Project

General

Profile

Actions
Copy link

Feature #143

closed
WM GI

Support should be added for the http_uri content modifier

Feature #143: Support should be added for the http_uri content modifier

Added by Will Metcalf almost 16 years ago. Updated almost 16 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Gerado Iglesias Galvan
Target version:
0.9.2
Effort:
Difficulty:
Label:

Description

Looks like in snort it just points to the same normalized buffer as uricontent.

[3499] 4/5/2010 -- 19:41:06 - (detect.c:295) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(36)] - Error parsing signature "alert tcp any any -> any any (msg:"content match for ALLWorkAndnoplay + http_uri"; content:"ALLWorkAndnoplay"; http_uri; nocase; classtype:bad-unknown; sid:88; rev:1;)" from file /home/coz/allworkplain.rules at line 143

VJ Updated by Victor Julien almost 16 years ago Actions
Copy link
 #1

Is the http_uri keyword just another name for the uricontent keyword?

WM Updated by Will Metcalf almost 16 years ago Actions
Copy link
 #2

Yes they point to the same normalized buffer, the format is content:"/someuri"; http_uri;

VJ Updated by Victor Julien almost 16 years ago Actions
Copy link
 #3

  • Target version changed from 1.0.0 to 0.9.1

VJ Updated by Victor Julien almost 16 years ago Actions
Copy link
 #4

  • Due date changed from 05/14/2010 to 05/16/2010
  • Status changed from New to Assigned
  • Assignee changed from Victor Julien to Gerado Iglesias Galvan
  • Estimated time changed from 2.50 h to 0.00 h

Addressed in a task.

VJ Updated by Victor Julien almost 16 years ago Actions
Copy link
 #5

  • Due date changed from 05/16/2010 to 05/28/2010
  • Target version changed from 0.9.1 to 0.9.2

VJ Updated by Victor Julien almost 16 years ago Actions
Copy link
 #6

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100

Patch is applied, thanks Gerardo.

Actions
Copy link

Also available in: PDF Atom