hi_server.c File Reference

Handles inspection of HTTP server responses. More...

#include <stdio.h>
#include "hi_ui_config.h"
#include "hi_si.h"
#include "hi_return_codes.h"
#include "hi_server.h"

Go to the source code of this file.

Functions
static int	IsHttpServerData (HI_SERVER *Server, u_char *data, int dsize, int flow_depth)
static int	ServerInspection (HI_SESSION *Session, unsigned char *data, int dsize)
int	hi_server_inspection (void *S, unsigned char *data, int dsize)

---

Detailed Description

Handles inspection of HTTP server responses.

Author:

Daniel Roelker <droelker@sourcefire.com>

HttpInspect handles server responses in a stateless manner because we are really only interested in the first response packet that contains the HTTP response code, headers, and the payload.

The first big thing is to incorporate the HTTP protocol flow analyzer.

NOTES:

• Initial development. DJR

Definition in file hi_server.c.

---

Function Documentation

int hi_server_inspection (  void *  S, unsigned char *  data, int  dsize )

Definition at line 133 of file hi_server.c. References HI_INVALID_ARG, HI_SUCCESS, and ServerInspection(). Referenced by hi_mi_mode_inspection().

static int IsHttpServerData (  HI_SERVER *  Server, u_char *  data, int  dsize, int  flow_depth )  [static]

Inspect an HTTP server response packet to determine the state. We inspect this packet and determine whether we are in the beginning of a response header or if we are looking at payload. We limit the amount of inspection done on responses by only inspecting the HTTP header and some payload. If the whole packet is a payload, then we just ignore it, since we inspected the previous header and payload. We limit the amount of the payload by adjusting the Server structure members, header and header size. Parameters: Server  the server structure data  pointer to the beginning of payload dsize  the size of the payload flow_depth  the amount of header and payload to inspect Returns: integer Return values: HI_INVALID_ARG  invalid argument HI_SUCCESS  function success Definition at line 51 of file hi_server.c. References s_HI_SERVER::header, s_HI_SERVER::header_size, HI_INVALID_ARG, HI_SUCCESS, and NULL. Referenced by ServerInspection().

static int ServerInspection (  HI_SESSION *  Session, unsigned char *  data, int  dsize )  [static]

Definition at line 112 of file hi_server.c. References s_HTTPINSPECT_CONF::flow_depth, HI_SUCCESS, IsHttpServerData(), s_HI_SESSION::server, and s_HI_SESSION::server_conf. Referenced by hi_server_inspection().

---