suricata icon indicating copy to clipboard operation
suricata copied to clipboard

http: Use libhtp-rs.

Open catenacyber opened this issue 2 years ago • 3 comments

Link to redmine ticket: 2696

Describe changes:

  • Use libhtp-rs.
  • Rebased from #9077

Rebased from v7. Did not tackle the commit separation yet - will wait until the functionality is considered good enough to merge.

LIBHTP_REPO=https://github.com/catenacyber/libhtp-rs LIBHTP_BRANCH=main

catenacyber avatar Oct 13 '23 10:10 catenacyber

What is left to do :

  • merge https://github.com/cccs-rtmorti/libhtp-rs/pull/9 or use https://github.com/catenacyber/libhtp-rs (as done in this PR) os create a new repo https://github.com/OISF/libhtp-rs
  • investigate differential fuzzing findings

catenacyber avatar Oct 13 '23 13:10 catenacyber

Information:

ERROR: QA failed on SURI_TLPW2_single_alerts_cmp.

ERROR: QA failed on SURI_TLPW2_autofp_alerts_cmp.

ERROR: QA failed on SURI_TLPW1_files_sha256.

ERROR: QA failed on SURI_TLPR1_alerts_cmp.

field baseline test %
SURI_TLPW2_single_stats_chk
.uptime 656 701 106.86%
SURI_TLPW2_autofp_stats_chk
.uptime 195 222 113.85%
.flow.spare 1951025 2162066 110.82%
SURI_TLPW1_stats_chk
.app_layer.error.http.parser 47 18 38.3%
SURI_TLPR1_stats_chk
.app_layer.error.http.parser 1108 1242 112.09%

Pipeline 16238

suricata-qa avatar Oct 19 '23 14:10 suricata-qa

Waiting for feedback before rebasing. Also waiting for https://github.com/OISF/libhtp/pull/410 merge to investigate further differential fuzzing findings Should there be a sub ticket for this differential fuzzing findings ?

catenacyber avatar Dec 05 '23 08:12 catenacyber

Information:

ERROR: QA failed on SURI_TLPW2_single_alerts_cmp.

ERROR: QA failed on SURI_TLPW2_autofp_alerts_cmp.

ERROR: QA failed on SURI_TLPW1_files_sha256.

ERROR: QA failed on SURI_TLPR1_alerts_cmp.

field baseline test %
SURI_TLPW2_single_stats_chk
.uptime 656 701 106.86%
SURI_TLPW2_autofp_stats_chk
.uptime 195 222 113.85%
.flow.spare 1951025 2162066 110.82%
SURI_TLPW1_stats_chk
.app_layer.error.http.parser 47 18 38.3%
SURI_TLPR1_stats_chk
.app_layer.error.http.parser 1108 1242 112.09%

Pipeline 16238

suricata-qa avatar Mar 05 '24 01:03 suricata-qa

Continued in https://github.com/OISF/suricata/pull/10764

catenacyber avatar Apr 04 '24 15:04 catenacyber