http: byte-range support
Not currently supported by libhtp: https://github.com/OISF/libhtp/issues/58
Updated by Philippe Antoine over 3 years ago
My understanding is the following :
We now log the byte-range but we would like suricata to handle the complete file reassembly (in case there is any).
Is that correct ?
Is there already an example of suricata of reassembly over TCP ? And in this case over different flows ?
Updated by Philippe Antoine over 2 years ago
- Status changed from In Review to Assigned
- Target version changed from 6.0.0beta1 to 7.0.0-beta1
PR needs deeper work to have something generic over multiple flows cf https://forum.suricata.io/t/suricata-5-0-1-in-ips-mode/94
Updated by Philippe Antoine almost 2 years ago
So, we would like :- To handle ranges over multiple flows, ie use another container than the flow (the url for instance)
- This container can be generic with a key, and a type for the key
- To handle unordered ranges
- That means storing an unordered range up until we can do the reassembly
- We need to limit the memory consumption... use a global memcap for these containers ?
- We also need timeouts (the new container shall timeout as flow time out)