Project

General

Profile

Actions
Copy link

Bug #2881

open

http.protocol parsing inaccuracy

Added by chris lujan about 4 years ago. Updated about 2 months ago.

Status:
In Review
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0beta1
Affected Versions:
Effort:
Difficulty:
low
Label:

Description

Request:

GET /uid=0(root) gid=0(root) groups=0(root)asdf HTTP/1.1
User-Agent: curl/7.29.0
Accept: */*

eve.json output:
"http":{"protocol":"gid=0(root) groups=0(root)asdf HTTP\/1.1"}

It appears that the http.protocol is matching too greedily with the space character and could use something like /\S+$/m instead.

Related issues 3 (0 open — 3 closed)

Related to Task #3479: libhtp 0.5.33 (4.1.x)ClosedPhilippe AntoineActions
Related to Task #3922: libhtp 0.5.35ClosedPhilippe AntoineActions
Related to Task #4667: libhtp 0.5.39ClosedVictor JulienActions
Actions
Copy link
 #1

Updated by chris lujan about 4 years ago

Conversely, the http.url field is only matching up until the first space resulting in something like:

"http":{"url":"/uid=0(root)"}

which leads me to believe those fields are created by splitting the line by spaces.

Actions
Copy link
 #2

Updated by Victor Julien about 4 years ago

  • Status changed from New to Assigned
  • Assignee set to Philippe Antoine
  • Target version set to TBD
Actions
Copy link
 #3

Updated by Victor Julien about 4 years ago

I think uri's are not supposed to have spaces, but I think it would be good to address this anyway.

Actions
Copy link
 #4

Updated by Philippe Antoine almost 4 years ago

Thanks Chris.
Indeed, Uris are not supposed to have spaces, but the protocol field is even less supposed to have spaces.
So I think we can take the last space in the request line as the uri end, instead of the second one.

Actions
Copy link
 #5

Updated by Philippe Antoine about 3 years ago

  • Related to Task #3479: libhtp 0.5.33 (4.1.x) added
Actions
Copy link
 #6

Updated by Philippe Antoine about 3 years ago

  • Status changed from Assigned to In Review
Actions
Copy link
 #7

Updated by Philippe Antoine almost 3 years ago

  • Target version changed from TBD to 6.0.0beta1
Actions
Copy link
 #8

Updated by Philippe Antoine over 2 years ago

Actions
Copy link
 #9

Updated by Victor Julien over 2 years ago

  • Target version changed from 6.0.0beta1 to 6.0.0rc1
Actions
Copy link
 #10

Updated by Victor Julien over 2 years ago

  • Target version changed from 6.0.0rc1 to 7.0.0-beta1
Actions
Copy link
 #11

Updated by Victor Julien over 2 years ago

Actions
Copy link
 #12

Updated by Philippe Antoine over 2 years ago

Actions
Copy link
 #13

Updated by Philippe Antoine over 2 years ago

  • Target version changed from 7.0.0-beta1 to 6.0.1
Actions
Copy link
 #14

Updated by Philippe Antoine over 2 years ago

Actions
Copy link
 #15

Updated by Victor Julien over 2 years ago

  • Target version changed from 6.0.1 to 7.0.0-beta1
Actions
Copy link
 #16

Updated by Philippe Antoine over 2 years ago

Actions
Copy link
 #17

Updated by Philippe Antoine over 2 years ago

https://github.com/OISF/suricata/pull/5599 for 6.0.1

For 7 :
changing the handling in 7 would be good, but I'm not sure it should be optional.

Actions
Copy link
 #18

Updated by Philippe Antoine over 2 years ago

https://github.com/OISF/suricata/pull/5614 merged for 6.0.1

Still work to do for 7

Actions
Copy link
 #19

Updated by Philippe Antoine over 1 year ago

Actions
Copy link
 #21

Updated by Philippe Antoine 6 months ago

  • Priority changed from Normal to High
Actions
Copy link
 #22

Updated by Victor Julien 5 months ago

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Actions
Copy link
 #23

Updated by Philippe Antoine 4 months ago

  • Status changed from In Review to Closed
Actions
Copy link
 #24

Updated by Victor Julien about 2 months ago

  • Status changed from Closed to In Review
  • Priority changed from High to Normal
  • Target version changed from 7.0.0-rc1 to 8.0beta1

Was accidentally closed. Postponing once more to give rule writers more time to update things on their end.

Actions
Copy link

Also available in: Atom PDF