Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix a problem with accidental and mistaken HTTP log lines.

Browse source
This commit is contained in:
Seth Hall 2011-09-25 00:56:53 -04:00
parent b3408d145c
commit 3449321dc1
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/protocols/http/main.bro
View file

@ -179,21 +179,21 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
{
if ( name == "REFERER" )
c$http$referrer = value;
else if ( name == "HOST" )
# The split is done to remove the occasional port value that shows up here.
c$http$host = split1(value, /:/)[1];
else if ( name == "USER-AGENT" )
c$http$user_agent = value;
else if ( name in proxy_headers )
{
if ( ! c$http?$proxied )
c$http$proxied = set();
add c$http$proxied[fmt("%s -> %s", name, value)];
}
else if ( name == "AUTHORIZATION" )
{
if ( /^[bB][aA][sS][iI][cC] / in value )
@ -214,9 +214,8 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
}
}
}
}
else # server headers
{
if ( name == "CONTENT-DISPOSITION" &&
@ -251,13 +250,15 @@ event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &
}
}
event connection_state_remove(c: connection)
event connection_state_remove(c: connection) &priority=-5
{
# Flush all pending but incomplete request/response pairs.
if ( c?$http_state )
{
for ( r in c$http_state$pending )
{
# We don't use pending elements at index 0.
if ( r == 0 ) next;
Log::write(HTTP::LOG, c$http_state$pending[r]);
}
}