"Fossies" - the Fresh Open Source Software Archive 
Member "snort-2.9.17/src/preprocessors/HttpInspect/include/hi_client.h" (16 Oct 2020, 6109 Bytes) of package /linux/misc/snort-2.9.17.tar.gz:
As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style:
standard) with prefixed line numbers and
code folding option.
Alternatively you can here
view or
download the uninterpreted source code file.
For more information about "hi_client.h" see the
Fossies "Dox" file reference documentation and the latest
Fossies "Diffs" side-by-side code changes report:
2.9.16.1_vs_2.9.17.
1 /* $Id$ */
2 /****************************************************************************
3 *
4 * Copyright (C) 2014-2020 Cisco and/or its affiliates. All rights reserved.
5 * Copyright (C) 2003-2013 Sourcefire, Inc.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License Version 2 as
9 * published by the Free Software Foundation. You may not use, modify or
10 * distribute this program under any other version of the GNU General
11 * Public License.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 *
22 ****************************************************************************/
23
24 #ifndef __HI_CLIENT_H__
25 #define __HI_CLIENT_H__
26
27
28 #ifdef HAVE_CONFIG_H
29 #include "config.h"
30 #endif
31
32 #include <sys/types.h>
33
34 #include "snort_httpinspect.h"
35 #include "hi_include.h"
36 #include "hi_eo.h"
37 #include "hi_eo_events.h"
38 #define URI_END 99
39 #define POST_END 100
40 #define NO_URI 101
41
42 #define XFF_MODE_MASK (0x000f)
43 #define XFF_EXFF_MASK (0x000c)
44
45 #define TRUE_CLIENT_IP_HDR (0x01)
46 #define XFF_HDR (0x02)
47 #define HDRS_BOTH (0x03)
48 #define XFF_HEADERS (0x04) // Using xff_headers list
49 #define XFF_HEADERS_ACTIVE (0x08) // Looking for highest precedence xff header
50 #define XFF_INIT (XFF_HEADERS | XFF_HEADERS_ACTIVE)
51
52 #define XFF_TOP_PRECEDENCE (1)
53 #define XFF_BOT_PRECEDENCE (255)
54
55 #define HTTP_RANGE_NONE 0
56 #define HTTP_RANGE_WITH_FULL_CONTENT_REQ 1
57 #define RANGE_WITH_PARTIAL_CONTENT_REQ 2
58 #define RANGE_WITH_REQ_ERROR 3
59
60 typedef struct s_COOKIE_PTR
61 {
62 const u_char *cookie;
63 const u_char *cookie_end;
64 struct s_COOKIE_PTR *next;
65 } COOKIE_PTR;
66
67
68 typedef struct s_CONTLEN_PTR
69 {
70 const u_char *cont_len_start;
71 const u_char *cont_len_end;
72 uint32_t len;
73 }CONTLEN_PTR;
74
75 typedef struct s_CONT_ENCODING_PTR
76 {
77 const u_char *cont_encoding_start;
78 const u_char *cont_encoding_end;
79 uint16_t compress_fmt;
80 }CONT_ENCODING_PTR;
81
82 typedef struct s_HEADER_FIELD_PTR
83 {
84 COOKIE_PTR *cookie;
85 CONTLEN_PTR *content_len;
86 CONT_ENCODING_PTR *content_encoding;
87 } HEADER_FIELD_PTR;
88
89 /* These numbers were chosen to avoid conflicting with
90 * the return codes in hi_return_codes.h */
91
92 /**
93 ** This structure holds pointers to the different sections of an HTTP
94 ** request. We need to track where whitespace begins and ends, so we
95 ** can evaluate the placement of the URI correctly.
96 **
97 ** For example,
98 **
99 ** GET / HTTP/1.0
100 ** ^ ^
101 ** start end
102 **
103 ** The end space pointers are set to NULL if there is space until the end
104 ** of the buffer.
