Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix a problem with accidental and mistaken HTTP log lines.

Browse source
This commit is contained in:
Seth Hall 2011-09-25 00:56:53 -04:00
parent b3408d145c
commit 3449321dc1
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/protocols/http/main.bro
View file

@ -179,21 +179,21 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
{ {
if ( name == "REFERER" ) if ( name == "REFERER" )
c$http$referrer = value; c$http$referrer = value;
else if ( name == "HOST" ) else if ( name == "HOST" )
# The split is done to remove the occasional port value that shows up here. # The split is done to remove the occasional port value that shows up here.
c$http$host = split1(value, /:/)[1]; c$http$host = split1(value, /:/)[1];
else if ( name == "USER-AGENT" ) else if ( name == "USER-AGENT" )
c$http$user_agent = value; c$http$user_agent = value;
else if ( name in proxy_headers ) else if ( name in proxy_headers )
{ {
if ( ! c$http?$proxied ) if ( ! c$http?$proxied )
c$http$proxied = set(); c$http$proxied = set();
add c$http$proxied[fmt("%s -> %s", name, value)]; add c$http$proxied[fmt("%s -> %s", name, value)];
} }
else if ( name == "AUTHORIZATION" ) else if ( name == "AUTHORIZATION" )
{ {
if ( /^[bB][aA][sS][iI][cC] / in value ) if ( /^[bB][aA][sS][iI][cC] / in value )
@ -214,9 +214,8 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
} }
} }
} }
} }
else # server headers else # server headers
{ {
if ( name == "CONTENT-DISPOSITION" && if ( name == "CONTENT-DISPOSITION" &&
@ -251,13 +250,15 @@ event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &
} }
} }
event connection_state_remove(c: connection) event connection_state_remove(c: connection) &priority=-5
{ {
# Flush all pending but incomplete request/response pairs. # Flush all pending but incomplete request/response pairs.
if ( c?$http_state ) if ( c?$http_state )
{ {
for ( r in c$http_state$pending ) for ( r in c$http_state$pending )
{ {
# We don't use pending elements at index 0.
if ( r == 0 ) next;
Log::write(HTTP::LOG, c$http_state$pending[r]); Log::write(HTTP::LOG, c$http_state$pending[r]);
} }
} }