/**
* \brief Registration function for keyword: http_uri
*/
void DetectHttpUriRegister (void)
{
sigmatch_table[DETECT_AL_HTTP_URI].name = "http_uri";
sigmatch_table[DETECT_AL_HTTP_URI].desc = "content modifier to match specifically and only on the HTTP uri-buffer";
sigmatch_table[DETECT_AL_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-uri-and-http-raw-uri";
sigmatch_table[DETECT_AL_HTTP_URI].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_URI].Setup = DetectHttpUriSetup;
sigmatch_table[DETECT_AL_HTTP_URI].Free = NULL;
sigmatch_table[DETECT_AL_HTTP_URI].RegisterTests = DetectHttpUriRegisterTests;
sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_NOOPT;
DetectAppLayerMpmRegister("http_uri", SIG_FLAG_TOSERVER, 2,
PrefilterTxUriRegister);
DetectAppLayerInspectEngineRegister("http_uri",
ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
DetectEngineInspectHttpUri);
DetectBufferTypeSetDescriptionByName("http_uri",
"http request uri");
DetectBufferTypeRegisterSetupCallback("http_uri",
DetectHttpUriSetupCallback);
DetectBufferTypeRegisterValidateCallback("http_uri",
DetectHttpUriValidateCallback);
g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri");
}
/**
* \brief Registration function for keyword: http_stat_msg
*/
void DetectHttpStatMsgRegister (void)
{
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].name = "http_stat_msg";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].desc = "content modifier to match on HTTP stat-msg-buffer";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_stat-msg";
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Setup = DetectHttpStatMsgSetup;
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].Free = NULL;
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].RegisterTests = DetectHttpStatMsgRegisterTests;
sigmatch_table[DETECT_AL_HTTP_STAT_MSG].flags |= SIGMATCH_NOOPT;
DetectAppLayerMpmRegister("http_stat_msg", SIG_FLAG_TOCLIENT, 3,
PrefilterTxHttpStatMsgRegister);
DetectAppLayerInspectEngineRegister("http_stat_msg",
ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_LINE,
DetectEngineInspectHttpStatMsg);
DetectBufferTypeSetDescriptionByName("http_stat_msg",
"http response status message");
DetectBufferTypeRegisterSetupCallback("http_stat_msg",
DetectHttpStatMsgSetupCallback);
g_http_stat_msg_buffer_id = DetectBufferTypeGetByName("http_stat_msg");
}
/**
* \brief Registers the keyword handlers for the "http_request_line" keyword.
*/
void DetectHttpRequestLineRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].name = "http.request_line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].alias = "http_request_line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].desc = "sticky buffer to match on the HTTP request line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-request-line";
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].Setup = DetectHttpRequestLineSetup;
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].RegisterTests = DetectHttpRequestLineRegisterTests;
sigmatch_table[DETECT_AL_HTTP_REQUEST_LINE].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerInspectEngineRegister2("http_request_line",
ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
DetectEngineInspectBufferGeneric,
GetData);
DetectAppLayerMpmRegister2("http_request_line", SIG_FLAG_TOSERVER, 2,
PrefilterGenericMpmRegister, GetData,
ALPROTO_HTTP, HTP_REQUEST_LINE);
DetectBufferTypeSetDescriptionByName("http_request_line",
"http request line");
g_http_request_line_buffer_id = DetectBufferTypeGetByName("http_request_line");
}
/**
* \brief Registration function for keyword: tls_cert_issuer
*/
void DetectTlsIssuerRegister(void)
{
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].name = "tls_cert_issuer";
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].desc = "content modifier to match specifically and only on the TLS cert issuer buffer";
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#tls-cert-issuer";
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Match = NULL;
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Setup = DetectTlsIssuerSetup;
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].Free = NULL;
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].RegisterTests = DetectTlsIssuerRegisterTests;
sigmatch_table[DETECT_AL_TLS_CERT_ISSUER].flags |= SIGMATCH_NOOPT;
DetectAppLayerInspectEngineRegister2("tls_cert_issuer", ALPROTO_TLS,
SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY,
DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister2("tls_cert_issuer", SIG_FLAG_TOCLIENT, 2,
PrefilterGenericMpmRegister, GetData, ALPROTO_TLS,
TLS_STATE_CERT_READY);
DetectBufferTypeSetDescriptionByName("tls_cert_issuer",
"TLS certificate issuer");
g_tls_cert_issuer_buffer_id = DetectBufferTypeGetByName("tls_cert_issuer");
}
/**
* \brief Registration function for keyword: file_data
*/
void DetectFiledataRegister(void)
{
sigmatch_table[DETECT_FILE_DATA].name = "file_data";
sigmatch_table[DETECT_FILE_DATA].desc = "make content keywords match on HTTP response body";
sigmatch_table[DETECT_FILE_DATA].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#file-data";
sigmatch_table[DETECT_FILE_DATA].Match = NULL;
sigmatch_table[DETECT_FILE_DATA].Setup = DetectFiledataSetup;
sigmatch_table[DETECT_FILE_DATA].Free = NULL;
sigmatch_table[DETECT_FILE_DATA].RegisterTests = DetectFiledataRegisterTests;
sigmatch_table[DETECT_FILE_DATA].flags = SIGMATCH_NOOPT;
DetectAppLayerMpmRegister("file_data", SIG_FLAG_TOSERVER, 2,
PrefilterTxSmtpFiledataRegister);
DetectAppLayerMpmRegister("file_data", SIG_FLAG_TOCLIENT, 2,
PrefilterTxHttpResponseBodyRegister);
DetectAppLayerInspectEngineRegister("file_data",
ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_BODY,
DetectEngineInspectHttpServerBody);
DetectAppLayerInspectEngineRegister("file_data",
ALPROTO_SMTP, SIG_FLAG_TOSERVER, 0,
DetectEngineInspectSMTPFiledata);
DetectBufferTypeRegisterSetupCallback("file_data",
DetectFiledataSetupCallback);
DetectBufferTypeSetDescriptionByName("file_data",
"http response body or smtp attachments data");
g_file_data_buffer_id = DetectBufferTypeGetByName("file_data");
}
/**
* \brief Registration function for keyword: http_method
*/
void DetectHttpMethodRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_METHOD].name = "http_method";
sigmatch_table[DETECT_AL_HTTP_METHOD].desc = "content modifier to match only on the HTTP method-buffer";
sigmatch_table[DETECT_AL_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method";
sigmatch_table[DETECT_AL_HTTP_METHOD].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_METHOD].Setup = DetectHttpMethodSetup;
sigmatch_table[DETECT_AL_HTTP_METHOD].Free = DetectHttpMethodFree;
sigmatch_table[DETECT_AL_HTTP_METHOD].RegisterTests = DetectHttpMethodRegisterTests;
sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_NOOPT;
DetectAppLayerMpmRegister("http_method", SIG_FLAG_TOSERVER, 4,
PrefilterTxMethodRegister);
DetectAppLayerInspectEngineRegister("http_method",
ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
DetectEngineInspectHttpMethod);
DetectBufferTypeSetDescriptionByName("http_method",
"http request method");
DetectBufferTypeRegisterValidateCallback("http_method",
DetectHttpMethodValidateCallback);
g_http_method_buffer_id = DetectBufferTypeGetByName("http_method");
SCLogDebug("registering http_method rule option");
}
/**
* \brief Registration function for keyword: dns_query
*/
void DetectDnsQueryRegister (void)
{
sigmatch_table[DETECT_AL_DNS_QUERY].name = "dns.query";
sigmatch_table[DETECT_AL_DNS_QUERY].alias = "dns_query";
sigmatch_table[DETECT_AL_DNS_QUERY].desc = "sticky buffer to match DNS query-buffer";
sigmatch_table[DETECT_AL_DNS_QUERY].Setup = DetectDnsQuerySetup;
sigmatch_table[DETECT_AL_DNS_QUERY].RegisterTests = DetectDnsQueryRegisterTests;
sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_AL_DNS_QUERY].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerMpmRegister2("dns_query", SIG_FLAG_TOSERVER, 2,
PrefilterMpmDnsQueryRegister, NULL,
ALPROTO_DNS, 1);
DetectAppLayerInspectEngineRegister2("dns_query",
ALPROTO_DNS, SIG_FLAG_TOSERVER, 1,
DetectEngineInspectDnsQuery, NULL);
DetectBufferTypeSetDescriptionByName("dns_query",
"dns request query");
g_dns_query_buffer_id = DetectBufferTypeGetByName("dns_query");
/* register these generic engines from here for now */
DetectAppLayerInspectEngineRegister("dns_request",
ALPROTO_DNS, SIG_FLAG_TOSERVER, 1,
DetectEngineInspectDnsRequest);
DetectAppLayerInspectEngineRegister("dns_response",
ALPROTO_DNS, SIG_FLAG_TOCLIENT, 1,
DetectEngineInspectDnsResponse);
DetectBufferTypeSetDescriptionByName("dns_request",
"dns requests");
DetectBufferTypeSetDescriptionByName("dns_response",
"dns responses");
}
/**
* \brief Registers the keyword handlers for the "http_raw_header" keyword.
