Actions
Feature #143
closedSupport should be added for the http_uri content modifier
Effort:
Difficulty:
Label:
Description
Looks like in snort it just points to the same normalized buffer as uricontent.
[3499] 4/5/2010 -- 19:41:06 - (detect.c:295) <Error> (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(36)] - Error parsing signature "alert tcp any any -> any any (msg:"content match for ALLWorkAndnoplay + http_uri"; content:"ALLWorkAndnoplay"; http_uri; nocase; classtype:bad-unknown; sid:88; rev:1;)" from file /home/coz/allworkplain.rules at line 143
Updated by Victor Julien over 14 years ago
Is the http_uri keyword just another name for the uricontent keyword?
Updated by Will Metcalf over 14 years ago
Yes they point to the same normalized buffer, the format is content:"/someuri"; http_uri;
Updated by Victor Julien over 14 years ago
- Target version changed from 1.0.0 to 0.9.1
Updated by Victor Julien over 14 years ago
- Due date changed from 05/14/2010 to 05/16/2010
- Status changed from New to Assigned
- Assignee changed from Victor Julien to Gerado Iglesias Galvan
- Estimated time changed from 2.50 h to 0.00 h
Addressed in a task.
Updated by Victor Julien over 14 years ago
- Due date changed from 05/16/2010 to 05/28/2010
- Target version changed from 0.9.1 to 0.9.2
Updated by Victor Julien over 14 years ago
- Status changed from Assigned to Closed
- % Done changed from 0 to 100
Patch is applied, thanks Gerardo.
Actions