http: add inspection engine for http request line

No MPM though.

src/Makefile.am

@@ -103,6 +103,7 @@ detect-engine-hmd.c detect-engine-hmd.h \
 detect-engine-hrhd.c detect-engine-hrhd.h \
 detect-engine-hrhhd.c detect-engine-hrhhd.h \
 detect-engine-hrud.c detect-engine-hrud.h \
+detect-engine-hrl.c detect-engine-hrl.h \
 detect-engine-hsbd.c detect-engine-hsbd.h \
 detect-engine-hscd.c detect-engine-hscd.h \
 detect-engine-hsmd.c detect-engine-hsmd.h \

src/detect-engine-content-inspection.h

@@ -35,6 +35,7 @@ enum {
     /* called with flow locked */
     DETECT_ENGINE_CONTENT_INSPECTION_MODE_DCE,
     DETECT_ENGINE_CONTENT_INSPECTION_MODE_URI,
+    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRL,
     DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRUD,
     DETECT_ENGINE_CONTENT_INSPECTION_MODE_HHD,
     DETECT_ENGINE_CONTENT_INSPECTION_MODE_HRHD,

src/detect-engine-hrl.h

@@ -0,0 +1,34 @@
+/* Copyright (C) 2015 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/** \file
+ *
+ *  \author Victor Julien <victor@inliniac.net>
+ */
+
+#ifndef __DETECT_ENGINE_HRL_H__
+#define __DETECT_ENGINE_HRL_H__
+
+int DetectEngineInspectHttpRequestLine(ThreadVars *tv,
+                                  DetectEngineCtx *de_ctx,
+                                  DetectEngineThreadCtx *det_ctx,
+                                  Signature *s, Flow *f, uint8_t flags,
+                                  void *alstate,
+                                  void *tx, uint64_t tx_id);
+void HttpRequestLineRegisterTests(void);
+
+#endif /* __DETECT_ENGINE_HRL_H__ */

src/detect-engine-state.h

@@ -77,6 +77,7 @@
 #define DE_STATE_FLAG_DNSQUERY_INSPECT    (1 << 17)
 #define DE_STATE_FLAG_APP_EVENT_INSPECT   (1 << 18)
 #define DE_STATE_FLAG_MODBUS_INSPECT	  (1 << 19)
+#define DE_STATE_FLAG_HRL_INSPECT	      (1 << 20)
 
 /* state flags */
 #define DETECT_ENGINE_STATE_FLAG_FILE_STORE_DISABLED 0x0001

src/detect-engine.c

@@ -52,6 +52,7 @@
 #include "detect-engine-hmd.h"
 #include "detect-engine-hcd.h"
 #include "detect-engine-hrud.h"
+#include "detect-engine-hrl.h"
 #include "detect-engine-hsmd.h"
 #include "detect-engine-hscd.h"
 #include "detect-engine-hua.h"
@@ -160,6 +161,13 @@ void DetectEngineRegisterAppInspectionEngines(void)
           DE_STATE_FLAG_URI_INSPECT,
           0,
           DetectEngineInspectPacketUris },
+        { IPPROTO_TCP,
+          ALPROTO_HTTP,
+          DETECT_SM_LIST_HRLMATCH,
+          DE_STATE_FLAG_HRL_INSPECT,
+          DE_STATE_FLAG_HRL_INSPECT,
+          0,
+          DetectEngineInspectHttpRequestLine },
         { IPPROTO_TCP,
           ALPROTO_HTTP,
           DETECT_SM_LIST_HCBDMATCH,
@@ -1637,6 +1645,8 @@ const char *DetectSigmatchListEnumToString(enum DetectSigmatchListEnum type)
             return "http cookie";
         case DETECT_SM_LIST_HUADMATCH:
             return "http user-agent";
+        case DETECT_SM_LIST_HRLMATCH:
+            return "http request line";
         case DETECT_SM_LIST_APP_EVENT:
             return "app layer events";
 

src/detect-lua.c

@@ -1042,7 +1042,7 @@ static int DetectLuaSetup (DetectEngineCtx *de_ctx, Signature *s, char *str)
         else if (luajit->flags & DATATYPE_HTTP_RESPONSE_COOKIE)
             SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HCDMATCH);
         else
-            SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_AMATCH);
+            SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HRLMATCH);
     } else if (luajit->alproto == ALPROTO_DNS) {
         SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_DNSQUERY_MATCH);
     } else {

src/detect-parse.c

@@ -1445,6 +1445,8 @@ static Signature *SigInitHelper(DetectEngineCtx *de_ctx, char *sigstr,
         sig->flags |= SIG_FLAG_STATE_MATCH;
     if (sig->sm_lists[DETECT_SM_LIST_AMATCH])
         sig->flags |= SIG_FLAG_STATE_MATCH;
+    if (sig->sm_lists[DETECT_SM_LIST_HRLMATCH])
+        sig->flags |= SIG_FLAG_STATE_MATCH;
     if (sig->sm_lists[DETECT_SM_LIST_HCBDMATCH])
         sig->flags |= SIG_FLAG_STATE_MATCH;
     if (sig->sm_lists[DETECT_SM_LIST_HSBDMATCH])

src/detect.h

@@ -109,6 +109,8 @@ enum DetectSigmatchListEnum {
     DETECT_SM_LIST_HCDMATCH,
     /* list for http_user_agent keyword and the ones relative to it */
     DETECT_SM_LIST_HUADMATCH,
+    /* list for http_request_line keyword and the ones relative to it */
+    DETECT_SM_LIST_HRLMATCH,
     /* app event engine sm list */
     DETECT_SM_LIST_APP_EVENT,