1 /* Copyright (C) 2007-2017 Open Information Security Foundation
2 *
3 * You can copy, redistribute or modify this Program under the terms of
4 * the GNU General Public License version 2 as published by the Free
5 * Software Foundation.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * version 2 along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15 * 02110-1301, USA.
16 */
17
18 /**
19 * \ingroup httplayer
20 *
21 * @{
22 */
23
24
25 /**
26 * \file
27 *
28 * \author Victor Julien <victor@inliniac.net>
29 *
30 * Implements support http_header_names
31 */
32
33 #include "suricata-common.h"
34 #include "threads.h"
35 #include "decode.h"
36
37 #include "detect.h"
38 #include "detect-parse.h"
39 #include "detect-engine.h"
40 #include "detect-engine-mpm.h"
41 #include "detect-engine-state.h"
42 #include "detect-engine-prefilter.h"
43 #include "detect-engine-content-inspection.h"
44 #include "detect-content.h"
45 #include "detect-pcre.h"
46 #include "detect-http-header-common.h"
47 #include "detect-http-header-names.h"
48
49 #include "flow.h"
50 #include "flow-var.h"
51 #include "flow-util.h"
52
53 #include "util-debug.h"
54 #include "util-unittest.h"
55 #include "util-unittest-helper.h"
56 #include "util-spm.h"
57 #include "util-print.h"
58
59 #include "app-layer.h"
60 #include "app-layer-parser.h"
61
62 #include "app-layer-htp.h"
63 #include "detect-http-header.h"
64 #include "stream-tcp.h"
65
66 #include "util-print.h"
67
68 #define KEYWORD_NAME "http.header_names"
69 #define KEYWORD_NAME_LEGACY "http_header_names"
70 #define KEYWORD_DOC "http-keywords.html#http-header-names"
71 #define BUFFER_NAME "http_header_names"
72 #define BUFFER_DESC "http header names"
73 static int g_buffer_id = 0;
74 static int g_keyword_thread_id = 0;
75
76 #define BUFFER_TX_STEP 4
77 #define BUFFER_SIZE_STEP 256
78 static HttpHeaderThreadDataConfig g_td_config = { BUFFER_TX_STEP, BUFFER_SIZE_STEP };
79
GetBufferForTX(htp_tx_t * tx,uint64_t tx_id,DetectEngineThreadCtx * det_ctx,Flow * f,uint8_t flags,uint32_t * buffer_len)80 static uint8_t *GetBufferForTX(htp_tx_t *tx, uint64_t tx_id,
81 DetectEngineThreadCtx *det_ctx,
82 Flow *f, uint8_t flags, uint32_t *buffer_len)
83 {
84 *buffer_len = 0;
85
86 HttpHeaderThreadData *hdr_td = NULL;
87 HttpHeaderBuffer *buf = HttpHeaderGetBufferSpaceForTXID(det_ctx, f, flags,
88 tx_id, g_keyword_thread_id, &hdr_td);
89 if (unlikely(buf == NULL)) {
90 return NULL;
91 } else if (buf->len > 0) {
92 /* already filled buf, reuse */
93 *buffer_len = buf->len;
94 return buf->buffer;
95 }
96
97 htp_table_t *headers;
98 if (flags & STREAM_TOSERVER) {
99 if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) <=
100 HTP_REQUEST_HEADERS)
101 return NULL;
102 headers = tx->request_headers;
103 } else {
104 if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, tx, flags) <=
105 HTP_RESPONSE_HEADERS)
106 return NULL;
107 headers = tx->response_headers;
108 }
109 if (headers == NULL)
110 return NULL;
111
112 /* fill the buffer. \r\nName1\r\nName2\r\n\r\n */
113 size_t i = 0;
114 size_t no_of_headers = htp_table_size(headers);
115 for (; i < no_of_headers; i++) {
116 htp_header_t *h = htp_table_get_index(headers, i, NULL);
117 size_t size = bstr_size(h->name) + 2; // for \r\n
118 if (i == 0)
119 size += 2;
120 if (i + 1 == no_of_headers)
121 size += 2;
122
123 SCLogDebug("size %"PRIuMAX" + buf->len %u vs buf->size %u",
124 (uintmax_t)size, buf->len, buf->size);
125 if (size + buf->len > buf->size) {
126 if (HttpHeaderExpandBuffer(hdr_td, buf, size) != 0) {
127 return NULL;
128 }
129 }
130
131 /* start with a \r\n */
132 if (i == 0) {
133 buf->buffer[buf->len++] = '\r';
134 buf->buffer[buf->len++] = '\n';
135 }
136
137 memcpy(buf->buffer + buf->len, bstr_ptr(h->name), bstr_size(h->name));
138 buf->len += bstr_size(h->name);
139 buf->buffer[buf->len++] = '\r';
140 buf->buffer[buf->len++] = '\n';
141
142 /* end with an extra \r\n */
143 if (i + 1 == no_of_headers) {
