http: add event for libhtp detection of request port not matching tcp port.

diff --git a/rules/http-events.rules b/rules/http-events.rules
index e779b8fb50b8e9d9ceef21c649046074107eb501..0563ca17adbcb3eaa811a48cd21c520924cfbaba 100644 (file)
--- a/rules/http-events.rules
+++ b/rules/http-events.rules
@@ -35,5 +35,7 @@ alert http any any -> any any (msg:"SURICATA HTTP multipart generic error"; flow
 alert http any any -> any any (msg:"SURICATA HTTP multipart no filedata"; flow:established,to_server; app-layer-event:http.multipart_no_filedata; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221023; rev:1;)
 # Multipart header invalid.
 alert http any any -> any any (msg:"SURICATA HTTP multipart invalid header"; flow:established,to_server; app-layer-event:http.multipart_invalid_header; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221024; rev:1;)
-# next sid 2221025
+# Warn when the port in the Host: header doesn't match the actual TCP Server port.
+alert http any any -> any any (msg:"SURICATA HTTP request server port doesn't match TCP port"; flow:established,to_server; app-layer-event:http.request_server_port_tcp_port_mismatch; flowint:http.anomaly.count,+,1; classtype:protocol-command-decode; sid:2221026; rev:1;)
+# next sid 2221026
 

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index c8ed30417ea5ae961eee286943f4e4a5fba59f9b..072b40cbe6443444969a2be2a7a196525b33f1fc 100644 (file)
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -130,7 +130,8 @@ SCEnumCharMap http_decoder_event_table[ ] = {
         HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG},
     { "RESPONSE_FIELD_TOO_LONG",
         HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG},
-
+    { "REQUEST_SERVER_PORT_TCP_PORT_MISMATCH",
+        HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH},
     /* suricata warnings/errors */
     { "MULTIPART_GENERIC_ERROR",
         HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR},
@@ -419,6 +420,7 @@ struct {
     { "Host information ambiguous", HTTP_DECODER_EVENT_HOST_HEADER_AMBIGUOUS},
     { "Invalid request field folding", HTTP_DECODER_EVENT_INVALID_REQUEST_FIELD_FOLDING},
     { "Invalid response field folding", HTTP_DECODER_EVENT_INVALID_RESPONSE_FIELD_FOLDING},
+    { "Request server port number differs from the actual TCP port", HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH},
 };
 
 #define HTP_ERROR_MAX (sizeof(htp_errors) / sizeof(htp_errors[0]))

diff --git a/src/app-layer-htp.h b/src/app-layer-htp.h
index 90471e4b7365456a13cfd9ab26052e10f0b2af5c..b4e2c7b6e023dca1558f0fa3e2fa79ca00f941b5 100644 (file)
--- a/src/app-layer-htp.h
+++ b/src/app-layer-htp.h
@@ -112,6 +112,7 @@ enum {
     HTTP_DECODER_EVENT_INVALID_RESPONSE_FIELD_FOLDING,
     HTTP_DECODER_EVENT_REQUEST_FIELD_TOO_LONG,
     HTTP_DECODER_EVENT_RESPONSE_FIELD_TOO_LONG,
+    HTTP_DECODER_EVENT_REQUEST_SERVER_PORT_TCP_PORT_MISMATCH,
 
     /* suricata errors/warnings */
     HTTP_DECODER_EVENT_MULTIPART_GENERIC_ERROR,