectHTTP2FuncParseErrorCode(const char *str, uint32_t *ec)
299 {
300  // first parse numeric value
301  if (ByteExtractStringUint32(ec, 10, (uint16_t)strlen(str), str) >= 0) {
302  return 1;
303  }
304 
305  // it it failed so far, parse string value from enumeration
306  int r = rs_http2_parse_errorcode(str);
307  if (r >= 0) {
308  *ec = r;
309  return 1;
310  }
311 
312  return 0;
313 }
314 
315 /**
316  * \brief this function is used to attach the parsed http2.errorcode data into the current signature
317  *
318  * \param de_ctx pointer to the Detection Engine Context
319  * \param s pointer to the Current Signature
320  * \param str pointer to the user provided http2.errorcode options
321  *
322  * \retval 0 on Success
323  * \retval -1 on Failure
324  */
325 static int DetectHTTP2errorcodeSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
326 {
327  uint32_t error_code;
328 
329  if (DetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
330  return -1;
331 
332  if (!DetectHTTP2FuncParseErrorCode(str, &error_code)) {
333  SCLogError("Invalid argument \"%s\" supplied to http2.errorcode keyword.", str);
334  return -1;
335  }
336 
337  uint32_t *http2ec = SCCalloc(1, sizeof(uint32_t));
338  if (http2ec == NULL)
339  return -1;
340  *http2ec = error_code;
341 
342  if (SigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_ERRORCODE, (SigMatchCtx *)http2ec,
343  g_http2_match_buffer_id) == NULL) {
344  DetectHTTP2errorcodeFree(NULL, http2ec);
345  return -1;
346  }
347 
348  return 0;
349 }
350 
351 /**
352  * \brief this function will free memory associated with uint32_t
353  *
354  * \param ptr pointer to uint32_t
355  */
356 void DetectHTTP2errorcodeFree(DetectEngineCtx *de_ctx, void *ptr)
357 {
358  SCFree(ptr);
359 }
360 
361 /**
362  * \brief This function is used to match HTTP2 error code rule option on a transaction with those passed via http2.priority:
363  *
364  * \retval 0 no match
365  * \retval 1 match
366  */
367 static int DetectHTTP2priorityMatch(DetectEngineThreadCtx *det_ctx,
368  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
369  const SigMatchCtx *ctx)
370 
371 {
372  uint32_t nb = 0;
373  int value = rs_http2_tx_get_next_priority(txv, flags, nb);
374  const DetectU8Data *du8 = (const DetectU8Data *)ctx;
375  while (value >= 0) {
376  if (DetectU8Match((uint8_t)value, du8)) {
377  return 1;
378  }
379  nb++;
380  value = rs_http2_tx_get_next_priority(txv, flags, nb);
381  }
382  return 0;
383 }
384 
385 /**
386  * \brief this function is used to attach the parsed http2.priority data into the current signature
387  *
388  * \param de_ctx pointer to the Detection Engine Context
389  * \param s pointer to the Current Signature
390  * \param str pointer to the user provided http2.priority options
391  *
392  * \retval 0 on Success
393  * \retval -1 on Failure
394  */
395 static int DetectHTTP2prioritySetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
396 {
397  if (DetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
398  return -1;
399 
400  DetectU8Data *prio = DetectU8Parse(str);
401  if (prio == NULL)
402  return -1;
403 
404  if (SigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_PRIORITY, (SigMatchCtx *)prio,
405  g_http2_match_buffer_id) == NULL) {
406  rs_detect_u8_free(prio);
407  return -1;
408  }
409 
410  return 0;
411 }
412 
413 /**
414  * \brief this function will free memory associated with uint32_t
415  *
416  * \param ptr pointer to DetectU8Data
417  */
418 void DetectHTTP2priorityFree(DetectEngineCtx *de_ctx, void *ptr)