144 buf->buffer[buf->len++] = '\r';
145 buf->buffer[buf->len++] = '\n';
146 }
147 }
148
149 *buffer_len = buf->len;
150 return buf->buffer;
151 }
152
GetBuffer2ForTX(DetectEngineThreadCtx * det_ctx,const DetectEngineTransforms * transforms,Flow * _f,const uint8_t flow_flags,void * txv,const int list_id)153 static InspectionBuffer *GetBuffer2ForTX(DetectEngineThreadCtx *det_ctx,
154 const DetectEngineTransforms *transforms, Flow *_f, const uint8_t flow_flags, void *txv,
155 const int list_id)
156 {
157 InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
158 if (buffer->inspect == NULL) {
159 uint32_t b_len = 0;
160 const uint8_t *b = NULL;
161
162 if (rs_http2_tx_get_header_names(txv, flow_flags, &b, &b_len) != 1)
163 return NULL;
164 if (b == NULL || b_len == 0)
165 return NULL;
166
167 InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
168 InspectionBufferApplyTransforms(buffer, transforms);
169 }
170
171 return buffer;
172 }
173
174 typedef struct PrefilterMpmHttpHeaderCtx {
175 int list_id;
176 const MpmCtx *mpm_ctx;
177 const DetectEngineTransforms *transforms;
178 } PrefilterMpmHttpHeaderCtx;
179
180 /** \brief HTTP Headers Mpm prefilter callback
181 *
182 * \param det_ctx detection engine thread ctx
183 * \param p packet to inspect
184 * \param f flow to inspect
185 * \param txv tx to inspect
186 * \param pectx inspection context
187 */
PrefilterTxHttpRequestHeaderNames(DetectEngineThreadCtx * det_ctx,const void * pectx,Packet * p,Flow * f,void * txv,const uint64_t idx,const uint8_t flags)188 static void PrefilterTxHttpRequestHeaderNames(DetectEngineThreadCtx *det_ctx,
189 const void *pectx,
190 Packet *p, Flow *f, void *txv,
191 const uint64_t idx, const uint8_t flags)
192 {
193 SCEnter();
194
195 htp_tx_t *tx = (htp_tx_t *)txv;
196 if (tx->request_headers == NULL)
197 return;
198
199 const PrefilterMpmHttpHeaderCtx *ctx = pectx;
200 const MpmCtx *mpm_ctx = ctx->mpm_ctx;
201 SCLogDebug("running on list %d", ctx->list_id);
202
203 const int list_id = ctx->list_id;
204 InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
205 if (buffer->inspect == NULL) {
206 uint32_t rawdata_len = 0;
207 uint8_t *rawdata = GetBufferForTX(txv, idx, det_ctx,
208 f, flags, &rawdata_len);
209 if (rawdata_len == 0)
210 return;
211
212 /* setup buffer and apply transforms */
213 InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
214 InspectionBufferApplyTransforms(buffer, ctx->transforms);
215 }
216
217 const uint32_t data_len = buffer->inspect_len;
218 const uint8_t *data = buffer->inspect;
219
220 SCLogDebug("mpm'ing buffer:");
221 //PrintRawDataFp(stdout, data, data_len);
222
223 if (data != NULL && data_len >= mpm_ctx->minlen) {
224 (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
225 &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
226 }
227 }
228
PrefilterMpmHttpHeaderFree(void * ptr)229 static void PrefilterMpmHttpHeaderFree(void *ptr)
230 {
231 SCFree(ptr);
232 }
233
PrefilterTxHttpRequestHeaderNamesRegister(DetectEngineCtx * de_ctx,SigGroupHead * sgh,MpmCtx * mpm_ctx,const DetectBufferMpmRegistery * mpm_reg,int list_id)234 static int PrefilterTxHttpRequestHeaderNamesRegister(DetectEngineCtx *de_ctx,
235 SigGroupHead *sgh, MpmCtx *mpm_ctx,
236 const DetectBufferMpmRegistery *mpm_reg, int list_id)
237 {
238 SCEnter();
239
240 PrefilterMpmHttpHeaderCtx *pectx = SCCalloc(1, sizeof(*pectx));
241 if (pectx == NULL)
242 return -1;
243 pectx->list_id = list_id;
244 pectx->mpm_ctx = mpm_ctx;
245 pectx->transforms = &mpm_reg->transforms;
246
247 int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxHttpRequestHeaderNames,
248 mpm_reg->app_v2.alproto, HTP_REQUEST_HEADERS,
249 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
250 if (r != 0) {
251 SCFree(pectx);
252 return r;
253 }
254
255 return r;
256 }
257
258 /** \brief HTTP Headers Mpm prefilter callback
259 *
260 * \param det_ctx detection engine thread ctx
