Coverage Report

Created: 2026-03-31 07:45

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/suricata7/src/detect-http-headers-stub.h
Line
Count
Source
1
/* Copyright (C) 2007-2019 Open Information Security Foundation
2
 *
3
 * You can copy, redistribute or modify this Program under the terms of
4
 * the GNU General Public License version 2 as published by the Free
5
 * Software Foundation.
6
 *
7
 * This program is distributed in the hope that it will be useful,
8
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
10
 * GNU General Public License for more details.
11
 *
12
 * You should have received a copy of the GNU General Public License
13
 * version 2 along with this program; if not, write to the Free Software
14
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
 * 02110-1301, USA.
16
 */
17
18
/**
19
 * Stub for per HTTP header detection keyword. Meant to be included into
20
 * a C file.
21
 */
22
23
/**
24
 * \ingroup httplayer
25
 *
26
 * @{
27
 */
28
29
#include "suricata-common.h"
30
#include "flow.h"
31
32
#include <htp/htp.h>
33
34
#include "detect.h"
35
#include "detect-parse.h"
36
#include "detect-engine.h"
37
#include "detect-engine-mpm.h"
38
#include "detect-engine-prefilter.h"
39
40
#include "util-debug.h"
41
#include "rust.h"
42
43
static int g_buffer_id = 0;
44
static int g_http2_thread_id = 0;
45
46
#ifdef KEYWORD_TOSERVER
47
static InspectionBuffer *GetRequestData(DetectEngineThreadCtx *det_ctx,
48
        const DetectEngineTransforms *transforms, Flow *_f,
49
        const uint8_t _flow_flags, void *txv, const int list_id)
50
7.77k
{
51
7.77k
    SCEnter();
52
53
7.77k
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
54
7.77k
    if (buffer->inspect == NULL) {
55
7.09k
        htp_tx_t *tx = (htp_tx_t *)txv;
56
57
7.09k
        if (tx->request_headers == NULL)
58
0
            return NULL;
59
60
7.09k
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
61
7.09k
                                                          HEADER_NAME);
62
7.09k
        if (h == NULL || h->value == NULL) {
63
6.31k
            SCLogDebug("HTTP %s header not present in this request",
64
6.31k
                       HEADER_NAME);
65
6.31k
            return NULL;
66
6.31k
        }
67
68
780
        const uint32_t data_len = bstr_len(h->value);
69
780
        const uint8_t *data = bstr_ptr(h->value);
70
71
780
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
72
780
        InspectionBufferApplyTransforms(buffer, transforms);
73
780
    }
74
75
1.46k
    return buffer;
76
7.77k
}
detect-http-referer.c:GetRequestData
Line
Count
Source
50
6
{
51
6
    SCEnter();
52
53
6
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
54
6
    if (buffer->inspect == NULL) {
55
6
        htp_tx_t *tx = (htp_tx_t *)txv;
56
57
6
        if (tx->request_headers == NULL)
58
0
            return NULL;
59
60
6
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
61
6
                                                          HEADER_NAME);
62
6
        if (h == NULL || h->value == NULL) {
63
6
            SCLogDebug("HTTP %s header not present in this request",
64
6
                       HEADER_NAME);
65
6
            return NULL;
66
6
        }
67
68
0
        const uint32_t data_len = bstr_len(h->value);
69
0
        const uint8_t *data = bstr_ptr(h->value);
70
71
0
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
72
0
        InspectionBufferApplyTransforms(buffer, transforms);
73
0
    }
74
75
0
    return buffer;
76
6
}
detect-http-accept.c:GetRequestData
Line
Count
Source
50
160
{
51
160
    SCEnter();
52
53
160
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
54
160
    if (buffer->inspect == NULL) {
55
157
        htp_tx_t *tx = (htp_tx_t *)txv;
56
57
157
        if (tx->request_headers == NULL)
58
0
            return NULL;
59
60
157
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
61
157
                                                          HEADER_NAME);
62
157
        if (h == NULL || h->value == NULL) {
63
154
            SCLogDebug("HTTP %s header not present in this request",
64
154
                       HEADER_NAME);
65
154
            return NULL;
66
154
        }
67
68
3
        const uint32_t data_len = bstr_len(h->value);
69
3
        const uint8_t *data = bstr_ptr(h->value);
70
71
3
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
72
3
        InspectionBufferApplyTransforms(buffer, transforms);
73
3
    }
74
75
6
    return buffer;
76
160
}
detect-http-accept-enc.c:GetRequestData
Line
Count
Source
50
268
{
51
268
    SCEnter();
52
53
268
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
54
268
    if (buffer->inspect == NULL) {
55
268
        htp_tx_t *tx = (htp_tx_t *)txv;
56
57
268
        if (tx->request_headers == NULL)
58
0
            return NULL;
59
60
268
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
