Project

General

Profile

Actions

Feature #1576

closed

http: byte-range support

Added by Victor Julien over 8 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:


Related issues 5 (1 open4 closed)

Related to Suricata - Task #2309: SuriCon 2017 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #2485: http: log byte range with file extractionClosedPhilippe AntoineActions
Related to Suricata - Feature #4117: http2: byte-range supportClosedPhilippe AntoineActions
Has duplicate Suricata - Bug #2326: File extraction not properly handling http range requestsClosedActions
Has duplicate Suricata - Feature #1017: Add support for content-rangeClosedActions
Actions #1

Updated by Andreas Herz about 8 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions #2

Updated by Victor Julien about 8 years ago

Related to #1017

Actions #3

Updated by Victor Julien over 6 years ago

  • Related to Task #2309: SuriCon 2017 brainstorm added
Actions #4

Updated by Victor Julien almost 6 years ago

  • Related to Feature #2485: http: log byte range with file extraction added
Actions #5

Updated by Raymond Hansen over 5 years ago

First step would be to document the chunks of file(s) as identified per sensor, if multiple sensors are in use.

Actions #6

Updated by Victor Julien about 5 years ago

  • Has duplicate Bug #2326: File extraction not properly handling http range requests added
Actions #7

Updated by Victor Julien almost 5 years ago

Actions #8

Updated by Philippe Antoine almost 5 years ago

  • Assignee changed from OISF Dev to Philippe Antoine
Actions #9

Updated by Philippe Antoine almost 5 years ago

My understanding is the following :
We now log the byte-range but we would like suricata to handle the complete file reassembly (in case there is any).
Is that correct ?
Is there already an example of suricata of reassembly over TCP ? And in this case over different flows ?

Actions #10

Updated by Andreas Herz over 4 years ago

  • Status changed from New to Assigned
Actions #11

Updated by Andreas Herz over 4 years ago

We will split those in multiple smaller tasks.

Actions #12

Updated by Philippe Antoine over 4 years ago

First is rebuilding the file if multiple requests/responses are in the same flow

Actions #13

Updated by Andreas Herz over 4 years ago

Does anyone remember WHAT smaller tasks we wanted to create :)?

Actions #14

Updated by Philippe Antoine over 4 years ago

First is rebuilding file if multiple transactions are in the same flow (maybe first subclass, if they are in the right order)
Then next task would be to see what to do if the transactions are across many flows

Actions #15

Updated by Victor Julien about 4 years ago

  • Target version changed from TBD to 6.0.0beta1
Actions #16

Updated by Philippe Antoine about 4 years ago

  • Status changed from Assigned to In Review
Actions #17

Updated by Philippe Antoine almost 4 years ago

  • Status changed from In Review to Assigned
  • Target version changed from 6.0.0beta1 to 7.0.0-beta1
Actions #18

Updated by Victor Julien over 3 years ago

  • Related to deleted (Feature #1017: Add support for content-range)
Actions #19

Updated by Victor Julien over 3 years ago

  • Has duplicate Feature #1017: Add support for content-range added
Actions #20

Updated by Philippe Antoine over 3 years ago

Actions #21

Updated by Philippe Antoine about 3 years ago

So, we would like :

- To handle ranges over multiple flows, ie use another container than the flow (the url for instance)
  • This container can be generic with a key, and a type for the key
    - To handle unordered ranges
  • That means storing an unordered range up until we can do the reassembly
  • We need to limit the memory consumption... use a global memcap for these containers ?
  • We also need timeouts (the new container shall timeout as flow time out)
Actions #22

Updated by Philippe Antoine about 3 years ago

  • Status changed from Assigned to In Progress
Actions #23

Updated by Philippe Antoine about 3 years ago

  • Status changed from In Progress to In Review
Actions #24

Updated by Philippe Antoine over 2 years ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF