Bug #78
closed
uricontent matching regression
Added by Will Metcalf almost 15 years ago.
Updated almost 15 years ago.
Description
The following signature fails to fire when it should processing the attached pcap.
alert tcp any any -> any any (msg:"msg escape tests"; uricontent:"blah"; sid: 100;)
GET /blah/ HTTP/1.0
User-Agent: Wget/1.11.4
Accept: */*
Host: www.google.com
Connection: Keep-Alive
Files
- Status changed from New to Assigned
- Assignee changed from OISF Dev to Gurvinder Singh
- Priority changed from Normal to High
The issue was in the direction of stream message setting, which was causing the ALPROTO_UNKNOWN in the app-layer protocol detection. The given patch fix the issue.
- Status changed from Resolved to Closed
- Related to Task #3055: Add tests for: #78 uricontent matching regression added
Also available in: Atom
PDF