diff --git a/src/detect-luajit.c b/src/detect-luajit.c index 3ea3ad9e66..572d4ba77d 100644 --- a/src/detect-luajit.c +++ b/src/detect-luajit.c @@ -133,6 +133,9 @@ static pthread_mutex_t luajit_states_lock = PTHREAD_MUTEX_INITIALIZER; #define DATATYPE_HTTP_RESPONSE_COOKIE (1<<11) #define DATATYPE_HTTP_RESPONSE_BODY (1<<12) +#define DATATYPE_HTTP_RESPONSE_HEADERS (1<<13) +#define DATATYPE_HTTP_RESPONSE_HEADERS_RAW (1<<14) + static void *LuaStatePoolAlloc(void) { return luaL_newstate(); } @@ -253,7 +256,7 @@ int DetectLuajitMatchBuffer(DetectEngineThreadCtx *det_ctx, Signature *s, SigMat lua_newtable(tluajit->luastate); /* stack at -1 */ lua_pushliteral (tluajit->luastate, "offset"); /* stack at -2 */ - lua_pushnumber (tluajit->luastate, (int)offset); + lua_pushnumber (tluajit->luastate, (int)(offset + 1)); lua_settable(tluajit->luastate, -3); lua_pushstring (tluajit->luastate, luajit->buffername); /* stack at -2 */ @@ -649,6 +652,12 @@ static int DetectLuaSetupPrime(DetectLuajitData *ld) { else if (strcmp(k, "http.response_cookie") == 0) ld->flags |= DATATYPE_HTTP_RESPONSE_COOKIE; + else if (strcmp(k, "http.response_headers") == 0) + ld->flags |= DATATYPE_HTTP_RESPONSE_HEADERS; + + else if (strcmp(k, "http.response_headers.raw") == 0) + ld->flags |= DATATYPE_HTTP_RESPONSE_HEADERS_RAW; + else { SCLogError(SC_ERR_LUAJIT_ERROR, "unsupported http data type %s", k); goto error; @@ -736,9 +745,9 @@ static int DetectLuajitSetup (DetectEngineCtx *de_ctx, Signature *s, char *str) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HCDMATCH); else if (luajit->flags & DATATYPE_HTTP_REQUEST_UA) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HUADMATCH); - else if (luajit->flags & DATATYPE_HTTP_REQUEST_HEADERS) + else if (luajit->flags & (DATATYPE_HTTP_REQUEST_HEADERS|DATATYPE_HTTP_RESPONSE_HEADERS)) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HHDMATCH); - else if (luajit->flags & DATATYPE_HTTP_REQUEST_HEADERS_RAW) + else if (luajit->flags & (DATATYPE_HTTP_REQUEST_HEADERS_RAW|DATATYPE_HTTP_RESPONSE_HEADERS_RAW)) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HRHDMATCH); else if (luajit->flags & DATATYPE_HTTP_RESPONSE_COOKIE) SigMatchAppendSMToList(s, sm, DETECT_SM_LIST_HCDMATCH);