Actions
Feature #5746
openhttp.connection - allow in server response
Description
Currently when using http.connection in combination with "to_client" produces the following error
Problem starting Suricata daemon: 7/12/2022 -- 19:57:49 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - rule 1 mixes keywords with conflicting directions
however, for whatever reason, the connection header is often observed in the HTTP Server Response.
This limitation forces the use of http.header to match on the Connection header instead of using the more specific buffer.
Files
Updated by Victor Julien about 2 months ago
Can you share a pcap / SV test for a connection with connection header in to client direction?
Updated by Brandon Murphy about 2 months ago
You betcha! Attached is a pcap of a wget to a benign site which exhibits this same behavior.
Actions