61
268
                                                          HEADER_NAME);
62
268
        if (h == NULL || h->value == NULL) {
63
268
            SCLogDebug("HTTP %s header not present in this request",
64
268
                       HEADER_NAME);
65
268
            return NULL;
66
268
        }
67
68
0
        const uint32_t data_len = bstr_len(h->value);
69
0
        const uint8_t *data = bstr_ptr(h->value);
70
71
0
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
72
0
        InspectionBufferApplyTransforms(buffer, transforms);
73
0
    }
74
75
0
    return buffer;
76
268
}
detect-http-accept-lang.c:GetRequestData
Line
Count
Source
50
397
{
51
397
    SCEnter();
52
53
397
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
54
397
    if (buffer->inspect == NULL) {
55
356
        htp_tx_t *tx = (htp_tx_t *)txv;
56
57
356
        if (tx->request_headers == NULL)
58
0
            return NULL;
59
60
356
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
61
356
                                                          HEADER_NAME);
62
356
        if (h == NULL || h->value == NULL) {
63
315
            SCLogDebug("HTTP %s header not present in this request",
64
315
                       HEADER_NAME);
65
315
            return NULL;
66
315
        }
67
68
41
        const uint32_t data_len = bstr_len(h->value);
69
41
        const uint8_t *data = bstr_ptr(h->value);
70
71
41
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
72
41
        InspectionBufferApplyTransforms(buffer, transforms);
73
41
    }
74
75
82
    return buffer;
76
397
}
detect-http-connection.c:GetRequestData
Line
Count
Source
50
173
{
51
173
    SCEnter();
52
53
173
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
54
173
    if (buffer->inspect == NULL) {
55
171
        htp_tx_t *tx = (htp_tx_t *)txv;
56
57
171
        if (tx->request_headers == NULL)
58
0
            return NULL;
59
60
171
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
61
171
                                                          HEADER_NAME);
62
171
        if (h == NULL || h->value == NULL) {
63
126
            SCLogDebug("HTTP %s header not present in this request",
64
126
                       HEADER_NAME);
65
126
            return NULL;
66
126
        }
67
68
45
        const uint32_t data_len = bstr_len(h->value);
69
45
        const uint8_t *data = bstr_ptr(h->value);
70
71
45
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
72
45
        InspectionBufferApplyTransforms(buffer, transforms);
73
45
    }
74
75
47
    return buffer;
76
173
}
detect-http-content-len.c:GetRequestData
Line
Count
Source
50
6.77k
{
51
6.77k
    SCEnter();
52
53
6.77k
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
54
6.77k
    if (buffer->inspect == NULL) {
55
6.13k
        htp_tx_t *tx = (htp_tx_t *)txv;
56
57
6.13k
        if (tx->request_headers == NULL)
58
0
            return NULL;
59
60
6.13k
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->request_headers,
61
6.13k
                                                          HEADER_NAME);
62
6.13k
        if (h == NULL || h->value == NULL) {
63
5.44k
            SCLogDebug("HTTP %s header not present in this request",
64
5.44k
                       HEADER_NAME);
65
5.44k
            return NULL;
66
5.44k
        }
67
68
691
        const uint32_t data_len = bstr_len(h->value);
69
691
        const uint8_t *data = bstr_ptr(h->value);
70
71
691
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
72
691
        InspectionBufferApplyTransforms(buffer, transforms);
73
691
    }
74
75
1.33k
    return buffer;
76
6.77k
}
Unexecuted instantiation: detect-http-content-type.c:GetRequestData
77
78
static InspectionBuffer *GetRequestData2(DetectEngineThreadCtx *det_ctx,
79
        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
80
        const int list_id)
81
5.59k
{
82
5.59k
    SCEnter();
83
84
5.59k
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
85
5.59k
    if (buffer->inspect == NULL) {
86
5.56k
        uint32_t b_len = 0;
87
5.56k
        const uint8_t *b = NULL;
88
89
5.56k
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
90
5.56k
        if (thread_buf == NULL)
91
0
            return NULL;
92
5.56k
        if (rs_http2_tx_get_header_value(
93
5.56k
                    txv, STREAM_TOSERVER, HEADER_NAME, &b, &b_len, thread_buf) != 1)
94
5.54k
            return NULL;
95
25
        if (b == NULL || b_len == 0)
96
0
            return NULL;
97
98
25
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
99
25
        InspectionBufferApplyTransforms(buffer, transforms);
100
25
    }
101
102
47
    return buffer;
103
5.59k
}
detect-http-referer.c:GetRequestData2
Line
Count
Source
81
33
{
82
33
    SCEnter();
83
84
33
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
85
33
    if (buffer->inspect == NULL) {
86
33
