Main Page | Modules | Class List | Directories | File List | Class Members | File Members | Related Pages
src / preprocessors / HttpInspect / user_interface

hi_ui_config.c File Reference

This file contains library calls to configure HttpInspect. More...

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include "hi_return_codes.h"
#include "hi_util_xmalloc.h"
#include "hi_ui_server_lookup.h"
#include "hi_ui_config.h"

Go to the source code of this file.

Functions

int hi_ui_config_init_global_conf (HTTPINSPECT_GLOBAL_CONF *GlobalConf)
int hi_ui_config_default (HTTPINSPECT_GLOBAL_CONF *GlobalConf)
int hi_ui_config_reset_global (HTTPINSPECT_GLOBAL_CONF *GlobalConf)
int hi_ui_config_reset_server (HTTPINSPECT_CONF *ServerConf)
int hi_ui_config_set_profile_apache (HTTPINSPECT_CONF *ServerConf)
int hi_ui_config_set_profile_iis (HTTPINSPECT_CONF *ServerConf, int *iis_unicode_map)
int hi_ui_config_set_profile_all (HTTPINSPECT_CONF *ServerConf, int *iis_unicode_map)
int hi_ui_config_add_server (HTTPINSPECT_GLOBAL_CONF *GlobalConf, unsigned long ServerIP, HTTPINSPECT_CONF *ServerConf)

Detailed Description

This file contains library calls to configure HttpInspect.

Author:
Daniel Roelker <droelker@sourcefire.com>
Copyright (C) 2003-2005 Sourcefire,Inc.

This file deals with configuring HttpInspect processing. It contains routines to set a default configuration, add server configurations, etc.

NOTES:

Definition in file hi_ui_config.c.

Function Documentation

int hi_ui_config_add_server (  HTTPINSPECT_GLOBAL_CONF *  GlobalConf,
unsigned long  ServerIP,
HTTPINSPECT_CONF *  ServerConf
) 
 

Add a server config to the HttpInspect configuration.

This function takes an IP address of a server and an HttpInspect configuration, and assigns the configuration to the IP address in a lookup table.

Parameters:
GlobalConf pointer to the global configuration
ServerIp the IP address of the server (in network byte order)
ServerConf pointer to the server configuration
Returns:
integer
Return values:
HI_SUCCESS function successful
HI_MEM_ALLOC_FAIL could not allocate memory
HI_NON_FATAL_ERR server has already been added

Definition at line 376 of file hi_ui_config.c.

References HI_SUCCESS, hi_ui_server_lookup_add(), and s_HTTPINSPECT_GLOBAL_CONF::server_lookup.

Referenced by ProcessUniqueServerConf().

int hi_ui_config_default (  HTTPINSPECT_GLOBAL_CONF *  GlobalConf  ) 
 

This function sets the global and the global_server default configuration.

In order to change the default configuration of HttpInspect, you must change this function.

Parameters:
GlobalConf pointer to the global configuration structure
Returns:
integer
Return values:
HI_INVALID_ARG Fatal Error. Undefined pointer to GlobalConf
HI_MEM_ALLOC_FAIL Fatal Error. Memory Allocation Failed

Definition at line 81 of file hi_ui_config.c.

References s_HTTPINSPECT_CONF_OPT::alert, s_HTTPINSPECT_CONF::apache_whitespace, s_HTTPINSPECT_CONF::ascii, s_HTTPINSPECT_CONF::chunk_length, s_HTTPINSPECT_CONF::directory, s_HTTPINSPECT_CONF::flow_depth, s_HTTPINSPECT_GLOBAL_CONF::global_server, HI_INVALID_ARG, HI_SUCCESS, HI_UI_CONFIG_STATELESS, s_HTTPINSPECT_CONF::iis_delimiter, s_HTTPINSPECT_GLOBAL_CONF::inspection_type, s_HTTPINSPECT_CONF::multiple_slash, s_HTTPINSPECT_CONF::non_strict, NULL, s_HTTPINSPECT_CONF_OPT::on, s_HTTPINSPECT_CONF::port_count, s_HTTPINSPECT_CONF::ports, s_HTTPINSPECT_CONF::utf_8, and s_HTTPINSPECT_CONF::webroot.

Referenced by HttpInspectInit().

int hi_ui_config_init_global_conf (  HTTPINSPECT_GLOBAL_CONF *  GlobalConf  ) 
 

Initialize the HttpInspect global configuration.

The main point of this function is to initialize the server lookup type. We also do things like memset, etc.

Parameters:
GlobalConf pointer to the global configuration
Returns:
integer
Return values:
HI_SUCCESS function successful
HI_MEM_ALLOC_FAIL could not allocate memory

Definition at line 50 of file hi_ui_config.c.

References HI_SUCCESS, hi_ui_server_lookup_init(), memset, and s_HTTPINSPECT_GLOBAL_CONF::server_lookup.

Referenced by HttpInspectInit().

int hi_ui_config_reset_global (  HTTPINSPECT_GLOBAL_CONF *  GlobalConf  ) 
 

This function resets the global parameters, THIS IS NOT THE GLOBAL SERVER CONFIGURATION.

Parameters:
GlobalConf pointer to the global configuration structure
Returns:
integer

HI_SUCCESS function successful

Definition at line 137 of file hi_ui_config.c.

References HI_SUCCESS, s_HTTPINSPECT_GLOBAL_CONF::iis_unicode_map, and s_HTTPINSPECT_GLOBAL_CONF::inspection_type.

