aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

unifying content structure - http_method now uses DetectContentData

Browse Source
remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent 041f5b1a4f
commit 1957eee389
3 changed files with 28 additions and 40 deletions
Show Stats Download Patch File Download Diff File

46
src/detect-http-method.c
Unescape Escape View File

@ -94,7 +94,7 @@ int DetectHttpMethodMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
SCEnter();
size_t idx;
DetectHttpMethodData *data = (DetectHttpMethodData *)sm->ctx;
DetectContentData *data = (DetectContentData *)sm->ctx;
HtpState *hs = (HtpState *)state;
htp_tx_t *tx = NULL;
int ret = 0;
@ -119,7 +119,7 @@ int DetectHttpMethodMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
printf("Pattern: ");PrintRawUriFp(stdout, data->content, data->content_len);printf("\n");
*/
if (data->flags & DETECT_AL_HTTP_METHOD_NOCASE) {
if (data->flags & DETECT_CONTENT_NOCASE) {
SCLogDebug("no case inspection");
ret = (SpmNocaseSearch((uint8_t *)meth_str, bstr_size(tx->request_method),
data->content, data->content_len) != NULL);
@ -136,7 +136,7 @@ int DetectHttpMethodMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
}
SCMutexUnlock(&f->m);
SCReturnInt(ret ^ ((data->flags & DETECT_AL_HTTP_METHOD_NEGATED) ? 1 : 0));
SCReturnInt(ret ^ ((data->flags & DETECT_CONTENT_NEGATED) ? 1 : 0));
}
/**
@ -153,7 +153,7 @@ int DetectHttpMethodMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *str)
{
SCEnter();
DetectHttpMethodData *data = NULL;
DetectContentData *data = NULL;
/** new sig match to replace previous content */
SigMatch *nm = NULL;
@ -198,21 +198,21 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, char *st
goto error;
}
data = SCMalloc(sizeof(DetectHttpMethodData));
data = SCMalloc(sizeof(DetectContentData));
if (data == NULL)
goto error;
memset(data, 0x00, sizeof(DetectHttpMethodData));
memset(data, 0x00, sizeof(DetectContentData));
data->content_len = ((DetectContentData *)pm->ctx)->content_len;
data->content = ((DetectContentData *)pm->ctx)->content;
/* transfer the nocase flag if it has already been set */
if (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NOCASE) {
data->flags |= DETECT_AL_HTTP_METHOD_NOCASE;
data->flags |= DETECT_CONTENT_NOCASE;
}
/* transfer the negate flag */
if (((DetectContentData *)pm->ctx)->flags & DETECT_CONTENT_NEGATED) {
data->flags |= DETECT_AL_HTTP_METHOD_NEGATED;
data->flags |= DETECT_CONTENT_NEGATED;
}
data->id = DetectPatternGetId(de_ctx->mpm_pattern_id_store, data, DETECT_AL_HTTP_METHOD);
@ -251,12 +251,12 @@ error:
}
/**
* \brief this function will free memory associated with DetectHttpMethodData
* \brief this function will free memory associated with DetectContentData
*
* \param id_d pointer to DetectHttpMethodData
* \param id_d pointer to DetectContentData
*/
void DetectHttpMethodFree(void *ptr) {
DetectHttpMethodData *data = (DetectHttpMethodData *)ptr;
DetectContentData *data = (DetectContentData *)ptr;
if (data->content != NULL) SCFree(data->content);
SCFree(data);
@ -426,7 +426,7 @@ int DetectHttpMethodTest06(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectContentData *hmd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
if (cd->id == hmd->id)
goto end;
@ -465,7 +465,7 @@ int DetectHttpMethodTest07(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectContentData *hmd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
if (cd->id == hmd->id)
goto end;
@ -504,7 +504,7 @@ int DetectHttpMethodTest08(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectContentData *hmd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
if (cd->id != 0 || hmd->id != 1)
goto end;
@ -543,7 +543,7 @@ int DetectHttpMethodTest09(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectContentData *hmd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
if (cd->id != 1 || hmd->id != 0)
goto end;
@ -583,8 +583,8 @@ int DetectHttpMethodTest10(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectHttpMethodData *hmd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->prev->ctx;
DetectContentData *hmd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectContentData *hmd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->prev->ctx;
if (cd->id != 1 || hmd1->id != 0 || hmd2->id != 0)
goto end;
@ -624,8 +624,8 @@ int DetectHttpMethodTest11(void)
}
DetectContentData *cd = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_PMATCH]->ctx;
DetectHttpMethodData *hmd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectHttpMethodData *hmd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->prev->ctx;
DetectContentData *hmd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectContentData *hmd2 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->prev->ctx;
if (cd->id != 2 || hmd1->id != 0 || hmd2->id != 0)
goto end;
@ -664,15 +664,15 @@ static int DetectHttpMethodTest12(void)
goto end;
}
DetectHttpMethodData *hmd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectHttpMethodData *hmd2 = de_ctx->sig_list->next->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectContentData *hmd1 = de_ctx->sig_list->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
DetectContentData *hmd2 = de_ctx->sig_list->next->sm_lists_tail[DETECT_SM_LIST_AMATCH]->ctx;
if (!(hmd1->flags & DETECT_AL_HTTP_METHOD_NOCASE)) {
if (!(hmd1->flags & DETECT_CONTENT_NOCASE)) {
printf("nocase flag not set on sig 1: ");
goto end;
}
if (!(hmd2->flags & DETECT_AL_HTTP_METHOD_NOCASE)) {
if (!(hmd2->flags & DETECT_CONTENT_NOCASE)) {
printf("nocase flag not set on sig 2: ");
goto end;
}