        uint32_t b_len = 0;
87
33
        const uint8_t *b = NULL;
88
89
33
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
90
33
        if (thread_buf == NULL)
91
0
            return NULL;
92
33
        if (rs_http2_tx_get_header_value(
93
33
                    txv, STREAM_TOSERVER, HEADER_NAME, &b, &b_len, thread_buf) != 1)
94
33
            return NULL;
95
0
        if (b == NULL || b_len == 0)
96
0
            return NULL;
97
98
0
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
99
0
        InspectionBufferApplyTransforms(buffer, transforms);
100
0
    }
101
102
0
    return buffer;
103
33
}
detect-http-accept.c:GetRequestData2
Line
Count
Source
81
3.73k
{
82
3.73k
    SCEnter();
83
84
3.73k
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
85
3.73k
    if (buffer->inspect == NULL) {
86
3.71k
        uint32_t b_len = 0;
87
3.71k
        const uint8_t *b = NULL;
88
89
3.71k
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
90
3.71k
        if (thread_buf == NULL)
91
0
            return NULL;
92
3.71k
        if (rs_http2_tx_get_header_value(
93
3.71k
                    txv, STREAM_TOSERVER, HEADER_NAME, &b, &b_len, thread_buf) != 1)
94
3.68k
            return NULL;
95
25
        if (b == NULL || b_len == 0)
96
0
            return NULL;
97
98
25
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
99
25
        InspectionBufferApplyTransforms(buffer, transforms);
100
25
    }
101
102
47
    return buffer;
103
3.73k
}
detect-http-accept-enc.c:GetRequestData2
Line
Count
Source
81
19
{
82
19
    SCEnter();
83
84
19
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
85
19
    if (buffer->inspect == NULL) {
86
19
        uint32_t b_len = 0;
87
19
        const uint8_t *b = NULL;
88
89
19
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
90
19
        if (thread_buf == NULL)
91
0
            return NULL;
92
19
        if (rs_http2_tx_get_header_value(
93
19
                    txv, STREAM_TOSERVER, HEADER_NAME, &b, &b_len, thread_buf) != 1)
94
19
            return NULL;
95
0
        if (b == NULL || b_len == 0)
96
0
            return NULL;
97
98
0
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
99
0
        InspectionBufferApplyTransforms(buffer, transforms);
100
0
    }
101
102
0
    return buffer;
103
19
}
detect-http-accept-lang.c:GetRequestData2
Line
Count
Source
81
6
{
82
6
    SCEnter();
83
84
6
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
85
6
    if (buffer->inspect == NULL) {
86
6
        uint32_t b_len = 0;
87
6
        const uint8_t *b = NULL;
88
89
6
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
90
6
        if (thread_buf == NULL)
91
0
            return NULL;
92
6
        if (rs_http2_tx_get_header_value(
93
6
                    txv, STREAM_TOSERVER, HEADER_NAME, &b, &b_len, thread_buf) != 1)
94
6
            return NULL;
95
0
        if (b == NULL || b_len == 0)
96
0
            return NULL;
97
98
0
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
99
0
        InspectionBufferApplyTransforms(buffer, transforms);
100
0
    }
101
102
0
    return buffer;
103
6
}
detect-http-connection.c:GetRequestData2
Line
Count
Source
81
985
{
82
985
    SCEnter();
83
84
985
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
85
985
    if (buffer->inspect == NULL) {
86
985
        uint32_t b_len = 0;
87
985
        const uint8_t *b = NULL;
88
89
985
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
90
985
        if (thread_buf == NULL)
91
0
            return NULL;
92
985
        if (rs_http2_tx_get_header_value(
93
985
                    txv, STREAM_TOSERVER, HEADER_NAME, &b, &b_len, thread_buf) != 1)
94
985
            return NULL;
95
0
        if (b == NULL || b_len == 0)
96
0
            return NULL;
97
98
0
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
99
0
        InspectionBufferApplyTransforms(buffer, transforms);
100
0
    }
101
102
0
    return buffer;
103
985
}
detect-http-content-len.c:GetRequestData2
Line
Count
Source
81
813
{
82
813
    SCEnter();
83
84
813
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
85
813
    if (buffer->inspect == NULL) {
86
813
        uint32_t b_len = 0;
87
813
        const uint8_t *b = NULL;
88
89
813
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
90
813
        if (thread_buf == NULL)
91
0
            return NULL;
92
813
        if (rs_http2_tx_get_header_value(
93
813
                    txv, STREAM_TOSERVER, HEADER_NAME, &b, &b_len, thread_buf) != 1)
94
813
            return NULL;
95
0
        if (b == NULL || b_len == 0)
96
0
            return NULL;
97
98
0
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
99
0
        InspectionBufferApplyTransforms(buffer, transforms);
100
0
    }
101
102
0
    return buffer;
103
813
}
Unexecuted instantiation: detect-http-content-type.c:GetRequestData2
104
105
#endif
106
#ifdef KEYWORD_TOCLIENT
