htp_tx_t Struct Reference

#include <htp.h>

Data Fields

htp_connp_tconnp
htp_conn_tconn
htp_cfg_tcfg
int is_config_shared
void * user_data
unsigned int request_ignored_lines
bstrrequest_line
bstrrequest_method
enum htp_method_t request_method_number
bstrrequest_uri
bstrrequest_protocol
int request_protocol_number
int is_protocol_0_9
htp_uri_tparsed_uri
htp_uri_tparsed_uri_raw
int64_t request_message_len
int64_t request_entity_len
htp_table_trequest_headers
enum htp_transfer_coding_t request_transfer_coding
enum htp_content_encoding_t request_content_encoding
bstrrequest_content_type
int64_t request_content_length
htp_hook_thook_request_body_data
htp_hook_thook_response_body_data
htp_urlenp_trequest_urlenp_query
htp_urlenp_trequest_urlenp_body
htp_mpartp_trequest_mpartp
htp_table_trequest_params
htp_table_trequest_cookies
enum htp_auth_type_t request_auth_type
bstrrequest_auth_username
bstrrequest_auth_password
bstrrequest_hostname
int request_port_number
unsigned int response_ignored_lines
bstrresponse_line
bstrresponse_protocol
int response_protocol_number
bstrresponse_status
int response_status_number
int response_status_expected_number
bstrresponse_message
int seen_100continue
htp_table_tresponse_headers
int64_t response_message_len
int64_t response_entity_len
int64_t response_content_length
enum htp_transfer_coding_t response_transfer_coding
enum htp_content_encoding_t response_content_encoding
enum htp_content_encoding_t response_content_encoding_processing
bstrresponse_content_type
uint64_t flags
enum htp_tx_req_progress_t request_progress
enum htp_tx_res_progress_t response_progress
size_t index

Detailed Description

Represents a single HTTP transaction, which is a combination of a request and a response.


Field Documentation

The configuration structure associated with this transaction.

The connection to which this transaction belongs.

The connection parser associated with this transaction.

uint64_t htp_tx_t::flags

Parsing flags; a combination of: HTP_REQUEST_INVALID_T_E, HTP_INVALID_FOLDING, HTP_REQUEST_SMUGGLING, HTP_MULTI_PACKET_HEAD, and HTP_FIELD_UNPARSEABLE.

Transaction-specific REQUEST_BODY_DATA hook. Behaves as the configuration hook with the same name.

Transaction-specific RESPONSE_BODY_DATA hook. Behaves as the configuration hook with the same name.

Transaction index on the connection.

Is the configuration structure shared with other transactions or connections? If this field is set to HTP_CONFIG_PRIVATE, the transaction owns the configuration.

Is this request using HTTP/0.9? We need a separate field for this purpose because the protocol version alone is not sufficient to determine if HTTP/0.9 is used. For example, if you submit "GET / HTTP/0.9" to Apache, it will not treat the request as HTTP/0.9.

This structure holds the individual components parsed out of the request URI, with appropriate normalization and transformation applied, per configuration. No information is added. In extreme cases when no URI is provided on the request line, all fields will be NULL. (Well, except for port_number, which will be -1.) To inspect raw data, use htp_tx_t::request_uri or htp_tx_t::parsed_uri_raw.

This structure holds the individual components parsed out of the request URI, but without any modification. The purpose of this field is to allow you to look at the data as it was supplied on the request line. Fields can be NULL, depending on what data was supplied. The port_number field is always -1.

Authentication password. Available only when htp_tx_t::request_auth_type is HTP_AUTH_BASIC.

Authentication type used in the request.

Authentication username.

Request body compression.

Contains the value specified in the Content-Length header. The value of this field will be -1 from the beginning of the transaction and until request headers are processed. It will stay -1 if the C-L header was not provided, or if the value in it cannot be parsed.

This field contain the request content type when that information is available in request headers. The contents of the field will be converted to lowercase and any parameters (e.g., character set information) removed.

Request cookies

The length of the request entity-body. In most cases, this value will be the same as request_message_len. The values will be different if request compression or chunking were applied. In that case, request_message_len contains the length of the request body as it has been seen over TCP; request_entity_len contains length after de-chunking and decompression.

