Bug #640
closed
Feature #775: libhtp 0.5 support
app-layer-event:http.host_header_ambiguous set when it shouldn't
Added by Victor Julien over 11 years ago.
Updated over 10 years ago.
Description
When URI and Host header both contain hostname:port, libhtp thinks they don't match while they actually do.
POST http://xxx.intranet.local:8000/xxx HTTP/1.1
User-Agent: Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_29
Host: xxx.intranet.local:8000
Issue reported to libhtp upstream https://github.com/ironbee/libhtp/issues/33
- Target version changed from 1.4 to 2.0rc2
- Status changed from New to Assigned
- Assignee changed from Victor Julien to Anoop Saldanha
- Target version changed from 2.0rc2 to 2.0beta1
Part of libhtp 0.5.x upgrade.
Anoop, can you add a unit test case for this?
- Target version changed from 2.0beta1 to 2.0beta2
https://github.com/inliniac/suricata/pull/511 introduces this unittest.
it will always pass now since we don't use the flags variable to detect events. I have confirmed the validity of this unittest through manually setting the event from reading the flags var.
We will use the flags event, once Ivan moves to setting events for every error log message. At the same time we can introduce per tx events.
- Assignee changed from Anoop Saldanha to Victor Julien
- Status changed from Assigned to Closed
- % Done changed from 0 to 100
Added 2 more tests. Issue is fixed. Thanks Anoop.
Also available in: Atom
PDF