mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
a35a0021f8
The HEADERS block that closes a stream can be a trailer block, but HTTP/2 kept it in the same header list as the opening headers, so trailer content could be matched by the header keywords. HTTP/2 also had no trailer state, so header fields that are only reachable through a header state hook, and any rule hooked at the trailer state, matched nothing: no rule could see a trailer at all. The parser marks the frames instead of storing them elsewhere. HPACK keeps one dynamic table per connection, updated by every header block in either direction, so the fields have to reach that table; the size update matcher walks the frames themselves, and continues to see trailers, while every other HTTP/2 header keyword and getter now goes through the header-section-only accessor. Three trailer accessors mirror them over the marked frames. http.trailer.raw has no wire format to reproduce for HTTP/2, so it is built the way http.header.raw is. HTTP/2 EVE output follows the buffers: a trailer field is no longer logged as a request header, like HTTP/1. A dedicated log key for trailers is a follow-up for both protocols. Ticket: #8256. |
5 days ago | |
|---|---|---|
| .. | ||
| dataset-examples | ||
| dns-keywords | ||
| fast-pattern | ||
| flow-keywords | ||
| header-keywords | ||
| http-keywords | ||
| intro | ||
| normalized-buffers | ||
| payload-keywords | 9 months ago | |
| pcre | ||
| rule-types | ||
| app-layer.rst | 3 weeks ago | |
| base64-keywords.rst | ||
| bypass-keyword.rst | 5 months ago | |
| config.rst | 1 week ago | |
| datasets.rst | 5 months ago | |
| dcerpc-keywords.rst | 6 months ago | |
| decode-layer.rst | 1 year ago | |
| dhcp-keywords.rst | 6 months ago | |
| differences-from-snort.rst | 6 months ago | |
| dnp3-keywords.rst | 3 weeks ago | |
| dns-keywords.rst | 3 weeks ago | |
| email-keywords.rst | 1 year ago | |
| enip-keyword.rst | 3 weeks ago | |
| fast-pattern-explained.rst | ||
| file-keywords.rst | 6 months ago | |
| flow-keywords.rst | 2 months ago | |
| ftp-keywords.rst | 4 months ago | |
| header-keywords.rst | 7 months ago | |
| http-keywords.rst | 5 days ago | |
| http2-keywords.rst | 3 weeks ago | |
| ike-keywords.rst | 8 months ago | |
| index.rst | 5 months ago | |
| integer-keywords.rst | 3 weeks ago | |
| intro.rst | 3 weeks ago | |
| ip-reputation-rules.rst | 6 months ago | |
| ipaddr.rst | ||
| ja-keywords.rst | 6 months ago | |
| kerberos-keywords.rst | 3 weeks ago | |
| ldap-keywords.rst | 3 weeks ago | |
| llmnr-keywords.rst | 5 months ago | |
| lua-detection.rst | 1 year ago | |
| mdns-keywords.rst | 6 months ago | |
| meta.rst | 6 months ago | |
| modbus-keyword.rst | ||
| mqtt-keywords.rst | 3 weeks ago | |
| multi-buffer-matching.rst | 6 months ago | |
| nfs-keywords.rst | 3 weeks ago | |
| noalert.rst | 6 months ago | |
| ntp-keywords.rst | 3 weeks ago | |
| payload-keywords.rst | 2 months ago | |
| pgsql-keywords.rst | 6 months ago | |
| prefilter-keywords.rst | 6 months ago | |
| quic-keywords.rst | ||
| rfb-keywords.rst | 3 weeks ago | |
| rule-types.rst | 1 year ago | |
| rules-internals.rst | 1 year ago | |
| sctp-keywords.rst | 3 weeks ago | |
| sdp-keywords.rst | ||
| sip-keywords.rst | ||
| smb-keywords.rst | 6 months ago | |
| smtp-keywords.rst | 6 months ago | |
| snmp-keywords.rst | 3 weeks ago | |
| ssh-keywords.rst | 3 weeks ago | |
| tag.rst | ||
| thresholding.rst | 4 weeks ago | |
| tls-keywords.rst | 6 months ago | |
| transforms.rst | 4 weeks ago | |
| vlan-keywords.rst | ||
| websocket-keywords.rst | 3 weeks ago | |
| xbits.rst | 6 months ago | |