Project

General

Profile

Feature #735

Introduce content_len keyword

Added by Anoop Saldanha about 7 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Add support for the content_len keyword.

Can be used as -

conten_len:<op>,<no>;

where,
op - >, <, >=, <=, = ,!=,
no - unsigned integer

The content_len can be modified by the http_* modifiers.

For example,

content:"index"; http_uri; content_len:=,8; http_uri;

If no modifier is used, it would match on the packet payload length(which is the same as dsize)

Suggestions, comments?


Related issues

Related to Support #2309: SuriCon 2017 brainstormNew12/01/2017Victor JulienActions
#1

Updated by Victor Julien about 7 years ago

I think the syntax should probably be more like urilen, filesize and dsize:

dsize:1; is exact match
urilen:5<>10; is a range

Like the concept. Think it makes sense to have a generic match for this.

#2

Updated by Anoop Saldanha about 7 years ago

Have almost completed this work, but I've used the operators like the way I've specified. Felt it was neater if one wants to specify equal_to or not_equal_to.

Will change it to the dsize format if needed.

#3

Updated by Victor Julien over 6 years ago

  • Status changed from New to Assigned
  • Target version changed from TBD to 2.0rc2
#4

Updated by Victor Julien about 6 years ago

  • Target version changed from 2.0rc2 to 3.0RC2
#5

Updated by Victor Julien almost 5 years ago

  • Target version changed from 3.0RC2 to TBD
#6

Updated by Andreas Herz over 3 years ago

  • Assignee changed from Anoop Saldanha to OISF Dev
#7

Updated by Victor Julien about 2 years ago

#8

Updated by Victor Julien about 2 years ago

  • Assignee changed from OISF Dev to Victor Julien
  • Target version changed from TBD to Soon
#9

Updated by Victor Julien almost 2 years ago

  • Status changed from Assigned to Closed
  • Target version changed from Soon to 4.1beta1

https://github.com/OISF/suricata/pull/3232 implements this under a different name: 'bsize'.

Also available in: Atom PDF