From e9d43254c8db0ea840de3189e5de68ede97651f7 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sun, 25 Nov 2018 18:33:01 +0100 Subject: [PATCH] detect: add http.host.raw sticky buffer --- src/detect-engine-register.h | 1 + src/detect-http-hh.c | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index 00364844c8..4ca936e395 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -140,6 +140,7 @@ enum { DETECT_AL_HTTP_HOST, DETECT_HTTP_HOST, DETECT_AL_HTTP_RAW_HOST, + DETECT_HTTP_HOST_RAW, DETECT_AL_HTTP_REQUEST_LINE, DETECT_AL_HTTP_RESPONSE_LINE, DETECT_AL_NFS_PROCEDURE, diff --git a/src/detect-http-hh.c b/src/detect-http-hh.c index 0bc9064a8b..37572d4e14 100644 --- a/src/detect-http-hh.c +++ b/src/detect-http-hh.c @@ -70,6 +70,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, void *txv, const int list_id); static int DetectHttpHRHSetup(DetectEngineCtx *, Signature *, const char *); static int g_http_raw_host_buffer_id = 0; +static int DetectHttpHostRawSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str); static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx, const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv, const int list_id); @@ -118,6 +119,13 @@ void DetectHttpHHRegister(void) sigmatch_table[DETECT_AL_HTTP_RAW_HOST].Setup = DetectHttpHRHSetup; sigmatch_table[DETECT_AL_HTTP_RAW_HOST].flags |= SIGMATCH_NOOPT ; + /* http.host sticky buffer */ + sigmatch_table[DETECT_HTTP_HOST_RAW].name = "http.host.raw"; + sigmatch_table[DETECT_HTTP_HOST_RAW].desc = "sticky buffer to match only on the HTTP host header or the raw hostname from the HTTP uri"; + sigmatch_table[DETECT_HTTP_HOST_RAW].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-host"; + sigmatch_table[DETECT_HTTP_HOST_RAW].Setup = DetectHttpHostRawSetupSticky; + sigmatch_table[DETECT_HTTP_HOST_RAW].flags |= SIGMATCH_NOOPT; + DetectAppLayerInspectEngineRegister2("http_raw_host", ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRawData); @@ -247,6 +255,22 @@ int DetectHttpHRHSetup(DetectEngineCtx *de_ctx, Signature *s, const char *arg) ALPROTO_HTTP); } +/** + * \brief this function setup the http.host keyword used in the rule + * + * \param de_ctx Pointer to the Detection Engine Context + * \param s Pointer to the Signature to which the current keyword belongs + * \param str Should hold an empty string always + * + * \retval 0 On success + */ +static int DetectHttpHostRawSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str) +{ + DetectBufferSetActiveList(s, g_http_raw_host_buffer_id); + s->alproto = ALPROTO_HTTP; + return 0; +} + static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx, const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv, const int list_id)