From: Victor Julien <vjulien@oisf.net>
Date: Thu, 23 Jan 2025 10:05:48 +0000 (+0100)
Subject: http1: register progress state names
X-Git-Tag: suricata-8.0.0-beta1~32
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8c674c8647013ad6ca9af70795cd091f899ab93b;p=thirdparty%2Fsuricata.git

http1: register progress state names

Use `request_started` for HTP_REQUEST_NOT_STARTED as when data is
received, the request parsing has started. The request line isn't
complete yet.

Similar for `response_started`.
---

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index b76b717c24..17cda7ea68 100644
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -251,6 +251,84 @@ static const char *HTTPGetFrameNameById(const uint8_t frame_id)
     return name;
 }
 
+static SCEnumCharMap http_state_client_table[] = {
+    {
+            // name this "request_started" as the tx has been created
+            "request_started",
+            HTP_REQUEST_PROGRESS_NOT_STARTED,
+    },
+    {
+            "request_line",
+            HTP_REQUEST_PROGRESS_LINE,
+    },
+    {
+            "request_headers",
+            HTP_REQUEST_PROGRESS_HEADERS,
+    },
+    {
+            "request_body",
+            HTP_REQUEST_PROGRESS_BODY,
+    },
+    {
+            "request_trailer",
+            HTP_REQUEST_PROGRESS_TRAILER,
+    },
+    {
+            "request_complete",
+            HTP_REQUEST_PROGRESS_COMPLETE,
+    },
+    { NULL, -1 },
+};
+
+static SCEnumCharMap http_state_server_table[] = {
+    {
+            // name this "response_started" as the tx has been created
+            "response_started",
+            HTP_RESPONSE_PROGRESS_NOT_STARTED,
+    },
+    {
+            "response_line",
+            HTP_RESPONSE_PROGRESS_LINE,
+    },
+    {
+            "response_headers",
+            HTP_RESPONSE_PROGRESS_HEADERS,
+    },
+    {
+            "response_body",
+            HTP_RESPONSE_PROGRESS_BODY,
+    },
+    {
+            "response_trailer",
+            HTP_RESPONSE_PROGRESS_TRAILER,
+    },
+    {
+            "response_complete",
+            HTP_RESPONSE_PROGRESS_COMPLETE,
+    },
+    { NULL, -1 },
+};
+
+static int HtpStateGetStateIdByName(const char *name, const uint8_t direction)
+{
+    SCEnumCharMap *map =
+            direction == STREAM_TOSERVER ? http_state_client_table : http_state_server_table;
+
+    int id = SCMapEnumNameToValue(name, map);
+    if (id < 0) {
+        return -1;
+    }
+    return id;
+}
+
+static const char *HtpStateGetStateNameById(const int id, const uint8_t direction)
+{
+    SCEnumCharMap *map =
+            direction == STREAM_TOSERVER ? http_state_client_table : http_state_server_table;
+    const char *name = SCMapEnumValueToName(id, map);
+    return name;
+}
+
 static void *HTPStateGetTx(void *alstate, uint64_t tx_id);
 static int HTPStateGetAlstateProgress(void *tx, uint8_t direction);
 static uint64_t HTPStateGetTxCnt(void *alstate);
@@ -2621,6 +2699,9 @@ void RegisterHTPParsers(void)
         AppLayerParserRegisterGetFrameFuncs(
                 IPPROTO_TCP, ALPROTO_HTTP1, HTTPGetFrameIdByName, HTTPGetFrameNameById);
         /* app-layer-frame-documentation tag end: registering relevant callbacks */
+        AppLayerParserRegisterGetStateFuncs(
+                IPPROTO_TCP, ALPROTO_HTTP1, HtpStateGetStateIdByName, HtpStateGetStateNameById);
+
         HTPConfigure();
     } else {
         SCLogInfo("Parser disabled for %s protocol. Protocol detection still on.", proto_name);