suricata

Commit Graph

Author	SHA1	Message	Date
Victor Julien	a8b971c710	http: strip 'proxy' part of http_uri Strip the 'proxy' parts from the normalized uri as inspected by http_uri, urilen, pcre /U and others. In a request line like: GET http://suricata-ids.org/blah/ HTTP/1.1 the normalized URI will now be: /blah/ This doesn't affect http_raw_uri. So matching the hostname, etc is still possible through this keyword. Additionally, a new per HTTP 'personality' option was added to change this behavior: "uri-include-all": uri-include-all: <true\|false> Include all parts of the URI. By default the 'scheme', username/password, hostname and port are excluded. Setting this option to true adds all of them to the normalized uri as inspected by http_uri, urilen, pcre with /U and the other keywords that inspect the normalized uri. Note that this does not affect http_raw_uri. So adding uri-include-all:true to all personalities in the yaml will restore the old default behavior. Ticket 1008.	11 years ago
Anoop Saldanha	48cf0585fb	Suricata upgrade to libhtp 0.5.x. Remove the support for now unsupported personalities from libhtp - TOMCAT_6_0, APACHE and APACHE_2_2. We instead use the APACHE_2 personality.	12 years ago

Author

SHA1

Message

Date

Victor Julien

a8b971c710

http: strip 'proxy' part of http_uri

Strip the 'proxy' parts from the normalized uri as inspected by http_uri,
urilen, pcre /U and others.

  In a request line like:
    GET http://suricata-ids.org/blah/ HTTP/1.1
  the normalized URI will now be:
    /blah/

This doesn't affect http_raw_uri. So matching the hostname, etc is still
possible through this keyword.

Additionally, a new per HTTP 'personality' option was added to change
this behavior: "uri-include-all":

  uri-include-all: <true|false>
    Include all parts of the URI. By default the
    'scheme', username/password, hostname and port
    are excluded. Setting this option to true adds
    all of them to the normalized uri as inspected
    by http_uri, urilen, pcre with /U and the other
    keywords that inspect the normalized uri.
    Note that this does not affect http_raw_uri.

So adding uri-include-all:true to all personalities in the yaml will
restore the old default behavior.

Ticket 1008.

Anoop Saldanha

48cf0585fb

Suricata upgrade to libhtp 0.5.x.

Remove the support for now unsupported personalities from libhtp -
TOMCAT_6_0, APACHE and APACHE_2_2.  We instead use the APACHE_2
personality.

2 Commits (ec2be2643b0e1e1f92245a56cf8e53cd19d7c6a2)