*/
void DetectHttpRawHeaderRegister(void)
{
/* http_raw_header content modifier */
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].name = "http_raw_header";
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].RegisterTests = DetectHttpRawHeaderRegisterTests;
#endif
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_AL_HTTP_RAW_HEADER].alternative = DETECT_HTTP_RAW_HEADER;
/* http.header.raw sticky buffer */
sigmatch_table[DETECT_HTTP_RAW_HEADER].name = "http.header.raw";
sigmatch_table[DETECT_HTTP_RAW_HEADER].desc = "sticky buffer to match the raw HTTP header buffer";
sigmatch_table[DETECT_HTTP_RAW_HEADER].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-raw-header";
sigmatch_table[DETECT_HTTP_RAW_HEADER].Setup = DetectHttpRawHeaderSetupSticky;
sigmatch_table[DETECT_HTTP_RAW_HEADER].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_HTTP_RAW_HEADER].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerInspectEngineRegister2("http_raw_header", ALPROTO_HTTP,
SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS+1,
DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerInspectEngineRegister2("http_raw_header", ALPROTO_HTTP,
SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS+1,
DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister2("http_raw_header", SIG_FLAG_TOSERVER, 2,
PrefilterMpmHttpHeaderRawRequestRegister, NULL, ALPROTO_HTTP,
0); /* progress handled in register */
DetectAppLayerMpmRegister2("http_raw_header", SIG_FLAG_TOCLIENT, 2,
PrefilterMpmHttpHeaderRawResponseRegister, NULL, ALPROTO_HTTP,
0); /* progress handled in register */
DetectBufferTypeSetDescriptionByName("http_raw_header",
"raw http headers");
DetectBufferTypeRegisterValidateCallback("http_raw_header",
DetectHttpRawHeaderValidateCallback);
g_http_raw_header_buffer_id = DetectBufferTypeGetByName("http_raw_header");
}
/**
* \brief Registration function for keyword: http_method
*/
void DetectHttpMethodRegister(void)
{
/* http_method content modifier */
sigmatch_table[DETECT_AL_HTTP_METHOD].name = "http_method";
sigmatch_table[DETECT_AL_HTTP_METHOD].desc = "content modifier to match only on the HTTP method-buffer";
sigmatch_table[DETECT_AL_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method";
sigmatch_table[DETECT_AL_HTTP_METHOD].Match = NULL;
sigmatch_table[DETECT_AL_HTTP_METHOD].Setup = DetectHttpMethodSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_METHOD].RegisterTests = DetectHttpMethodRegisterTests;
#endif
sigmatch_table[DETECT_AL_HTTP_METHOD].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_CONTENT_MODIFIER;
sigmatch_table[DETECT_AL_HTTP_METHOD].alternative = DETECT_HTTP_METHOD;
/* http.method sticky buffer */
sigmatch_table[DETECT_HTTP_METHOD].name = "http.method";
sigmatch_table[DETECT_HTTP_METHOD].desc = "sticky buffer to match specifically and only on the HTTP method buffer";
sigmatch_table[DETECT_HTTP_METHOD].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-method";
sigmatch_table[DETECT_HTTP_METHOD].Setup = DetectHttpMethodSetupSticky;
sigmatch_table[DETECT_HTTP_METHOD].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerInspectEngineRegister2("http_method", ALPROTO_HTTP,
SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister2("http_method", SIG_FLAG_TOSERVER, 4,
PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP,
HTP_REQUEST_LINE);
DetectBufferTypeSetDescriptionByName("http_method",
"http request method");
DetectBufferTypeRegisterValidateCallback("http_method",
DetectHttpMethodValidateCallback);
g_http_method_buffer_id = DetectBufferTypeGetByName("http_method");
SCLogDebug("registering http_method rule option");
}
/**
* \brief Registers the keyword handlers for the "http_header" keyword.
