← Back to branch summary

~ubuntu-branches/ubuntu/raring/suricata/raring

~ubuntu-branches/ubuntu/raring/suricata/raring

« back to all changes in this revision

Viewing changes to src/detect-engine-hmd.c

Committer: Package Import Robot
Author(s): Pierre Chifflier
Date: 2012-12-14 00:02:51 UTC
mfrom: (1.1.18)
Revision ID: package-import@ubuntu.com-20121214000251-3326bvmr1x6ofsy5

Tags: 1.4-1

* Imported Upstream version 1.4
* Enable Jansson and LuaJIT support, and add libjansson-dev libluajit-5.1-dev
to build-deps
* Add python to recommends, for the suricatasc script
* Create /var/run/suricata directory when starting daemon

files added:
configure.ac

contrib

contrib/Makefile.am

contrib/Makefile.in

contrib/file_processor

contrib/file_processor/Action

contrib/file_processor/Action/Log.pm

contrib/file_processor/Action/Makefile.am

contrib/file_processor/Action/Makefile.in

contrib/file_processor/Action/Syslog.pm

contrib/file_processor/LICENSE

contrib/file_processor/Makefile.am

contrib/file_processor/Makefile.in

contrib/file_processor/Processor

contrib/file_processor/Processor/Anubis.pm

contrib/file_processor/Processor/Makefile.am

contrib/file_processor/Processor/Makefile.in

contrib/file_processor/Processor/Malwr.pm

contrib/file_processor/Processor/ShadowServer.pm

contrib/file_processor/Processor/ThreatExpert.pm

contrib/file_processor/Processor/VirusTotal.pm

contrib/file_processor/README

contrib/file_processor/file_processor.conf

contrib/file_processor/file_processor.pl

scripts

scripts/Makefile.am

scripts/Makefile.in

scripts/suricatasc

scripts/suricatasc/Makefile.am

scripts/suricatasc/Makefile.in

scripts/suricatasc/suricatasc.in

src/decode-teredo.c

src/decode-teredo.h

src/defrag-hash.c

src/defrag-hash.h

src/defrag-queue.c

src/defrag-queue.h

src/defrag-timeout.c

src/defrag-timeout.h

src/detect-filesize.c

src/detect-filesize.h

src/detect-iprep.c

src/detect-iprep.h

src/detect-l3proto.c

src/detect-l3proto.h

src/detect-luajit.c

src/detect-luajit.h

src/detect-pkt-data.c

src/detect-pkt-data.h

src/log-tlslog.c

src/log-tlslog.h

src/runmode-unix-socket.c

src/runmode-unix-socket.h

src/unix-manager.c

src/unix-manager.h

src/util-crypt.c

src/util-crypt.h

src/util-profiling-rules.c

threshold.config

files removed:
configure.in

files modified:
ChangeLog

Makefile.am

Makefile.in

config.h.in

configure

debian/changelog

debian/control

debian/rules

debian/suricata.init

doc/AUTHORS

doc/Basic_Setup.txt

doc/CentOS5.txt

doc/CentOS_56_Installation.txt

doc/Debian_Installation.txt

doc/Fedora_Core.txt

doc/FreeBSD_8.txt

doc/HTP_library_installation.txt

doc/INSTALL

doc/Installation_from_GIT_with_PCRE-JIT.txt

doc/Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6.txt

doc/Installation_with_CUDA_on_Scientific_Linux_6.txt

doc/Installation_with_CUDA_on_Ubuntu_server_1104.txt

doc/Installation_with_PF_RING.txt

doc/Mac_OS_X_106x.txt

doc/Makefile.am

doc/Makefile.in

doc/NEWS

doc/OpenBSD_Installation_from_GIT.txt

doc/Setting_up_IPSinline_for_Linux.txt

doc/TODO

doc/Third_Party_Installation_Guides.txt

doc/Ubuntu_Installation.txt