Parsed request headers.

Request hostname. Per the RFC, the hostname will be taken from the Host header when available. If the host information is also available in the URI, it is used instead of whatever might be in the Host header. Can be NULL. This field does not contain port information.

Contains a count of how many empty lines were skipped before the request line.

The first line of this request.

The length of the request message-body. In most cases, this value will be the same as request_entity_len. The values will be different if request compression or chunking were applied. In that case, request_message_len contains the length of the request body as it has been seen over TCP; request_entity_len contains length after de-chunking and decompression.

Request method.

Request method, as number. Available only if we were able to recognize the request method.

Request body MULTIPART parser. Available only when the body is in the multipart/form-data format and the parser was configured to run.

Request parameters.

Request port number, if presented. The rules for htp_tx_t::request_host apply. Set to -1 by default.

Request progress.

Request protocol, as text. Can be NULL if no protocol was specified.

Protocol version as a number. Multiply the high version number by 100, then add the low version number. You should prefer to work the pre-defined HTP_PROTOCOL_* constants.

Request transfer coding. Can be one of HTP_CODING_UNKNOWN (body presence not determined yet), HTP_CODING_IDENTITY, HTP_CODING_CHUNKED, HTP_CODING_NO_BODY, and HTP_CODING_UNRECOGNIZED.

Request URI, raw, as given to us on the request line. This field can take different forms, for example authority for CONNECT methods, absolute URIs for proxy requests, and the query string when one is provided. Use htp_tx_t::parsed_uri if you need to access to specific URI elements. Can be NULL if the request line contains only a request method (which is an extreme case of HTTP/0.9, but passes in practice.

Request body URLENCODED parser. Available only when the request body is in the application/x-www-form-urlencoded format and the parser was configured to run.

Query string URLENCODED parser. Available only when the query string is not NULL and not empty.

Response body compression, which indicates if compression is used for the response body. This field is an interpretation of the information available in response headers.

Response body compression processing information, which is related to how the library is going to process (or has processed) a response body. Changing this field mid-processing can influence library actions. For example, setting this field to HTP_COMPRESSION_NONE in a RESPONSE_HEADERS callback will prevent decompression.

Contains the value specified in the Content-Length header. The value of this field will be -1 from the beginning of the transaction and until response headers are processed. It will stay -1 if the C-L header was not provided, or if the value in it cannot be parsed.

This field will contain the response content type when that information is available in response headers. The contents of the field will be converted to lowercase and any parameters (e.g., character set information) removed.

The length of the response entity-body. In most cases, this value will be the same as response_message_len. The values will be different if request compression or chunking were applied. In that case, response_message_len contains the length of the response body as it has been seen over TCP; response_entity_len contains length after de-chunking and decompression.

Parsed response headers. Contains instances of htp_header_t.

How many empty lines did we ignore before reaching the status line?

Response line.

The message associated with the response status code. Can be NULL.

The length of the response message-body. In most cases, this value will be the same as response_entity_len. The values will be different if response compression or chunking were applied. In that case, response_message_len contains the length of the response body as it has been seen over TCP; response_entity_len contains the length after de-chunking and decompression.

Response progress.

Response protocol, as text. Can be NULL.

Response protocol as number. Available only if we were able to parse the protocol version, HTP_PROTOCOL_INVALID otherwise. HTP_PROTOCOL_UNKNOWN until parsing is attempted.

Response status code, as text. Starts as NULL and can remain NULL on an invalid response that does not specify status code.

This field is set by the protocol decoder with it thinks that the backend server will reject a request with a particular status code.

Response status code, available only if we were able to parse it, HTP_STATUS_INVALID otherwise. HTP_STATUS_UNKNOWN until parsing is attempted.

Response transfer coding, which indicates if there is a response body, and how it is transported (e.g., as-is, or chunked).

Have we seen the server respond with a 100 response?

The user data associated with this transaction.


The documentation for this struct was generated from the following file:

Generated on 1 Jan 2017 for HTP by  doxygen 1.6.1