419 {
420  rs_detect_u8_free(ptr);
421 }
422 
423 /**
424  * \brief This function is used to match HTTP2 window rule option on a transaction with those passed via http2.window:
425  *
426  * \retval 0 no match
427  * \retval 1 match
428  */
429 static int DetectHTTP2windowMatch(DetectEngineThreadCtx *det_ctx,
430  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
431  const SigMatchCtx *ctx)
432 
433 {
434  uint32_t nb = 0;
435  int value = rs_http2_tx_get_next_window(txv, flags, nb);
436  const DetectU32Data *du32 = (const DetectU32Data *)ctx;
437  while (value >= 0) {
438  if (DetectU32Match(value, du32)) {
439  return 1;
440  }
441  nb++;
442  value = rs_http2_tx_get_next_window(txv, flags, nb);
443  }
444  return 0;
445 }
446 
447 /**
448  * \brief this function is used to attach the parsed http2.window data into the current signature
449  *
450  * \param de_ctx pointer to the Detection Engine Context
451  * \param s pointer to the Current Signature
452  * \param str pointer to the user provided http2.window options
453  *
454  * \retval 0 on Success
455  * \retval -1 on Failure
456  */
457 static int DetectHTTP2windowSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
458 {
459  if (DetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
460  return -1;
461 
462  DetectU32Data *wu = DetectU32Parse(str);
463  if (wu == NULL)
464  return -1;
465 
466  if (SigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_WINDOW, (SigMatchCtx *)wu,
467  g_http2_match_buffer_id) == NULL) {
468  rs_detect_u32_free(wu);
469  return -1;
470  }
471 
472  return 0;
473 }
474 
475 /**
476  * \brief this function will free memory associated with uint32_t
477  *
478  * \param ptr pointer to DetectU8Data
479  */
480 void DetectHTTP2windowFree(DetectEngineCtx *de_ctx, void *ptr)
481 {
482  rs_detect_u32_free(ptr);
483 }
484 
485 /**
486  * \brief This function is used to match HTTP2 size update rule option on a transaction with those passed via http2.size_update:
487  *
488  * \retval 0 no match
489  * \retval 1 match
490  */
491 static int DetectHTTP2sizeUpdateMatch(DetectEngineThreadCtx *det_ctx,
492  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
493  const SigMatchCtx *ctx)
494 
495 {
496  return rs_http2_detect_sizeupdatectx_match(ctx, txv, flags);
497 }
498 
499 /**
500  * \brief this function is used to attach the parsed http2.size_update data into the current signature
501  *
502  * \param de_ctx pointer to the Detection Engine Context
503  * \param s pointer to the Current Signature
504  * \param str pointer to the user provided http2.size_update options
505  *
506  * \retval 0 on Success
507  * \retval -1 on Failure
508  */
509 static int DetectHTTP2sizeUpdateSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
510 {
511  if (DetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
512  return -1;
513 
514  void *su = rs_detect_u64_parse(str);
515  if (su == NULL)
516  return -1;
517 
518  if (SigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_SIZEUPDATE, (SigMatchCtx *)su,
519  g_http2_match_buffer_id) == NULL) {
520  DetectHTTP2settingsFree(NULL, su);
521  return -1;
522  }
523 
524  return 0;
525 }
526 
527 /**
528  * \brief this function will free memory associated with uint32_t
529  *
530  * \param ptr pointer to DetectU8Data
531  */
532 void DetectHTTP2sizeUpdateFree(DetectEngineCtx *de_ctx, void *ptr)
533 {
534  rs_detect_u64_free(ptr);
535 }
536 
537 /**
