]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
http2: http.uri.raw keyword now works for HTTP2
authorPhilippe Antoine <contact@catenacyber.fr>
Thu, 17 Dec 2020 13:19:25 +0000 (14:19 +0100)
committerVictor Julien <victor@inliniac.net>
Thu, 18 Feb 2021 12:54:45 +0000 (13:54 +0100)
src/detect-http-uri.c

index da9fa1166539cf10cc9250f43f92b5886f94c5a8..dbbbb653d584d69a6655ec8287c4c851681e23f1 100644 (file)
@@ -153,6 +153,13 @@ void DetectHttpUriRegister (void)
     DetectAppLayerMpmRegister2("http_raw_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
             GetRawData, ALPROTO_HTTP1, HTP_REQUEST_LINE);
 
+    // no difference between raw and decoded uri for HTTP2
+    DetectAppLayerInspectEngineRegister2("http_raw_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
+            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2);
+
+    DetectAppLayerMpmRegister2("http_raw_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
+            GetData2, ALPROTO_HTTP2, HTTP2StateDataClient);
+
     DetectBufferTypeSetDescriptionByName("http_raw_uri",
             "raw http uri");
 
@@ -302,7 +309,7 @@ static int DetectHttpRawUriSetupSticky(DetectEngineCtx *de_ctx, Signature *s, co
 {
     if (DetectBufferSetActiveList(s, g_http_raw_uri_buffer_id) < 0)
         return -1;
-    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP1) < 0)
+    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
         return -1;
     return 0;
 }