Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Make HTTP 206 reassembly require ETags by default.

Browse source
This commit is contained in:
Seth Hall 2015-04-09 23:58:46 -04:00
parent e8c87e19bd
commit 0ee7d82e19
2 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/http/files.bro
View file

@ -19,12 +19,12 @@ function get_file_handle(c: connection, is_orig: bool): string
if ( ! c?$http )
return "";
if ( c$http$range_request && ! is_orig )
if ( c$http$range_request && c$http?$etag && ! is_orig )
{
# Any multipart responses from the server are pieces of same file
# that correspond to range requests, so don't use mime depth to
# identify the file.
return cat(Analyzer::ANALYZER_HTTP, is_orig, c$id$orig_h, build_url(c$http));
return cat(Analyzer::ANALYZER_HTTP, is_orig, c$id$orig_h, build_url(c$http), c$http$etag);
}
else
{

19
scripts/base/protocols/http/main.bro
View file

@ -78,6 +78,9 @@ export {
## Indicates if this request can assume 206 partial content in
## response.
range_request: bool &default=F;
## ETag for the return data used to match up
## partial content responses.
etag: string &optional;
};
## Structure to maintain state for an HTTP connection with multiple
@ -89,6 +92,10 @@ export {
current_request: count &default=0;
## Current response in the pending queue.
current_response: count &default=0;
## Track the current deepest transaction.
## This is meant to cope with missing requests
## and responses.
trans_depth: count &default=0;
};
## A list of HTTP headers typically used to indicate proxied requests.
@ -150,9 +157,7 @@ function new_http_session(c: connection): Info
tmp$ts=network_time();
tmp$uid=c$uid;
tmp$id=c$id;
# $current_request is set prior to the Info record creation so we
# can use the value directly here.
tmp$trans_depth = c$http_state$current_request;
tmp$trans_depth = ++c$http_state$trans_depth;
return tmp;
}
@ -278,7 +283,13 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
}
}
}
else
{
if ( name == "ETAG" )
{
c$http$etag = value;
}
}
}
event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &priority = 5