Example #1
0
/*
 * Check HTTP partial content header
 * Return: 1: partial content header
 *         0: not http partial content header
 */
static inline int check_http_partial_content(Packet *p)
{
    uint8_t *buf = NULL;
    uint32_t len = 0;
    uint32_t type = 0;
    uint32_t file_sig;
    const HttpBuffer* hb = GetHttpBuffer(HTTP_BUFFER_STAT_CODE);

    /*Not HTTP response, return*/
    if ( !hb )
        return 0;

    /*Not partial content, return*/
    if ( (hb->length != 3) || strncmp((const char*)hb->buf, "206", 3) )
        return 0;

    /*Use URI as the identifier for file*/
    if (GetHttpUriData(p->ssnptr, &buf, &len, &type))
    {
        file_sig = str_to_hash(buf, len);
        file_resume_block_check(p, file_sig);
    }

    return 1;
}
Example #2
0
void EventTrace_Log (const Packet* p, OptTreeNode* otn, int action)
{
    int i;
    const char* acts = (action < RULE_TYPE__MAX) ? rule_type[action] : "ERROR";

    if ( !tlog )
        return;

    TextLog_Print(tlog,
        "\nEvt=%u, Gid=%u, Sid=%u, Rev=%u, Act=%s\n",
        event_id, otn->sigInfo.generator, 
        otn->sigInfo.id, otn->sigInfo.rev, acts
    );
    TextLog_Print(tlog,
        "Pkt=%lu, Sec=%u.%6u, Len=%u, Cap=%u\n",
        pc.total_from_daq, p->pkth->ts.tv_sec, p->pkth->ts.tv_usec,
        p->pkth->pktlen, p->pkth->caplen
    );
    TextLog_Print(tlog,
        "Pkt Bits: Flags=0x%X, PP=0x%X, PPR=0x%X, Proto=0x%X"
        ", Err=0x%X\n",
        p->packet_flags, p->preprocessor_bits, p->preproc_reassembly_pkt_bits,
        (unsigned)p->proto_bits, (unsigned)p->error_flags
    );
    TextLog_Print(tlog,
        "Pkt Cnts: Dsz=%u, Alt=%u, Uri=0x%X\n",
        (unsigned)p->dsize, (unsigned)p->alt_dsize, http_mask
    );
    TextLog_Print(tlog, "Detect: DoeFlags=0x%X, DetectFlags=0x%X, DetBuf=%u, B64=%u\n",
        doe_buf_flags, detect_flags, DetectBuffer.len, base64_decode_size
    );
    LogBuffer("Decode", DecodeBuffer.data, DecodeBuffer.len);
    LogBuffer("Detect", DetectBuffer.data, DetectBuffer.len);
    LogBuffer("FileData", file_data_ptr.data, file_data_ptr.len);
    LogBuffer("Base64", base64_decode_buf, base64_decode_size);
    if(mime_present)
        LogBuffer("Mime", file_data_ptr.data, file_data_ptr.len);

    for ( i = 0; i < HTTP_BUFFER_MAX; i++ )
    {
        const HttpBuffer* hb = GetHttpBuffer(i);

        if ( !hb )
            continue;

        TextLog_Print(tlog, "%s[%u] = 0x%X\n",
            http_buffer_name[i], hb->length, hb->encode_type);

        LogBuffer(http_buffer_name[i], hb->buf, hb->length);
    }
    nEvents++;
}