107
static InspectionBuffer *GetResponseData(DetectEngineThreadCtx *det_ctx,
108
        const DetectEngineTransforms *transforms, Flow *_f,
109
        const uint8_t _flow_flags, void *txv, const int list_id)
110
7.39k
{
111
7.39k
    SCEnter();
112
113
7.39k
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
114
7.39k
    if (buffer->inspect == NULL) {
115
6.78k
        htp_tx_t *tx = (htp_tx_t *)txv;
116
117
6.78k
        if (tx->response_headers == NULL)
118
0
            return NULL;
119
120
6.78k
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers,
121
6.78k
                                                          HEADER_NAME);
122
6.78k
        if (h == NULL || h->value == NULL) {
123
5.32k
            SCLogDebug("HTTP %s header not present in this request",
124
5.32k
                       HEADER_NAME);
125
5.32k
            return NULL;
126
5.32k
        }
127
128
1.45k
        const uint32_t data_len = bstr_len(h->value);
129
1.45k
        const uint8_t *data = bstr_ptr(h->value);
130
131
1.45k
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
132
1.45k
        InspectionBufferApplyTransforms(buffer, transforms);
133
1.45k
    }
134
135
2.07k
    return buffer;
136
7.39k
}
detect-http-location.c:GetResponseData
Line
Count
Source
110
405
{
111
405
    SCEnter();
112
113
405
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
114
405
    if (buffer->inspect == NULL) {
115
405
        htp_tx_t *tx = (htp_tx_t *)txv;
116
117
405
        if (tx->response_headers == NULL)
118
0
            return NULL;
119
120
405
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers,
121
405
                                                          HEADER_NAME);
122
405
        if (h == NULL || h->value == NULL) {
123
387
            SCLogDebug("HTTP %s header not present in this request",
124
387
                       HEADER_NAME);
125
387
            return NULL;
126
387
        }
127
128
18
        const uint32_t data_len = bstr_len(h->value);
129
18
        const uint8_t *data = bstr_ptr(h->value);
130
131
18
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
132
18
        InspectionBufferApplyTransforms(buffer, transforms);
133
18
    }
134
135
18
    return buffer;
136
405
}
detect-http-server.c:GetResponseData
Line
Count
Source
110
748
{
111
748
    SCEnter();
112
113
748
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
114
748
    if (buffer->inspect == NULL) {
115
697
        htp_tx_t *tx = (htp_tx_t *)txv;
116
117
697
        if (tx->response_headers == NULL)
118
0
            return NULL;
119
120
697
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers,
121
697
                                                          HEADER_NAME);
122
697
        if (h == NULL || h->value == NULL) {
123
58
            SCLogDebug("HTTP %s header not present in this request",
124
58
                       HEADER_NAME);
125
58
            return NULL;
126
58
        }
127
128
639
        const uint32_t data_len = bstr_len(h->value);
129
639
        const uint8_t *data = bstr_ptr(h->value);
130
131
639
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
132
639
        InspectionBufferApplyTransforms(buffer, transforms);
133
639
    }
134
135
690
    return buffer;
136
748
}
detect-http-connection.c:GetResponseData
Line
Count
Source
110
119
{
111
119
    SCEnter();
112
113
119
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
114
119
    if (buffer->inspect == NULL) {
115
118
        htp_tx_t *tx = (htp_tx_t *)txv;
116
117
118
        if (tx->response_headers == NULL)
118
0
            return NULL;
119
120
118
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers,
121
118
                                                          HEADER_NAME);
122
118
        if (h == NULL || h->value == NULL) {
123
58
            SCLogDebug("HTTP %s header not present in this request",
124
58
                       HEADER_NAME);
125
58
            return NULL;
126
58
        }
127
128
60
        const uint32_t data_len = bstr_len(h->value);
129
60
        const uint8_t *data = bstr_ptr(h->value);
130
131
60
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
132
60
        InspectionBufferApplyTransforms(buffer, transforms);
133
60
    }
134
135
61
    return buffer;
136
119
}
detect-http-content-len.c:GetResponseData
Line
Count
Source
110
6.12k
{
111
6.12k
    SCEnter();
112
113
6.12k
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
114
6.12k
    if (buffer->inspect == NULL) {
115
5.56k
        htp_tx_t *tx = (htp_tx_t *)txv;
116
117
5.56k
        if (tx->response_headers == NULL)
118
0
            return NULL;
119
120
5.56k
        htp_header_t *h = (htp_header_t *)htp_table_get_c(tx->response_headers,
121
5.56k
                                                          HEADER_NAME);
122
5.56k
        if (h == NULL || h->value == NULL) {
