Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

http: prepare libhtp-rs #12407

Closed
wants to merge 8 commits into from
Closed

http: prepare libhtp-rs #12407

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
1cdd740
http: aliases for htp statuses
catenacyber Jan 16, 2025
1759c87
http: aliases for htp server personalities
catenacyber Jan 16, 2025
1d1b4cc
http: aliases for htp flags
catenacyber Jan 16, 2025
24324e9
http: aliases for htp auths
catenacyber Jan 16, 2025
4437d71
http: aliases for htp methods
catenacyber Jan 16, 2025
7077061
http: aliases for htp stream states
catenacyber Jan 16, 2025
063552f
http: aliases for htp protocol versions
catenacyber Jan 16, 2025
4f4dcc0
http: aliases for htp progresses
catenacyber Jan 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions src/app-layer-htp-libhtp.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,54 @@

#include "suricata-common.h"

// Temporary alias definitions before switching to libhtp rust
#define HTP_STATUS_OK HTP_OK
#define HTP_STATUS_ERROR HTP_ERROR

#define HTP_SERVER_PERSONALITY_APACHE_2 HTP_SERVER_APACHE_2
#define HTP_SERVER_PERSONALITY_MINIMAL HTP_SERVER_MINIMAL
#define HTP_SERVER_PERSONALITY_GENERIC HTP_SERVER_GENERIC
#define HTP_SERVER_PERSONALITY_IDS HTP_SERVER_IDS
#define HTP_SERVER_PERSONALITY_IIS_4_0 HTP_SERVER_IIS_4_0
#define HTP_SERVER_PERSONALITY_IIS_5_0 HTP_SERVER_IIS_5_0
#define HTP_SERVER_PERSONALITY_IIS_5_1 HTP_SERVER_IIS_5_1
#define HTP_SERVER_PERSONALITY_IIS_6_0 HTP_SERVER_IIS_6_0
#define HTP_SERVER_PERSONALITY_IIS_7_0 HTP_SERVER_IIS_7_0
#define HTP_SERVER_PERSONALITY_IIS_7_5 HTP_SERVER_IIS_7_5

#define HTP_FLAGS_REQUEST_INVALID_T_E HTP_REQUEST_INVALID_T_E
#define HTP_FLAGS_REQUEST_INVALID_C_L HTP_REQUEST_INVALID_C_L
#define HTP_FLAGS_HOST_MISSING HTP_HOST_MISSING
#define HTP_FLAGS_HOST_AMBIGUOUS HTP_HOST_AMBIGUOUS
#define HTP_FLAGS_HOSTU_INVALID HTP_HOSTU_INVALID
#define HTP_FLAGS_HOSTH_INVALID HTP_HOSTH_INVALID

#define HTP_AUTH_TYPE_UNRECOGNIZED HTP_AUTH_UNRECOGNIZED

#define HTP_METHOD_UNKNOWN HTP_M_UNKNOWN
#define HTP_METHOD_GET HTP_M_GET
#define HTP_METHOD_POST HTP_M_POST
#define HTP_METHOD_PUT HTP_M_PUT
#define HTP_METHOD_CONNECT HTP_M_CONNECT

#define HTP_STREAM_STATE_ERROR HTP_STREAM_ERROR
#define HTP_STREAM_STATE_TUNNEL HTP_STREAM_TUNNEL

#define HTP_PROTOCOL_V1_1 HTP_PROTOCOL_1_1
#define HTP_PROTOCOL_V1_0 HTP_PROTOCOL_1_0
#define HTP_PROTOCOL_V0_9 HTP_PROTOCOL_0_9

