inliniac/suricata — pull request #640 by inliniac (2013-11-19 14:53:39+00:00)
Title: http: strip 'proxy' part of http_uri

Strip the 'proxy' parts from the normalized uri as inspected by http_uri,
urilen, pcre /U and others.

In a request line like:
GET http://suricata-ids.org/blah/ HTTP/1.1
the normalized URI will now be:
/blah/

This doesn't affect http_raw_uri. So matching the hostname, etc is still
possible through this keyword.

Additionally, a new per HTTP 'personality' option was added to change
this behavior: "uri-include-all":

uri-include-all:
Include all parts of the URI. By default the
'scheme', username/password, hostname and port
are excluded. Setting this option to true adds
all of them to the normalized uri as inspected
by http_uri, urilen, pcre with /U and the other
keywords that inspect the normalized uri.
Note that this does not affect http_raw_uri.

So adding uri-include-all:true to all personalities in the yaml will
restore the old default behavior.

Ticket 1008.

https://redmine.openinfosecfoundation.org/issues/1008
https://buildbot.suricata-ids.org/builders/inliniac/builds/51