Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-1100: Fix reported body-length of HTTP messages w/ sub-entities

Browse source 
The body-lengths of sub-entities, like multipart messages, got counted
twice by mistake: once upon the end of the sub-entity and then again
upon the end of the top-level entity that contains all sub-entities.
The size of just the top-level entity is the correct one to use.
This commit is contained in:
Jon Siwek 2020-08-04 14:21:03 -07:00
parent 8e99d4b170
commit 363b167bd2
10 changed files with 29 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/analyzer/protocol/http/HTTP.cc
View file

@ -692,8 +692,11 @@ void HTTP_Message::EndEntity(mime::MIME_Entity* entity)
if ( DEBUG_http )
DEBUG_MSG("%.6f: end entity (%d)\n", network_time, is_orig);
body_length += ((HTTP_Entity*) entity)->BodyLength();
header_length += ((HTTP_Entity*) entity)->HeaderLength();
if ( entity == top_level )
{
body_length += ((HTTP_Entity*) entity)->BodyLength();
header_length += ((HTTP_Entity*) entity)->HeaderLength();
}
if ( http_end_entity )
analyzer->EnqueueConnEvent(http_end_entity,