Actions
Feature #1008
closedOptionally have http_uri buffer start with uri path for use in proxied environments
Effort:
Difficulty:
Label:
Description
We need a toggle in the libhtp config to have the http_uri buffer point to the beginning of the URI path for proxied environments. We often use pcre with anchors, urilen, depth/offset etc in a uri which breaks when host is contained with-in the URI. http_uri now points to start of path in snort.
See the "touched by a proxy" threads on the following for importance.
https://lists.emergingthreats.net/pipermail/emerging-sigs/2013-February/thread.html#21502
https://lists.emergingthreats.net/pipermail/emerging-sigs/2013-April/thread.html#21722
Actions