diff --git a/src/Makefile.am b/src/Makefile.am index 94eafcd7a1..a67d5761f4 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -168,6 +168,7 @@ detect-http-accept-enc.c detect-http-accept-enc.h \ detect-http-accept-lang.c detect-http-accept-lang.h \ detect-http-client-body.c detect-http-client-body.h \ detect-http-connection.c detect-http-connection.h \ +detect-http-content-len.c detect-http-content-len.h \ detect-http-content-type.c detect-http-content-type.h \ detect-http-cookie.c detect-http-cookie.h \ detect-http-header.c detect-http-header.h \ diff --git a/src/detect-http-content-len.c b/src/detect-http-content-len.c new file mode 100644 index 0000000000..cbce16259d --- /dev/null +++ b/src/detect-http-content-len.c @@ -0,0 +1,47 @@ +/* Copyright (C) 2007-2017 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \ingroup httplayer + * + * @{ + */ + + +/** + * \file + * + * \author Victor Julien + * + * Implements http_content_len sticky buffer + */ + +#define KEYWORD_NAME "http_content_len" +#define KEYWORD_DOC "http-keywords#http-content-len" +#define BUFFER_NAME "http_content_len" +#define BUFFER_DESC "http content length header" +#define HEADER_NAME "Content-Length" +#define KEYWORD_ID DETECT_AL_HTTP_HEADER_CONTENT_LEN +#define KEYWORD_TOSERVER 1 +#define KEYWORD_TOCLIENT 1 + +#include "detect-http-headers-stub.h" + +void RegisterHttpHeadersContentLen(void) +{ + DetectHttpHeadersRegisterStub(); +} diff --git a/src/detect-http-content-len.h b/src/detect-http-content-len.h new file mode 100644 index 0000000000..1e4b1a260a --- /dev/null +++ b/src/detect-http-content-len.h @@ -0,0 +1,23 @@ +/* Copyright (C) 2007-2017 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +#ifndef __DETECT_HTTP_CONTENT_LEN_H__ +#define __DETECT_HTTP_CONTENT_LEN_H__ + +void RegisterHttpHeadersContentLen(void); + +#endif /* __DETECT_HTTP_CONTENT_LEN_H__ */ diff --git a/src/detect-http-headers.c b/src/detect-http-headers.c index 2b8c769a60..807bac6142 100644 --- a/src/detect-http-headers.c +++ b/src/detect-http-headers.c @@ -19,6 +19,7 @@ #include "detect-http-accept-enc.h" #include "detect-http-accept-lang.h" #include "detect-http-connection.h" +#include "detect-http-content-len.h" #include "detect-http-content-type.h" #include "detect-http-referer.h" @@ -29,5 +30,7 @@ void DetectHttpHeadersRegister(void) RegisterHttpHeadersAcceptLang(); RegisterHttpHeadersReferer(); RegisterHttpHeadersConnection(); + RegisterHttpHeadersContentLen(); RegisterHttpHeadersContentType(); } + diff --git a/src/detect.h b/src/detect.h index 783ac476c2..bda17fb4e8 100644 --- a/src/detect.h +++ b/src/detect.h @@ -1245,6 +1245,7 @@ enum { DETECT_AL_HTTP_HEADER_ACCEPT_LANG, DETECT_AL_HTTP_HEADER_ACCEPT_ENC, DETECT_AL_HTTP_HEADER_CONNECTION, + DETECT_AL_HTTP_HEADER_CONTENT_LEN, DETECT_AL_HTTP_HEADER_CONTENT_TYPE, DETECT_AL_HTTP_HEADER_REFERER, DETECT_AL_HTTP_RAW_HEADER,