From d9811e58b6b4ef4fd5d4c96001ca4114a09813ab Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 28 Sep 2016 08:46:27 +0200 Subject: [PATCH] http_header: don't separately inspect trailer yet Currently the regular 'Header' inspection code will run each time after the HTTP progress moved beyond 'headers'. This will include the trailers if there are any. Leave the code in place as this model will change in the not too distant future. --- src/detect-engine-hhd.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/detect-engine-hhd.c b/src/detect-engine-hhd.c index d28016251a..c4146169cc 100644 --- a/src/detect-engine-hhd.c +++ b/src/detect-engine-hhd.c @@ -249,7 +249,7 @@ static void PrefilterTxHttpRequestHeaders(DetectEngineThreadCtx *det_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } - +#if 0 static void PrefilterTxHttpRequestTrailers(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, @@ -280,7 +280,7 @@ static void PrefilterTxHttpRequestTrailers(DetectEngineThreadCtx *det_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } - +#endif int PrefilterTxHttpRequestHeadersRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); @@ -288,11 +288,14 @@ int PrefilterTxHttpRequestHeadersRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) int r = PrefilterAppendTxEngine(sgh, PrefilterTxHttpRequestHeaders, ALPROTO_HTTP, HTP_REQUEST_HEADERS, mpm_ctx, NULL, "http_header (request)"); + return r; +#if 0 if (r != 0) return r; return PrefilterAppendTxEngine(sgh, PrefilterTxHttpRequestTrailers, ALPROTO_HTTP, HTP_REQUEST_TRAILER, mpm_ctx, NULL, "http_header (request)"); +#endif } /** \brief HTTP Headers Mpm prefilter callback @@ -329,7 +332,7 @@ static void PrefilterTxHttpResponseHeaders(DetectEngineThreadCtx *det_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } - +#if 0 static void PrefilterTxHttpResponseTrailers(DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f, void *txv, @@ -360,7 +363,7 @@ static void PrefilterTxHttpResponseTrailers(DetectEngineThreadCtx *det_ctx, &det_ctx->mtcu, &det_ctx->pmq, buffer, buffer_len); } } - +#endif int PrefilterTxHttpResponseHeadersRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) { SCEnter(); @@ -368,11 +371,14 @@ int PrefilterTxHttpResponseHeadersRegister(SigGroupHead *sgh, MpmCtx *mpm_ctx) int r = PrefilterAppendTxEngine(sgh, PrefilterTxHttpResponseHeaders, ALPROTO_HTTP, HTP_RESPONSE_HEADERS, mpm_ctx, NULL, "http_header (response)"); + return r; +#if 0 if (r != 0) return r; return PrefilterAppendTxEngine(sgh, PrefilterTxHttpResponseTrailers, ALPROTO_HTTP, HTP_RESPONSE_TRAILER, mpm_ctx, NULL, "http_header (response)"); +#endif } int DetectEngineInspectHttpHeader(ThreadVars *tv,