#define HTP_REQUEST_PROGRESS_LINE HTP_REQUEST_LINE
#define HTP_REQUEST_PROGRESS_HEADERS HTP_REQUEST_HEADERS
#define HTP_REQUEST_PROGRESS_BODY HTP_REQUEST_BODY
#define HTP_REQUEST_PROGRESS_TRAILER HTP_REQUEST_TRAILER
#define HTP_REQUEST_PROGRESS_COMPLETE HTP_REQUEST_COMPLETE
#define HTP_RESPONSE_PROGRESS_LINE HTP_RESPONSE_LINE
#define HTP_RESPONSE_PROGRESS_HEADERS HTP_RESPONSE_HEADERS
#define HTP_RESPONSE_PROGRESS_BODY HTP_RESPONSE_BODY
#define HTP_RESPONSE_PROGRESS_TRAILER HTP_RESPONSE_TRAILER
#define HTP_RESPONSE_PROGRESS_COMPLETE HTP_RESPONSE_COMPLETE

bstr *SCHTPGenerateNormalizedUri(htp_tx_t *tx, htp_uri_t *uri, bool uri_include_all);

#endif /* SURICATA_APP_LAYER_HTP_LIBHTP__H */
280 changes: 146 additions & 134 deletions src/app-layer-htp.c
View file
Open in desktop

Large diffs are not rendered by default.

3 changes: 2 additions & 1 deletion src/detect-file-data.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "app-layer-htp-libhtp.h"
#include "app-layer-smtp.h"

#include "flow.h"
Expand Down Expand Up @@ -260,7 +261,7 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx,
ips = htp_state->cfg->http_body_inline;

const bool body_done = AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, tx,
flow_flags) > HTP_RESPONSE_BODY;
flow_flags) > HTP_RESPONSE_PROGRESS_BODY;

SCLogDebug("response.body_limit %u file_size %" PRIu64
", cur_file->inspect_min_size %" PRIu32 ", EOF %s, progress > body? %s",
Expand Down
13 changes: 7 additions & 6 deletions src/detect-http-client-body.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@
#include "app-layer.h"
#include "app-layer-parser.h"
#include "app-layer-htp.h"
#include "app-layer-htp-libhtp.h"
#include "detect-http-client-body.h"
#include "stream-tcp.h"
#include "util-profiling.h"
Expand Down Expand Up @@ -104,10 +105,10 @@ void DetectHttpClientBodyRegister(void)
sigmatch_table[DETECT_HTTP_REQUEST_BODY].flags |= SIGMATCH_INFO_STICKY_BUFFER;

DetectAppLayerInspectEngineRegister("http_client_body", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_BODY, DetectEngineInspectBufferHttpBody, NULL);
HTP_REQUEST_PROGRESS_BODY, DetectEngineInspectBufferHttpBody, NULL);

DetectAppLayerMpmRegister("http_client_body", SIG_FLAG_TOSERVER, 2,
PrefilterMpmHttpRequestBodyRegister, NULL, ALPROTO_HTTP1, HTP_REQUEST_BODY);
PrefilterMpmHttpRequestBodyRegister, NULL, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_BODY);

DetectAppLayerInspectEngineRegister("http_client_body", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
HTTP2StateDataClient, DetectEngineInspectFiledata, NULL);
Expand Down Expand Up @@ -245,7 +246,7 @@ static InspectionBuffer *HttpRequestBodyGetDataCallback(DetectEngineThreadCtx *d
htp_state->cfg->request.body_limit, body->content_len_so_far,
htp_state->cfg->request.inspect_min_size, flags & STREAM_EOF ? "true" : "false",
(AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, tx, flags) >
HTP_REQUEST_BODY)
HTP_REQUEST_PROGRESS_BODY)
? "true"
: "false");

