From: maxtors <moe.andreas@gmail.com>
Date: Thu, 16 Apr 2015 20:44:36 +0000 (+0200)
Subject: Added http methods for webdav (rfc4918).
X-Git-Tag: suricata-2.1beta4~51
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7a9e963619a905b59378b4a5de653216182fff25;p=thirdparty%2Fsuricata.git

Added http methods for webdav (rfc4918).

Included the following methods to app-layer-htp.c:
- PROPFIND
- PROPPATCH
- MKCOL
- COPY
- MOVE
- LOCK
- UNLOCK
---

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 4b25f5f276..73b11ad0e7 100644
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -2766,6 +2766,91 @@ static int HTPRegisterPatternsForProtocolDetection(void)
         return -1;
     }
 
+    /* WEBDAV METHODS (rfc4918) */
+    /* PROPFIND */
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "PROPFIND|20|", 9, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "PROPFIND|09|", 9, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+
+    /* PROPPATCH */
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "PROPPATCH|20|", 10, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "PATCH|09|", 10, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+
+    /* MKCOL */
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "MKCOL|20|", 6, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "MKCOL|09|", 6, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+
+    /* COPY */
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "COPY|20|", 5, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "COPY|09|", 5, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+
+    /* MOVE */
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "MOVE|20|", 5, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "MOVE|09|", 5, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+
+    /* LOCK */
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "LOCK|20|", 5, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "LOCK|09|", 5, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+
+    /* UNLOCK */
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "UNLOCK|20|", 7, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+    if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
+                                               "UNLOCK|09|", 7, 0, STREAM_TOSERVER) < 0)
+    {
+        return -1;
+    }
+
     /* toclient */
     if (AppLayerProtoDetectPMRegisterPatternCS(IPPROTO_TCP, ALPROTO_HTTP,
                                                "HTTP/0.9", 8, 0, STREAM_TOCLIENT) < 0)