From 7d1f6d98bcdf3387f3c7f1295259ad58ffbffcfa Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 17 Dec 2020 14:19:25 +0100 Subject: [PATCH] http2: http.uri.raw keyword now works for HTTP2 (cherry picked from commit 5d676c5998aeb33c529e8ee8efcaa2fdf10324ef) --- src/detect-http-uri.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c index d2bccf2bdf..ec26c10905 100644 --- a/src/detect-http-uri.c +++ b/src/detect-http-uri.c @@ -157,6 +157,13 @@ void DetectHttpUriRegister (void) PrefilterGenericMpmRegister, GetRawData, ALPROTO_HTTP, HTP_REQUEST_LINE); + // no difference between raw and decoded uri for HTTP2 + DetectAppLayerInspectEngineRegister2("http_raw_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, + HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); + + DetectAppLayerMpmRegister2("http_raw_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, + GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); + DetectBufferTypeSetDescriptionByName("http_raw_uri", "raw http uri"); -- 2.47.2