62 static int g_http_header_buffer_id = 0;
63 static int g_keyword_thread_id = 0;
65 #define BUFFER_SIZE_STEP 1024
68 static uint8_t *GetBufferForTX(
81 if (
flags & STREAM_TOSERVER) {
85 headers = tx->request_headers;
90 headers = tx->response_headers;
96 size_t no_of_headers = htp_table_size(headers);
97 for (; i < no_of_headers; i++) {
98 htp_header_t *h = htp_table_get_index(headers, i, NULL);
99 size_t size1 = bstr_size(h->name);
100 size_t size2 = bstr_size(h->value);
102 if (
flags & STREAM_TOSERVER) {
104 SCMemcmpLowercase(
"cookie", bstr_ptr(h->name), 6) == 0) {
109 SCMemcmpLowercase(
"set-cookie", bstr_ptr(h->name), 10) == 0) {
114 size_t size = size1 + size2 + 4;
116 if (i + 1 == no_of_headers)
119 if (size + buf->
len > buf->
size) {
125 memcpy(buf->
buffer + buf->
len, bstr_ptr(h->name), bstr_size(h->name));
126 buf->
len += bstr_size(h->name);
129 memcpy(buf->
buffer + buf->
len, bstr_ptr(h->value), bstr_size(h->value));
130 buf->
len += bstr_size(h->value);
133 #if 0 // looks like this breaks existing rules
134 if (i + 1 == no_of_headers) {
141 *buffer_len = buf->
len;
152 const uint8_t *b = NULL;
154 if (rs_http2_tx_get_headers(txv, flow_flags, &b, &b_len) != 1)
156 if (b == NULL || b_len == 0)
169 static int DetectEngineInspectBufferHttpHeader(
173 Flow *f, uint8_t
flags,
void *alstate,
void *txv, uint64_t tx_id)
177 const int list_id = engine->
sm_list;
180 SCLogDebug(
"setting up inspect buffer %d", list_id);
188 uint32_t rawdata_len = 0;
189 uint8_t *rawdata = GetBufferForTX(txv, det_ctx, f,
flags, &rawdata_len);
190 if (rawdata_len == 0) {
200 const uint8_t *data = buffer->
inspect;
210 NULL, f, (uint8_t *)data, data_len,
offset,
217 if (
flags & STREAM_TOSERVER) {
223 HTP_RESPONSE_HEADERS)
246 const uint64_t idx,
const uint8_t
flags)
254 const int list_id = ctx->
list_id;
257 uint32_t rawdata_len = 0;
258 uint8_t *rawdata = GetBufferForTX(txv, det_ctx, f,
flags, &rawdata_len);
259 if (rawdata_len == 0)
268 const uint8_t *data = buffer->
inspect;
273 if (data != NULL && data_len >= mpm_ctx->
minlen) {
275 &det_ctx->
mtcu, &det_ctx->
pmq, data, data_len);
282 const uint64_t idx,
const uint8_t
flags)
294 PrefilterMpmHttpHeader(det_ctx, pectx, p, f, txv, idx,
flags);
298 static void PrefilterMpmHttpHeaderFree(
void *ptr)
318 mpm_reg->
app_v2.alproto, HTP_REQUEST_HEADERS,
319 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->
pname);
326 pectx =
SCCalloc(1,
sizeof(*pectx));
334 mpm_reg->
app_v2.alproto, HTP_REQUEST_TRAILER,
335 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->
pname);
357 mpm_reg->
app_v2.alproto, HTP_RESPONSE_HEADERS,
358 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->
pname);
365 pectx =
SCCalloc(1,
sizeof(*pectx));
373 mpm_reg->
app_v2.alproto, HTP_RESPONSE_TRAILER,
374 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->
pname);
444 HTP_REQUEST_HEADERS, DetectEngineInspectBufferHttpHeader, NULL);
450 HTP_RESPONSE_HEADERS, DetectEngineInspectBufferHttpHeader, NULL);