Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix file analysis placement of data after gap in HTTP Content-Range.

Browse source 
Addresses BIT-1248.
This commit is contained in:
Jon Siwek 2014-09-11 12:25:43 -05:00
parent f1cef9d2a9
commit 1e02d5d5b5
4 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/analyzer/protocol/http/HTTP.cc
View file

@ -243,10 +243,13 @@ int HTTP_Entity::Undelivered(int64_t len)
return 0; return 0;
if ( is_partial_content ) if ( is_partial_content )
{
precomputed_file_id = file_mgr->Gap(body_length, len, precomputed_file_id = file_mgr->Gap(body_length, len,
http_message->MyHTTP_Analyzer()->GetAnalyzerTag(), http_message->MyHTTP_Analyzer()->GetAnalyzerTag(),
http_message->MyHTTP_Analyzer()->Conn(), http_message->MyHTTP_Analyzer()->Conn(),
http_message->IsOrig(), precomputed_file_id); http_message->IsOrig(), precomputed_file_id);
offset += len;
}
else else
precomputed_file_id = file_mgr->Gap(body_length, len, precomputed_file_id = file_mgr->Gap(body_length, len,
http_message->MyHTTP_Analyzer()->GetAnalyzerTag(), http_message->MyHTTP_Analyzer()->GetAnalyzerTag(),

BIN
testing/btest/Baseline/scripts.base.protocols.http.content-range-gap/extract_files.thefile Normal file
View file

Binary file not shown.

BIN
testing/btest/Traces/http/content-range-gap.trace Normal file
View file

Binary file not shown.

8
testing/btest/scripts/base/protocols/http/content-range-gap.bro Normal file
View file

@ -0,0 +1,8 @@
# @TEST-EXEC: bro -r $TRACES/http/content-range-gap.trace %INPUT
# @TEST-EXEC: btest-diff extract_files/thefile
event file_new(f: fa_file)
{
Files::add_analyzer(f, Files::ANALYZER_EXTRACT,
[$extract_filename="thefile"]);
}