【代码片段记录】sc 获取基础信息，获取请求响应体

ゝ一纸荒年。 2022-05-18 05:17 152阅读 0赞

json_t *JsonHttpAddMetadata(const Flow *f, uint64_t tx_id)
    {
        HtpState *htp_state = (HtpState *)FlowGetAppState(f);
        if (htp_state) {
            htp_tx_t *tx = AppLayerParserGetTx(IPPROTO_TCP, ALPROTO_HTTP, htp_state, tx_id);
    
            if (tx) {
                json_t *hjs = json_object();
                if (unlikely(hjs == NULL))
                    return NULL;
    
                JsonHttpLogJSONBasic(hjs, tx);
                JsonHttpLogJSONExtended(hjs, tx);
    
                HtpTxUserData *htud = (HtpTxUserData *)htp_tx_get_user_data(tx);
                if (htud != NULL) {
                    BodyPrintableBuffer(hjs, &htud->request_body, "http_request_body_printable");
                    BodyPrintableBuffer(hjs, &htud->response_body, "http_response_body_printable");
                }
                return hjs;
            }
        }
    
        return NULL;
    }

获取基础信息

static void JsonHttpLogJSONBasic(json_t *js, htp_tx_t *tx)
    {
        char *c;
    
        htp_header_t *h_res_head = NULL;
        if (tx->response_headers != NULL) {
            h_res_head = htp_table_get_c(tx->response_headers, "Content-Type");
        }
        if (h_res_head != NULL) {
            c = bstr_util_strdup_to_c(h_res_head->value);
            if (c != NULL) {
                json_object_set_new(js, "http_res_type", json_string(c));
                SCFree(c);
            }
        }
    
    
        /* hostname */
        if (tx->request_hostname != NULL)
        {
            c = bstr_util_strdup_to_c(tx->request_hostname);
            if (c != NULL) {
                json_object_set_new(js, "hostname", json_string(c));
                SCFree(c);
            }
        }
    
        /* uri */
        if (tx->request_uri != NULL)
        {
            c = bstr_util_strdup_to_c(tx->request_uri);
            if (c != NULL) {
                json_object_set_new(js, "url", json_string(c));
                SCFree(c);
            }
        }
    
        /* user agent */
        htp_header_t *h_user_agent = NULL;
        if (tx->request_headers != NULL) {
            h_user_agent = htp_table_get_c(tx->request_headers, "user-agent");
        }
        if (h_user_agent != NULL) {
            c = bstr_util_strdup_to_c(h_user_agent->value);
            if (c != NULL) {
                json_object_set_new(js, "http_user_agent", json_string(c));
                SCFree(c);
            }
        }
    
        /* x-forwarded-for */
        htp_header_t *h_x_forwarded_for = NULL;
        if (tx->request_headers != NULL) {
            h_x_forwarded_for = htp_table_get_c(tx->request_headers, "x-forwarded-for");
        }
        if (h_x_forwarded_for != NULL) {
            c = bstr_util_strdup_to_c(h_x_forwarded_for->value);
            if (c != NULL) {
                json_object_set_new(js, "xff", json_string(c));
                SCFree(c);
            }
        }
    
        /* content-type */
        htp_header_t *h_content_type = NULL;
        if (tx->response_headers != NULL) {
            h_content_type = htp_table_get_c(tx->response_headers, "content-type");
        }
        if (h_content_type != NULL) {
            char *p;
            c = bstr_util_strdup_to_c(h_content_type->value);
            if (c != NULL) {
                p = strchr(c, ';');
                if (p != NULL)
                    *p = '\0';
                json_object_set_new(js, "http_content_type", json_string(c));
                SCFree(c);
            }
        }
    }

获取扩展信息

static void JsonHttpLogJSONExtended(json_t *js, htp_tx_t *tx)
    {
        char *c;
    
        /* referer */
        htp_header_t *h_referer = NULL;
        if (tx->request_headers != NULL) {
            h_referer = htp_table_get_c(tx->request_headers, "referer");
        }
        if (h_referer != NULL) {
            c = bstr_util_strdup_to_c(h_referer->value);
            if (c != NULL) {
                json_object_set_new(js, "http_refer", json_string(c));
                SCFree(c);
            }
        }
    
        /* method */
        if (tx->request_method != NULL) {
            c = bstr_util_strdup_to_c(tx->request_method);
            if (c != NULL) {
                json_object_set_new(js, "http_method", json_string(c));
                SCFree(c);
            }
        }
    
        /* protocol */
        if (tx->request_protocol != NULL) {
            c = bstr_util_strdup_to_c(tx->request_protocol);
            if (c != NULL) {
                json_object_set_new(js, "protocol", json_string(c));
                SCFree(c);
            }
        }
    
        /* response status */
        if (tx->response_status != NULL) {
            c = bstr_util_strdup_to_c(tx->response_status);
            if (c != NULL) {
                unsigned int val = strtoul(c, NULL, 10);
                json_object_set_new(js, "status", json_integer(val));
                SCFree(c);
            }
    
            htp_header_t *h_location = htp_table_get_c(tx->response_headers, "location");
            if (h_location != NULL) {
                c = bstr_util_strdup_to_c(h_location->value);
                if (c != NULL) {
                    json_object_set_new(js, "redirect", json_string(c));
                    SCFree(c);
                }
            }
        }
    
        /* length */
        json_object_set_new(js, "length", json_integer(tx->response_message_len));
    }