Jason Taylor wrote:
I was working on ticket #3025 and reviewing the http.request_header and http.response_header keywords and found they did not work as I expected from reading the existing documentation with regard to HTTP1 traffic.
Using a signature with either keyword http.request_header or http.response_header and using any header and value other than the last header in the header request or response header list did not trigger an alert on HTTP1 traffic.
Signature examples for the attached pcap that do not fire:
alert http any any -> any any (msg:"request_header"; flow:established,to_server; http.request_header; content:"Connection|3a 20|"; classtype:bad-unknown; sid:1; rev:1;)
alert http any any -> any any (msg:"response_header"; flow:established,to_client; http.response_header; content:"Connection|3a 20|"; classtype:bad-unknown; sid:2; rev:1;)
Signature examples for the attached pcap that fire alerts:
alert http any any -> any any (msg:"request_header"; flow:established,to_server; http.request_header; content:"User-Agent|3a 20|"; classtype:bad-unknown; sid:1; rev:1;)
alert http any any -> any any (msg:"response_header"; flow:established,to_client; http.response_header; content:"Date|3a 20|"; classtype:bad-unknown; sid:2; rev:1;)