Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The post request cannot be ended when use filesotre in suricata #377

Closed
InterNALXz opened this issue Feb 8, 2023 · 7 comments
Closed

The post request cannot be ended when use filesotre in suricata #377

InterNALXz opened this issue Feb 8, 2023 · 7 comments

Comments

@InterNALXz
Copy link

When i use filestore in suricata, http protocol's Get req file is saved,ftp download or upload is right. But http post cannot save file because of is not end. when i kill a sigint ,it saved. I notice the func: htp_table_get_c(rh, "content-length") return NULL and the list current size is 0. It is a BUG?

@InterNALXz
Copy link
Author

My team built a http server with flask, and found twice 100 continue req, then got wrong by function htp_connp_RES_BODY_DETERMINE's have seen 100-Continue. So post cannot get end, and Suricata couldn't store file. The twice 100-continue is a right status?

@catenacyber
Copy link
Contributor

Thanks for this report.

Would you be able to share a pcap ?
And if possible describe the expected output as a suricata-verify test ? cf https://github.com/OISF/suricata-verify/

@InterNALXz
Copy link
Author

http_crul_by.zip

@catenacyber
Copy link
Contributor

Thanks for the pcap

Does #380 fix your problem ?

@InterNALXz
Copy link
Author

There is also the issue of not supporting UTF-8, which is replaced with a question mark when using Chinese, whether a macro should be added to the htp_utf8_decode_path_inplace in the htp_util.c file

@InterNALXz
Copy link
Author

Thanks for the pcap

Does #380 fix your problem ?

is fixed

@catenacyber
Copy link
Contributor

There is also the issue of not supporting UTF-8, which is replaced with a question mark when using Chinese, whether a macro should be added to the htp_utf8_decode_path_inplace in the htp_util.c file

Ok, if this is solved, could you open another issue describing the issue about UTF-8 ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants