Using http.uri rules with spaces in the URI?

1

I’m curious about the correct way to match http requests which have a space in the URI.

For example:

alert http any any -> any any ( http.uri; content:"index.html?var=Flash Player";   )

Is that legal?

I would expect that to match on a HTTP Request such as

GET index.html?var=Flash Player HTTP/1.0
User-Agent: curl
Host: localhost

foo

But it doesn’t seem to.

However…

alert http any any -> any any ( http.uri; content:"index.html?var=Flash+Player";   )

matches on the following

GET index.html?var=Flash+Player HTTP/1.0
User-Agent: curl
Host: localhost

foo

How should I match a the space in the first example then?

Does Suricata stop filling the http.uri buffer when it first encounters a space?

For example on

GET index.html?var=Flash Player HTTP/1.0

the rule

alert http any any -> any any ( http.uri; content:"index.html?var=Flash";   )

Will alert, but…

alert http any any -> any any ( http.uri; content:"Player";   )

…Does not.

(PCAPs attached)

flash_plus_player.pcap (319 Bytes)
flash_space_player.pcap (319 Bytes)

2

This is a known issue, please see

1 Like
3

Wow! Thank you. I did conclude that it was putting everything after the first space in the uri into the http.method buffer.