538  * \brief This function is used to match HTTP2 error code rule option on a transaction with those passed via http2.settings:
539  *
540  * \retval 0 no match
541  * \retval 1 match
542  */
543 static int DetectHTTP2settingsMatch(DetectEngineThreadCtx *det_ctx,
544  Flow *f, uint8_t flags, void *state, void *txv, const Signature *s,
545  const SigMatchCtx *ctx)
546 
547 {
548  return rs_http2_detect_settingsctx_match(ctx, txv, flags);
549 }
550 
551 /**
552  * \brief this function is used to attach the parsed http2.settings data into the current signature
553  *
554  * \param de_ctx pointer to the Detection Engine Context
555  * \param s pointer to the Current Signature
556  * \param str pointer to the user provided http2.settings options
557  *
558  * \retval 0 on Success
559  * \retval -1 on Failure
560  */
561 static int DetectHTTP2settingsSetup (DetectEngineCtx *de_ctx, Signature *s, const char *str)
562 {
563  if (DetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
564  return -1;
565 
566  void *http2set = rs_http2_detect_settingsctx_parse(str);
567  if (http2set == NULL)
568  return -1;
569 
570  if (SigMatchAppendSMToList(de_ctx, s, DETECT_HTTP2_SETTINGS, (SigMatchCtx *)http2set,
571  g_http2_match_buffer_id) == NULL) {
572  DetectHTTP2settingsFree(NULL, http2set);
573  return -1;
574  }
575 
576  return 0;
577 }
578 
579 /**
580  * \brief this function will free memory associated with rust signature context
581  *
582  * \param ptr pointer to rust signature context
583  */
584 void DetectHTTP2settingsFree(DetectEngineCtx *de_ctx, void *ptr)
585 {
586  rs_http2_detect_settingsctx_free(ptr);
587 }
588 
589 static int DetectHTTP2headerNameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
590 {
591  if (DetectBufferSetActiveList(de_ctx, s, g_http2_header_name_buffer_id) < 0)
592  return -1;
593 
594  if (DetectSignatureSetAppProto(s, ALPROTO_HTTP2) != 0)
595  return -1;
596 
597  return 0;
598 }
599 
600 static void PrefilterMpmHttp2HNameFree(void *ptr)
601 {
602  SCFree(ptr);
603 }
604 
605 static InspectionBuffer *GetHttp2HNameData(DetectEngineThreadCtx *det_ctx, const uint8_t flags,
606  const DetectEngineTransforms *transforms, Flow *_f, const struct MpmListIdDataArgs *cbdata,
607  int list_id)
608 {
609  SCEnter();
610 
611  InspectionBuffer *buffer =
612  InspectionBufferMultipleForListGet(det_ctx, list_id, cbdata->local_id);
613  if (buffer == NULL)
614  return NULL;
615  if (buffer->initialized)
616  return buffer;
617 
618  uint32_t b_len = 0;
619  const uint8_t *b = NULL;
620 
621  if (rs_http2_tx_get_header_name(cbdata->txv, flags, cbdata->local_id, &b, &b_len) != 1) {
622  InspectionBufferSetupMultiEmpty(buffer);
623  return NULL;
624  }
625  if (b == NULL || b_len == 0) {
626  InspectionBufferSetupMultiEmpty(buffer);
627  return NULL;
628  }
629 
630  InspectionBufferSetupMulti(buffer, transforms, b, b_len);
631 
632  SCReturnPtr(buffer, "InspectionBuffer");
633 }
634 
635 static void PrefilterTxHttp2HName(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p,
636  Flow *f, void *txv, const uint64_t idx, const AppLayerTxData *_txd, const uint8_t flags)
637 {
638  SCEnter();
639 
640  const PrefilterMpmListId *ctx = (const PrefilterMpmListId *)pectx;
641  const MpmCtx *mpm_ctx = ctx->mpm_ctx;
642  const int list_id = ctx->list_id;
643 
644  uint32_t local_id = 0;
645 
646  while(1) {
647  // loop until we get a NULL
648 
649  struct MpmListIdDataArgs cbdata = { local_id, txv };
650  InspectionBuffer *buffer =
651  GetHttp2HNameData(det_ctx, flags, ctx->transforms, f, &cbdata, list_id);
652  if (buffer == NULL)
653  break;
654 
655  if (buffer->inspect_len >= mpm_ctx->minlen) {
656  (void)mpm_table[mpm_ctx->mpm_type].Search(
657  mpm_ctx, &det_ctx->mtc, &det_ctx->pmq, buffer->inspect, buffer->inspect_len);
658  PREFILTER_PROFILING_ADD_BYTES(det_ctx, buffer->inspect_len);
659  }
660 
661  local_id++;
662  }
663 }
664 
665 static int PrefilterMpmHttp2HeaderNameRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
666  MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
667 {
668  //TODOask use PrefilterMpmListId elsewhere
669  PrefilterMpmListId *pectx = SCCalloc(1, sizeof(*pectx));
670  if (pectx == NULL)
671  return -1;
672  pectx->list_id = list_id;
673  pectx->mpm_ctx = mpm_ctx;
674  pectx->transforms = &mpm_reg->transforms;
675 
676  return PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxHttp2HName,
677  mpm_reg->app_v2.alproto, mpm_reg->app_v2.tx_min_progress,
678  pectx, PrefilterMpmHttp2HNameFree, mpm_reg->name);
679 }
680 
681 static uint8_t DetectEngineInspectHttp2HeaderName(DetectEngineCtx *de_ctx,
682  DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine,
683  const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
684 {
685  uint32_t local_id = 0;
686 
687  const DetectEngineTransforms *transforms = NULL;
688  if (!engine->mpm) {
689  transforms = engine->v2.transforms;
690  }
691 
692  while (1) {
693  //TODOask use MpmListIdDataArgs elsewhere
694  struct MpmListIdDataArgs cbdata = { local_id, txv, };
695  InspectionBuffer *buffer =
696  GetHttp2HNameData(det_ctx, flags, transforms, f, &cbdata, engine->sm_list);
697 
698  if (buffer == NULL || buffer->inspect == NULL)
699  break;
700 
701  const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f,
702  buffer->inspect, buffer->inspect_len, buffer->inspect_offset,
703  DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE);
704  if (match) {
705  return DETECT_ENGINE_INSPECT_SIG_MATCH;
706  }
707  local_id++;
708  }
709 
710  return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;
711 }
712 
713 #ifdef UNITTESTS
714 #include "tests/detect-http2.c"
715 #endif
util-byte.h
detect-engine-uint.h
DetectEngineAppInspectionEngine_
Definition: detect.h:427
SigTableElmt_::url
const char * url
Definition: detect.h:1299
DetectSignatureSetAppProto
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
Definition: detect-parse.c:1753
DetectEngineAppInspectionEngine_::mpm
bool mpm
Definition: detect.h:431
detect-content.h
MpmCtx_::mpm_type
uint8_t mpm_type
Definition: util-mpm.h:90
detect-engine.h
SIGMATCH_INFO_STICKY_BUFFER
#define SIGMATCH_INFO_STICKY_BUFFER
Definition: detect.h:1500
DetectHTTP2priorityRegisterTests
void DetectHTTP2priorityRegisterTests(void)
Definition: detect-http2.c:90
DetectU32Match
int DetectU32Match(const uint32_t parg, const DetectUintData_u32 *du32)
Definition: detect-engine-uint.c:31
SigTableElmt_::desc
const char * desc
Definition: detect.h:1298
SigTableElmt_::Free
void(* Free)(DetectEngineCtx *, void *)
Definition: detect.h:1286
SigTableElmt_::name
const char * name
Definition: detect.h:1296
InspectionBuffer::initialized
bool initialized
Definition: detect.h:378
MpmListIdDataArgs
Definition: detect-engine-mpm.h:128
SigGroupHead_
Container for matching data for a signature group.
Definition: detect.h:1448
DetectEngineTransforms
Definition: detect.h:409
DetectHTTP2RegisterTests
void DetectHTTP2RegisterTests(void)
DetectU32Parse
DetectUintData_u32 * DetectU32Parse(const char *u32str)
This function is used to parse u32 options passed via some u32 keyword.
Definition: detect-engine-uint.c:45
DetectBufferSetActiveList
int DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
Definition: detect-engine.c:1335
InspectionBuffer
Definition: detect.h:374
Flow_
Flow data structure.
Definition: flow.h:351
DetectEngineThreadCtx_::pmq
PrefilterRuleStore pmq
Definition: detect.h:1204
DETECT_HTTP2_SETTINGS
@ DETECT_HTTP2_SETTINGS
Definition: detect-engine-register.h:194
SigTableElmt_::flags
uint16_t flags
Definition: detect.h:1290
DetectHTTP2priorityFree
void DetectHTTP2priorityFree(DetectEngineCtx *, void *)
this function will free memory associated with uint32_t
Definition: detect-http2.c:418
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:839
MpmListIdDataArgs::local_id
uint32_t local_id
Definition: detect-engine-mpm.h:129
DETECT_HTTP2_SIZEUPDATE
@ DETECT_HTTP2_SIZEUPDATE
Definition: detect-engine-register.h:193
DetectBufferTypeSupportsMultiInstance
void DetectBufferTypeSupportsMultiInstance(const char *name)
Definition: detect-engine.c:1022
SigTableElmt_::AppLayerTxMatch
int(* AppLayerTxMatch)(DetectEngineThreadCtx *, Flow *, uint8_t flags, void *alstate, void *txv, const Signature *, const SigMatchCtx *)
Definition: detect.h:1267
rust.h
MpmListIdDataArgs::txv
void * txv
Definition: detect-engine-mpm.h:130
DetectBufferMpmRegistry_
one time registration of keywords at start up
Definition: detect.h:680
ByteExtractStringUint32
int ByteExtractStringUint32(uint32_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:239
DetectHTTP2sizeUpdateFree
void DetectHTTP2sizeUpdateFree(DetectEngineCtx *, void *)
this function will free memory associated with uint32_t
Definition: detect-http2.c:532
DETECT_HTTP2_HEADERNAME
@ DETECT_HTTP2_HEADERNAME
Definition: detect-engine-register.h:195
DetectBufferMpmRegistry_::app_v2
struct DetectBufferMpmRegistry_::@88::@90 app_v2
SIG_FLAG_TOCLIENT
#define SIG_FLAG_TOCLIENT
Definition: detect.h:267
SigTableElmt_::Setup
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
Definition: detect.h:1281
DetectBufferMpmRegistry_::transforms
DetectEngineTransforms transforms
Definition: detect.h:693
detect-engine-prefilter.h
DetectBufferTypeGetByName
int DetectBufferTypeGetByName(const char *name)
Definition: detect-engine.c:1072
DetectEngineAppInspectionEngine_::sm_list
uint16_t sm_list
Definition: detect.h:433
DetectU8Parse
DetectUintData_u8 * DetectU8Parse(const char *u8str)
This function is used to parse u8 options passed via some u8 keyword.
