mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
11 lines
506 B
ReStructuredText
11 lines
506 B
ReStructuredText
HTTP-uri normalization
|
|
======================
|
|
|
|
The uri has two appearances in Suricata: the raw_uri and the
|
|
normalized uri. The space for example can be indicated with the
|
|
heximal notation %20. To convert this notation in a space, means
|
|
normalizing it. It is possible though to match specific on the
|
|
characters %20 in a uri. This means matching on the raw_uri. The
|
|
raw_uri and the normalized uri are separate buffers. So, the raw_uri
|
|
inspects the raw_uri buffer and can not inspect the normalized buffer.
|