diff --git a/scripts/base/protocols/http/entities.zeek b/scripts/base/protocols/http/entities.zeek index b0689c5478..4c0aae2d4b 100644 --- a/scripts/base/protocols/http/entities.zeek +++ b/scripts/base/protocols/http/entities.zeek @@ -1,6 +1,7 @@ ##! Analysis and logging for MIME entities found in HTTP sessions. @load base/frameworks/files +@load base/frameworks/notice/weird @load base/utils/strings @load base/utils/files @load ./main @@ -83,6 +84,19 @@ event http_begin_entity(c: connection, is_orig: bool) &priority=10 event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=3 { + if ( ! c$http?$current_entity ) + { + local weird = Weird::Info( + $ts=network_time(), + $name="missing_HTTP_entity", + $uid=c$uid, + $id=c$id, + $source="HTTP" + ); + Weird::weird(weird); + return; + } + if ( name == "CONTENT-DISPOSITION" && /[fF][iI][lL][eE][nN][aA][mM][eE]/ in value ) { diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-no-crlf/weird.log b/testing/btest/Baseline/scripts.base.protocols.http.http-no-crlf/weird.log new file mode 100644 index 0000000000..01b82634c2 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-no-crlf/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.6.206 49783 5.2.136.90 80 line_terminated_without_CRLF - F zeek CONTENTLINE +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.missing-http-entity/http.log b/testing/btest/Baseline/scripts.base.protocols.http.missing-http-entity/http.log new file mode 100644 index 0000000000..8c93f43a3a --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.missing-http-entity/http.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path http +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types +#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 35474 127.0.0.1 8080 1 POST interleave.me / - 1.1 - - 10 3 200 OK - - (empty) - - - FtWn3S3nVYQ9iA3uu8 - text/plain F2bxt6qiQGYTYxTgg - - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.http.missing-http-entity/weird.log b/testing/btest/Baseline/scripts.base.protocols.http.missing-http-entity/weird.log new file mode 100644 index 0000000000..adbc77bead --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.missing-http-entity/weird.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path weird +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source +#types time string addr port addr port string string bool string string +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 35474 127.0.0.1 8080 missing_HTTP_entity - F zeek HTTP +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/http/interleaved-http-entity.pcap b/testing/btest/Traces/http/interleaved-http-entity.pcap new file mode 100644 index 0000000000..7ee49abfbe Binary files /dev/null and b/testing/btest/Traces/http/interleaved-http-entity.pcap differ diff --git a/testing/btest/scripts/base/protocols/http/http-no-crlf.zeek b/testing/btest/scripts/base/protocols/http/http-no-crlf.zeek index 458be00446..3d932bb099 100644 --- a/testing/btest/scripts/base/protocols/http/http-no-crlf.zeek +++ b/testing/btest/scripts/base/protocols/http/http-no-crlf.zeek @@ -3,7 +3,7 @@ # @TEST-EXEC: zeek -b -r $TRACES/http/no_crlf.pcap %INPUT # @TEST-EXEC: btest-diff conn.log # @TEST-EXEC: btest-diff http.log -# @TEST-EXEC: test ! -f weird.log +# @TEST-EXEC: btest-diff weird.log @load base/protocols/conn @load base/protocols/http diff --git a/testing/btest/scripts/base/protocols/http/missing-http-entity.zeek b/testing/btest/scripts/base/protocols/http/missing-http-entity.zeek new file mode 100644 index 0000000000..67e76b491f --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/missing-http-entity.zeek @@ -0,0 +1,7 @@ +# @TEST-DOC: The server starts sending a response while the client is still uploading the POST payload. This causes http_header to be raised while no entity is set. +# @TEST-EXEC: zeek -b -r $TRACES/http/interleaved-http-entity.pcap %INPUT +# @TEST-EXEC: btest-diff http.log +# @TEST-EXEC: btest-diff weird.log + +@load base/protocols/http +@load base/frameworks/notice/weird