63 static int g_http_header_buffer_id = 0;
64 static int g_keyword_thread_id = 0;
66 #define BUFFER_SIZE_STEP 1024
69 static uint8_t *GetBufferForTX(
82 if (
flags & STREAM_TOSERVER) {
86 headers = tx->request_headers;
91 headers = tx->response_headers;
97 size_t no_of_headers = htp_table_size(headers);
98 for (; i < no_of_headers; i++) {
99 htp_header_t *h = htp_table_get_index(headers, i, NULL);
100 size_t size1 = bstr_size(h->name);
101 size_t size2 = bstr_size(h->value);
103 if (
flags & STREAM_TOSERVER) {
105 SCMemcmpLowercase(
"cookie", bstr_ptr(h->name), 6) == 0) {
110 SCMemcmpLowercase(
"set-cookie", bstr_ptr(h->name), 10) == 0) {
115 size_t size = size1 + size2 + 4;
117 if (i + 1 == no_of_headers)
120 if (size + buf->
len > buf->
size) {
126 memcpy(buf->
buffer + buf->
len, bstr_ptr(h->name), bstr_size(h->name));
127 buf->
len += bstr_size(h->name);
130 memcpy(buf->
buffer + buf->
len, bstr_ptr(h->value), bstr_size(h->value));
131 buf->
len += bstr_size(h->value);
134 #if 0 // looks like this breaks existing rules
135 if (i + 1 == no_of_headers) {
142 *buffer_len = buf->
len;
153 const uint8_t *b = NULL;
155 if (rs_http2_tx_get_headers(txv, flow_flags, &b, &b_len) != 1)
157 if (b == NULL || b_len == 0)
176 const int list_id = engine->
sm_list;
179 SCLogDebug(
"setting up inspect buffer %d", list_id);
187 uint32_t rawdata_len = 0;
188 uint8_t *rawdata = GetBufferForTX(txv, det_ctx, f,
flags, &rawdata_len);
189 if (rawdata_len == 0) {
199 const uint8_t *data = buffer->
inspect;
209 NULL, f, (uint8_t *)data, data_len,
offset,
216 if (
flags & STREAM_TOSERVER) {
222 HTP_RESPONSE_HEADERS)
251 const int list_id = ctx->
list_id;
254 uint32_t rawdata_len = 0;
255 uint8_t *rawdata = GetBufferForTX(txv, det_ctx, f,
flags, &rawdata_len);
256 if (rawdata_len == 0)
265 const uint8_t *data = buffer->
inspect;
270 if (data != NULL && data_len >= mpm_ctx->
minlen) {
272 &det_ctx->
mtcu, &det_ctx->
pmq, data, data_len);
290 PrefilterMpmHttpHeader(det_ctx, pectx, p, f, txv, idx, _txd,
flags);
294 static void PrefilterMpmHttpHeaderFree(
void *ptr)
314 mpm_reg->
app_v2.alproto, HTP_REQUEST_HEADERS,
315 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->
pname);
322 pectx =
SCCalloc(1,
sizeof(*pectx));
330 mpm_reg->
app_v2.alproto, HTP_REQUEST_TRAILER,
331 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->
pname);
353 mpm_reg->
app_v2.alproto, HTP_RESPONSE_HEADERS,
354 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->
pname);
361 pectx =
SCCalloc(1,
sizeof(*pectx));
369 mpm_reg->
app_v2.alproto, HTP_RESPONSE_TRAILER,
370 pectx, PrefilterMpmHttpHeaderFree, mpm_reg->
pname);
440 HTP_REQUEST_HEADERS, DetectEngineInspectBufferHttpHeader, NULL);
446 HTP_RESPONSE_HEADERS, DetectEngineInspectBufferHttpHeader, NULL);