Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Change HTTP's DPD signatures so that each side can trigger the analyzer on its own.

Browse source 
This is to avoid missing large sessions where a single side exceeds
the DPD buffer size. It comes with the trade-off that now the analyzer
can be triggered by anybody controlling one of the endpoints (instead
of both).

Test suite changes are minor, and nothing in "external".

Closes #343.
This commit is contained in:
Robin Sommer 2020-09-08 07:33:36 +00:00
parent a00b712e39
commit 0af57d12b2
6 changed files with 32 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/scripts/base/protocols/http/http-dpd-large-req.zeek Normal file
View file

@ -0,0 +1,13 @@
# @TEST-EXEC: zeek -C -b -r $TRACES/http/http_large_req_8001.pcap %INPUT >output
# @TEST-EXEC: btest-diff output
#
# @TEST-DOC: Tests our DPD signatures with a session where one side exceeds the DPD buffer size.
@load base/protocols/conn
@load base/protocols/http
@load base/frameworks/dpd
event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string)
{
print "http_request", version, method, original_URI;
}