Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

http: Prevent script errors when http$current_entity is not set

Browse source 
The current_entity tracking in HTTP assumes that client/server never
send HTTP entities at the same time. The attached pcap (generated
artificially) violates this and triggers:

    1663698249.307259 expression error in <...>base/protocols/http/./entities.zeek, line 89: field value missing (HTTP::c$http$current_entity)

For the http-no-crlf test, include weird.log as baseline. Now that weird is
@load'ed from http, it is actually created and seems to make sense
to btest-diff it, too.
This commit is contained in:
Arne Welzel 2022-09-21 10:17:03 +02:00
parent 19ba30d77a
commit 38e226bf75
7 changed files with 55 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/protocols/http/entities.zeek
View file

@ -1,6 +1,7 @@
##! Analysis and logging for MIME entities found in HTTP sessions.
@load base/frameworks/files
@load base/frameworks/notice/weird
@load base/utils/strings
@load base/utils/files
@load ./main
@ -83,6 +84,19 @@ event http_begin_entity(c: connection, is_orig: bool) &priority=10
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=3
{
if ( ! c$http?$current_entity )
{
local weird = Weird::Info(
$ts=network_time(),
$name="missing_HTTP_entity",
$uid=c$uid,
$id=c$id,
$source="HTTP"
);
Weird::weird(weird);
return;
}
if ( name == "CONTENT-DISPOSITION" &&
/[fF][iI][lL][eE][nN][aA][mM][eE]/ in value )
{

11
testing/btest/Baseline/scripts.base.protocols.http.http-no-crlf/weird.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.1.6.206 49783 5.2.136.90 80 line_terminated_without_CRLF - F zeek CONTENTLINE
#close XXXX-XX-XX-XX-XX-XX

11
testing/btest/Baseline/scripts.base.protocols.http.missing-http-entity/http.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path http
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types
#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string]
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 35474 127.0.0.1 8080 1 POST interleave.me / - 1.1 - - 10 3 200 OK - - (empty) - - - FtWn3S3nVYQ9iA3uu8 - text/plain F2bxt6qiQGYTYxTgg - -
#close XXXX-XX-XX-XX-XX-XX

11
testing/btest/Baseline/scripts.base.protocols.http.missing-http-entity/weird.log Normal file
View file

@ -0,0 +1,11 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path weird
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
#types time string addr port addr port string string bool string string
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 127.0.0.1 35474 127.0.0.1 8080 missing_HTTP_entity - F zeek HTTP
#close XXXX-XX-XX-XX-XX-XX

BIN
testing/btest/Traces/http/interleaved-http-entity.pcap Normal file
View file

Binary file not shown.

2
testing/btest/scripts/base/protocols/http/http-no-crlf.zeek
View file

@ -3,7 +3,7 @@
# @TEST-EXEC: zeek -b -r $TRACES/http/no_crlf.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: test ! -f weird.log
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/conn
@load base/protocols/http

7
testing/btest/scripts/base/protocols/http/missing-http-entity.zeek Normal file
View file

@ -0,0 +1,7 @@
# @TEST-DOC: The server starts sending a response while the client is still uploading the POST payload. This causes http_header to be raised while no entity is set.
# @TEST-EXEC: zeek -b -r $TRACES/http/interleaved-http-entity.pcap %INPUT
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: btest-diff weird.log
@load base/protocols/http
@load base/frameworks/notice/weird