Go to the documentation of this file.
66 #define KEYWORD_NAME "http.start"
67 #define KEYWORD_NAME_LEGACY "http_start"
68 #define KEYWORD_DOC "http-keywords.html#http-start"
69 #define BUFFER_NAME "http_start"
70 #define BUFFER_DESC "http start: request/response line + headers"
71 static int g_buffer_id = 0;
72 static int g_keyword_thread_id = 0;
74 #define BUFFER_SIZE_STEP 2048
77 static uint8_t *GetBufferForTX(
89 const bstr *line = NULL;
90 const htp_headers_t *headers;
91 if (
flags & STREAM_TOSERVER) {
93 HTP_REQUEST_PROGRESS_HEADERS)
95 line = htp_tx_request_line(tx);
96 headers = htp_tx_request_headers(tx);
99 HTP_RESPONSE_PROGRESS_HEADERS)
101 headers = htp_tx_response_headers(tx);
102 line = htp_tx_response_line(tx);
104 if (line == NULL || headers == NULL)
107 size_t line_size = bstr_len(line) + 2;
108 if (line_size + buf->
len > buf->
size) {
113 memcpy(buf->
buffer + buf->
len, bstr_ptr(line), bstr_size(line));
114 buf->
len += bstr_size(line);
119 size_t no_of_headers = htp_headers_size(headers);
120 for (; i < no_of_headers; i++) {
121 const htp_header_t *h = htp_headers_get_index(headers, i);
122 size_t size1 = htp_header_name_len(h);
123 size_t size2 = htp_header_value_len(h);
124 size_t size = size1 + size2 + 4;
125 if (i + 1 == no_of_headers)
127 if (size + buf->
len > buf->
size) {
133 memcpy(buf->
buffer + buf->
len, htp_header_name_ptr(h), htp_header_name_len(h));
134 buf->
len += htp_header_name_len(h);
137 memcpy(buf->
buffer + buf->
len, htp_header_value_ptr(h), htp_header_value_len(h));
138 buf->
len += htp_header_value_len(h);
141 if (i + 1 == no_of_headers) {
147 *buffer_len = buf->
len;
157 uint32_t rawdata_len = 0;
158 uint8_t *rawdata = GetBufferForTX(txv, det_ctx, f, flow_flags, &rawdata_len);
159 if (rawdata_len == 0)
163 det_ctx, list_id, buffer, rawdata, rawdata_len, transforms);
193 GetBuffer1ForTX,
ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS);
195 GetBuffer1ForTX,
ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_HEADERS);
210 SCLogDebug(
"keyword %s registered. Thread id %d. "
211 "Buffer %s registered. Buffer id %d",
int DetectSignatureSetAppProto(Signature *s, AppProto alproto)
#define SIGMATCH_INFO_STICKY_BUFFER
SigTableElmt * sigmatch_table
uint8_t DetectEngineInspectBufferGeneric(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const DetectEngineAppInspectionEngine *engine, const Signature *s, Flow *f, uint8_t flags, void *alstate, void *txv, uint64_t tx_id)
Do the content inspection & validation for a signature.
#define KEYWORD_NAME_LEGACY
void InspectionBufferSetupAndApplyTransforms(DetectEngineThreadCtx *det_ctx, const int list_id, InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len, const DetectEngineTransforms *transforms)
setup the buffer with our initial data
void DetectHttpStartRegister(void)
Registers the keyword handlers for the "http_start" keyword.
int AppLayerParserGetStateProgress(uint8_t ipproto, AppProto alproto, void *alstate, uint8_t flags)
get the progress value for a tx/protocol
main detection engine ctx
int SCDetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
#define SIG_FLAG_TOCLIENT
int HttpHeaderExpandBuffer(HttpHeaderThreadData *td, HttpHeaderBuffer *buf, size_t size)
int(* Setup)(DetectEngineCtx *, Signature *, const char *)
InspectionBuffer * InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
int DetectBufferTypeGetByName(const char *name)
#define SIG_FLAG_TOSERVER
int PrefilterGenericMpmRegister(DetectEngineCtx *de_ctx, SigGroupHead *sgh, MpmCtx *mpm_ctx, const DetectBufferMpmRegistry *mpm_reg, int list_id)
void DetectAppLayerMpmRegister(const char *name, int direction, int priority, PrefilterRegisterFunc PrefilterRegister, InspectionBufferGetDataPtr GetData, AppProto alproto, int tx_min_progress)
register an app layer keyword for mpm
Data structures and function prototypes for keeping state for the detection engine.
void * HttpHeaderThreadDataInit(void *data)
HttpHeaderBuffer * HttpHeaderGetBufferSpace(DetectEngineThreadCtx *det_ctx, Flow *f, uint8_t flags, const int keyword_id, HttpHeaderThreadData **ret_hdr_td)
void DetectAppLayerInspectEngineRegister(const char *name, AppProto alproto, uint32_t dir, int progress, InspectEngineFuncPtr Callback, InspectionBufferGetDataPtr GetData)
Registers an app inspection engine.
void DetectBufferTypeSetDescriptionByName(const char *name, const char *desc)
void HttpHeaderThreadDataFree(void *data)
int DetectRegisterThreadCtxGlobalFuncs(const char *name, void *(*InitFunc)(void *), void *data, void(*FreeFunc)(void *))
Register Thread keyword context Funcs (Global)