261 * \param p packet to inspect
262 * \param f flow to inspect
263 * \param txv tx to inspect
264 * \param pectx inspection context
265 */
PrefilterTxHttpResponseHeaderNames(DetectEngineThreadCtx * det_ctx,const void * pectx,Packet * p,Flow * f,void * txv,const uint64_t idx,const uint8_t flags)266 static void PrefilterTxHttpResponseHeaderNames(DetectEngineThreadCtx *det_ctx,
267 const void *pectx,
268 Packet *p, Flow *f, void *txv,
269 const uint64_t idx, const uint8_t flags)
270 {
271 SCEnter();
272
273 htp_tx_t *tx = (htp_tx_t *)txv;
274 if (tx->response_headers == NULL)
275 return;
276
277 const PrefilterMpmHttpHeaderCtx *ctx = pectx;
278 const MpmCtx *mpm_ctx = ctx->mpm_ctx;
279 SCLogDebug("running on list %d", ctx->list_id);
280
281 const int list_id = ctx->list_id;
282 InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
283 if (buffer->inspect == NULL) {
284 uint32_t rawdata_len = 0;
285 uint8_t *rawdata = GetBufferForTX(txv, idx, det_ctx,
286 f, flags, &rawdata_len);
287 if (rawdata_len == 0)
288 return;
289
290 /* setup buffer and apply transforms */
291 InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
292 InspectionBufferApplyTransforms(buffer, ctx->transforms);
293 }
294
295 const uint32_t data_len = buffer->inspect_len;
296 const uint8_t *data = buffer->inspect;
297
298 SCLogDebug("mpm'ing buffer:");
299 //PrintRawDataFp(stdout, data, data_len);
300
301 if (data != NULL && data_len >= mpm_ctx->minlen) {
302 (void)mpm_table[mpm_ctx->mpm_type].Search(mpm_ctx,
303 &det_ctx->mtcu, &det_ctx->pmq, data, data_len);
304 }
305 }
306
PrefilterTxHttpResponseHeaderNamesRegister(DetectEngineCtx * de_ctx,SigGroupHead * sgh,MpmCtx * mpm_ctx,const DetectBufferMpmRegistery * mpm_reg,int list_id)307 static int PrefilterTxHttpResponseHeaderNamesRegister(DetectEngineCtx *de_ctx,
308 SigGroupHead *sgh, MpmCtx *mpm_ctx,
309 const DetectBufferMpmRegistery *mpm_reg, int list_id)
310 {
311 SCEnter();
312
313 PrefilterMpmHttpHeaderCtx *pectx = SCCalloc(1, sizeof(*pectx));
314 if (pectx == NULL)
315 return -1;
316 pectx->list_id = list_id;
317 pectx->mpm_ctx = mpm_ctx;
318 pectx->transforms = &mpm_reg->transforms;
319
320 int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterTxHttpResponseHeaderNames,
321 mpm_reg->app_v2.alproto, HTP_RESPONSE_HEADERS,
322 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
323 if (r != 0) {
324 SCFree(pectx);
325 return r;
326 }
327
328 return r;
329 }
330
InspectEngineHttpHeaderNames(DetectEngineCtx * de_ctx,DetectEngineThreadCtx * det_ctx,const DetectEngineAppInspectionEngine * engine,const Signature * s,Flow * f,uint8_t flags,void * alstate,void * txv,uint64_t tx_id)331 static int InspectEngineHttpHeaderNames(
332 DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
333 const DetectEngineAppInspectionEngine *engine,
334 const Signature *s,
335 Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
336 {
337 const int list_id = engine->sm_list;
338 InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
339 if (buffer->inspect == NULL) {
340 SCLogDebug("setting up inspect buffer %d", list_id);
341
342 /* if prefilter didn't already run, we need to consider transformations */
343 const DetectEngineTransforms *transforms = NULL;
344 if (!engine->mpm) {
345 transforms = engine->v2.transforms;
346 }
347
348 uint32_t rawdata_len = 0;
349 uint8_t *rawdata = GetBufferForTX(txv, tx_id, det_ctx,
350 f, flags, &rawdata_len);
351 if (rawdata_len == 0) {
352 SCLogDebug("no data");
353 goto end;
354 }
355 /* setup buffer and apply transforms */
356 InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
357 InspectionBufferApplyTransforms(buffer, transforms);
358 }
359
360 const uint32_t data_len = buffer->inspect_len;
361 const uint8_t *data = buffer->inspect;
362 const uint64_t offset = buffer->inspect_offset;
363
364 det_ctx->buffer_offset = 0;
365 det_ctx->discontinue_matching = 0;
366 det_ctx->inspection_recursion_counter = 0;
