Actions
Feature #733
closedhttp_host keyword
Effort:
Difficulty:
Label:
Description
Introduce the http_host keyword which would match on the normalized http host header.
Updated by Anoop Saldanha almost 12 years ago
Updated by Anoop Saldanha almost 12 years ago
- The keyword inspects the normalized hostname. The hostname being normalized is lowercase, hence we invalidate all sigs that don't use "nocase" along with the http_host modified content.
Updated by Victor Julien almost 12 years ago
Does this keyword addition affect anything in the existing functionality? If it doesn't I think it can go into 1.4.x, else 1.5
Updated by Anoop Saldanha almost 12 years ago
It doesn't affect the working. http_header would still inspect the host header section.
Updated by Victor Julien over 11 years ago
- Status changed from New to Closed
- Target version changed from TBD to 1.4.1
- % Done changed from 0 to 100
Merged https://github.com/inliniac/suricata/pull/280, thanks Anoop!
Actions