doc/Ubuntu_Installation_from_GIT.txt

doc/Windows.txt

libhtp/htp/htp_decompressors.c

libhtp/htp/htp_request.c

libhtp/htp/htp_response.c

libhtp/htp/htp_util.c

libhtp/test/main.c

qa/Makefile.in

qa/coccinelle/Makefile.in

qa/coccinelle/run_check.sh

rules/Makefile.in

rules/decoder-events.rules

rules/http-events.rules

rules/stream-events.rules

src/Makefile.am

src/Makefile.in

src/alert-debuglog.c

src/alert-fastlog.c

src/alert-pcapinfo.c

src/alert-prelude.c

src/alert-syslog.c

src/alert-unified2-alert.c

src/app-layer-dcerpc-udp.c

src/app-layer-dcerpc.c

src/app-layer-detect-proto.c

src/app-layer-ftp.c

src/app-layer-htp-body.c

src/app-layer-htp-file.c

src/app-layer-htp.c

src/app-layer-htp.h

src/app-layer-parser.c

src/app-layer-parser.h

src/app-layer-protos.h

src/app-layer-smb.c

src/app-layer-smb2.c

src/app-layer-smtp.c

src/app-layer-ssh.c

src/app-layer-ssl.c

src/app-layer-ssl.h

src/app-layer-tls-handshake.c

src/app-layer.c

src/conf.c

src/counters.c

src/cuda-packet-batcher.c

src/decode-ethernet.c

src/decode-events.c

src/decode-events.h

src/decode-gre.c

src/decode-icmpv4.c

src/decode-icmpv6.c

src/decode-ipv4.c

src/decode-ipv6.c

src/decode-ppp.c

src/decode-pppoe.c

src/decode-raw.c

src/decode-tcp.c

src/decode-udp.c

src/decode-vlan.c

src/decode.c

src/decode.h

src/defrag.c

src/defrag.h

src/detect-ack.c

src/detect-app-layer-event.c

src/detect-asn1.c

src/detect-byte-extract.c

src/detect-bytejump.c

src/detect-bytetest.c

src/detect-classtype.c

src/detect-content.c

src/detect-content.h

src/detect-csum.c

src/detect-depth.c

src/detect-detection-filter.c

src/detect-distance.c

src/detect-dsize.c

src/detect-engine-address.c

src/detect-engine-alert.c

src/detect-engine-analyzer.c

src/detect-engine-analyzer.h

src/detect-engine-content-inspection.c

src/detect-engine-event.c

src/detect-engine-event.h

src/detect-engine-file.c

src/detect-engine-file.h

src/detect-engine-hcbd.c

src/detect-engine-hcbd.h

src/detect-engine-hcd.c

src/detect-engine-hcd.h

src/detect-engine-hhd.c

src/detect-engine-hhd.h

src/detect-engine-hmd.c

src/detect-engine-hmd.h

src/detect-engine-hrhd.c

src/detect-engine-hrhd.h

src/detect-engine-hrud.c

src/detect-engine-hrud.h

src/detect-engine-hsbd.c

src/detect-engine-hsbd.h

src/detect-engine-hscd.c

src/detect-engine-hscd.h

src/detect-engine-hsmd.c

src/detect-engine-hsmd.h

src/detect-engine-hua.c

src/detect-engine-hua.h

src/detect-engine-iponly.c

src/detect-engine-mpm.c

src/detect-engine-mpm.h

src/detect-engine-payload.c

src/detect-engine-port.c

src/detect-engine-proto.c

src/detect-engine-proto.h

src/detect-engine-siggroup.c

src/detect-engine-siggroup.h

src/detect-engine-sigorder.c

src/detect-engine-state.c

src/detect-engine-tag.c

src/detect-engine-threshold.c

src/detect-engine-uri.c

src/detect-engine-uri.h

src/detect-engine.c

src/detect-engine.h

src/detect-fast-pattern.c

src/detect-file-data.c

src/detect-fileext.c

src/detect-filemagic.c

src/detect-filemagic.h

src/detect-filemd5.c

src/detect-filename.c

src/detect-filestore.c

src/detect-flags.c

src/detect-flow.c

src/detect-flowbits.c

src/detect-flowint.c

