Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

http: Prevent script errors when http$current_entity is not set

Browse source 
The current_entity tracking in HTTP assumes that client/server never
send HTTP entities at the same time. The attached pcap (generated
artificially) violates this and triggers:

    1663698249.307259 expression error in <...>base/protocols/http/./entities.zeek, line 89: field value missing (HTTP::c$http$current_entity)

For the http-no-crlf test, include weird.log as baseline. Now that weird is
@load'ed from http, it is actually created and seems to make sense
to btest-diff it, too.
This commit is contained in:
Arne Welzel 2022-09-21 10:17:03 +02:00
parent 19ba30d77a
commit 38e226bf75
7 changed files with 55 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/protocols/http/entities.zeek
View file

@ -1,6 +1,7 @@
##! Analysis and logging for MIME entities found in HTTP sessions.
@load base/frameworks/files
@load base/frameworks/notice/weird
@load base/utils/strings
@load base/utils/files
@load ./main
@ -83,6 +84,19 @@ event http_begin_entity(c: connection, is_orig: bool) &priority=10
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=3
{
if ( ! c$http?$current_entity )
{
local weird = Weird::Info(
$ts=network_time(),
$name="missing_HTTP_entity",
$uid=c$uid,
$id=c$id,
$source="HTTP"
);
Weird::weird(weird);
return;
}
if ( name == "CONTENT-DISPOSITION" &&
/[fF][iI][lL][eE][nN][aA][mM][eE]/ in value )
{