diff --git a/src/detect-http-protocol.c b/src/detect-http-protocol.c index 809dc20d71..9dc3455d21 100644 --- a/src/detect-http-protocol.c +++ b/src/detect-http-protocol.c @@ -75,7 +75,7 @@ static int DetectHttpProtocolSetup(DetectEngineCtx *de_ctx, Signature *s, const if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0) return -1; - if (DetectSignatureSetAppProto(s, ALPROTO_HTTP1) < 0) + if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0) return -1; return 0; @@ -114,6 +114,20 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, return buffer; } +static InspectionBuffer *GetData2(DetectEngineThreadCtx *det_ctx, + const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv, + const int list_id) +{ + InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id); + if (buffer->inspect == NULL) { + InspectionBufferSetup( + det_ctx, list_id, buffer, (const uint8_t *)"HTTP/2", strlen("HTTP/2")); + InspectionBufferApplyTransforms(buffer, transforms); + } + + return buffer; +} + /** * \brief Registers the keyword handlers for the "http.protocol" keyword. */ @@ -135,6 +149,15 @@ void DetectHttpProtocolRegister(void) DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE, DetectEngineInspectBufferGeneric, GetData); + DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, + GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT, + HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetData2); + DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, + GetData2, ALPROTO_HTTP2, HTTP2StateDataServer); + DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);