Expand All @@ -256,7 +257,7 @@ static InspectionBuffer *HttpRequestBodyGetDataCallback(DetectEngineThreadCtx *d
body->content_len_so_far < htp_state->cfg->request.body_limit) &&
body->content_len_so_far < htp_state->cfg->request.inspect_min_size &&
!(AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, tx, flags) >
HTP_REQUEST_BODY) &&
HTP_REQUEST_PROGRESS_BODY) &&
!(flags & STREAM_EOF)) {
SCLogDebug("we still haven't seen the entire request body. "
"Let's defer body inspection till we see the "
Expand Down Expand Up @@ -336,11 +337,11 @@ static uint8_t DetectEngineInspectBufferHttpBody(DetectEngineCtx *de_ctx,

if (flags & STREAM_TOSERVER) {
if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, txv, flags) >
HTP_REQUEST_BODY)
HTP_REQUEST_PROGRESS_BODY)
return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH;
} else {
if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, txv, flags) >
HTP_RESPONSE_BODY)
HTP_RESPONSE_PROGRESS_BODY)
return DETECT_ENGINE_INSPECT_SIG_CANT_MATCH;
}
return DETECT_ENGINE_INSPECT_SIG_NO_MATCH;
Expand Down
9 changes: 5 additions & 4 deletions src/detect-http-cookie.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@
#include "app-layer-parser.h"

#include "app-layer-htp.h"
#include "app-layer-htp-libhtp.h"
#include "detect-http-cookie.h"
#include "stream-tcp.h"

Expand Down Expand Up @@ -107,14 +108,14 @@ void DetectHttpCookieRegister(void)
sigmatch_table[DETECT_HTTP_COOKIE].flags |= SIGMATCH_INFO_STICKY_BUFFER;

DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);

DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);
DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
GetResponseData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
GetResponseData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);

DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
Expand Down
13 changes: 7 additions & 6 deletions src/detect-http-header-names.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@
#include "app-layer-parser.h"

#include "app-layer-htp.h"
#include "app-layer-htp-libhtp.h"
#include "detect-http-header.h"
#include "stream-tcp.h"

Expand Down Expand Up @@ -89,12 +90,12 @@ static uint8_t *GetBufferForTX(
htp_table_t *headers;
if (flags & STREAM_TOSERVER) {
if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, tx, flags) <=
HTP_REQUEST_HEADERS)
HTP_REQUEST_PROGRESS_HEADERS)
return NULL;
headers = tx->request_headers;
} else {
if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, tx, flags) <=
HTP_RESPONSE_HEADERS)
HTP_RESPONSE_PROGRESS_HEADERS)
return NULL;
headers = tx->response_headers;
}
Expand Down Expand Up @@ -220,14 +221,14 @@ void DetectHttpHeaderNamesRegister(void)

/* http1 */
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetBuffer1ForTX, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
GetBuffer1ForTX, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
GetBuffer1ForTX, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
GetBuffer1ForTX, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_HEADERS);

DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetBuffer1ForTX);
HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetBuffer1ForTX);
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetBuffer1ForTX);
HTP_RESPONSE_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetBuffer1ForTX);

/* http2 */
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
Expand Down
33 changes: 15 additions & 18 deletions src/detect-http-header.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@
#include "app-layer-parser.h"

#include "app-layer-htp.h"
#include "app-layer-htp-libhtp.h"
#include "detect-http-header.h"
#include "detect-http-header-common.h"

Expand Down Expand Up @@ -82,12 +83,12 @@ static uint8_t *GetBufferForTX(
htp_table_t *headers;
if (flags & STREAM_TOSERVER) {
if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, tx, flags) <=
HTP_REQUEST_HEADERS)
HTP_REQUEST_PROGRESS_HEADERS)
return NULL;
headers = tx->request_headers;
} else {
if (AppLayerParserGetStateProgress(IPPROTO_TCP, ALPROTO_HTTP1, tx, flags) <=
HTP_RESPONSE_HEADERS)
HTP_RESPONSE_PROGRESS_HEADERS)
return NULL;
headers = tx->response_headers;
}
Expand Down Expand Up @@ -304,9 +305,8 @@ static int PrefilterMpmHttpHeaderRequestRegister(DetectEngineCtx *de_ctx, SigGro
pectx->mpm_ctx = mpm_ctx;
pectx->transforms = &mpm_reg->transforms;