105 */
106
107 typedef struct s_URI_PTR
108 {
109 const u_char *uri; /* the beginning of the URI */
110 const u_char *uri_end; /* the end of the URI */
111 const u_char *norm; /* ptr to first normalization occurence */
112 const u_char *ident; /* ptr to beginning of the HTTP identifier */
113 const u_char *first_sp_start; /* beginning of first space delimiter */
114 const u_char *first_sp_end; /* end of first space delimiter */
115 const u_char *second_sp_start; /* beginning of second space delimiter */
116 const u_char *second_sp_end; /* end of second space delimiter */
117 const u_char *param; /* '?' (beginning of parameter field) */
118 const u_char *delimiter; /* HTTP URI delimiter (\r\n\) */
119 const u_char *last_dir; /* ptr to last dir, so we catch long dirs */
120 const u_char *proxy; /* ptr to the absolute URI */
121 } URI_PTR;
122
123 typedef struct s_HEADER_PTR
124 {
125 URI_PTR header;
126 COOKIE_PTR cookie;
127 CONTLEN_PTR content_len;
128 CONT_ENCODING_PTR content_encoding;
129 uint8_t range_flag;
130 bool is_chunked;
131 #if defined(FEAT_OPEN_APPID)
132 HEADER_LOCATION userAgent, referer, method, via, responseCode, server, xWorkingWith, contentType;
133 #endif /* defined(FEAT_OPEN_APPID) */
134 } HEADER_PTR;
135
136
137 typedef struct s_HI_CLIENT_REQ
138 {
139 /*
140 u_char *method;
141 int method_size;
142 */
143
144 const u_char *uri;
145 const u_char *uri_norm;
146 const u_char *post_raw;
147 const u_char *post_norm;
148 const u_char *header_raw;
149 const u_char *header_norm;
150 COOKIE_PTR cookie;
151 const u_char *cookie_norm;
152 const u_char *method_raw;
153
154 u_int uri_size;
155 u_int uri_norm_size;
156 u_int post_raw_size;
157 u_int post_norm_size;
158 u_int header_raw_size;
159 u_int header_norm_size;
160 u_int cookie_norm_size;
161 u_int method_size;
162
163 /*
164 u_char *param;
165 u_int param_size;
166 u_int param_norm;
167 */
168
169 /*
170 u_char *ver;
171 u_int ver_size;
172
173 u_char *hdr;
174 u_int hdr_size;
175
176 u_char *payload;
177 u_int payload_size;
178 */
179
180 const u_char *pipeline_req;
181 u_char method;
182 uint16_t uri_encode_type;
183 uint16_t header_encode_type;
184 uint16_t cookie_encode_type;
185 uint16_t post_encode_type;
186 const u_char *content_type;
187 const u_char *content_disp;
188 uint8_t range_flag;
189
190 } HI_CLIENT_REQ;
191
192 typedef struct s_HI_CLIENT
193 {
194 HI_CLIENT_REQ request;
195 int (*state)(void *, unsigned char, int);
196 HI_CLIENT_EVENTS event_list;
197
198 } HI_CLIENT;
199
200 typedef struct s_HI_CLIENT_HDR_ARGS
201 {
202 HEADER_PTR *hdr_ptr;
203 HEADER_FIELD_PTR *hdr_field_ptr;
204 HttpSessionData *sd;
205 int strm_ins;
206 int hst_name_hdr;
207 uint8_t true_clnt_xff;
208 uint8_t prev_true_clnt_xff;
209 uint8_t top_precedence;
210 uint8_t new_precedence;
211 } HI_CLIENT_HDR_ARGS;
212
213 int hi_client_inspection(Packet *p, void *Session, HttpSessionData *hsd, int stream_ins);
214 int hi_client_init(HTTPINSPECT_GLOBAL_CONF *GlobalConf);
215
216 char **hi_client_get_field_names();
217
218 extern const u_char *proxy_start;
219 extern const u_char *proxy_end;
220
221 #endif