From 4acd5a04e69750a9f45f319507cf7ea166ad3bba Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Mon, 9 Jan 2012 12:44:09 +0530 Subject: [PATCH] Enable http raw response header inspection only if libhtp supports raw response header buffering which should be available post 0.2.6 --- configure.in | 5 +++++ src/detect-engine-hrhd.c | 9 +++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/configure.in b/configure.in index 45904ad798..3eed6d875c 100644 --- a/configure.in +++ b/configure.in @@ -845,6 +845,11 @@ AC_CHECK_HEADER(pcap.h,,[AC_ERROR(pcap.h not found ...)]) AC_CHECK_LIB([htp], [htp_config_register_request_uri_normalize],AC_DEFINE_UNQUOTED([HAVE_HTP_URI_NORMALIZE_HOOK],[1],[Found htp_config_register_request_uri_normalize function in libhtp]) ,,[-lhtp]) ]) + AC_CHECK_LIB([htp], [htp_tx_get_response_headers_raw],[libhtp_raw_response_header_buffer_support_enabled="yes"],[libhtp_raw_response_header_buffer_support_enabled="no"]) + if test "$libhtp_raw_response_header_buffer_support_enabled" = "yes"; then + CFLAGS="${CFLAGS} -D__LIBHTP_026GT_RESPONSE_HEADER_SUPPORT__" + fi + #even if we are using an installed htp lib we still need to gen Makefiles inside of htp AC_CONFIG_SUBDIRS([libhtp]) AM_CONDITIONAL([BUILD_LIBHTP], [test "x$enable_non_bundled_htp" = "xno"]) diff --git a/src/detect-engine-hrhd.c b/src/detect-engine-hrhd.c index c0b9cd478d..27e9ab1aeb 100644 --- a/src/detect-engine-hrhd.c +++ b/src/detect-engine-hrhd.c @@ -346,12 +346,14 @@ int DetectEngineRunHttpRawHeaderMpm(DetectEngineThreadCtx *det_ctx, Flow *f, (uint8_t *)bstr_ptr(raw_headers), bstr_len(raw_headers)); } +#ifdef __LIBHTP_026GT_RESPONSE_HEADER_SUPPORT__ raw_headers = htp_tx_get_response_headers_raw(tx); if (raw_headers != NULL) { cnt += HttpRawHeaderPatternSearch(det_ctx, (uint8_t *)bstr_ptr(raw_headers), bstr_len(raw_headers)); } +#endif } end: @@ -407,12 +409,15 @@ int DetectEngineInspectHttpRawHeader(DetectEngineCtx *de_ctx, if (tx == NULL) continue; - bstr *raw_headers; + bstr *raw_headers = NULL; if (flags & STREAM_TOSERVER) { raw_headers = htp_tx_get_request_headers_raw(tx); - } else { + } +#ifdef __LIBHTP_026GT_RESPONSE_HEADER_SUPPORT__ + else { raw_headers = htp_tx_get_response_headers_raw(tx); } +#endif if (raw_headers == NULL) continue;