suricata
app-layer-htp-xff.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  HttpXFFCfg_
 

Macros

#define XFF_DISABLED   1
 
#define XFF_EXTRADATA   2
 
#define XFF_OVERWRITE   4
 
#define XFF_REVERSE   8
 
#define XFF_FORWARD   16
 
#define XFF_MAXLEN   46
 

Typedefs

typedef struct HttpXFFCfg_ HttpXFFCfg
 

Functions

void HttpXFFGetCfg (ConfNode *conf, HttpXFFCfg *result)
 Function to return XFF configuration from a configuration node. More...
 
int HttpXFFGetIPFromTx (const Flow *f, uint64_t tx_id, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen)
 Function to return XFF IP if any in the selected transaction. The caller needs to lock the flow. More...
 
int HttpXFFGetIP (const Flow *f, HttpXFFCfg *xff_cfg, char *dstbuf, int dstbuflen)
 Function to return XFF IP if any. The caller needs to lock the flow. More...
 
void HTPXFFParserRegisterTests (void)
 

Detailed Description

Macro Definition Documentation

#define XFF_DISABLED   1

XFF is disabled

Definition at line 29 of file app-layer-htp-xff.h.

Referenced by HttpXFFGetCfg(), JsonBuildFileInfoRecord(), and Unified2Logger().

#define XFF_EXTRADATA   2

XFF extra data mode

Definition at line 31 of file app-layer-htp-xff.h.

Referenced by HttpXFFGetCfg(), JsonBuildFileInfoRecord(), and Unified2Logger().

#define XFF_FORWARD   16

XFF is to be used in a forward proxy deployment

Definition at line 37 of file app-layer-htp-xff.h.

Referenced by HttpXFFGetCfg().

#define XFF_MAXLEN   46

Single XFF IP maximum length (default value based on IPv6 address length)

Definition at line 39 of file app-layer-htp-xff.h.

Referenced by JsonBuildFileInfoRecord(), and Unified2Logger().

#define XFF_OVERWRITE   4

XFF overwrite mode

Definition at line 33 of file app-layer-htp-xff.h.

Referenced by HttpXFFGetCfg(), JsonBuildFileInfoRecord(), and Unified2Logger().

#define XFF_REVERSE   8

XFF is to be used in a reverse proxy deployment

Definition at line 35 of file app-layer-htp-xff.h.

Referenced by HttpXFFGetCfg(), and HttpXFFGetIPFromTx().

Typedef Documentation

typedef struct HttpXFFCfg_ HttpXFFCfg

Function Documentation

void HTPXFFParserRegisterTests ( void  )

Definition at line 351 of file app-layer-htp-xff.c.

References UtRegisterTest().

Referenced by HTPParserRegisterTests().

Here is the call graph for this function:

Here is the caller graph for this function:

void HttpXFFGetCfg ( ConfNode conf,
HttpXFFCfg result 
)

Function to return XFF configuration from a configuration node.

Definition at line 202 of file app-layer-htp-xff.c.

References BUG_ON, ConfNodeChildValueIsTrue(), ConfNodeLookupChild(), ConfNodeLookupChildValue(), HttpXFFCfg_::flags, HttpXFFCfg_::header, SC_WARN_XFF_INVALID_DEPLOYMENT, SC_WARN_XFF_INVALID_HEADER, SC_WARN_XFF_INVALID_MODE, SCLogWarning, XFF_DEFAULT, XFF_DISABLED, XFF_EXTRADATA, XFF_FORWARD, XFF_OVERWRITE, and XFF_REVERSE.

Referenced by OutputJsonRegister(), and Unified2AlertInitCtx().

Here is the call graph for this function:

Here is the caller graph for this function:

int HttpXFFGetIP ( const Flow f,
HttpXFFCfg xff_cfg,
char *  dstbuf,
int  dstbuflen 
)

Function to return XFF IP if any. The caller needs to lock the flow.

Return values
1if the IP has been found and returned in dstbuf
0if the IP has not being found or error

Definition at line 177 of file app-layer-htp-xff.c.

References AppLayerParserGetTxCnt(), FlowGetAppState(), HttpXFFGetIPFromTx(), SCLogDebug, and tx_id.

Referenced by Unified2Logger().

Here is the call graph for this function:

Here is the caller graph for this function:

int HttpXFFGetIPFromTx ( const Flow f,
uint64_t  tx_id,
HttpXFFCfg xff_cfg,
char *  dstbuf,
int  dstbuflen 
)

Function to return XFF IP if any in the selected transaction. The caller needs to lock the flow.

Return values
1if the IP has been found and returned in dstbuf
0if the IP has not being found or error

Get the last IP address from the chain

Get the first IP address from the chain

Definition at line 113 of file app-layer-htp-xff.c.

References ALPROTO_HTTP, AppLayerParserGetTx(), AppLayerParserGetTxCnt(), HttpXFFCfg_::flags, FlowGetAppState(), HttpXFFCfg_::header, memrchr(), Flow_::proto, SCLogDebug, XFF_CHAIN_MAXLEN, XFF_CHAIN_MINLEN, and XFF_REVERSE.

Referenced by HttpXFFGetIP(), and JsonBuildFileInfoRecord().

Here is the call graph for this function:

Here is the caller graph for this function: