~ubuntu-branches/ubuntu/precise/suricata/precise-proposed

« back to all changes in this revision

Viewing changes to src/detect-engine-uri.c

Committer: Bazaar Package Importer
Author(s): Pierre Chifflier
Date: 2010-06-19 17:39:14 UTC
mfrom: (1.1.3 upstream)
Revision ID: james.westby@ubuntu.com-20100619173914-5vkjfgz24mbia29z

Tags: 0.9.2-1

Imported Upstream version 0.9.2

files added:
doc/INSTALL.PF_RING

doc/INSTALL.WINDOWS

libhtp/m4

libhtp/m4/libtool.m4

libhtp/m4/ltoptions.m4

libhtp/m4/ltsugar.m4

libhtp/m4/ltversion.m4

libhtp/m4/lt~obsolete.m4

src/detect-engine-dcepayload.c

src/detect-engine-dcepayload.h

src/detect-http-uri.c

src/detect-http-uri.h

src/source-erf-dag.c

src/source-erf-dag.h

src/tmqh-ringbuffer.c

src/tmqh-ringbuffer.h

src/util-atomic.h

src/util-ringbuffer.c

src/util-ringbuffer.h

src/win32-service.c

src/win32-service.h

files modified:
Makefile.am

Makefile.in

configure

configure.in

debian/changelog

debian/rules

doc/INSTALL

libhtp/Makefile.am

libhtp/Makefile.in

libhtp/aclocal.m4

libhtp/configure

libhtp/htp/Makefile.in

libhtp/test/Makefile.in

src/Makefile.am

src/Makefile.in

src/alert-debuglog.c

src/alert-fastlog.c

src/alert-prelude.c

src/alert-unified-alert.c

src/alert-unified-log.c

src/alert-unified2-alert.c

src/app-layer-dcerpc-common.h

src/app-layer-dcerpc.c

src/app-layer-detect-proto.c

src/app-layer-detect-proto.h

src/app-layer-ftp.c

src/app-layer-htp.c

src/app-layer-parser.c

src/app-layer-parser.h

src/app-layer-smb.c

src/app-layer-smb2.c

src/app-layer-ssl.c

src/app-layer-tls.c

src/app-layer.c

src/app-layer.h

src/conf.c

src/conf.h

src/counters.c

src/decode-events.h

src/decode-ipv4.c

src/decode-ipv6.c

src/decode-udp.c

src/decode.c

src/decode.h

src/detect-asn1.c

src/detect-bytejump.c

src/detect-bytejump.h

src/detect-bytetest.c

src/detect-bytetest.h

src/detect-classtype.c

src/detect-content.c

src/detect-dce-iface.c

src/detect-dce-opnum.c

src/detect-dce-stub-data.c

src/detect-decode-event.c

src/detect-depth.c

src/detect-detection-filter.c

src/detect-detection-filter.h

src/detect-distance.c

src/detect-engine-alert.c

src/detect-engine-iponly.c

src/detect-engine-mpm.c

src/detect-engine-mpm.h

src/detect-engine-payload.c

src/detect-engine-payload.h

src/detect-engine-port.c

src/detect-engine-proto.c

src/detect-engine-siggroup.c

src/detect-engine-siggroup.h

src/detect-engine-sigorder.c

src/detect-engine-state.c

src/detect-engine-state.h

src/detect-engine-threshold.c

src/detect-engine-threshold.h

src/detect-engine-uri.c

src/detect-engine-uri.h

src/detect-engine.c

src/detect-fast-pattern.c

src/detect-flags.c

src/detect-flow.c

src/detect-flowbits.c

src/detect-fragbits.c

src/detect-ftpbounce.c

src/detect-http-client-body.c

src/detect-http-cookie.c

src/detect-http-header.c

src/detect-http-method.c

src/detect-isdataat.c

src/detect-offset.c

src/detect-parse.c

src/detect-parse.h

src/detect-pcre.c

src/detect-pcre.h

src/detect-threshold.c

src/detect-threshold.h

src/detect-tls-version.c

src/detect-uricontent.c

src/detect-uricontent.h

src/detect-urilen.c

src/detect-within.c

src/detect.c

src/detect.h

src/flow-bit.c

src/flow-hash.c

src/flow-private.h

src/flow-queue.c

src/flow-queue.h

src/flow-util.c

src/flow-util.h

src/flow.c

src/flow.h

src/host.c

src/log-httplog.c

src/respond-reject.c

src/respond-reject.h

src/runmodes.c

src/runmodes.h

src/source-erf-file.c

src/source-ipfw.c

src/source-nfq.c

src/source-pcap-file.c

src/source-pcap.c

src/source-pfring.c

src/stream-tcp-private.h

src/stream-tcp-reassemble.c

src/stream-tcp-reassemble.h

src/stream-tcp.c

src/stream-tcp.h

src/stream.c

src/stream.h

src/suricata-common.h

src/suricata.c

src/suricata.h

src/threadvars.h

src/tm-modules.h

src/tm-queuehandlers.c

src/tm-queuehandlers.h

src/tm-threads.c

src/tmqh-packetpool.c

src/tmqh-simple.c

src/util-classification-config.c

src/util-classification-config.h

src/util-debug.c

src/util-error.c

src/util-error.h

src/util-fmemopen.c

src/util-host-os-info.c

src/util-mpm-b2g.c

src/util-mpm-b2g.h

src/util-mpm.c

src/util-mpm.h

src/util-profiling.c

src/util-profiling.h

src/util-radix-tree.c

src/util-spm-bm.c

src/util-spm-bm.h

src/util-threshold-config.c

src/util-unittest-helper.c

src/util-unittest-helper.h

suricata.yaml

Show diffs side-by-side

added added

removed removed

src/detect-engine-uri.c

* \param det_ctx Detection engine thread context

* \param s Signature to inspect

* \param sm SigMatch to inspect

* \param p Packet

* \param payload ptr to the uricontent payload to inspect

* \param payload_len length of the uricontent payload

static int DoInspectPacketUri(DetectEngineCtx *de_ctx,

DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch *sm,

Packet *p, uint8_t *payload, uint32_t payload_len)

uint8_t *payload, uint32_t payload_len)

