Project

General

Profile

Bug #993

libhtp upgrade to handle responses first

Added by Anoop Saldanha over 5 years ago. Updated 12 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:

Description

libhtp would be having a feature upgrade/update where it would accept responses, as opposed to the current implementation where it can't handle response before request.

When such an upgrade comes through, we will have to configure our http parser to allow receiving http responses first.

History

#1 Updated by Anoop Saldanha over 5 years ago

Also we have currently inserted BUG_ON() inside our http parser that would be hit, if we end up seeing a response first. Currently this serves more as a debug to pick up any bugs in suricata's updated protocol detection.

Once the libhtp update comes in, this should go.

#2 Updated by Victor Julien over 5 years ago

Whats the purpose of the BUG_ON? Sounds like this is a trivial DOS to everyone running this code?

#3 Updated by Anoop Saldanha over 5 years ago

We should never go through this code sequence in the first place, i.e.
response gets sent first in case of http. If we do there's a very good
chance that we would segv in detection.

The main reason why I have it in dev branch is to catch any bugs or for
missed corner cases in the new protocol detection code. Makes it easier
to debug than catch a segv later in detection, as confirmed by the bug
reports form bug_989.

#4 Updated by Victor Julien about 5 years ago

Can you add a link to the upstream libhtp ticket?

#5 Updated by Anoop Saldanha about 5 years ago

I don't see a ticket for this in -

https://github.com/ironbee/libhtp/issues

Any idea if I should create a new ticket for this in libhtp issues?

#6 Updated by Victor Julien about 5 years ago

Anoop Saldanha wrote:

I don't see a ticket for this in -

https://github.com/ironbee/libhtp/issues

Any idea if I should create a new ticket for this in libhtp issues?

Might be good to discuss with Ivan.

#7 Updated by Victor Julien about 5 years ago

  • Target version changed from 2.0beta2 to 3.0RC2

#8 Updated by Victor Julien about 4 years ago

  • Target version changed from 3.0RC2 to Soon

#9 Updated by Victor Julien over 2 years ago

  • Assignee changed from Anoop Saldanha to OISF Dev

#10 Updated by Victor Julien 12 months ago

  • Status changed from New to Closed
  • Assignee changed from OISF Dev to Victor Julien
  • Target version changed from Soon to 4.1beta1

Merged into libhtp 0.5.x branch: https://github.com/OISF/libhtp/pull/163

Will go into 0.5.26

Also available in: Atom PDF