123
4.81k
            SCLogDebug("HTTP %s header not present in this request",
124
4.81k
                       HEADER_NAME);
125
4.81k
            return NULL;
126
4.81k
        }
127
128
741
        const uint32_t data_len = bstr_len(h->value);
129
741
        const uint8_t *data = bstr_ptr(h->value);
130
131
741
        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
132
741
        InspectionBufferApplyTransforms(buffer, transforms);
133
741
    }
134
135
1.30k
    return buffer;
136
6.12k
}
Unexecuted instantiation: detect-http-content-type.c:GetResponseData
137
138
static InspectionBuffer *GetResponseData2(DetectEngineThreadCtx *det_ctx,
139
        const DetectEngineTransforms *transforms, Flow *_f, const uint8_t _flow_flags, void *txv,
140
        const int list_id)
141
12.2k
{
142
12.2k
    SCEnter();
143
144
12.2k
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
145
12.2k
    if (buffer->inspect == NULL) {
146
12.2k
        uint32_t b_len = 0;
147
12.2k
        const uint8_t *b = NULL;
148
149
12.2k
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
150
12.2k
        if (thread_buf == NULL)
151
0
            return NULL;
152
12.2k
        if (rs_http2_tx_get_header_value(
153
12.2k
                    txv, STREAM_TOCLIENT, HEADER_NAME, &b, &b_len, thread_buf) != 1)
154
11.6k
            return NULL;
155
589
        if (b == NULL || b_len == 0)
156
8
            return NULL;
157
158
581
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
159
581
        InspectionBufferApplyTransforms(buffer, transforms);
160
581
    }
161
162
584
    return buffer;
163
12.2k
}
detect-http-location.c:GetResponseData2
Line
Count
Source
141
9.87k
{
142
9.87k
    SCEnter();
143
144
9.87k
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
145
9.87k
    if (buffer->inspect == NULL) {
146
9.87k
        uint32_t b_len = 0;
147
9.87k
        const uint8_t *b = NULL;
148
149
9.87k
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
150
9.87k
        if (thread_buf == NULL)
151
0
            return NULL;
152
9.87k
        if (rs_http2_tx_get_header_value(
153
9.87k
                    txv, STREAM_TOCLIENT, HEADER_NAME, &b, &b_len, thread_buf) != 1)
154
9.54k
            return NULL;
155
328
        if (b == NULL || b_len == 0)
156
8
            return NULL;
157
158
320
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
159
320
        InspectionBufferApplyTransforms(buffer, transforms);
160
320
    }
161
162
320
    return buffer;
163
9.87k
}
detect-http-server.c:GetResponseData2
Line
Count
Source
141
593
{
142
593
    SCEnter();
143
144
593
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
145
593
    if (buffer->inspect == NULL) {
146
590
        uint32_t b_len = 0;
147
590
        const uint8_t *b = NULL;
148
149
590
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
150
590
        if (thread_buf == NULL)
151
0
            return NULL;
152
590
        if (rs_http2_tx_get_header_value(
153
590
                    txv, STREAM_TOCLIENT, HEADER_NAME, &b, &b_len, thread_buf) != 1)
154
329
            return NULL;
155
261
        if (b == NULL || b_len == 0)
156
0
            return NULL;
157
158
261
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
159
261
        InspectionBufferApplyTransforms(buffer, transforms);
160
261
    }
161
162
264
    return buffer;
163
593
}
detect-http-connection.c:GetResponseData2
Line
Count
Source
141
989
{
142
989
    SCEnter();
143
144
989
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
145
989
    if (buffer->inspect == NULL) {
146
989
        uint32_t b_len = 0;
147
989
        const uint8_t *b = NULL;
148
149
989
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
150
989
        if (thread_buf == NULL)
151
0
            return NULL;
152
989
        if (rs_http2_tx_get_header_value(
153
989
                    txv, STREAM_TOCLIENT, HEADER_NAME, &b, &b_len, thread_buf) != 1)
154
989
            return NULL;
155
0
        if (b == NULL || b_len == 0)
156
0
            return NULL;
157
158
0
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
159
0
        InspectionBufferApplyTransforms(buffer, transforms);
160
0
    }
161
162
0
    return buffer;
163
989
}
detect-http-content-len.c:GetResponseData2
Line
Count
Source
141
799
{
142
799
    SCEnter();
143
144
799
    InspectionBuffer *buffer = InspectionBufferGet(det_ctx, list_id);
145
799
    if (buffer->inspect == NULL) {
146
799
        uint32_t b_len = 0;
147
799
        const uint8_t *b = NULL;
148
149
799
        void *thread_buf = DetectThreadCtxGetGlobalKeywordThreadCtx(det_ctx, g_http2_thread_id);
150
799
        if (thread_buf == NULL)
151
0
            return NULL;
152
799
        if (rs_http2_tx_get_header_value(
153
799
                    txv, STREAM_TOCLIENT, HEADER_NAME, &b, &b_len, thread_buf) != 1)
154
799
            return NULL;
155
0
        if (b == NULL || b_len == 0)
156
0
            return NULL;
157
158
0
        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
159
0
        InspectionBufferApplyTransforms(buffer, transforms);
160
0
    }
161
162
0
    return buffer;
163
799
}
Unexecuted instantiation: detect-http-content-type.c:GetResponseData2
164
#endif
165
166
/**
167
 * \brief this function setup the http.header keyword used in the rule
168
 *
169
 * \param de_ctx   Pointer to the Detection Engine Context
170
 * \param s        Pointer to the Signature to which the current keyword belongs
171
 * \param str      Should hold an empty string always
172
 *
173
 * \retval 0       On success
174
 */
175
static int DetectHttpHeadersSetupSticky(DetectEngineCtx *de_ctx, Signature *s, const char *str)
176
25.8k
{
177
25.8k
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
864
        return -1;
179
180
24.9k
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
1.89k
        return -1;
182
183
23.0k
    return 0;
184
24.9k
}
detect-http-location.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
11.4k
{
177
11.4k
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
41
        return -1;
179
180
11.4k
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
111
        return -1;
182
183
11.3k
    return 0;
184
11.4k
}
detect-http-referer.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
336
{
177
336
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
5
        return -1;
179
180
331
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
61
        return -1;
182
183
270
    return 0;
184
331
}
detect-http-server.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
2.75k
{
177
2.75k
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
142
        return -1;
179
180
2.61k
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
2
        return -1;
182
183
2.61k
    return 0;
184
2.61k
}
detect-http-accept.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
558
{
177
558
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
7
        return -1;
179
180
551
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
4
        return -1;
182
183
547
    return 0;
184
551
}
detect-http-accept-enc.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
827
{
177
827
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
232
        return -1;
179
180
595
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
198
        return -1;
182
183
397
    return 0;
184
595
}
detect-http-accept-lang.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
230
{
177
230
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
5
        return -1;
179
180
225
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
38
        return -1;
182
183
187
    return 0;
184
225
}
detect-http-connection.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
6.62k
{
177
6.62k
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
414
        return -1;
179
180
6.20k
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
109
        return -1;
182
183
6.09k
    return 0;
184
6.20k
}
detect-http-content-len.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
1.66k
{
177
1.66k
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
3
        return -1;
179
180
1.65k
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
1.02k
        return -1;
182
183
630
    return 0;
184
1.65k
}
detect-http-content-type.c:DetectHttpHeadersSetupSticky
Line
Count
Source
176
1.34k
{
177
1.34k
    if (DetectBufferSetActiveList(de_ctx, s, g_buffer_id) < 0)
178
15
        return -1;
179
180
1.32k
    if (DetectSignatureSetAppProto(s, ALPROTO_HTTP) < 0)
181
347
        return -1;
182
183
979
    return 0;
184
1.32k
}
185
186
static void DetectHttpHeadersRegisterStub(void)
187
657
{
188
657
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
#ifdef KEYWORD_NAME_LEGACY
190
511
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
#endif
192
657
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
657
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
657
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
657
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
#ifdef KEYWORD_TOSERVER
198
511
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
511
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
#endif
203
#ifdef KEYWORD_TOCLIENT
204
365
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
365
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
#endif
209
#ifdef KEYWORD_TOSERVER
210
511
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
511
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
#endif
215
#ifdef KEYWORD_TOCLIENT
216
365
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
365
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
#endif
221
222
657
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
657
