Project

General

Profile

Actions

Feature #143

closed

Support should be added for the http_uri content modifier

Added by Will Metcalf about 14 years ago. Updated almost 14 years ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Looks like in snort it just points to the same normalized buffer as uricontent.

[3499] 4/5/2010 -- 19:41:06 - (detect.c:295) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(36)] - Error parsing signature "alert tcp any any -> any any (msg:"content match for ALLWorkAndnoplay + http_uri"; content:"ALLWorkAndnoplay"; http_uri; nocase; classtype:bad-unknown; sid:88; rev:1;)" from file /home/coz/allworkplain.rules at line 143

Actions #1

Updated by Victor Julien about 14 years ago

Is the http_uri keyword just another name for the uricontent keyword?

Actions #2

Updated by Will Metcalf about 14 years ago

Yes they point to the same normalized buffer, the format is content:"/someuri"; http_uri;

Actions #3

Updated by Victor Julien about 14 years ago

  • Target version changed from 1.0.0 to 0.9.1
Actions #4

Updated by Victor Julien about 14 years ago

  • Due date changed from 05/14/2010 to 05/16/2010
  • Status changed from New to Assigned
  • Assignee changed from Victor Julien to Gerado Iglesias Galvan
  • Estimated time changed from 2.50 h to 0.00 h

Addressed in a task.

Actions #5

Updated by Victor Julien almost 14 years ago

  • Due date changed from 05/16/2010 to 05/28/2010
  • Target version changed from 0.9.1 to 0.9.2
Actions #6

Updated by Victor Julien almost 14 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

Patch is applied, thanks Gerardo.

Actions

Also available in: Atom PDF