Project

General

Profile

Actions
Copy link

Feature #6216

open
VJ PA

http: HHHash support

Feature #6216: http: HHHash support

Added by Victor Julien about 3 years ago. Updated 13 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

This could be interesting to support.

https://github.com/adulau/HHHash

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #1

  • Target version changed from TBD to 9.0.0-beta1

Investigate as a plugin

PA Updated by Philippe Antoine 9 months ago Actions
Copy link
 #2

  • Status changed from New to Assigned

PA Updated by Philippe Antoine 14 days ago ยท Edited Actions
Copy link
 #3

We can easily enough do a plugin that registers a new logger for http1 (and also a new one for http2)

But this new logger will emit a new http event in addition to the current one emitted by the suricata http1 logger
And it will not add details to alert events

SCEveRunCallbacks is for all events

I think the best way forward may be to
- enhance EveJsonSimpleAppLayerLogger with other callbacks than LogTx and use them
- convert http1 protocol to EveJsonSimpleAppLayerLogger
- so maybe first solve https://redmine.openinfosecfoundation.org/issues/7696

JI Updated by Jason Ish 14 days ago Actions
Copy link
 #4

Why as a plugin and not just built-in?

PA Updated by Philippe Antoine 13 days ago Actions
Copy link
 #5

  • Status changed from Assigned to Feedback

Jason Ish wrote in #note-4:

Why as a plugin and not just built-in?

I think https://redmine.openinfosecfoundation.org/issues/6216#note-1 comes from a discussion with Victor

putting in feedback state to make this clear with him

Actions
Copy link

Also available in: PDF Atom