src/detect-flowvar.c

src/detect-fragbits.c

src/detect-fragoffset.c

src/detect-ftpbounce.c

src/detect-gid.c

src/detect-http-client-body.c

src/detect-http-cookie.c

src/detect-http-header.c

src/detect-http-method.c

src/detect-http-raw-header.c

src/detect-http-raw-uri.c

src/detect-http-server-body.c

src/detect-http-stat-code.c

src/detect-http-stat-msg.c

src/detect-http-ua.c

src/detect-http-uri.c

src/detect-icmp-id.c

src/detect-icmp-seq.c

src/detect-icode.c

src/detect-id.c

src/detect-ipopts.c

src/detect-ipproto.c

src/detect-isdataat.c

src/detect-itype.c

src/detect-mark.c

src/detect-metadata.c

src/detect-msg.c

src/detect-nocase.c

src/detect-offset.c

src/detect-parse.c

src/detect-pcre.c

src/detect-pktvar.c

src/detect-priority.c

src/detect-rawbytes.c

src/detect-reference.c

src/detect-replace.c

src/detect-rev.c

src/detect-rpc.c

src/detect-sameip.c

src/detect-seq.c

src/detect-sid.c

src/detect-ssh-proto-version.c

src/detect-ssh-software-version.c

src/detect-ssl-state.c

src/detect-ssl-version.c

src/detect-stream_size.c

src/detect-tag.c

src/detect-threshold.c

src/detect-tls-version.c

src/detect-tls.c

src/detect-tls.h

src/detect-tos.c

src/detect-ttl.c

src/detect-uricontent.c

src/detect-urilen.c

src/detect-window.c

src/detect-within.c

src/detect.c

src/detect.h

src/flow-alert-sid.c

src/flow-bit.c

src/flow-hash.c

src/flow-manager.c

src/flow-timeout.c

src/flow-util.c

src/flow-var.c

src/flow.c

src/flow.h

src/host-timeout.c

src/host.c

src/host.h

src/log-droplog.c

src/log-file.c

src/log-filestore.c

src/log-httplog.c

src/log-pcap.c

src/output.c

src/pkt-var.c

src/queue.h

src/reputation.c

src/reputation.h

src/runmode-af-packet.c

src/runmode-erf-file.c

src/runmode-napatech.c

src/runmode-napatech.h

src/runmode-pcap-file.c

src/runmode-pcap.c

src/runmode-pfring.c

src/runmodes.c

src/runmodes.h

src/source-af-packet.c

src/source-af-packet.h

src/source-erf-dag.c

src/source-erf-file.c

src/source-ipfw.c

src/source-ipfw.h

src/source-napatech.c

src/source-napatech.h

src/source-nfq.c

src/source-pcap-file.c

src/source-pcap.c

src/source-pfring.c

src/stream-tcp-inline.c

src/stream-tcp-reassemble.c

src/stream-tcp-sack.c

src/stream-tcp.c

src/stream-tcp.h

src/stream.c

src/stream.h

src/suricata-common.h

src/suricata.c

src/suricata.h

src/threads.h

src/tm-modules.c

src/tm-queues.c

src/tm-threads-common.h

src/tm-threads.c

src/tm-threads.h

src/tmqh-flow.c

src/tmqh-packetpool.c

src/util-action.c

src/util-affinity.c

src/util-atomic.c

src/util-bloomfilter-counting.c

src/util-bloomfilter.c

src/util-buffer.c

src/util-classification-config.c

src/util-cpu.c

src/util-cuda-handlers.c

src/util-cuda.c

src/util-daemon.c

src/util-debug-filters.c

src/util-debug.c

src/util-debug.h

src/util-decode-asn1.c

src/util-decode-der-get.c

src/util-decode-der.c

src/util-device.c

src/util-device.h

src/util-error.c

src/util-error.h

src/util-file.c

src/util-file.h

src/util-hash.c

src/util-hashlist.c

src/util-host-os-info.c

src/util-magic.c

src/util-magic.h

src/util-mpm-ac-bs.c

src/util-mpm-ac-gfbs.c

