Skip to content

Detect http trailers 8256 v2 #14724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
catenacyber wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Detect http trailers 8256 v2 #14724

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
358999d
detect: convert tx_progress to uint8_t
catenacyber Jan 29, 2026
bc1c83f
detect: AppInspectionEngine can have a min and max progress
catenacyber Jan 29, 2026
3b8d059
detect: introduce DetectAppLayerInspectEngineRegisterMax
catenacyber Jan 29, 2026
dc3edee
detect: http.headers now works for trailers
catenacyber Jan 29, 2026
e42618b
detect/file: reorder struct fields to reduce padding
catenacyber Jan 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion doc/userguide/devguide/extending/app-layer/transactions.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ Rule Matching

Transaction progress is also used for certain keywords to know what is the minimum state before we can expect a match: until that, Suricata won't even try to look for the patterns.

As seen in ``DetectAppLayerMpmRegister`` that has ``int progress`` as parameter, and ``DetectAppLayerInspectEngineRegister``, which expects ``int tx_min_progress``, for instance. In the code snippet,
As seen in ``DetectAppLayerMpmRegister`` that has ``int progress`` as parameter, and ``DetectAppLayerInspectEngineRegister``, which expects ``uint8_t tx_min_progress``, for instance. In the code snippet,
``HTTP2StateDataClient``, ``HTTP2StateDataServer`` and ``0`` are the values passed to the functions - in the last
example, for ``FTPDATA``,
the existence of a transaction implies that a file is being transferred. Hence the ``0`` value.
Expand Down
12 changes: 6 additions & 6 deletions rust/src/ssh/detect.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,7 +298,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOSERVER | STREAM_TOCLIENT,
Some(SCSshTxGetSoftware),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
ssh_software_kw_id,
Expand Down Expand Up @@ -340,7 +340,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOSERVER | STREAM_TOCLIENT,
Some(SCSshTxGetProtocol),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
ssh_proto_kw_id,
Expand All @@ -360,7 +360,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOSERVER,
Some(SCSshTxGetHasshString),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
DETECT_SSH_HASSH_STRING,
Expand All @@ -380,7 +380,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOCLIENT,
Some(SCSshTxGetHasshString),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
DETECT_SSH_HASSH_SERVER_STRING,
Expand All @@ -400,7 +400,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOSERVER,
Some(SCSshTxGetHassh),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
DETECT_SSH_HASSH,
Expand All @@ -421,7 +421,7 @@ pub unsafe extern "C" fn SCDetectSshRegister() {
ALPROTO_SSH,
STREAM_TOCLIENT,
Some(SCSshTxGetHassh),
SSHConnectionState::SshStateBannerDone as c_int,
SSHConnectionState::SshStateBannerDone as u8,
);
SCDetectHelperKeywordAliasRegister(
DETECT_SSH_HASSH_SERVER,
Expand Down
6 changes: 2 additions & 4 deletions rust/sys/src/sys.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -455,8 +455,7 @@ extern "C" {
extern "C" {
pub fn SCDetectHelperBufferProgressMpmRegister(
name: *const ::std::os::raw::c_char, desc: *const ::std::os::raw::c_char,
alproto: AppProto, direction: u8, GetData: InspectionSingleBufferGetDataPtr,
progress: ::std::os::raw::c_int,
alproto: AppProto, direction: u8, GetData: InspectionSingleBufferGetDataPtr, progress: u8,
) -> ::std::os::raw::c_int;
}
extern "C" {
Expand All @@ -468,8 +467,7 @@ extern "C" {
extern "C" {
pub fn SCDetectHelperMultiBufferProgressMpmRegister(
name: *const ::std::os::raw::c_char, desc: *const ::std::os::raw::c_char,
alproto: AppProto, direction: u8, GetData: InspectionMultiBufferGetDataPtr,
progress: ::std::os::raw::c_int,
alproto: AppProto, direction: u8, GetData: InspectionMultiBufferGetDataPtr, progress: u8,
) -> ::std::os::raw::c_int;
}
extern "C" {
Expand Down
6 changes: 3 additions & 3 deletions src/app-layer-parser.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1106,12 +1106,12 @@ void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint
SCReturnPtr(r, "void *");
}