*/
void DetectHttpStartRegister(void)
{
sigmatch_table[DETECT_AL_HTTP_START].name = KEYWORD_NAME;
sigmatch_table[DETECT_AL_HTTP_START].alias = KEYWORD_NAME_LEGACY;
sigmatch_table[DETECT_AL_HTTP_START].desc = BUFFER_NAME " sticky buffer";
sigmatch_table[DETECT_AL_HTTP_START].url = DOC_URL DOC_VERSION "/rules/" KEYWORD_DOC;
sigmatch_table[DETECT_AL_HTTP_START].Setup = DetectHttpStartSetup;
sigmatch_table[DETECT_AL_HTTP_START].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2,
PrefilterTxHttpRequestStartRegister, NULL, ALPROTO_HTTP,
HTP_REQUEST_HEADERS);
DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2,
PrefilterTxHttpResponseStartRegister, NULL, ALPROTO_HTTP,
HTP_RESPONSE_HEADERS);
DetectAppLayerInspectEngineRegister2(BUFFER_NAME,
ALPROTO_HTTP, SIG_FLAG_TOSERVER, HTP_REQUEST_HEADERS,
InspectEngineHttpStart, NULL);
DetectAppLayerInspectEngineRegister2(BUFFER_NAME,
ALPROTO_HTTP, SIG_FLAG_TOCLIENT, HTP_RESPONSE_HEADERS,
InspectEngineHttpStart, NULL);
DetectBufferTypeSetDescriptionByName(BUFFER_NAME,
BUFFER_DESC);
g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
g_keyword_thread_id = DetectRegisterThreadCtxGlobalFuncs(KEYWORD_NAME,
HttpHeaderThreadDataInit, &g_td_config, HttpHeaderThreadDataFree);
SCLogDebug("keyword %s registered. Thread id %d. "
"Buffer %s registered. Buffer id %d",
KEYWORD_NAME, g_keyword_thread_id,
BUFFER_NAME, g_buffer_id);
}
/**
* \brief Registration function for keywords: http_uri and http.uri
*/
void DetectHttpUriRegister (void)
{
/* http_uri content modifier */
sigmatch_table[DETECT_AL_HTTP_URI].name = "http_uri";
sigmatch_table[DETECT_AL_HTTP_URI].desc = "content modifier to match specifically and only on the HTTP uri-buffer";
sigmatch_table[DETECT_AL_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http-uri-and-http-raw-uri";
sigmatch_table[DETECT_AL_HTTP_URI].Setup = DetectHttpUriSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_AL_HTTP_URI].RegisterTests = DetectHttpUriRegisterTests;
#endif
sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_NOOPT;
/* http.uri sticky buffer */
sigmatch_table[DETECT_HTTP_URI].name = "http.uri";
sigmatch_table[DETECT_HTTP_URI].alias = "http.uri.normalized";
sigmatch_table[DETECT_HTTP_URI].desc = "sticky buffer to match specifically and only on the normalized HTTP URI buffer";
sigmatch_table[DETECT_HTTP_URI].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#http-uri";
sigmatch_table[DETECT_HTTP_URI].Setup = DetectHttpUriSetupSticky;
sigmatch_table[DETECT_HTTP_URI].flags |= SIGMATCH_NOOPT;
DetectAppLayerInspectEngineRegister2("http_uri", ALPROTO_HTTP,
SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister2("http_uri", SIG_FLAG_TOSERVER, 2,
PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP,
HTP_REQUEST_LINE);
DetectBufferTypeSetDescriptionByName("http_uri",
"http request uri");
DetectBufferTypeRegisterSetupCallback("http_uri",
DetectHttpUriSetupCallback);
DetectBufferTypeRegisterValidateCallback("http_uri",
DetectHttpUriValidateCallback);
g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri");
/* http_raw_uri content modifier */
sigmatch_table[DETECT_AL_HTTP_RAW_URI].name = "http_raw_uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].desc = "content modifier to match on the raw HTTP uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].url = DOC_URL DOC_VERSION "/rules/http-keywords.html#http_uri-and-http_raw-uri";
sigmatch_table[DETECT_AL_HTTP_RAW_URI].Setup = DetectHttpRawUriSetup;
sigmatch_table[DETECT_AL_HTTP_RAW_URI].flags |= SIGMATCH_NOOPT;
/* http.uri.raw sticky buffer */
sigmatch_table[DETECT_HTTP_URI_RAW].name = "http.uri.raw";
sigmatch_table[DETECT_HTTP_URI_RAW].desc = "sticky buffer to match specifically and only on the raw HTTP URI buffer";
sigmatch_table[DETECT_HTTP_URI_RAW].url = DOC_URL DOC_VERSION "/rules/tls-keywords.html#http-uri";
sigmatch_table[DETECT_HTTP_URI_RAW].Setup = DetectHttpRawUriSetupSticky;
sigmatch_table[DETECT_HTTP_URI_RAW].flags |= SIGMATCH_NOOPT;
DetectAppLayerInspectEngineRegister2("http_raw_uri", ALPROTO_HTTP,
SIG_FLAG_TOSERVER, HTP_REQUEST_LINE,
DetectEngineInspectBufferGeneric, GetRawData);
DetectAppLayerMpmRegister2("http_raw_uri", SIG_FLAG_TOSERVER, 2,
PrefilterGenericMpmRegister, GetRawData, ALPROTO_HTTP,
HTP_REQUEST_LINE);
DetectBufferTypeSetDescriptionByName("http_raw_uri",
"raw http uri");
DetectBufferTypeRegisterSetupCallback("http_raw_uri",
DetectHttpRawUriSetupCallback);
DetectBufferTypeRegisterValidateCallback("http_raw_uri",
DetectHttpRawUriValidateCallback);
g_http_raw_uri_buffer_id = DetectBufferTypeGetByName("http_raw_uri");
}
