Feature #1008: Optionally have http_uri buffer start with uri path for use in proxied environments - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #1008

closed

Optionally have http_uri buffer start with uri path for use in proxied environments

Added by Will Metcalf about 11 years ago. Updated about 11 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

2.0beta2

Effort:

Difficulty:

Label:

Description

We need a toggle in the libhtp config to have the http_uri buffer point to the beginning of the URI path for proxied environments. We often use pcre with anchors, urilen, depth/offset etc in a uri which breaks when host is contained with-in the URI. http_uri now points to start of path in snort.

See the "touched by a proxy" threads on the following for importance.
https://lists.emergingthreats.net/pipermail/emerging-sigs/2013-February/thread.html#21502
https://lists.emergingthreats.net/pipermail/emerging-sigs/2013-April/thread.html#21722