/*
* Check HTTP partial content header
* Return: 1: partial content header
* 0: not http partial content header
*/
static inline int check_http_partial_content(Packet *p)
{
uint8_t *buf = NULL;
uint32_t len = 0;
uint32_t type = 0;
uint32_t file_sig;
const HttpBuffer* hb = GetHttpBuffer(HTTP_BUFFER_STAT_CODE);
/*Not HTTP response, return*/
if ( !hb )
return 0;
/*Not partial content, return*/
if ( (hb->length != 3) || strncmp((const char*)hb->buf, "206", 3) )
return 0;
/*Use URI as the identifier for file*/
if (GetHttpUriData(p->ssnptr, &buf, &len, &type))
{
file_sig = str_to_hash(buf, len);
file_resume_block_check(p, file_sig);
}
return 1;
}
void EventTrace_Log (const Packet* p, OptTreeNode* otn, int action)
{
int i;
const char* acts = (action < RULE_TYPE__MAX) ? rule_type[action] : "ERROR";
if ( !tlog )
return;
TextLog_Print(tlog,
"\nEvt=%u, Gid=%u, Sid=%u, Rev=%u, Act=%s\n",
event_id, otn->sigInfo.generator,
otn->sigInfo.id, otn->sigInfo.rev, acts
);
TextLog_Print(tlog,
"Pkt=%lu, Sec=%u.%6u, Len=%u, Cap=%u\n",
pc.total_from_daq, p->pkth->ts.tv_sec, p->pkth->ts.tv_usec,
p->pkth->pktlen, p->pkth->caplen
);
TextLog_Print(tlog,
"Pkt Bits: Flags=0x%X, PP=0x%X, PPR=0x%X, Proto=0x%X"
", Err=0x%X\n",
p->packet_flags, p->preprocessor_bits, p->preproc_reassembly_pkt_bits,
(unsigned)p->proto_bits, (unsigned)p->error_flags
);
TextLog_Print(tlog,
"Pkt Cnts: Dsz=%u, Alt=%u, Uri=0x%X\n",
(unsigned)p->dsize, (unsigned)p->alt_dsize, http_mask
);
TextLog_Print(tlog, "Detect: DoeFlags=0x%X, DetectFlags=0x%X, DetBuf=%u, B64=%u\n",
doe_buf_flags, detect_flags, DetectBuffer.len, base64_decode_size
);
LogBuffer("Decode", DecodeBuffer.data, DecodeBuffer.len);
LogBuffer("Detect", DetectBuffer.data, DetectBuffer.len);
LogBuffer("FileData", file_data_ptr.data, file_data_ptr.len);
LogBuffer("Base64", base64_decode_buf, base64_decode_size);
if(mime_present)
LogBuffer("Mime", file_data_ptr.data, file_data_ptr.len);
for ( i = 0; i < HTTP_BUFFER_MAX; i++ )
{
const HttpBuffer* hb = GetHttpBuffer(i);
if ( !hb )
continue;
TextLog_Print(tlog, "%s[%u] = 0x%X\n",
http_buffer_name[i], hb->length, hb->encode_type);
LogBuffer(http_buffer_name[i], hb->buf, hb->length);
}
nEvents++;
}