Definition: detect-engine-uint.c:85
PrefilterMpmListId
Definition: detect-engine-mpm.h:122
SIG_FLAG_TOSERVER
#define SIG_FLAG_TOSERVER
Definition: detect.h:266
InspectionBufferSetupMultiEmpty
void InspectionBufferSetupMultiEmpty(InspectionBuffer *buffer)
setup the buffer empty
Definition: detect-engine.c:1546
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:17
detect-http2.h
DetectEngineThreadCtx_
Definition: detect.h:1095
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
detect-engine-mpm.h
detect.h
DetectHTTP2sizeUpdateRegisterTests
void DetectHTTP2sizeUpdateRegisterTests(void)
Definition: detect-http2.c:158
DETECT_ENGINE_INSPECT_SIG_MATCH
#define DETECT_ENGINE_INSPECT_SIG_MATCH
Definition: detect-engine-state.h:38
DetectHTTP2settingsFree
void DetectHTTP2settingsFree(DetectEngineCtx *, void *)
this function will free memory associated with rust signature context
Definition: detect-http2.c:584
InspectionBuffer::inspect_offset
uint64_t inspect_offset
Definition: detect.h:376
DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE
@ DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE
Definition: detect-engine-content-inspection.h:36
DetectU8Data
DetectUintData_u8 DetectU8Data
Definition: detect-engine-uint.h:43
PrefilterMpmListId::transforms
const DetectEngineTransforms * transforms
Definition: detect-engine-mpm.h:125
DetectAppLayerMpmRegister
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register a MPM engine
Definition: detect-engine-mpm.c:89
MpmCtx_::minlen
uint16_t minlen
Definition: util-mpm.h:99
DetectHTTP2settingsRegisterTests
void DetectHTTP2settingsRegisterTests(void)
Definition: detect-http2.c:135
util-profiling.h
PrefilterMpmListId::mpm_ctx
const MpmCtx * mpm_ctx
Definition: detect-engine-mpm.h:124
Packet_
Definition: decode.h:437
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:287
SigTableElmt_::Match
int(* Match)(DetectEngineThreadCtx *, Packet *, const Signature *, const SigMatchCtx *)
Definition: detect.h:1264
ALPROTO_HTTP2
@ ALPROTO_HTTP2
Definition: app-layer-protos.h:62
DetectHTTP2windowRegisterTests
void DetectHTTP2windowRegisterTests(void)
Definition: detect-http2.c:112
MpmTableElmt_::Search
uint32_t(* Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t)
Definition: util-mpm.h:168
DetectEngineAppInspectionEngine_::v2
struct DetectEngineAppInspectionEngine_::@85 v2
DetectEngineThreadCtx_::mtc
MpmThreadCtx mtc
Definition: detect.h:1203
detect-engine-content-inspection.h
SigMatchCtx_
Used to start a pointer to SigMatch context Should never be dereferenced without casting to something...
Definition: detect.h:345
DetectEngineAppInspectionEngine_::smd
SigMatchData * smd
Definition: detect.h:444
ByteExtractStringUint8
int ByteExtractStringUint8(uint8_t *res, int base, size_t len, const char *str)
Definition: util-byte.c:285
AppLayerTxData
struct AppLayerTxData AppLayerTxData
Definition: detect.h:1358
PREFILTER_PROFILING_ADD_BYTES
#define PREFILTER_PROFILING_ADD_BYTES(det_ctx, bytes)
Definition: util-profiling.h:287
DetectU8Match
int DetectU8Match(const uint8_t parg, const DetectUintData_u8 *du8)
Definition: detect-engine-uint.c:71
DETECT_CI_FLAGS_SINGLE
#define DETECT_CI_FLAGS_SINGLE
Definition: detect-engine-content-inspection.h:49
DetectBufferTypeRegister
int DetectBufferTypeRegister(const char *name)
Definition: detect-engine.c:1008
flags
uint8_t flags
Definition: decode-gre.h:0
suricata-common.h
DetectHTTP2windowFree
void DetectHTTP2windowFree(DetectEngineCtx *, void *)
this function will free memory associated with uint32_t
Definition: detect-http2.c:480
DETECT_HTTP2_ERRORCODE
@ DETECT_HTTP2_ERRORCODE
Definition: detect-engine-register.h:190
DetectBufferMpmRegistry_::name
const char * name
Definition: detect.h:681
sigmatch_table
SigTableElmt sigmatch_table[DETECT_TBLSIZE]
Definition: detect-parse.c:127
DetectU32Data
DetectUintData_u32 DetectU32Data
Definition: detect-engine-uint.h:41
DetectHttp2Register
void DetectHttp2Register(void)
Registration function for HTTP2 keywords.
