diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c index 22b7965052..7045a0edec 100644 --- a/src/detect-http-client-body.c +++ b/src/detect-http-client-body.c @@ -111,10 +111,10 @@ void DetectHttpClientBodyRegister(void) DetectAppLayerMpmRegister("http_client_body", SIG_FLAG_TOSERVER, 2, PrefilterMpmHttpRequestBodyRegister, NULL, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_BODY); - DetectAppLayerInspectEngineRegister("http_client_body", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgData, DetectEngineInspectFiledata, NULL); - DetectAppLayerMpmRegister("http_client_body", SIG_FLAG_TOSERVER, 2, - PrefilterMpmFiledataRegister, NULL, ALPROTO_HTTP2, HTTP2ProgData); + DetectAppLayerInspectEngineRegisterSubState("http_client_body", ALPROTO_HTTP2, + SIG_FLAG_TOSERVER, HTTP2TxTypeStream, HTTP2ProgData, DetectEngineInspectFiledata, NULL); + DetectAppLayerMpmRegisterSubState("http_client_body", SIG_FLAG_TOSERVER, 2, + PrefilterMpmFiledataRegister, NULL, ALPROTO_HTTP2, HTTP2TxTypeStream, HTTP2ProgData); DetectBufferTypeSetDescriptionByName("http_client_body", "http request body"); diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c index f687232a7a..ae524ea787 100644 --- a/src/detect-http-cookie.c +++ b/src/detect-http-cookie.c @@ -119,15 +119,18 @@ void DetectHttpCookieRegister(void) DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetResponseData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); - DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetRequestData2); - DetectAppLayerInspectEngineRegister("http_cookie", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetResponseData2); - - DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetRequestData2, ALPROTO_HTTP2, HTTP2ProgHeaders); - DetectAppLayerMpmRegister("http_cookie", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, - GetResponseData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerInspectEngineRegisterSubState("http_cookie", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetRequestData2); + DetectAppLayerInspectEngineRegisterSubState("http_cookie", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, + GetResponseData2); + + DetectAppLayerMpmRegisterSubState("http_cookie", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetRequestData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_cookie", SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetResponseData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); DetectBufferTypeSetDescriptionByName("http_cookie", "http cookie header"); diff --git a/src/detect-http-header-names.c b/src/detect-http-header-names.c index 4b6285a4cf..c4846e5ab5 100644 --- a/src/detect-http-header-names.c +++ b/src/detect-http-header-names.c @@ -234,15 +234,17 @@ void DetectHttpHeaderNamesRegister(void) HTP_RESPONSE_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetBuffer1ForTX); /* http2 */ - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2ProgHeaders); - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, - GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2ProgHeaders); - - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); + DetectAppLayerMpmRegisterSubState(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); + + DetectAppLayerInspectEngineRegisterSubState(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); + DetectAppLayerInspectEngineRegisterSubState(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC); diff --git a/src/detect-http-header.c b/src/detect-http-header.c index 40c54cf81c..89ea1d199e 100644 --- a/src/detect-http-header.c +++ b/src/detect-http-header.c @@ -399,6 +399,12 @@ void DetectHttpHeaderRegister(void) 0); /* not used, registered twice: HEADERS/TRAILER */ /* header is for stream TX type */ + DetectAppLayerInspectEngineRegisterSubState("http_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); + DetectAppLayerMpmRegisterSubState("http_header", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetBuffer2ForTX, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); + DetectAppLayerInspectEngineRegisterSubState("http_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetBuffer2ForTX); DetectAppLayerMpmRegisterSubState("http_header", SIG_FLAG_TOCLIENT, 2, @@ -608,8 +614,8 @@ void DetectHttpResponseHeaderRegister(void) sigmatch_table[DETECT_HTTP_RESPONSE_HEADER].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER | SIGMATCH_INFO_MULTI_BUFFER; - DetectAppLayerMultiRegister("http_response_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgHeaders, GetHttp2HeaderData, 2); + DetectAppLayerMultiRegisterSubState("http_response_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2TxTypeStream, HTTP2ProgHeaders, GetHttp2HeaderData, 2); DetectAppLayerMultiRegister("http_response_header", ALPROTO_HTTP1, SIG_FLAG_TOCLIENT, HTP_RESPONSE_PROGRESS_HEADERS, GetHttp1HeaderData, 2); diff --git a/src/detect-http-headers-stub.h b/src/detect-http-headers-stub.h index 7b45ccda46..f296e9d4ea 100644 --- a/src/detect-http-headers-stub.h +++ b/src/detect-http-headers-stub.h @@ -197,26 +197,29 @@ static void DetectHttpHeadersRegisterStub(void) #ifdef KEYWORD_TOSERVER DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetRequestData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetRequestData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); #endif #ifdef KEYWORD_TOCLIENT DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_HEADERS); - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, - GetResponseData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetResponseData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); #endif #ifdef KEYWORD_TOSERVER DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER, HTP_REQUEST_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData); - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetRequestData2); + DetectAppLayerInspectEngineRegisterSubState(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetRequestData2); #endif #ifdef KEYWORD_TOCLIENT DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT, HTP_RESPONSE_PROGRESS_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData); - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetResponseData2); + DetectAppLayerInspectEngineRegisterSubState(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, + GetResponseData2); #endif DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC); diff --git a/src/detect-http-host.c b/src/detect-http-host.c index f32780c24c..db3af083cf 100644 --- a/src/detect-http-host.c +++ b/src/detect-http-host.c @@ -115,11 +115,12 @@ void DetectHttpHHRegister(void) DetectAppLayerMpmRegister("http_host", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); - DetectAppLayerInspectEngineRegister("http_host", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerInspectEngineRegisterSubState("http_host", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_host", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_host", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); DetectBufferTypeRegisterValidateCallback("http_host", DetectHttpHostValidateCallback); @@ -154,11 +155,12 @@ void DetectHttpHHRegister(void) DetectAppLayerMpmRegister("http_raw_host", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetRawData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); - DetectAppLayerInspectEngineRegister("http_raw_host", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetRawData2); + DetectAppLayerInspectEngineRegisterSubState("http_raw_host", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetRawData2); - DetectAppLayerMpmRegister("http_raw_host", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetRawData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_raw_host", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetRawData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); DetectBufferTypeSetDescriptionByName("http_raw_host", "http raw host header"); diff --git a/src/detect-http-method.c b/src/detect-http-method.c index b19523d54b..95182b0f37 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -106,11 +106,12 @@ void DetectHttpMethodRegister(void) DetectAppLayerMpmRegister("http_method", SIG_FLAG_TOSERVER, 4, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE); - DetectAppLayerInspectEngineRegister("http_method", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerInspectEngineRegisterSubState("http_method", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_method", SIG_FLAG_TOSERVER, 4, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_method", SIG_FLAG_TOSERVER, 4, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); DetectBufferTypeSetDescriptionByName("http_method", "http request method"); diff --git a/src/detect-http-protocol.c b/src/detect-http-protocol.c index b08be46591..9107d10fa0 100644 --- a/src/detect-http-protocol.c +++ b/src/detect-http-protocol.c @@ -172,14 +172,16 @@ void DetectHttpProtocolRegister(void) DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT, HTP_RESPONSE_PROGRESS_LINE, DetectEngineInspectBufferGeneric, GetData); - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgStart, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgStart); - DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgStart, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgStart); + DetectAppLayerInspectEngineRegisterSubState(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgStart, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerMpmRegisterSubState(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgStart); + DetectAppLayerInspectEngineRegisterSubState(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2TxTypeStream, HTTP2ProgStart, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerMpmRegisterSubState(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgStart); DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC); diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c index 993fa951ff..3bb50cd1fc 100644 --- a/src/detect-http-raw-header.c +++ b/src/detect-http-raw-header.c @@ -113,15 +113,17 @@ void DetectHttpRawHeaderRegister(void) PrefilterMpmHttpHeaderRawResponseRegister, NULL, ALPROTO_HTTP1, 0); /* progress handled in register */ - DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerInspectEngineRegister("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); - - DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgHeaders); - DetectAppLayerMpmRegister("http_raw_header", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerInspectEngineRegisterSubState("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerInspectEngineRegisterSubState("http_raw_header", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); + + DetectAppLayerMpmRegisterSubState("http_raw_header", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_raw_header", SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); DetectBufferTypeSetDescriptionByName("http_raw_header", "raw http headers"); diff --git a/src/detect-http-request-line.c b/src/detect-http-request-line.c index 0ac7bca5a4..85f0016519 100644 --- a/src/detect-http-request-line.c +++ b/src/detect-http-request-line.c @@ -116,10 +116,11 @@ void DetectHttpRequestLineRegister(void) DetectAppLayerMpmRegister("http_request_line", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE); - DetectAppLayerInspectEngineRegister("http_request_line", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgData, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_request_line", SIG_FLAG_TOSERVER, 2, - PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2ProgData); + DetectAppLayerInspectEngineRegisterSubState("http_request_line", ALPROTO_HTTP2, + SIG_FLAG_TOSERVER, HTTP2TxTypeStream, HTTP2ProgData, DetectEngineInspectBufferGeneric, + GetData2); + DetectAppLayerMpmRegisterSubState("http_request_line", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, HTTP2ProgData); DetectBufferTypeSetDescriptionByName("http_request_line", "http request line"); diff --git a/src/detect-http-response-line.c b/src/detect-http-response-line.c index 6d7100e525..28326a401c 100644 --- a/src/detect-http-response-line.c +++ b/src/detect-http-response-line.c @@ -115,10 +115,11 @@ void DetectHttpResponseLineRegister(void) DetectAppLayerMpmRegister("http_response_line", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_LINE); - DetectAppLayerInspectEngineRegister("http_response_line", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgData, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_response_line", SIG_FLAG_TOCLIENT, 2, - PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2ProgData); + DetectAppLayerInspectEngineRegisterSubState("http_response_line", ALPROTO_HTTP2, + SIG_FLAG_TOCLIENT, HTTP2TxTypeStream, HTTP2ProgData, DetectEngineInspectBufferGeneric, + GetData2); + DetectAppLayerMpmRegisterSubState("http_response_line", SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, HTTP2ProgData); DetectBufferTypeSetDescriptionByName("http_response_line", "http response line"); diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c index 2a33d84a0e..392fb95c25 100644 --- a/src/detect-http-stat-code.c +++ b/src/detect-http-stat-code.c @@ -107,11 +107,12 @@ void DetectHttpStatCodeRegister (void) DetectAppLayerMpmRegister("http_stat_code", SIG_FLAG_TOCLIENT, 4, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_LINE); - DetectAppLayerInspectEngineRegister("http_stat_code", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerInspectEngineRegisterSubState("http_stat_code", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_stat_code", SIG_FLAG_TOCLIENT, 4, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_stat_code", SIG_FLAG_TOCLIENT, 4, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); DetectBufferTypeSetDescriptionByName("http_stat_code", "http response status code"); diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c index 9fd39433a3..969485bfa8 100644 --- a/src/detect-http-stat-msg.c +++ b/src/detect-http-stat-msg.c @@ -117,10 +117,11 @@ void DetectHttpStatMsgRegister (void) DetectAppLayerMpmRegister("http_stat_msg", SIG_FLAG_TOCLIENT, 3, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_RESPONSE_PROGRESS_LINE); - DetectAppLayerInspectEngineRegister("http_stat_msg", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, - HTTP2ProgStart, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_stat_msg", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgStart); + DetectAppLayerInspectEngineRegisterSubState("http_stat_msg", ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2TxTypeStream, HTTP2ProgStart, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerMpmRegisterSubState("http_stat_msg", SIG_FLAG_TOCLIENT, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgStart); DetectBufferTypeSetDescriptionByName("http_stat_msg", "http response status message"); diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c index aab0fe8121..42b82b9c3b 100644 --- a/src/detect-http-ua.c +++ b/src/detect-http-ua.c @@ -107,11 +107,12 @@ void DetectHttpUARegister(void) DetectAppLayerMpmRegister("http_user_agent", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_HEADERS); - DetectAppLayerInspectEngineRegister("http_user_agent", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerInspectEngineRegisterSubState("http_user_agent", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_user_agent", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_user_agent", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); DetectBufferTypeSetDescriptionByName("http_user_agent", "http user agent"); diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index afaf81e258..d3b6b28f82 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -113,11 +113,11 @@ void DetectHttpUriRegister (void) DetectAppLayerMpmRegister("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE); - DetectAppLayerInspectEngineRegister("http_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerInspectEngineRegisterSubState("http_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, + GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, HTTP2ProgHeaders); DetectBufferTypeSetDescriptionByName("http_uri", "http request uri"); @@ -151,11 +151,12 @@ void DetectHttpUriRegister (void) GetRawData, ALPROTO_HTTP1, HTP_REQUEST_PROGRESS_LINE); // no difference between raw and decoded uri for HTTP2 - DetectAppLayerInspectEngineRegister("http_raw_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, - HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerInspectEngineRegisterSubState("http_raw_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2TxTypeStream, HTTP2ProgHeaders, DetectEngineInspectBufferGeneric, GetData2); - DetectAppLayerMpmRegister("http_raw_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, - GetData2, ALPROTO_HTTP2, HTTP2ProgHeaders); + DetectAppLayerMpmRegisterSubState("http_raw_uri", SIG_FLAG_TOSERVER, 2, + PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2TxTypeStream, + HTTP2ProgHeaders); DetectBufferTypeSetDescriptionByName("http_raw_uri", "raw http uri");