Project

General

Profile

Actions

Bug #308

closed

gzipped http content does not get unzipped and processed

Added by Sander Klein about 13 years ago. Updated almost 13 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Suricata does not unzip and process gzipped http content. I tried versions: 1.0.4, 1.0.5, 1.1bet2, 1.1 git clone on 20110801.

For testing I used this rule:

alert tcp any any -> any any (msg:"TEST SUCCESFULL - inspecting body";flow:stateless; content:"implementation"; nocase;)

I requested my own web page using:

curl http://www.roedie.nl <- Triggers the alert
curl --compressed http://www.roedie.nl <- Does not trigger the alert.

I've attached a pcap with the compressed request.


Files

www.roedie.nl-20110802.pcap (10.4 KB) www.roedie.nl-20110802.pcap Sander Klein, 08/02/2011 03:07 AM
Actions

Also available in: Atom PDF