Definition: detect-http2.c:106
InspectionBufferSetupMulti
void InspectionBufferSetupMulti(InspectionBuffer *buffer, const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len)
setup the buffer with our initial data
Definition: detect-engine.c:1559
PrefilterAppendTxEngine
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh, PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx, void(*FreeFunc)(void *pectx), const char *name)
Definition: detect-engine-prefilter.c:270
DetectEngineInspectGenericList
uint8_t DetectEngineInspectGenericList(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const struct DetectEngineAppInspectionEngine_ *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
Definition: detect-engine.c:2079
DETECT_ENGINE_INSPECT_SIG_NO_MATCH
#define DETECT_ENGINE_INSPECT_SIG_NO_MATCH
Definition: detect-engine-state.h:37
InspectionBuffer::inspect_len
uint32_t inspect_len
Definition: detect.h:377
InspectionBuffer::inspect
const uint8_t * inspect
Definition: detect.h:375
str
#define str(s)
Definition: suricata-common.h:291
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
DetectHTTP2errorCodeRegisterTests
void DetectHTTP2errorCodeRegisterTests(void)
Definition: detect-http2.c:68
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DETECT_HTTP2_WINDOW
@ DETECT_HTTP2_WINDOW
Definition: detect-engine-register.h:192
detect-parse.h
Signature_
Signature container.
Definition: detect.h:596
DetectEngineAppInspectionEngine_::transforms
const DetectEngineTransforms * transforms
Definition: detect.h:441
PrefilterMpmListId::list_id
int list_id
Definition: detect-engine-mpm.h:123
mpm_table
MpmTableElmt mpm_table[MPM_TABLE_SIZE]
Definition: util-mpm.c:47
DETECT_HTTP2_PRIORITY
@ DETECT_HTTP2_PRIORITY
Definition: detect-engine-register.h:191
detect-http2.c
InspectionBufferMultipleForListGet
InspectionBuffer * InspectionBufferMultipleForListGet(DetectEngineThreadCtx *det_ctx, const int list_id, const uint32_t local_id)
for a InspectionBufferMultipleForList get a InspectionBuffer
Definition: detect-engine.c:1499
SIGMATCH_NOOPT
#define SIGMATCH_NOOPT
Definition: detect.h:1476
DetectAppLayerInspectEngineRegister
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
register inspect engine at start up time
Definition: detect-engine.c:169
SigMatchAppendSMToList
SigMatch * SigMatchAppendSMToList(DetectEngineCtx *de_ctx, Signature *s, uint16_t type, SigMatchCtx *ctx, const int list)
Append a SigMatch to the list type.
Definition: detect-parse.c:447
DetectBufferTypeSetDescriptionByName
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
Definition: detect-engine.c:1169
DetectHTTP2frameTypeRegisterTests
void DetectHTTP2frameTypeRegisterTests(void)
this function registers unit tests for DetectHTTP2frameType
Definition: detect-http2.c:46
DetectHTTP2errorcodeFree
void DetectHTTP2errorcodeFree(DetectEngineCtx *, void *)
this function will free memory associated with uint32_t
Definition: detect-http2.c:356
MpmCtx_
Definition: util-mpm.h:88
DetectHTTP2frametypeFree
void DetectHTTP2frametypeFree(DetectEngineCtx *, void *)
this function will free memory associated with uint8_t
Definition: detect-http2.c:276
DetectEngineContentInspection
bool DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const Signature *s, const SigMatchData *smd, Packet *p, Flow *f, const uint8_t *buffer, const uint32_t buffer_len, const uint32_t stream_start_offset, const uint8_t flags, const enum DetectContentInspectionType inspection_mode)
wrapper around DetectEngineContentInspectionInternal to return true/false only
Definition: detect-engine-content-inspection.c:723
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DETECT_HTTP2_FRAMETYPE
@ DETECT_HTTP2_FRAMETYPE
Definition: detect-engine-register.h:189
SigTableElmt_::RegisterTests
void(* RegisterTests)(void)
Definition: detect.h:1288