Referenced by HttpInspectSnortConf().

int hi_ui_config_reset_server (  HTTPINSPECT_CONF *  ServerConf  ) 
 

This function resets a server construct.

Parameters:
ServerConf pointer to the HTTPINSPECT_CONF structure
Returns:
integer

HI_SUCCESS function successful

Definition at line 158 of file hi_ui_config.c.

References HI_SUCCESS, and memset.

Referenced by hi_ui_config_set_profile_all(), hi_ui_config_set_profile_apache(), hi_ui_config_set_profile_iis(), HttpInspectSnortConf(), and ProcessUniqueServerConf().

int hi_ui_config_set_profile_all (  HTTPINSPECT_CONF *  ServerConf,
int *  iis_unicode_map
) 
 

Set an HTTPINSPECT_CONF to catch all attacks and evasions.

This basically turns on all the tricks and most of the alerts, so you won't miss anything that HttpInspect does.

Parameters:
ServerConf pointer to structure HTTPINSPECT_CONF
Returns:
integer
Return values:
HI_SUCCESS function successful
HI_MEM_ALLOC_FAIL memory allocation failed

Definition at line 302 of file hi_ui_config.c.

References s_HTTPINSPECT_CONF_OPT::alert, s_HTTPINSPECT_CONF::apache_whitespace, s_HTTPINSPECT_CONF::ascii, s_HTTPINSPECT_CONF::bare_byte, s_HTTPINSPECT_CONF::chunk_length, s_HTTPINSPECT_CONF::directory, s_HTTPINSPECT_CONF::double_decoding, s_HTTPINSPECT_CONF::flow_depth, HI_INVALID_ARG, HI_SUCCESS, hi_ui_config_reset_server(), s_HTTPINSPECT_CONF::iis_backslash, s_HTTPINSPECT_CONF::iis_delimiter, s_HTTPINSPECT_CONF::iis_unicode, s_HTTPINSPECT_CONF::iis_unicode_map, s_HTTPINSPECT_CONF::multiple_slash, s_HTTPINSPECT_CONF::non_strict, NULL, s_HTTPINSPECT_CONF_OPT::on, s_HTTPINSPECT_CONF::tab_uri_delimiter, s_HTTPINSPECT_CONF::u_encoding, and s_HTTPINSPECT_CONF::webroot.

Referenced by ProcessProfile().

int hi_ui_config_set_profile_apache (  HTTPINSPECT_CONF *  ServerConf  ) 
 

Set an HTTPINSPECT_CONF to mimic apache configuration.

This sets a server configuration to imitate an apache web server, and should reduce false positives against systems on which certain attacks or evasions do not work. We hope to still log an event, but one that is less priority.

Parameters:
ServerConf pointer to structure HTTPINSPECT_CONF
Returns:
integer
Return values:
HI_SUCCESS function successful
HI_MEM_ALLOC_FAIL memory allocation failed

Definition at line 184 of file hi_ui_config.c.

References s_HTTPINSPECT_CONF_OPT::alert, s_HTTPINSPECT_CONF::apache_whitespace, s_HTTPINSPECT_CONF::ascii, s_HTTPINSPECT_CONF::chunk_length, s_HTTPINSPECT_CONF::directory, s_HTTPINSPECT_CONF::flow_depth, HI_SUCCESS, hi_ui_config_reset_server(), s_HTTPINSPECT_CONF::multiple_slash, s_HTTPINSPECT_CONF::non_strict, s_HTTPINSPECT_CONF_OPT::on, s_HTTPINSPECT_CONF::tab_uri_delimiter, s_HTTPINSPECT_CONF::utf_8, and s_HTTPINSPECT_CONF::webroot.

Referenced by ProcessProfile().

int hi_ui_config_set_profile_iis (  HTTPINSPECT_CONF *  ServerConf,
int *  iis_unicode_map
) 
 

Set an HTTPINSPECT_CONF to mimic IIS configuration.

This sets a server configuration to imitate an IIS web server, and should reduce false positives against systems on which certain attacks or evasions do not work. We hope to still log an event, but one that is less priority.

Parameters:
ServerConf pointer to structure HTTPINSPECT_CONF
Returns:
integer
Return values:
HI_SUCCESS function successful
HI_MEM_ALLOC_FAIL memory allocation failed

Definition at line 234 of file hi_ui_config.c.

References s_HTTPINSPECT_CONF_OPT::alert, s_HTTPINSPECT_CONF::apache_whitespace, s_HTTPINSPECT_CONF::ascii, s_HTTPINSPECT_CONF::bare_byte, s_HTTPINSPECT_CONF::chunk_length, s_HTTPINSPECT_CONF::directory, s_HTTPINSPECT_CONF::double_decoding, s_HTTPINSPECT_CONF::flow_depth, HI_INVALID_ARG, HI_SUCCESS, hi_ui_config_reset_server(), s_HTTPINSPECT_CONF::iis_backslash, s_HTTPINSPECT_CONF::iis_delimiter, s_HTTPINSPECT_CONF::iis_unicode, s_HTTPINSPECT_CONF::iis_unicode_map, s_HTTPINSPECT_CONF::multiple_slash, s_HTTPINSPECT_CONF::non_strict, NULL, s_HTTPINSPECT_CONF_OPT::on, s_HTTPINSPECT_CONF::u_encoding, and s_HTTPINSPECT_CONF::webroot.

Referenced by ProcessProfile().

Generated on Sun May 14 14:51:25 2006 by  doxygen 1.4.2