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
657
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
657
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
657
}
detect-http-location.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
#ifdef KEYWORD_NAME_LEGACY
190
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
#ifdef KEYWORD_TOSERVER
198
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
#endif
203
73
#ifdef KEYWORD_TOCLIENT
204
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
73
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
73
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
73
#endif
209
#ifdef KEYWORD_TOSERVER
210
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
#endif
215
73
#ifdef KEYWORD_TOCLIENT
216
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
73
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
73
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
73
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}
detect-http-referer.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
73
#ifdef KEYWORD_NAME_LEGACY
190
73
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
73
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
73
#ifdef KEYWORD_TOSERVER
198
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
73
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
73
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
73
#endif
203
#ifdef KEYWORD_TOCLIENT
204
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
#endif
209
73
#ifdef KEYWORD_TOSERVER
210
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
73
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
73
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
73
#endif
215
#ifdef KEYWORD_TOCLIENT
216
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}
detect-http-server.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
#ifdef KEYWORD_NAME_LEGACY
190
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
#ifdef KEYWORD_TOSERVER
198
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
#endif
203
73
#ifdef KEYWORD_TOCLIENT
204
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
73
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
73
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
73
#endif
209
#ifdef KEYWORD_TOSERVER
210
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
#endif
215
73
#ifdef KEYWORD_TOCLIENT
216
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
73
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
73
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
73
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}
detect-http-accept.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
73
#ifdef KEYWORD_NAME_LEGACY
190
73
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
73
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
73
#ifdef KEYWORD_TOSERVER
198
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
73
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
73
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
73
#endif
203
#ifdef KEYWORD_TOCLIENT
204
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
#endif
209
73
#ifdef KEYWORD_TOSERVER
210
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
73
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
73
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
73
#endif
215
#ifdef KEYWORD_TOCLIENT
216
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}
detect-http-accept-enc.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
73
#ifdef KEYWORD_NAME_LEGACY
190
73
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
73
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
73
#ifdef KEYWORD_TOSERVER
198
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
73
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
73
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
73
#endif
203
#ifdef KEYWORD_TOCLIENT
204
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
#endif
209
73
#ifdef KEYWORD_TOSERVER
210
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
73
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
73
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
73
#endif
215
#ifdef KEYWORD_TOCLIENT
216
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}
detect-http-accept-lang.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
73
#ifdef KEYWORD_NAME_LEGACY
190
73
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
73
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
73
#ifdef KEYWORD_TOSERVER
198
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
73
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
73
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
73
#endif
203
#ifdef KEYWORD_TOCLIENT
204
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
#endif
209
73
#ifdef KEYWORD_TOSERVER
210
