[ulog2] Plugin ulogd_filter_HTTPSNIFF proposal

[ulog2] Plugin ulogd_filter_HTTPSNIFF proposal

[Jean Weisbuch]

I created a filter plugin for ulogd2 that does retrieve informations 
from HTTP request, it is similar to ulogd_filter_PWSNIFF (on which the 
code is based) which allows to monitor/log HTTP requests sent/recieved 
by the system.
Other solutions based on PCAP allows to log HTTP queries but not along 
with informations such as the UID that did sent the packet which can be 
useful to which users are executing virus/hacked scripts.

Output of "ulogd --info ulogd_filter_HTTPSNIFF.so" :
     Input keys:
         Key: raw.pkt (raw data)
     Output keys:
         Key: httpsniff.host (string)
         Key: httpsniff.uri (string)
         Key: httpsniff.method (unsigned int 8)


The code is available at : https://github.com/jb-boin/ulogd_filter_HTTPSNIFF

It requires both https://bugzilla.netfilter.org/show_bug.cgi?id=1192 and 
https://bugzilla.netfilter.org/show_bug.cgi?id=1193 to be fixed for it 
to work correctly.
I included proposed patchs for those two bugs.


I have been using it with a MariaDB output for about 3 months on more 
than 30 Debian Jessie hosts, ulogd2 compiled as packages using the 
Debian Stretch 2.0.5-5 source package and i didnt hit any issue so far.