16
src/detect-http-method.h
Unescape Escape View File

@ -24,22 +24,10 @@
#ifndef __DETECT_HTTP_METHOD_H__
#define __DETECT_HTTP_METHOD_H__
#define DETECT_AL_HTTP_METHOD_NOCASE 0x01
#define DETECT_AL_HTTP_METHOD_NEGATED 0x02
typedef struct DetectHttpMethodData_ {
/* please keep the order of the first 2 members intact, since we use the
* same template obtained from DetectContentData to access these members
* for pattern id retrieval from DetectPatternGetId() */
uint8_t *content; /**< Raw HTTP method content to match */
uint8_t content_len; /**< Raw HTTP method content length */
PatIntId id;
uint8_t flags;
} DetectHttpMethodData;
/* prototypes */
void DetectHttpMethodRegister(void);
int DetectHttpMethodDoMatch(DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm, Flow *f, uint8_t flags, void *state);
int DetectHttpMethodDoMatch(DetectEngineThreadCtx *, Signature *, SigMatch *,
Flow *, uint8_t, void *);
#endif /* __DETECT_HTTP_METHOD_H__ */

6
src/detect-nocase.c
Unescape Escape View File

@ -192,7 +192,7 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
DetectContentData *dhcb = NULL;
DetectContentData *dhcd = NULL;
DetectHttpHeaderData *dhhd = NULL;
DetectHttpMethodData *dhmd = NULL;
DetectContentData *dhmd = NULL;
switch (pm->type) {
case DETECT_URICONTENT:
@ -227,8 +227,8 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
dhhd->flags |= DETECT_AL_HTTP_HEADER_NOCASE;
break;
case DETECT_AL_HTTP_METHOD:
dhmd =(DetectHttpMethodData *) pm->ctx;
dhmd->flags |= DETECT_AL_HTTP_METHOD_NOCASE;
dhmd =(DetectContentData *) pm->ctx;
dhmd->flags |= DETECT_CONTENT_NOCASE;
break;
case DETECT_AL_HTTP_COOKIE:
dhcd = (DetectContentData *) pm->ctx;

Write Preview
Loading…
Cancel
Save