detect/file_data: Apply transforms

src/detect-file-data.c

@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2018 Open Information Security Foundation
+/* Copyright (C) 2007-2020 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -262,7 +262,7 @@ static InspectionBuffer *HttpServerBodyGetDataCallback(DetectEngineThreadCtx *de
 
     HtpBodyChunk *cur = body->first;
     if (cur == NULL) {
-        SCLogDebug("No http chunks to inspect for this transacation");
+        SCLogDebug("No http chunks to inspect for this transaction");
         return NULL;
     }
 
@@ -334,6 +334,8 @@ static InspectionBuffer *HttpServerBodyGetDataCallback(DetectEngineThreadCtx *de
         }
     }
 
+    InspectionBufferApplyTransforms(buffer, transforms);
+
     /* move inspected tracker to end of the data. HtpBodyPrune will consider
      * the window sizes when freeing data */
     body->body_inspected = body->content_len_so_far;

src/detect-transform-compress-whitespace.c

@@ -39,6 +39,8 @@ static int DetectTransformCompressWhitespaceSetup (DetectEngineCtx *, Signature
 static void DetectTransformCompressWhitespaceRegisterTests(void);
 #endif
 static void TransformCompressWhitespace(InspectionBuffer *buffer, void *options);
+static bool TransformCompressWhitespaceValidate(
+        const uint8_t *content, uint16_t content_len, void *options);
 
 void DetectTransformCompressWhitespaceRegister(void)
 {
@@ -50,6 +52,8 @@ void DetectTransformCompressWhitespaceRegister(void)
         "/rules/transforms.html#compress-whitespace";
     sigmatch_table[DETECT_TRANSFORM_COMPRESS_WHITESPACE].Transform =
         TransformCompressWhitespace;
+    sigmatch_table[DETECT_TRANSFORM_COMPRESS_WHITESPACE].TransformValidate =
+            TransformCompressWhitespaceValidate;
     sigmatch_table[DETECT_TRANSFORM_COMPRESS_WHITESPACE].Setup =
         DetectTransformCompressWhitespaceSetup;
 #ifdef UNITTESTS
@@ -75,6 +79,30 @@ static int DetectTransformCompressWhitespaceSetup (DetectEngineCtx *de_ctx, Sign
     SCReturnInt(r);
 }
 
+/*
+ *  \brief Validate content bytes to see if it's compatible with this transform
+ *  \param content Byte array to check for compatibility
+ *  \param content_len Number of bytes to check
+ *  \param options Ignored
+ *  \retval false If the string contains spaces
+ *  \retval true Otherwise.
+ */
+static bool TransformCompressWhitespaceValidate(
+        const uint8_t *content, uint16_t content_len, void *options)
+{
+    if (content) {
+        for (uint32_t i = 0; i < content_len; i++) {
+            if (!isspace(*content++)) {
+                continue;
+            }
+            if ((i + 1) < content_len && isspace(*content)) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+
 static void TransformCompressWhitespace(InspectionBuffer *buffer, void *options)
 {
     const uint8_t *input = buffer->inspect;
@@ -132,7 +160,7 @@ static int DetectTransformCompressWhitespaceTest01(void)
     uint32_t input_len = strlen((char *)input);
 
     InspectionBuffer buffer;
-    InspectionBufferInit(&buffer, 8);
+    InspectionBufferInit(&buffer, 9);
     InspectionBufferSetup(&buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformCompressWhitespace(&buffer, NULL);
@@ -147,7 +175,7 @@ static int DetectTransformCompressWhitespaceTest02(void)
     uint32_t input_len = strlen((char *)input);
 
     InspectionBuffer buffer;
-    InspectionBufferInit(&buffer, 8);
+    InspectionBufferInit(&buffer, 9);
     InspectionBufferSetup(&buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformDoubleWhitespace(&buffer);
@@ -160,11 +188,42 @@ static int DetectTransformCompressWhitespaceTest02(void)
     PASS;
 }
 
+static int DetectTransformCompressWhitespaceTest03(void)
+{
+    const uint8_t *input = (const uint8_t *)" A B C D  ";
+    uint32_t input_len = strlen((char *)input);
+
+    InspectionBuffer buffer;
+    InspectionBufferInit(&buffer, 10);
+    InspectionBufferSetup(&buffer, input, input_len);
+    PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
+    FAIL_IF(TransformCompressWhitespaceValidate(buffer.inspect, buffer.inspect_len, NULL));
+    PASS;
+}
+
+static int DetectTransformCompressWhitespaceTest04(void)
+{
+    const uint8_t *input = (const uint8_t *)" A B C D ";
+    uint32_t input_len = strlen((char *)input);
+
+    InspectionBuffer buffer;
+    InspectionBufferInit(&buffer, 9);
+    InspectionBufferSetup(&buffer, input, input_len);
+    TransformDoubleWhitespace(&buffer);
+    PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
+    FAIL_IF(TransformCompressWhitespaceValidate(buffer.inspect, buffer.inspect_len, NULL));
+    PASS;
+}
+
 static void DetectTransformCompressWhitespaceRegisterTests(void)
 {
     UtRegisterTest("DetectTransformCompressWhitespaceTest01",
             DetectTransformCompressWhitespaceTest01);
     UtRegisterTest("DetectTransformCompressWhitespaceTest02",
             DetectTransformCompressWhitespaceTest02);
+    UtRegisterTest(
+            "DetectTransformCompressWhitespaceTest03", DetectTransformCompressWhitespaceTest03);
+    UtRegisterTest(
+            "DetectTransformCompressWhitespaceTest04", DetectTransformCompressWhitespaceTest04);
 }
-#endif
+#endif