367 int r = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd,
368 NULL, f, (uint8_t *)data, data_len, offset,
369 DETECT_CI_FLAGS_SINGLE,
370 DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE);
371 if (r == 1)
372 return DETECT_ENGINE_INSPECT_SIG_MATCH;
373
374 end:
375 if (flags & STREAM_TOSERVER) {
376 if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) > HTP_REQUEST_HEADERS)
377 return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH;
378 } else {
379 if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP, txv, flags) > HTP_RESPONSE_HEADERS)
380 return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH;
381 }
382 return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;
383 }
384
385 /**
386 * \brief The setup function for the http.header_names keyword for a signature.
387 *
388 * \param de_ctx Pointer to the detection engine context.
389 * \param s Pointer to signature for the current Signature being parsed
390 * from the rules.
391 * \param m Pointer to the head of the SigMatchs for the current rule
392 * being parsed.
393 * \param arg Pointer to the string holding the keyword value.
394 *
395 * \retval 0 On success.
396 * \retval -1 On failure.
397 */
DetectHttpHeaderNamesSetup(DetectEngineCtx * de_ctx,Signature * s,const char * arg)398 static int DetectHttpHeaderNamesSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg)
399 {
400 if (DetectBufferSetActiveList(s, g_buffer_id) < 0)
401 return -1;
402
403 if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
404 return -1;
405
406 return 0;
407 }
408
409 /**
410 * \brief Registers the keyword handlers for the "http.header_names" keyword.
411 */
DetectHttpHeaderNamesRegister(void)412 void DetectHttpHeaderNamesRegister(void)
413 {
414 sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].name = KEYWORD_NAME;
415 sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].alias = KEYWORD_NAME_LEGACY;
416 sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].desc = BUFFER_NAME " sticky buffer";
417 sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].url = "/rules/" KEYWORD_DOC;
418 sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].Setup = DetectHttpHeaderNamesSetup;
419
420 sigmatch_table[DETECT_AL_HTTP_HEADER_NAMES].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
421
422 DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
423 PrefilterTxHttpRequestHeaderNamesRegister, NULL, ALPROTO_HTTP,
424 HTP_REQUEST_HEADERS);
425 DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2,
426 PrefilterTxHttpResponseHeaderNamesRegister, NULL, ALPROTO_HTTP,
427 HTP_RESPONSE_HEADERS);
428
429 DetectAppLayerInspectEngineRegister2(BUFFER_NAME,
430 ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
431 InspectEngineHttpHeaderNames, NULL);
432 DetectAppLayerInspectEngineRegister2(BUFFER_NAME,
433 ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
434 InspectEngineHttpHeaderNames, NULL);
435
436 DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
437 GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2StateDataClient);
438 DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
439 GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2StateDataServer);
440
441 DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
442 HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetBuffer2ForTX);
443 DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
444 HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetBuffer2ForTX);
445
446 DetectBufferTypeSetDescriptionByName(BUFFER_NAME,
447 BUFFER_DESC);
448
449 g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
450
451 g_keyword_thread_id = DetectRegisterThreadCtxGlobalFuncs(KEYWORD_NAME,
452 HttpHeaderThreadDataInit, &g_td_config, HttpHeaderThreadDataFree);
453
454 SCLogDebug("keyword %s registered. Thread id %d. "
455 "Buffer %s registered. Buffer id %d",
456 KEYWORD_NAME, g_keyword_thread_id,
457 BUFFER_NAME, g_buffer_id);
458 }
459