src/util-mpm-ac.c

src/util-mpm-b2g-cuda.c

src/util-mpm-b2g.c

src/util-mpm-b2gc.c

src/util-mpm-b2gm.c

src/util-mpm-b3g.c

src/util-mpm-wumanber.c

src/util-mpm.c

src/util-optimize.h

src/util-path.c

src/util-pidfile.c

src/util-pidfile.h

src/util-pool.c

src/util-pool.h

src/util-privs.c

src/util-profiling-locks.c

src/util-profiling.c

src/util-profiling.h

src/util-radix-tree.c

src/util-reference-config.c

src/util-ringbuffer.c

src/util-rohash.c

src/util-runmodes.c

src/util-spm-bm.c

src/util-spm.c

src/util-threshold-config.c

src/util-unittest-helper.c

src/util-unittest.c

src/util-var-name.c

src/win32-misc.c

src/win32-service.c

suricata.yaml.in

Show diffs side-by-side

added added

removed removed

src/detect-engine-hmd.c

112

112

* \retval 0 No match.

113

113

* \retval 1 Match.

114

114

*/

115

int DetectEngineInspectHttpMethod(DetectEngineCtx *de_ctx,

115

int DetectEngineInspectHttpMethod(ThreadVars *tv,

116

DetectEngineCtx *de_ctx,

116

117

DetectEngineThreadCtx *det_ctx,

117

118

Signature *s, Flow *f, uint8_t flags,

118

void *alstate)

119

void *alstate, int tx_id)

119

120

{

120

SCEnter();

121

int r = 0;

122

HtpState *htp_state = NULL;

123

htp_tx_t *tx = NULL;

124

int idx;

125

126

FLOWLOCK_RDLOCK(f);

127

128

htp_state = (HtpState *)alstate;

129

if (htp_state == NULL) {

130

SCLogDebug("no HTTP state");

131

goto end;

132

}

133

134

if (htp_state->connp == NULL || htp_state->connp->conn == NULL) {

135

SCLogDebug("HTP state has no conn(p)");

136

goto end;

137

}

138

139

idx = AppLayerTransactionGetInspectId(f);

140

if (idx == -1) {

141

goto end;

142

}

143

144

int size = (int)list_size(htp_state->connp->conn->transactions);

145

for (; idx < size; idx++) {

146

147

tx = list_get(htp_state->connp->conn->transactions, idx);

148

if (tx == NULL || tx->request_method == NULL)

149

continue;

150

151

det_ctx->buffer_offset = 0;

152

det_ctx->discontinue_matching = 0;

153

det_ctx->inspection_recursion_counter = 0;

154

155

r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HMDMATCH],

121

HtpState *htp_state = (HtpState *)alstate;

122

htp_tx_t *tx = list_get(htp_state->connp->conn->transactions, tx_id);

123

if (tx == NULL || tx->request_method == NULL)

124

return 0;

125

126

det_ctx->buffer_offset = 0;

127

det_ctx->discontinue_matching = 0;

128

det_ctx->inspection_recursion_counter = 0;

129

int r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HMDMATCH],

156

130

f,

157

131

(uint8_t *)bstr_ptr(tx->request_method),

158

132

bstr_len(tx->request_method),

159

133

DETECT_ENGINE_CONTENT_INSPECTION_MODE_HMD, NULL);

160

//r = DoInspectHttpMethod(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HMDMATCH],

161

//(uint8_t *)bstr_ptr(tx->request_method),

162

//bstr_len(tx->request_method));

163

if (r == 1) {

164

break;

165

}

166

}

134

if (r == 1)

135

return 1;

167

136

168

end:

169

FLOWLOCK_UNLOCK(f);

170

SCReturnInt(r);

137

return 0;

171

138

}

172

139

173

140

/***********************************Unittests**********************************/

Older »