From e9fcb9d5efa695187974cd4b20222250c0673ec3 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sun, 25 Nov 2018 16:44:54 +0100 Subject: [PATCH] detect/http_method: add http.method sticky buffer --- src/detect-engine-register.h | 1 + src/detect-http-method.c | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/src/detect-engine-register.h b/src/detect-engine-register.h index b3787a2b69..00364844c8 100644 --- a/src/detect-engine-register.h +++ b/src/detect-engine-register.h @@ -113,6 +113,7 @@ enum { DETECT_AL_HTTP_COOKIE, DETECT_AL_HTTP_METHOD, + DETECT_HTTP_METHOD, DETECT_AL_HTTP_PROTOCOL, DETECT_AL_HTTP_START, DETECT_AL_URILEN, diff --git a/src/detect-http-method.c b/src/detect-http-method.c index 48a96aac01..42b2247b8a 100644 --- a/src/detect-http-method.c +++ b/src/detect-http-method.c @@ -61,6 +61,7 @@ static int g_http_method_buffer_id = 0; static int DetectHttpMethodSetup(DetectEngineCtx *, Signature *, const char *); +static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str); #ifdef UNITTESTS void DetectHttpMethodRegisterTests(void); #endif @@ -75,6 +76,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx, */ void DetectHttpMethodRegister(void) { + /* http_method content modifier */ sigmatch_table[DETECT_AL_HTTP_METHOD].name = "http_method"; sigmatch_table[DETECT_AL_HTTP_METHOD].desc = "content modifier to match only on the HTTP method-buffer"; sigmatch_table[DETECT_AL_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method"; @@ -85,6 +87,13 @@ void DetectHttpMethodRegister(void) #endif sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_NOOPT; + /* http.method sticky buffer */ + sigmatch_table[DETECT_HTTP_METHOD].name = "http.method"; + sigmatch_table[DETECT_HTTP_METHOD].desc = "sticky buffer to match specifically and only on the HTTP method buffer"; + sigmatch_table[DETECT_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method"; + sigmatch_table[DETECT_HTTP_METHOD].Setup = DetectHttpMethodSetupSticky; + sigmatch_table[DETECT_HTTP_METHOD].flags |= SIGMATCH_NOOPT; + DetectAppLayerInspectEngineRegister2("http_method", ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE, DetectEngineInspectBufferGeneric, GetData); @@ -123,6 +132,22 @@ static int DetectHttpMethodSetup(DetectEngineCtx *de_ctx, Signature *s, const ch ALPROTO_HTTP); } +/** + * \brief this function setup the http.method keyword used in the rule + * + * \param de_ctx Pointer to the Detection Engine Context + * \param s Pointer to the Signature to which the current keyword belongs + * \param str Should hold an empty string always + * + * \retval 0 On success + */ +static int DetectHttpMethodSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str) +{ + DetectBufferSetActiveList(s, g_http_method_buffer_id); + s->alproto = ALPROTO_HTTP; + return 0; +} + /** * \retval 1 valid * \retval 0 invalid -- 2.47.2