int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpHeader,
mpm_reg->app_v2.alproto, HTP_REQUEST_HEADERS,
pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpHeader, mpm_reg->app_v2.alproto,
HTP_REQUEST_PROGRESS_HEADERS, pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
if (r != 0) {
SCFree(pectx);
return r;
Expand All @@ -320,9 +320,8 @@ static int PrefilterMpmHttpHeaderRequestRegister(DetectEngineCtx *de_ctx, SigGro
pectx->mpm_ctx = mpm_ctx;
pectx->transforms = &mpm_reg->transforms;

r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpTrailer,
mpm_reg->app_v2.alproto, HTP_REQUEST_TRAILER,
pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpTrailer, mpm_reg->app_v2.alproto,
HTP_REQUEST_PROGRESS_TRAILER, pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
if (r != 0) {
SCFree(pectx);
}
Expand All @@ -342,9 +341,8 @@ static int PrefilterMpmHttpHeaderResponseRegister(DetectEngineCtx *de_ctx, SigGr
pectx->mpm_ctx = mpm_ctx;
pectx->transforms = &mpm_reg->transforms;

int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpHeader,
mpm_reg->app_v2.alproto, HTP_RESPONSE_HEADERS,
pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
int r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpHeader, mpm_reg->app_v2.alproto,
HTP_RESPONSE_PROGRESS_HEADERS, pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
if (r != 0) {
SCFree(pectx);
return r;
Expand All @@ -358,9 +356,8 @@ static int PrefilterMpmHttpHeaderResponseRegister(DetectEngineCtx *de_ctx, SigGr
pectx->mpm_ctx = mpm_ctx;
pectx->transforms = &mpm_reg->transforms;

r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpTrailer,
mpm_reg->app_v2.alproto, HTP_RESPONSE_TRAILER,
pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
r = PrefilterAppendTxEngine(de_ctx, sgh, PrefilterMpmHttpTrailer, mpm_reg->app_v2.alproto,
HTP_RESPONSE_PROGRESS_TRAILER, pectx, PrefilterMpmHttpHeaderFree, mpm_reg->pname);
if (r != 0) {
SCFree(pectx);
}
Expand Down Expand Up @@ -430,13 +427,13 @@ void DetectHttpHeaderRegister(void)
sigmatch_table[DETECT_HTTP_HEADER].flags |= SIGMATCH_INFO_STICKY_BUFFER;

DetectAppLayerInspectEngineRegister("http_header", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_HEADERS, DetectEngineInspectBufferHttpHeader, NULL);
HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferHttpHeader, NULL);
DetectAppLayerMpmRegister("http_header", SIG_FLAG_TOSERVER, 2,
PrefilterMpmHttpHeaderRequestRegister, NULL, ALPROTO_HTTP1,
0); /* not used, registered twice: HEADERS/TRAILER */

DetectAppLayerInspectEngineRegister("http_header", ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
HTP_RESPONSE_HEADERS, DetectEngineInspectBufferHttpHeader, NULL);
HTP_RESPONSE_PROGRESS_HEADERS, DetectEngineInspectBufferHttpHeader, NULL);
DetectAppLayerMpmRegister("http_header", SIG_FLAG_TOCLIENT, 2,
PrefilterMpmHttpHeaderResponseRegister, NULL, ALPROTO_HTTP1,
0); /* not used, registered twice: HEADERS/TRAILER */
Expand Down Expand Up @@ -637,7 +634,7 @@ void DetectHttpRequestHeaderRegister(void)
DetectAppLayerMultiRegister("http_request_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
HTTP2StateOpen, GetHttp2HeaderData, 2, HTTP2StateOpen);
DetectAppLayerMultiRegister("http_request_header", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_HEADERS, GetHttp1HeaderData, 2, HTP_REQUEST_HEADERS);
HTP_REQUEST_PROGRESS_HEADERS, GetHttp1HeaderData, 2, HTP_REQUEST_PROGRESS_HEADERS);

