@ -78,130 +78,12 @@ void DetectHttpStatCodeRegister (void) {
sigmatch_table [ DETECT_AL_HTTP_STAT_CODE ] . AppLayerMatch = NULL ;
sigmatch_table [ DETECT_AL_HTTP_STAT_CODE ] . alproto = ALPROTO_HTTP ;
sigmatch_table [ DETECT_AL_HTTP_STAT_CODE ] . Setup = DetectHttpStatCodeSetup ;
sigmatch_table [ DETECT_AL_HTTP_STAT_CODE ] . Free = DetectHttpStatCodeFree ;
sigmatch_table [ DETECT_AL_HTTP_STAT_CODE ] . Free = NULL ;
sigmatch_table [ DETECT_AL_HTTP_STAT_CODE ] . RegisterTests = DetectHttpStatCodeRegisterTests ;
sigmatch_table [ DETECT_AL_HTTP_STAT_CODE ] . flags | = SIGMATCH_PAYLOAD ;
}
/**
* \ brief match the specified content in the signature with the received http
* status code header in the http response .
*
* \ param t pointer to thread vars
* \ param det_ctx pointer to the pattern matcher thread
* \ param f pointer to the current flow
* \ param flags flags to indicate the direction of the received packet
* \ param state pointer the app layer state , which will cast into HtpState
* \ param s pointer to the current signature
* \ param sm pointer to the sigmatch
*
* \ retval 0 no match
* \ retval 1 match
*/
int DetectHttpStatCodeMatch ( ThreadVars * t , DetectEngineThreadCtx * det_ctx ,
Flow * f , uint8_t flags , void * state , Signature * s ,
SigMatch * sm )
{
SCEnter ( ) ;
int ret = 0 ;
int idx ;
SCMutexLock ( & f - > m ) ;
SCLogDebug ( " got lock %p " , & f - > m ) ;
DetectHttpStatCodeData * co = ( DetectHttpStatCodeData * ) sm - > ctx ;
HtpState * htp_state = ( HtpState * ) state ;
if ( htp_state = = NULL ) {
SCLogDebug ( " no HTTP layer state has been received, so no match " ) ;
goto end ;
}
if ( ! ( htp_state - > flags & HTP_FLAG_STATE_OPEN ) ) {
SCLogDebug ( " HTP state not yet properly setup, so no match " ) ;
goto end ;
}
SCLogDebug ( " htp_state %p, flow %p " , htp_state , f ) ;
SCLogDebug ( " htp_state->connp %p " , htp_state - > connp ) ;
SCLogDebug ( " htp_state->connp->conn %p " , htp_state - > connp - > conn ) ;
if ( htp_state - > connp = = NULL | | htp_state - > connp - > conn = = NULL ) {
SCLogDebug ( " HTTP connection structure is NULL " ) ;
goto end ;
}
htp_tx_t * tx = NULL ;
idx = AppLayerTransactionGetInspectId ( f ) ;
if ( idx = = - 1 ) {
goto end ;
}
int size = ( int ) list_size ( htp_state - > connp - > conn - > transactions ) ;
for ( ; idx < size ; idx + + )
{
tx = list_get ( htp_state - > connp - > conn - > transactions , idx ) ;
if ( tx = = NULL )
continue ;
SCLogDebug ( " we have a response message " ) ;
if ( co - > code ! = - 1 ) {
if ( co - > code = = tx - > response_status_number ) {
SCLogDebug ( " Matched numeric HTTP status value " ) ;
ret = 1 ;
}
} else if ( tx - > response_status ! = NULL ) {
/* call the case insensitive version if nocase has been specified in
the sig */
if ( co - > flags & DETECT_AL_HTTP_STAT_CODE_NOCASE ) {
if ( SpmNocaseSearch ( ( uint8_t * ) bstr_ptr ( tx - > response_status ) ,
bstr_len ( tx - > response_status ) , co - > data , co - > data_len )
! = NULL )
{
SCLogDebug ( " match has been found in received request and "
" given http_stat_code rule " ) ;
ret = 1 ;
}
} else {
if ( SpmSearch ( ( uint8_t * ) bstr_ptr ( tx - > response_status ) ,
bstr_len ( tx - > response_status ) , co - > data , co - > data_len )
! = NULL )
{
SCLogDebug ( " match has been found in received request and "
" given http_stat_code rule " ) ;
ret = 1 ;
}
}
}
}
SCMutexUnlock ( & f - > m ) ;
SCReturnInt ( ret ^ ( ( co - > flags & DETECT_AL_HTTP_STAT_CODE_NEGATED ) ? 1 : 0 ) ) ;
end :
SCMutexUnlock ( & f - > m ) ;
SCLogDebug ( " released lock %p " , & f - > m ) ;
SCReturnInt ( ret ) ;
}
/**
* \ brief this function clears the memory of http_stat_code modifier keyword
*
* \ param ptr Pointer to the Detection Stat Code data
*/
void DetectHttpStatCodeFree ( void * ptr )
{
DetectHttpStatCodeData * hsmd = ( DetectHttpStatCodeData * ) ptr ;
if ( hsmd = = NULL )
return ;
if ( hsmd - > data ! = NULL )
SCFree ( hsmd - > data ) ;
SCFree ( hsmd ) ;
}
/**
* \ brief this function setups the http_stat_code modifier keyword used in the rule
*
@ -269,7 +151,7 @@ static int DetectHttpStatCodeSetup (DetectEngineCtx *de_ctx, Signature *s, char
/* reassigning pm */
pm = SigMatchGetLastSMFromLists ( s , 4 ,
DETECT_ AL_HTTP_STAT_CODE , s - > sm_lists_tail [ DETECT_SM_LIST_HSCDMATCH ] ,
DETECT_ CONTENT , s - > sm_lists_tail [ DETECT_SM_LIST_HSCDMATCH ] ,
DETECT_PCRE , s - > sm_lists_tail [ DETECT_SM_LIST_HSCDMATCH ] ) ;
if ( pm = = NULL ) {
SCLogError ( SC_ERR_INVALID_SIGNATURE , " http_stat_code seen with a "
@ -286,7 +168,7 @@ static int DetectHttpStatCodeSetup (DetectEngineCtx *de_ctx, Signature *s, char
}
}
cd - > id = DetectPatternGetId ( de_ctx - > mpm_pattern_id_store , cd , DETECT_SM_LIST_HSCDMATCH ) ;
sm - > type = DETECT_ AL_HTTP_STAT_CODE ;
sm - > type = DETECT_ CONTENT ;
/* transfer the sm from the pmatch list to hcbdmatch list */
SigMatchTransferSigMatchAcrossLists ( sm ,
@ -392,10 +274,10 @@ int DetectHttpStatCodeTest02(void)
SigMatch * prev = NULL ;
while ( sm ! = NULL ) {
if ( sm - > type = = DETECT_ AL_HTTP_STAT_CODE ) {
if ( sm - > type = = DETECT_ CONTENT ) {
result = 1 ;
} else {
printf ( " expected DETECT_ AL_HTTP_STAT_CODE , got %d: " , sm - > type ) ;
printf ( " expected DETECT_ CONTENT for http_stat_code , got %d: " , sm - > type ) ;
goto end ;
}
prev = sm ;
Anoop Saldanha
14 years ago
committed by
Victor Julien