Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

GH-1100: Fix reported body-length of HTTP messages w/ sub-entities

Browse source 
The body-lengths of sub-entities, like multipart messages, got counted
twice by mistake: once upon the end of the sub-entity and then again
upon the end of the top-level entity that contains all sub-entities.
The size of just the top-level entity is the correct one to use.
This commit is contained in:
Jon Siwek 2020-08-04 14:21:03 -07:00
parent 8e99d4b170
commit 363b167bd2
10 changed files with 29 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
testing/btest/scripts/base/protocols/http/multipart-body-length.zeek Normal file
View file

@ -0,0 +1,8 @@
# @TEST-EXEC: zeek -C -r $TRACES/http/multipart-form-data.pcap %INPUT
# @TEST-EXEC: btest-diff http.log
# This test is mainly checking the request_body_len field for correctness.
# Historical versions of Zeek would mistakenly count the body-lengths of the
# multipart sub-entities twice: once upon the end of the sub-entity and then
# again upon the end of the top-level enitity that contains all sub-entities.
# The size of just the top-level enitity is the correct one to use.