From d2121945c93ea7db0454a2865c8696b940df477a Mon Sep 17 00:00:00 2001 From: Giuseppe Longo Date: Thu, 25 Jan 2018 08:58:01 +0100 Subject: [PATCH] doc: update file_data description --- doc/userguide/rules/http-keywords.rst | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/doc/userguide/rules/http-keywords.rst b/doc/userguide/rules/http-keywords.rst index f8c80f65a7..56ba020095 100644 --- a/doc/userguide/rules/http-keywords.rst +++ b/doc/userguide/rules/http-keywords.rst @@ -680,6 +680,26 @@ in your :ref:`libhtp configuration section ` via the ``response-body-limit`` setting. +If the HTTP body is a flash file compressed with 'deflate' or 'lzma', +it can be decompressed and ``file_data`` can match on the decompress data. +Flash decompression must be enabled under ``libhtp`` configuration: + +:: + + # Decompress SWF files. + # 2 types: 'deflate', 'lzma', 'both' will decompress deflate and lzma + # compress-depth: + # Specifies the maximum amount of data to decompress, + # set 0 for unlimited. + # decompress-depth: + # Specifies the maximum amount of decompressed data to obtain, + # set 0 for unlimited. + swf-decompression: + enabled: yes + type: both + compress-depth: 0 + decompress-depth: 0 + Notes ~~~~~ -- 2.47.2