Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/awelzel/1705-http-pending-requests'

Browse source 
* origin/topic/awelzel/1705-http-pending-requests:
  http: Prevent request/response de-synchronization and unbounded state growth
This commit is contained in:
Arne Welzel 2023-09-01 11:53:55 +02:00
commit 14a2c02f9d
15 changed files with 137 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
testing/btest/scripts/base/protocols/http/http-desynched.zeek Normal file
View file

@ -0,0 +1,13 @@
# @TEST-DOC: 5 HTTP requests, the first one is responded to with 3 HTTP responses.
#
# @TEST-EXEC: zeek -b -r $TRACES/http/http-desync-request-response-5.pcap %INPUT
# @TEST-EXEC: btest-diff http.log
@load base/protocols/http
# mime type is irrelevant to this test, so filter it out
event zeek_init()
{
Log::remove_default_filter(HTTP::LOG);
Log::add_filter(HTTP::LOG, [$name="less-mime-types", $exclude=set("mime_type")]);
}

15
testing/btest/scripts/base/protocols/http/http-pending-state-growth.zeek Normal file
View file

@ -0,0 +1,15 @@
# @TEST-DOC: Pcap has a gap for the server side. This previously caused unbounded state growth in c$http_state$pending.
#
# @TEST-EXEC: zcat <$TRACES/http/1000-requests-one-dropped-response.pcap.gz | zeek -C -b -r - %INPUT >out
# @TEST-EXEC: echo "total http.log lines" >>out
# @TEST-EXEC: grep -v '^#' http.log | wc -l | sed 's/ //g' >>out
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/http
event connection_state_remove(c: connection)
{
if ( c?$http_state )
print "http_state pending", |c$http_state$pending|;
}