DetectBufferTypeSetDescriptionByName("http_request_header", "HTTP header name and value");
g_http_request_header_buffer_id = DetectBufferTypeGetByName("http_request_header");
Expand Down Expand Up @@ -670,7 +667,7 @@ void DetectHttpResponseHeaderRegister(void)
DetectAppLayerMultiRegister("http_response_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
HTTP2StateOpen, GetHttp2HeaderData, 2, HTTP2StateOpen);
DetectAppLayerMultiRegister("http_response_header", ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
HTP_RESPONSE_HEADERS, GetHttp1HeaderData, 2, HTP_RESPONSE_HEADERS);
HTP_RESPONSE_PROGRESS_HEADERS, GetHttp1HeaderData, 2, HTP_RESPONSE_PROGRESS_HEADERS);

DetectBufferTypeSetDescriptionByName("http_response_header", "HTTP header name and value");
g_http_response_header_buffer_id = DetectBufferTypeGetByName("http_response_header");
Expand Down
9 changes: 5 additions & 4 deletions src/detect-http-headers-stub.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
#include "flow.h"

#include <htp/htp.h>
#include "app-layer-htp-libhtp.h"

#include "detect.h"
#include "detect-parse.h"
Expand Down Expand Up @@ -187,25 +188,25 @@ static void DetectHttpHeadersRegisterStub(void)

#ifdef KEYWORD_TOSERVER
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
#endif
#ifdef KEYWORD_TOCLIENT
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_HEADERS);
DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
#endif
#ifdef KEYWORD_TOSERVER
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
#endif
#ifdef KEYWORD_TOCLIENT
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
HTP_RESPONSE_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
#endif
Expand Down
9 changes: 5 additions & 4 deletions src/detect-http-host.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@
#include "app-layer-parser.h"

#include "app-layer-htp.h"
#include "app-layer-htp-libhtp.h"
#include "stream-tcp.h"
#include "detect-http-host.h"

Expand Down Expand Up @@ -106,10 +107,10 @@ void DetectHttpHHRegister(void)
sigmatch_table[DETECT_HTTP_HOST].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

DetectAppLayerInspectEngineRegister("http_host", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetData);
HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetData);

DetectAppLayerMpmRegister("http_host", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);

DetectAppLayerInspectEngineRegister("http_host", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
Expand Down Expand Up @@ -141,10 +142,10 @@ void DetectHttpHHRegister(void)
sigmatch_table[DETECT_HTTP_HOST_RAW].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

DetectAppLayerInspectEngineRegister("http_raw_host", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRawData);
HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetRawData);

DetectAppLayerMpmRegister("http_raw_host", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetRawData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
GetRawData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);

DetectAppLayerInspectEngineRegister("http_raw_host", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRawData2);
Expand Down
5 changes: 3 additions & 2 deletions src/detect-http-method.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@
#include "app-layer-parser.h"

#include "app-layer-htp.h"
#include "app-layer-htp-libhtp.h"
#include "detect-http-method.h"
#include "stream-tcp.h"

Expand Down Expand Up @@ -98,10 +99,10 @@ void DetectHttpMethodRegister(void)
sigmatch_table[DETECT_HTTP_METHOD].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;

DetectAppLayerInspectEngineRegister("http_method", ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
HTP_REQUEST_LINE, DetectEngineInspectBufferGeneric, GetData);
HTP_REQUEST_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData);

DetectAppLayerMpmRegister("http_method", SIG_FLAG_TOSERVER, 4, PrefilterGenericMpmRegister,
GetData, ALPROTO_HTTP1, HTP_REQUEST_LINE);
GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE);

DetectAppLayerInspectEngineRegister("http_method", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
Expand Down
Loading
Loading