Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 22:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Make HTTP 206 reassembly require ETags by default.

Browse source
This commit is contained in:
Seth Hall 2015-04-09 23:58:46 -04:00
parent e8c87e19bd
commit 0ee7d82e19
2 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/http/files.bro
View file

@ -19,12 +19,12 @@ function get_file_handle(c: connection, is_orig: bool): string
if ( ! c?$http ) if ( ! c?$http )
return ""; return "";
if ( c$http$range_request && ! is_orig ) if ( c$http$range_request && c$http?$etag && ! is_orig )
{ {
# Any multipart responses from the server are pieces of same file # Any multipart responses from the server are pieces of same file
# that correspond to range requests, so don't use mime depth to # that correspond to range requests, so don't use mime depth to
# identify the file. # identify the file.
return cat(Analyzer::ANALYZER_HTTP, is_orig, c$id$orig_h, build_url(c$http)); return cat(Analyzer::ANALYZER_HTTP, is_orig, c$id$orig_h, build_url(c$http), c$http$etag);
} }
else else
{ {

19
scripts/base/protocols/http/main.bro
View file

@ -78,6 +78,9 @@ export {
## Indicates if this request can assume 206 partial content in ## Indicates if this request can assume 206 partial content in
## response. ## response.
range_request: bool &default=F; range_request: bool &default=F;
## ETag for the return data used to match up
## partial content responses.
etag: string &optional;
}; };
## Structure to maintain state for an HTTP connection with multiple ## Structure to maintain state for an HTTP connection with multiple
@ -89,6 +92,10 @@ export {
current_request: count &default=0; current_request: count &default=0;
## Current response in the pending queue. ## Current response in the pending queue.
current_response: count &default=0; current_response: count &default=0;
## Track the current deepest transaction.
## This is meant to cope with missing requests
## and responses.
trans_depth: count &default=0;
}; };
## A list of HTTP headers typically used to indicate proxied requests. ## A list of HTTP headers typically used to indicate proxied requests.
@ -150,9 +157,7 @@ function new_http_session(c: connection): Info
tmp$ts=network_time(); tmp$ts=network_time();
tmp$uid=c$uid; tmp$uid=c$uid;
tmp$id=c$id; tmp$id=c$id;
# $current_request is set prior to the Info record creation so we tmp$trans_depth = ++c$http_state$trans_depth;
# can use the value directly here.
tmp$trans_depth = c$http_state$current_request;
return tmp; return tmp;
} }
@ -278,7 +283,13 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
} }
} }
} }
else
{
if ( name == "ETAG" )
{
c$http$etag = value;
}
}
} }
event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &priority = 5 event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &priority = 5