mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
75f3feab6c
A trailer HEADERS frame lands in the same header store as the request, so a rule on http.host could see the authority of a trailer: a request to a denied host that named an allowed one while closing itself was accepted, flow included. RFC 9113 8.1 forbids pseudo-header fields in trailers and RFC 9110 6.5.1 keeps routing fields such as Host out of them, so the value is now taken from the frames before the first DATA frame, or before the HEADERS frame that follows a completed block. The h2c upgrade path sends one HEADERS frame per field with no END_HEADERS, so those frames are all header section and keep counting: cutting at the second HEADERS frame rather than at a completed block breaks that stream, and http2-keywords2 says so. Ticket: #9149. |
1 week ago | |
|---|---|---|
| .. | ||
| dataset-examples | ||
| dns-keywords | ||
| fast-pattern | ||
| flow-keywords | ||
| header-keywords | ||
| http-keywords | ||
| intro | ||
| normalized-buffers | ||
| payload-keywords | 9 months ago | |
| pcre | ||
| rule-types | 2 years ago | |
| app-layer.rst | 4 weeks ago | |
| base64-keywords.rst | 2 years ago | |
| bypass-keyword.rst | 5 months ago | |
| config.rst | 1 week ago | |
| datasets.rst | 5 months ago | |
| dcerpc-keywords.rst | 6 months ago | |
| decode-layer.rst | 1 year ago | |
| dhcp-keywords.rst | 6 months ago | |
| differences-from-snort.rst | 6 months ago | |
| dnp3-keywords.rst | 3 weeks ago | |
| dns-keywords.rst | 3 weeks ago | |
| email-keywords.rst | 1 year ago | |
| enip-keyword.rst | 3 weeks ago | |
| fast-pattern-explained.rst | ||
| file-keywords.rst | 6 months ago | |
| flow-keywords.rst | 2 months ago | |
| ftp-keywords.rst | 4 months ago | |
| header-keywords.rst | 7 months ago | |
| http-keywords.rst | 1 week ago | |
| http2-keywords.rst | 3 weeks ago | |
| ike-keywords.rst | 8 months ago | |
| index.rst | 5 months ago | |
| integer-keywords.rst | 3 weeks ago | |
| intro.rst | 4 weeks ago | |
| ip-reputation-rules.rst | 6 months ago | |
| ipaddr.rst | ||
| ja-keywords.rst | 6 months ago | |
| kerberos-keywords.rst | 3 weeks ago | |
| ldap-keywords.rst | 3 weeks ago | |
| llmnr-keywords.rst | 5 months ago | |
| lua-detection.rst | 1 year ago | |
| mdns-keywords.rst | 6 months ago | |
| meta.rst | 6 months ago | |
| modbus-keyword.rst | ||
| mqtt-keywords.rst | 3 weeks ago | |
| multi-buffer-matching.rst | 6 months ago | |
| nfs-keywords.rst | 3 weeks ago | |
| noalert.rst | 6 months ago | |
| ntp-keywords.rst | 3 weeks ago | |
| payload-keywords.rst | 2 months ago | |
| pgsql-keywords.rst | 6 months ago | |
| prefilter-keywords.rst | 6 months ago | |
| quic-keywords.rst | ||
| rfb-keywords.rst | 3 weeks ago | |
| rule-types.rst | 1 year ago | |
| rules-internals.rst | 1 year ago | |
| sctp-keywords.rst | 3 weeks ago | |
| sdp-keywords.rst | 2 years ago | |
| sip-keywords.rst | ||
| smb-keywords.rst | 6 months ago | |
| smtp-keywords.rst | 6 months ago | |
| snmp-keywords.rst | 3 weeks ago | |
| ssh-keywords.rst | 4 weeks ago | |
| tag.rst | ||
| thresholding.rst | 4 weeks ago | |
| tls-keywords.rst | 6 months ago | |
| transforms.rst | 4 weeks ago | |
| vlan-keywords.rst | 2 years ago | |
| websocket-keywords.rst | 3 weeks ago | |
| xbits.rst | 6 months ago | |