Project

General

Profile

Actions
Copy link

Task #3559

closed

Task #3553: Tracking: enable GAP recovery for all TCP app-layer protocols

http: support GAP recovery

Added by Victor Julien about 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
6.0.0rc1
Effort:
Difficulty:
Label:
Protocol

Description

In HTTP we can deal with GAPs in various ways

  1. if there is a content length set and we are in the body parsing, we can simply skip this part of the body. For file extraction the SMB parser can serve as an example
  2. it would be useful to be able to communicate the CL to the stream engine so we might know where the next record/tx starts.
  3. bruteforce search for the next record/tx as a fallback

Related issues 1 (0 open — 1 closed)

Blocks Suricata - Task #3824: libhtp 0.5.34ClosedPhilippe AntoineActions
Actions
Copy link
 #1

Updated by Victor Julien about 4 years ago

  • Description updated (diff)
  • Status changed from New to Assigned
  • Assignee set to Philippe Antoine
  • Target version set to 6.0.0beta1
  • Label Protocol added
Actions
Copy link
 #3

Updated by Philippe Antoine almost 4 years ago

Actions
Copy link
 #4

Updated by Victor Julien over 3 years ago

  • Target version changed from 6.0.0beta1 to 6.0.0rc1
Actions
Copy link
 #5

Updated by Victor Julien over 3 years ago

  • Status changed from In Review to Closed
Actions
Copy link

Also available in: Atom PDF