From 4ae02b7973d2e5dfa102d2823b3e5d2cac36af3f Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Tue, 27 Jun 2023 18:17:40 +0200 Subject: [PATCH] Merge branch 'master' of https://github.com/progmboy/zeek * 'master' of https://github.com/progmboy/zeek: fix http AUTHORIZATION base64 decode failed Added a test during merge. (cherry picked from commit b18122da08d37ab48a70c9dbb09d8b9403ebd19e) --- scripts/base/protocols/http/main.zeek | 2 +- .../http.log | 11 +++++++++++ .../http/basic-auth-with-extra-space.trace | Bin 0 -> 5180 bytes .../http/http-basic-auth-extra-space.zeek | 8 ++++++++ 4 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-basic-auth-extra-space/http.log create mode 100644 testing/btest/Traces/http/basic-auth-with-extra-space.trace create mode 100644 testing/btest/scripts/base/protocols/http/http-basic-auth-extra-space.zeek diff --git a/scripts/base/protocols/http/main.zeek b/scripts/base/protocols/http/main.zeek index f54216b0dd..e0f0cdc0a0 100644 --- a/scripts/base/protocols/http/main.zeek +++ b/scripts/base/protocols/http/main.zeek @@ -290,7 +290,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr { if ( /^[bB][aA][sS][iI][cC] / in value ) { - local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]/, "")); + local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]+/, "")); local up = split_string(userpass, /:/); if ( |up| >= 2 ) { diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-basic-auth-extra-space/http.log b/testing/btest/Baseline/scripts.base.protocols.http.http-basic-auth-extra-space/http.log new file mode 100644 index 0000000000..0acd48d84a --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-basic-auth-extra-space/http.log @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path http +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent origin request_body_len response_body_len status_code status_msg info_code info_msg tags username password proxied orig_fuids orig_filenames orig_mime_types resp_fuids resp_filenames resp_mime_types +#types time string addr port addr port count string string string string string string string count count count string count string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string] vector[string] vector[string] +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 172.24.133.205 43090 172.24.133.205 8000 1 GET 172.24.133.205:8000 / - 1.0 python-requests/2.31.0 - 0 643 200 OK - - (empty) test 1234 - - - - F2yF2x2UFyYsb6poSc - text/html +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Traces/http/basic-auth-with-extra-space.trace b/testing/btest/Traces/http/basic-auth-with-extra-space.trace new file mode 100644 index 