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
73
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
73
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
73
#endif
215
#ifdef KEYWORD_TOCLIENT
216
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}
detect-http-connection.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
73
#ifdef KEYWORD_NAME_LEGACY
190
73
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
73
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
73
#ifdef KEYWORD_TOSERVER
198
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
73
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
73
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
73
#endif
203
73
#ifdef KEYWORD_TOCLIENT
204
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
73
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
73
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
73
#endif
209
73
#ifdef KEYWORD_TOSERVER
210
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
73
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
73
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
73
#endif
215
73
#ifdef KEYWORD_TOCLIENT
216
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
73
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
73
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
73
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}
detect-http-content-len.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
73
#ifdef KEYWORD_NAME_LEGACY
190
73
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
73
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
73
#ifdef KEYWORD_TOSERVER
198
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
73
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
73
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
73
#endif
203
73
#ifdef KEYWORD_TOCLIENT
204
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
73
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
73
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
73
#endif
209
73
#ifdef KEYWORD_TOSERVER
210
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
73
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
73
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
73
#endif
215
73
#ifdef KEYWORD_TOCLIENT
216
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
73
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
73
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
73
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}
detect-http-content-type.c:DetectHttpHeadersRegisterStub
Line
Count
Source
187
73
{
188
73
    sigmatch_table[KEYWORD_ID].name = KEYWORD_NAME;
189
73
#ifdef KEYWORD_NAME_LEGACY
190
73
    sigmatch_table[KEYWORD_ID].alias = KEYWORD_NAME_LEGACY;
191
73
#endif
192
73
    sigmatch_table[KEYWORD_ID].desc = KEYWORD_NAME " sticky buffer for the " BUFFER_DESC;
193
73
    sigmatch_table[KEYWORD_ID].url = "/rules/" KEYWORD_DOC;
194
73
    sigmatch_table[KEYWORD_ID].Setup = DetectHttpHeadersSetupSticky;
195
73
    sigmatch_table[KEYWORD_ID].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;
196
197
73
#ifdef KEYWORD_TOSERVER
198
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
199
73
            GetRequestData, ALPROTO_HTTP1, HTP_REQUEST_HEADERS);
200
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
201
73
            GetRequestData2, ALPROTO_HTTP2, HTTP2StateDataClient);
202
73
#endif
203
73
#ifdef KEYWORD_TOCLIENT
204
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
205
73
            GetResponseData, ALPROTO_HTTP1, HTP_RESPONSE_HEADERS);
206
73
    DetectAppLayerMpmRegister2(BUFFER_NAME, SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
207
73
            GetResponseData2, ALPROTO_HTTP2, HTTP2StateDataServer);
208
73
#endif
209
73
#ifdef KEYWORD_TOSERVER
210
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOSERVER,
211
73
            HTP_REQUEST_HEADERS, DetectEngineInspectBufferGeneric, GetRequestData);
212
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOSERVER,
213
73
            HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetRequestData2);
214
73
#endif
215
73
#ifdef KEYWORD_TOCLIENT
216
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP1, SIG_FLAG_TOCLIENT,
217
73
            HTP_RESPONSE_HEADERS, DetectEngineInspectBufferGeneric, GetResponseData);
218
73
    DetectAppLayerInspectEngineRegister2(BUFFER_NAME, ALPROTO_HTTP2, SIG_FLAG_TOCLIENT,
219
73
            HTTP2StateDataServer, DetectEngineInspectBufferGeneric, GetResponseData2);
220
73
#endif
221
222
73
    DetectBufferTypeSetDescriptionByName(BUFFER_NAME, BUFFER_DESC);
223
224
73
    g_http2_thread_id = DetectRegisterThreadCtxGlobalFuncs(
225
73
            BUFFER_NAME, SCHttp2ThreadBufDataInit, NULL, SCHttp2ThreadBufDataFree);
226
227
73
    g_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
228
73
}