int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto,
uint8_t direction)
uint8_t AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction)
{
SCEnter();
int r = StateGetProgressCompletionStatus(alproto, direction);
SCReturnInt(r);
// TODO convert StateGetProgressCompletionStatus and more to uint8_t
return (uint8_t)r;
}

int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
Expand Down
2 changes: 1 addition & 1 deletion src/app-layer-parser.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,7 +244,7 @@ int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto,
void *alstate, uint8_t direction);
uint64_t AppLayerParserGetTxCnt(const Flow *, void *alstate);
void *AppLayerParserGetTx(uint8_t ipproto, AppProto alproto, void *alstate, uint64_t tx_id);
int AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
uint8_t AppLayerParserGetStateProgressCompletionStatus(AppProto alproto, uint8_t direction);
int AppLayerParserGetEventInfo(uint8_t ipproto, AppProto alproto, const char *event_name,
uint8_t *event_id, AppLayerEventType *event_type);
int AppLayerParserGetEventInfoById(uint8_t ipproto, AppProto alproto, uint8_t event_id,
Expand Down
6 changes: 3 additions & 3 deletions src/detect-app-layer-state.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,7 +140,7 @@ static uint8_t DetectEngineAptStateInspect(DetectEngineCtx *de_ctx, DetectEngine
}

// TODO dedup with detect-parse.c
static SignatureHook SetAppHook(const AppProto alproto, int progress)
static SignatureHook SetAppHook(const AppProto alproto, uint8_t progress)
{
SignatureHook h = {
.type = SIGNATURE_HOOK_TYPE_APP,
Expand Down Expand Up @@ -175,15 +175,15 @@ static int DetectAppLayerStateSetup(DetectEngineCtx *de_ctx, Signature *s, const
IPPROTO_TCP /* TODO */, s->alproto, h, STREAM_TOSERVER);
if (progress_ts >= 0) {
s->flags |= SIG_FLAG_TOSERVER;
s->init_data->hook = SetAppHook(s->alproto, progress_ts);
s->init_data->hook = SetAppHook(s->alproto, (uint8_t)progress_ts);
} else {
const int progress_tc = AppLayerParserGetStateIdByName(
IPPROTO_TCP /* TODO */, s->alproto, h, STREAM_TOCLIENT);
if (progress_tc < 0) {
return -1;
}
s->flags |= SIG_FLAG_TOCLIENT;
s->init_data->hook = SetAppHook(s->alproto, progress_tc);
s->init_data->hook = SetAppHook(s->alproto, (uint8_t)progress_tc);
}
SCLogDebug("hook %u", s->init_data->hook.t.app.app_progress);
return 0;
Expand Down
4 changes: 3 additions & 1 deletion src/detect-engine-analyzer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1441,7 +1441,9 @@ void EngineAnalysisRules2(const DetectEngineCtx *de_ctx, const Signature *s)
SCJbSetString(ctx.js, "direction", direction);
SCJbSetBool(ctx.js, "is_mpm", app->mpm);
SCJbSetString(ctx.js, "app_proto", AppProtoToString(app->alproto));
SCJbSetUint(ctx.js, "progress", app->progress);
SCJbSetUint(ctx.js, "progress", app->min_progress);
Copy link
Member

@victorjulien victorjulien Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be named progress_min?

Copy link
Contributor Author

@catenacyber catenacyber Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did not want to break compatibility, I will just add min and max if they are different

if (app->max_progress != app->min_progress)
SCJbSetUint(ctx.js, "progress_max", app->max_progress);

if (app->v2.transforms != NULL) {
SCJbOpenArray(ctx.js, "transforms");
Expand Down
2 changes: 1 addition & 1 deletion src/detect-engine-file.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,6 @@ uint8_t DetectFileInspectGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
uint8_t flags, void *_alstate, void *tx, uint64_t tx_id);

void DetectFileRegisterProto(
AppProto alproto, int direction, int to_client_progress, int to_server_progress);
AppProto alproto, int direction, uint8_t to_client_progress, uint8_t to_server_progress);