0000000000000000000000000000000000000000..5e37970992e4d194229bfa8fd0b24305e9a36715 GIT binary patch literal 5180 zcmaJ_3s6&68omJp3PurEwA1Z+Veo|{7YJ1h5kUe(9)bv3UqDE1LNFxZauH$O7K4~- zNU6HAD%#O?ZSA(UXxF-S#t|R*z#^_swjxetc9xy#x-0EE)(6@DzsU^&OwMpPH|L)F zec$>1|D1c~-o9|+kPqQU3>QB_06&5Zd)4~I1hERPvAUN)B8?!j{ODvN**_uueS#2R zJz%m*md|*2`NyZn`|76^bq_6qPC;OhomzRuPUSu}@3`~XvMmpxLTf34_HR%-kZ3ay z!5>%05XBGv3W+k0@kCb10TYq{SzmpK4>2^`ooMA5M2ufT5QPAR)xB`iGX|${h7x>;(0*QqEt1S#DD)zm zszeguGM)t7E=2+$T0GM2H6eCtbw45&rc59{g{;BqUeIm9UeQ+^;+H&P7h{!Ni0b`? z+;k$h9^AIuc(>Q&+o`3o<{`nl$b$pEGY$^K)Eyki?uYBY9vbi^PJTL(=-!%^^PMd{ zzhi3+jM@7B{mzmV9ouSBE_N<>|JB9tj4RtJQahT$fAeBjIMKCP>%Z^sl>d!wHQDBy z;lUSfMpxdlRjzE_qfYPM5l!FNlaY3NTl9wRZHAod&C%NKCQb1FS~V-0n~hoLw;5}0 zTPo8o+rk6QttHtVjT--boiuQVuL7RrjxCxzj_2fiwV-XPeZY6UcEC3>;9tIxTZXb{ zZ?ROAUfrTm-nCWaf&RaMo{XEeQs*<2|AqR}%*!^=_w`2qEsf>L=9_VW<~^l(S2`E? zH(M8QI&NLAN3;tnGRmr*irNM)i(j`~7s)PG2+LY!qrj(nP)r#)zrHY^S>sOp> z*7!Gdnli4~3@I?z{99Iia!1F8l^y%EFvqc)F>H^$hOMv|!}gC?eAo_@StV;FCBh$y zXE%-w+lo^dHuWRLY5I|3_svI&#`SRhtY2~Zch>_>CfjD(g&&GuhFWHJ!5G=1z2)DB zS>|*Jww5<6I;(CC*gof;uO+&*=(MCYxjFnndQa`{^qq6M#``g6I?&%&is~H*Tyx9S{3by-;cM< z=uPh_e+b;IZvqctiR=yGc&1!j0NNCViqr4@TX9;Qw&b+>1^u+_(yV(C*2v!Q-;3^r zfc~FBPryf_9_KT=(>IenL5(8NH~D<}r5QJfcIE>`dqPjh_VR}GuDK1Ijvd;ozV)-( zvkoU*B^zWtS#7g=-muQ>%Q`gcfuQT{PQgdozCc@4PvCLc-LM9#H~o5fXTWyRZ2`O1c#*b~b4z-%33CcF2DP+JRV^E}(a64drjC9ln~fRqgA>mD^* z)K-Xy@}UV{UI3!wh&W-0M;zhbi1*f-2K3KttLr^Cz6vU|smHMm29oJ|Z||*DGmxZz zKTqOJpuLblm7`?00Z9WQZqM~6mVtd(-3ynJsmG2WVzY1N^IJTLbItWZ zI2%XF9t7E!5b-1tdi(3JUV5SaGZ{NMWpErDW{8bl0TSxr~5RaBf<5-Wx=DJm6hVnt~Nl~JuTXr-jKPG^cH)wD*hWNH4s zl#HUHgh8oBgMn7DI-@~KuBT~}NU7Itz(Lgj&gkltj$4bBRXP<(sxwy9spZCvIpsM( zBn(0?V!#W}?rzFLFIFGpy>P~@jX2rVQXe9)zs}wI`+&Tucm^n)dqMzPC~}UNZ*l20VyM=fOC(9ScuqK6AWhQjVx8hR_GH+Rhg2hqS=Mj ztVWbDJT99yXxTC;IWJzq+qVlQ>)Af}3oeyj@so8VXH!duX@1ry`*5;}7?3{#VuugG z)zS9(oZ6Iwi0{tk5gh@UpTz|P?9)`cl9NM}h0AkO3s&W&L4xLFlX-=UvzMfj5h99O zDM_U$d4b$AU8R83&7n7QswxyFv63~h{)<#J)I=iF_68q<)Sl?>eq&L=zE5M^MT^=6QRIApDO)8}+BFS~> zVW>%|TCdd7Ae_JQG*Dly)fsS{6=5D-m! z9Ou#3pGgO&B4TDMebh S@cHLReF%JCa(%IKNd7;RR?XZ1 literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/http/http-basic-auth-extra-space.zeek b/testing/btest/scripts/base/protocols/http/http-basic-auth-extra-space.zeek new file mode 100644 index 0000000000..9c0b52b1ec --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/http-basic-auth-extra-space.zeek @@ -0,0 +1,8 @@ +# Authorization: Basic is followed by two spaces rather than one. +# +# @TEST-EXEC: zeek -b -Cr $TRACES/http/basic-auth-with-extra-space.trace %INPUT +# @TEST-EXEC: btest-diff http.log + +@load base/protocols/http + +redef HTTP::default_capture_password = T;