Bug #2881: http.protocol parsing inaccuracy - Suricata - Open Information Security Foundation

Custom queries

Good First Issues
OISF community

Actions

Copy link

Bug #2881

open

http.protocol parsing inaccuracy

Added by chris lujan about 4 years ago. Updated 13 days ago.

Status:

In Review

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

8.0.0-beta1

Affected Versions:

Effort:

Difficulty:

low

Label:

Description

Request:
GET /uid=0(root) gid=0(root) groups=0(root)asdf HTTP/1.1 User-Agent: curl/7.29.0 Accept: */*

eve.json output:
"http":{"protocol":"gid=0(root) groups=0(root)asdf HTTP\/1.1"}

It appears that the http.protocol is matching too greedily with the space character and could use something like /\S+$/m instead.

Related issues 3 (0 open — 3 closed)

Related to Task #3479: libhtp 0.5.33 (4.1.x)	Closed	Philippe Antoine	Actions
Related to Task #3922: libhtp 0.5.35	Closed	Philippe Antoine	Actions
Related to Task #4667: libhtp 0.5.39	Closed	Victor Julien	Actions

Issue # Delay: days Cancel

History
Notes
Property changes

Actions

Copy link

Updated by chris lujan about 4 years ago

Conversely, the http.url field is only matching up until the first space resulting in something like:

"http":{"url":"/uid=0(root)"}

which leads me to believe those fields are created by splitting the line by spaces.

Actions

Copy link

Updated by Victor Julien about 4 years ago

Status changed from New to Assigned
Assignee set to Philippe Antoine
Target version set to TBD

Actions

Copy link

Updated by Victor Julien about 4 years ago

I think uri's are not supposed to have spaces, but I think it would be good to address this anyway.

Actions

Copy link

Updated by Philippe Antoine about 4 years ago

Thanks Chris.
Indeed, Uris are not supposed to have spaces, but the protocol field is even less supposed to have spaces.
So I think we can take the last space in the request line as the uri end, instead of the second one.

Actions

Copy link