Go to the documentation of this file.
67 #define KEYWORD_NAME "http.header_names"
68 #define KEYWORD_NAME_LEGACY "http_header_names"
69 #define KEYWORD_DOC "http-keywords.html#http-header-names"
70 #define BUFFER_NAME "http_header_names"
71 #define BUFFER_DESC "http header names"
72 static int g_buffer_id = 0;
73 static int g_keyword_thread_id = 0;
75 #define BUFFER_SIZE_STEP 256
78 static uint8_t *GetBufferForTX(
90 const htp_headers_t *headers;
91 if (
flags & STREAM_TOSERVER) {
93 HTP_REQUEST_PROGRESS_HEADERS)
95 headers = htp_tx_request_headers(tx);
98 HTP_RESPONSE_PROGRESS_HEADERS)
100 headers = htp_tx_response_headers(tx);
107 size_t no_of_headers = htp_headers_size(headers);
108 for (; i < no_of_headers; i++) {
109 const htp_header_t *h = htp_headers_get_index(headers, i);
110 size_t size = htp_header_name_len(h) + 2;
113 if (i + 1 == no_of_headers)
116 SCLogDebug(
"size %"PRIuMAX
" + buf->len %u vs buf->size %u",
117 (uintmax_t)size, buf->
len, buf->
size);
118 if (size + buf->
len > buf->
size) {
130 memcpy(buf->
buffer + buf->
len, htp_header_name_ptr(h), htp_header_name_len(h));
131 buf->
len += htp_header_name_len(h);
136 if (i + 1 == no_of_headers) {
142 *buffer_len = buf->
len;
152 uint32_t rawdata_len = 0;
153 uint8_t *rawdata = GetBufferForTX(txv, det_ctx, f, flow_flags, &rawdata_len);
154 if (rawdata_len == 0)
158 det_ctx, list_id, buffer, rawdata, rawdata_len, transforms);
171 const uint8_t *b = NULL;
173 if (SCHttp2TxGetHeaderNames(txv, flow_flags, &b, &b_len) != 1)
175 if (b == NULL || b_len == 0)
223 GetBuffer1ForTX,
ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);
225 GetBuffer1ForTX,
ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_HEADERS);
251 SCLogDebug(
"keyword %s registered. Thread id %d. "
252 "Buffer %s registered. Buffer id %d",
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
#define SIGMATCH_INFO_STICKY_BUFFER
SigTableElmt * sigmatch_table
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
main detection engine ctx
int SCDetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
#define SIG_FLAG_TOCLIENT
int HttpHeaderExpandBuffer(HttpHeaderThreadData *td, HttpHeaderBuffer *buf, size_t size)
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
int DetectBufferTypeGetByName(const char *name)
#define SIG_FLAG_TOSERVER
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Data structures and function prototypes for keeping state for the detection engine.
void * HttpHeaderThreadDataInit(void *data)
HttpHeaderBuffer * HttpHeaderGetBufferSpace(DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, const int keyword_id, HttpHeaderThreadData **ret_hdr_td)
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
@ DETECT_HTTP_HEADER_NAMES
void HttpHeaderThreadDataFree(void *data)
int DetectRegisterThreadCtxGlobalFuncs(const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *))
Register Thread keyword context Funcs (Global)