#endif /* SURICATA_DETECT_ENGINE_FILE_H */
5 changes: 3 additions & 2 deletions src/detect-engine-helper.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto
}

int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionSingleBufferGetDataPtr GetData, int progress)
uint8_t direction, InspectionSingleBufferGetDataPtr GetData, uint8_t progress)
{
if (direction & STREAM_TOSERVER) {
DetectAppLayerInspectEngineRegisterSingle(name, alproto, SIG_FLAG_TOSERVER, progress,
Expand All @@ -83,7 +83,8 @@ int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc,
}

int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc,
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress)
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData,
uint8_t progress)
{
if (direction & STREAM_TOSERVER) {
DetectAppLayerMultiRegister(name, alproto, SIG_FLAG_TOSERVER, progress, GetData, 2);
Expand Down
5 changes: 3 additions & 2 deletions src/detect-engine-helper.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,11 +85,12 @@ int SCDetectHelperBufferRegister(const char *name, AppProto alproto, uint8_t dir
int SCDetectHelperBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionSingleBufferGetDataPtr GetData);
int SCDetectHelperBufferProgressMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionSingleBufferGetDataPtr GetData, int progress);
uint8_t direction, InspectionSingleBufferGetDataPtr GetData, uint8_t progress);
int SCDetectHelperMultiBufferMpmRegister(const char *name, const char *desc, AppProto alproto,
uint8_t direction, InspectionMultiBufferGetDataPtr GetData);
int SCDetectHelperMultiBufferProgressMpmRegister(const char *name, const char *desc,
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData, int progress);
AppProto alproto, uint8_t direction, InspectionMultiBufferGetDataPtr GetData,
uint8_t progress);

int SCDetectHelperTransformRegister(const SCTransformTableElmt *kw);

Expand Down
8 changes: 4 additions & 4 deletions src/detect-engine-mpm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ static int g_mpm_list_cnt[DETECT_BUFFER_MPM_TYPE_SIZE] = { 0, 0, 0 };
static void RegisterInternal(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
InspectionSingleBufferGetDataPtr GetDataSingle,
InspectionMultiBufferGetDataPtr GetMultiData, AppProto alproto, int tx_min_progress)
InspectionMultiBufferGetDataPtr GetMultiData, AppProto alproto, uint8_t tx_min_progress)
{
SCLogDebug("registering %s/%d/%d/%p/%p/%u/%d", name, direction, priority,
PrefilterRegister, GetData, alproto, tx_min_progress);
Expand Down Expand Up @@ -151,23 +151,23 @@ static void RegisterInternal(const char *name, int direction, int priority,

void DetectAppLayerMpmRegister(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress)
AppProto alproto, uint8_t tx_min_progress)
{
RegisterInternal(name, direction, priority, PrefilterRegister, GetData, NULL, NULL, alproto,
tx_min_progress);
}

void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress)
AppProto alproto, uint8_t tx_min_progress)
{
RegisterInternal(name, direction, priority, PrefilterRegister, NULL, GetData, NULL, alproto,
tx_min_progress);
}

void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress)
AppProto alproto, uint8_t tx_min_progress)
{
RegisterInternal(name, direction, priority, PrefilterRegister, NULL, NULL, GetData, alproto,
tx_min_progress);
Expand Down
6 changes: 3 additions & 3 deletions src/detect-engine-mpm.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,13 +86,13 @@ typedef int (*PrefilterRegisterFunc)(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
*/
void DetectAppLayerMpmRegister(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress);
AppProto alproto, uint8_t tx_min_progress);
void DetectAppLayerMpmRegisterSingle(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionSingleBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress);
AppProto alproto, uint8_t tx_min_progress);
void DetectAppLayerMpmMultiRegister(const char *name, int direction, int priority,
PrefilterRegisterFunc PrefilterRegister, InspectionMultiBufferGetDataPtr GetData,
AppProto alproto, int tx_min_progress);
AppProto alproto, uint8_t tx_min_progress);
void DetectAppLayerMpmRegisterByParentId(
DetectEngineCtx *de_ctx,
const int id, const int parent_id,
Expand Down
19 changes: 9 additions & 10 deletions src/detect-engine-prefilter.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -350,7 +350,7 @@ int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
}

int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
PrefilterTxFn PrefilterTxFunc, AppProto alproto, int tx_min_progress, void *pectx,
PrefilterTxFn PrefilterTxFunc, AppProto alproto, int8_t tx_min_progress, void *pectx,
void (*FreeFunc)(void *pectx), const char *name)
{
if (sgh == NULL || PrefilterTxFunc == NULL || pectx == NULL)
Expand All @@ -364,9 +364,7 @@ int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
e->PrefilterTx = PrefilterTxFunc;
e->pectx = pectx;
e->alproto = alproto;
// TODO change function prototype ?
DEBUG_VALIDATE_BUG_ON(tx_min_progress > INT8_MAX);
e->tx_min_progress = (uint8_t)tx_min_progress;
e->tx_min_progress = tx_min_progress;
e->Free = FreeFunc;

if (sgh->init->tx_engines == NULL) {
Expand Down Expand Up @@ -700,7 +698,7 @@ static void NonPFNamesFree(void *data)
struct TxNonPFData {
AppProto alproto;
int dir; /**< 0: toserver, 1: toclient */
int progress; /**< progress state value to register at */
uint8_t progress; /**< progress state value to register at */
int sig_list; /**< special handling: normally 0, but for special cases (app-layer-state,
app-layer-event) use the list id to create separate engines */
uint32_t sigs_cnt;
Expand Down Expand Up @@ -730,7 +728,7 @@ static void TxNonPFFree(void *data)
}

static int TxNonPFAddSig(DetectEngineCtx *de_ctx, HashListTable *tx_engines_hash,
const AppProto alproto, const int dir, const int16_t progress, const int sig_list,
const AppProto alproto, const int dir, const uint8_t progress, const int sig_list,
const char *name, const Signature *s)
{
const uint32_t max_sids = DetectEngineGetMaxSigId(de_ctx);
Expand Down Expand Up @@ -990,7 +988,7 @@ static int SetupNonPrefilter(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
if (list_id == app_state_list_id)
sig_list = app_state_list_id;
if (TxNonPFAddSig(de_ctx, tx_engines_hash, app->alproto, app->dir,
app->progress, sig_list, buf->name, s) != 0) {
app->min_progress, sig_list, buf->name, s) != 0) {
goto error;
}
tx_non_pf = true;
Expand All @@ -1005,8 +1003,8 @@ static int SetupNonPrefilter(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
dir == 0 ? STREAM_TOSERVER : STREAM_TOCLIENT);

if (TxNonPFAddSig(de_ctx, tx_engines_hash, s->alproto, dir,
(int16_t)s->init_data->hook.t.app.app_progress, s->init_data->hook.sm_list,
pname, s) != 0) {
s->init_data->hook.t.app.app_progress, s->init_data->hook.sm_list, pname,
s) != 0) {
goto error;
}
tx_non_pf = true;
Expand Down Expand Up @@ -1082,7 +1080,8 @@ static int SetupNonPrefilter(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
}

/* register special progress value to indicate we need to run it all the time */
int engine_progress = t->progress;
DEBUG_VALIDATE_BUG_ON(t->progress > INT8_MAX);
int8_t engine_progress = (int8_t)t->progress;
if (t->sig_list == app_state_list_id) {
SCLogDebug("engine %s for state list", t->engine_name);
engine_progress = -1;
Expand Down
4 changes: 2 additions & 2 deletions src/detect-engine-prefilter.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ typedef struct DetectTransaction_ {
/* original value to track changes. */
const uint8_t detect_progress_orig;

const int tx_progress;
const uint8_t tx_progress;
const int tx_end_state;
} DetectTransaction;

Expand All @@ -63,7 +63,7 @@ void PrefilterPostRuleMatch(
int PrefilterAppendPayloadEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
PrefilterPktFn PrefilterFunc, void *pectx, void (*FreeFunc)(void *pectx), const char *name);
int PrefilterAppendTxEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
PrefilterTxFn PrefilterTxFunc, const AppProto alproto, const int tx_min_progress,
PrefilterTxFn PrefilterTxFunc, const AppProto alproto, const int8_t tx_min_progress,
void *pectx, void (*FreeFunc)(void *pectx), const char *name);
int PrefilterAppendFrameEngine(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
PrefilterFrameFn PrefilterFrameFunc, AppProto alproto, uint8_t frame_type, void *pectx,
Expand Down
Loading
Loading