4241dae1ad
The raw HTTP header buffer had to be registered one state past the header state. The reason is that htp reports progress as soon as a block starts: request_progress reaches HEADERS right after the request line and TRAILER at the zero-length chunk, so a detection round at HEADERS can run while the block is still arriving. For a byte buffer that shows - negated content or a within: relative match would decide on a truncated block. HEADERS + 1 avoided it by accident of numbering, BODY being what htp reaches once the block is done. Make completion an event instead of inferring it from numbering. htp's REQUEST_HEADERS and RESPONSE_HEADERS hooks only ran in test builds, which is why production had nothing to key on; they now run always and are bound through the C API. Suricata marks per transaction that a block ended, from those hooks and from the trailer hooks that already ran, and the four HTTP/1 block buffers - http.header.raw, http.trailer, http.trailer.raw and http.trailer_names - report no data until then. Each registers at the state where its content completes, and no state offset remains in the tree. A block that ends because the stream closes needs no special case: htp's closure handling advances progress past the block state and runs the trailer hook, so the gate opens on its own and the partial content is inspected as it is today. Suricata-Verify tests/http1-raw-header- truncated covers both directions. htp progress values, and the transaction lifecycle built on them, are left alone: delaying those changes when firewall decisions become definitive and fails the ruletype-firewall state hook tests. Ticket: #8256. |
5 days ago | |
|---|---|---|
| .. | ||
| fuzz | ||
| src | 5 days ago | |
| Cargo.toml.in | 1 month ago | |
| LICENSE | ||
| Makefile.am | 1 year ago | |
| README.md | ||
| cbindgen.toml | 2 years ago | |
README.md
LibHTP
Copyright 2009-2010 Open Information Security Foundation
Copyright 2010-2013 Qualys, Inc.
LibHTP is a security-aware parser for the HTTP protocol and the related bits and pieces. The goal of the project is mainly to support the Suricata use case. Other use cases might not be fully supported, and we encourage you to cover these.
See the LICENSE file distributed with this work for information regarding licensing, copying and copyright ownership.
Usage
Start using libHTP by including it in your project's Cargo.toml
dependencies. The base library will also be required for using common
types.
The minimum supported version of rustc is 1.58.1.
Example
[dependencies]
htp = "2.0.0"
FFI Support
LibHTP has a foreign function interface for use in C/C++ projects.
FFI Support can be enabled by building with the cbindgen feature.
# Install cbindgen which is required to generate headers
cargo install --force cbindgen
# Build headers and shared objects
make
LICENSE
LibHTP is licensed under the BSD 3-Clause license (also known as "BSD New" and "BSD Simplified".) The complete text of the license is enclosed in the file LICENSE.