mirror of https://github.com/OISF/suricata
http1: keep monotonic progress for 100-continue
Ticket: 9096
In case of a 100-continue response, we used to
- parse the response line, set progress to headers
- parse headers, set progress back to line
This caused FPs as the engine expects the progress to just increase
so that it skips signatures that did not match yet, and whose
progress is less than the tx progress.
Solution is to keep progress at line when we see a 100 response,
until we get to the body, or after a next response line which
is not 100.
(cherry picked from commit 65d2df795f)
pull/16342/head
parent
ea090023ff
commit
b4c9c8db35
Loading…
Reference in New Issue