{

SCEnter();

210

209

/* see if the next payload keywords match. If not, we will

211

210

* search for another occurence of this uricontent and see

212

211

* if the others match then until we run out of matches */

213

int r = DoInspectPacketUri(de_ctx,det_ctx,s,sm->next, p, payload, payload_len);

212

int r = DoInspectPacketUri(de_ctx,det_ctx,s,sm->next, payload, payload_len);

214

213

if (r == 1) {

215

214

SCReturnInt(1);

216

215

}

231

230

/* this sigmatch matched, inspect the next one. If it was the last,

232

231

* the payload portion of the signature matched. */

233

232

if (sm->next != NULL) {

234

int r = DoInspectPacketUri(de_ctx,det_ctx,s,sm->next, p, payload, payload_len);

233

int r = DoInspectPacketUri(de_ctx,det_ctx,s,sm->next, payload, payload_len);

235

234

SCReturnInt(r);

236

235

} else {

237

236

SCReturnInt(1);

247

246

* \param f Flow

248

247

* \param flags app layer flags

249

248

* \param state App layer state

250

* \param p Packet

251

249

252

250

* \retval 0 no match

253

251

* \retval 1 match

254

252

255

253

int DetectEngineInspectPacketUris(DetectEngineCtx *de_ctx,

256

254

DetectEngineThreadCtx *det_ctx, Signature *s, Flow *f, uint8_t flags,

257

void *alstate, Packet *p)

255

void *alstate)

258

256

{

259

257

SCEnter();

260

258

SigMatch *sm = NULL;

261

259

int r = 0;

262

260

HtpState *htp_state = NULL;

263

261

262

if (!(det_ctx->sgh->flags & SIG_GROUP_HAVEURICONTENT)) {

263

SCLogDebug("no uricontent in sgh");

264

SCReturnInt(0);

265

}

266

264

267

htp_state = (HtpState *)alstate;

265

268

if (htp_state == NULL) {

266

269

SCLogDebug("no HTTP state");

270

273

/* locking the flow, we will inspect the htp state */

271

274

SCMutexLock(&f->m);

272

275

276

if (htp_state->connp == NULL) {

277

SCLogDebug("HTP state has no connp");

278

goto end;

279

}

280

281

/* If we have the uricontent multi pattern matcher signatures in

282

signature list, then search the received HTTP uri(s) in the htp

283

state against those patterns */

284

if (s->flags & SIG_FLAG_MPM_URI) {

285

if (det_ctx->de_mpm_scanned_uri == FALSE) {

286

uint32_t cnt = DetectUricontentInspectMpm(det_ctx, f, htp_state);

287

288

/* only consider uri sigs if we've seen at least one match */

289

/** \warning when we start supporting negated uri content matches

290

* we need to update this check as well */

291

if (cnt > 0) {

292

det_ctx->de_have_httpuri = TRUE;

293

}

294

295

SCLogDebug("uricontent cnt %"PRIu32"", cnt);

296

297

/* make sure we don't inspect this mpm again */

298

det_ctx->de_mpm_scanned_uri = TRUE;

299

300

}

301

}

302

273

303

/* if we don't have a uri, don't bother inspecting */

274

304

if (det_ctx->de_have_httpuri == FALSE) {

275

305

SCLogDebug("We don't have uri");

276

306

goto end;

277

307

}

278

308

279

if (htp_state->connp == NULL) {

280

SCLogDebug("HTP state has no connp");

281

goto end;

309

if (det_ctx->de_mpm_scanned_uri == TRUE) {

310

if (det_ctx->pmq.pattern_id_bitarray != NULL) {

311

/* filter out sigs that want pattern matches, but

312

* have no matches */

313

if (!(det_ctx->pmq.pattern_id_bitarray[(s->mpm_uripattern_id / 8)] & (1<<(s->mpm_uripattern_id % 8))) &&

314

(s->flags & SIG_FLAG_MPM_URI) && !(s->flags & SIG_FLAG_MPM_URI_NEG)) {

315

SCLogDebug("mpm sig without matches (pat id %"PRIu32

316

" check in uri).", s->mpm_uripattern_id);

317

goto end;

318

}

319

}

282

320

}

283

321

284

322

sm = s->umatch;

290

328

SCLogDebug("co->id %"PRIu32, co->id);

291

329

#endif

292

330

293

size_t idx = 0;

331

size_t idx = AppLayerTransactionGetInspectId(f);

294

332

htp_tx_t *tx = NULL;

295

333

296

for (idx = 0;//htp_state->new_in_tx_index;

297

idx < list_size(htp_state->connp->conn->transactions); idx++)

334

for ( ; idx < list_size(htp_state->connp->conn->transactions); idx++)

298

335

{

299

336

tx = list_get(htp_state->connp->conn->transactions, idx);

300

337

if (tx == NULL || tx->request_uri_normalized == NULL)

302

339

303

340

/* Inspect all the uricontents fetched on each

304

341

* transaction at the app layer */

305

r = DoInspectPacketUri(de_ctx, det_ctx, s, s->umatch, p,

342

r = DoInspectPacketUri(de_ctx, det_ctx, s, s->umatch,

306

343

(uint8_t *) bstr_ptr(tx->request_uri_normalized),

307

344

bstr_len(tx->request_uri_normalized));

308

345

Older »