From 64e821624b34dcb886599a5e478f0a386f26e569 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Mon, 26 Sep 2011 17:37:29 -0500 Subject: [PATCH 1/2] Fix handling of HTTP 1xx response codes (addresses #411). Changed the parser to not treat 1xx response codes as a final answer to an unanswered request -- a later response is still expected. The scripting layer will also not finish a request-reply pair when seeing 1xx's, instead it logs both the 1xx and final response messages with associated information of the current request as they're seen. --- scripts/base/protocols/http/main.bro | 13 ++++++++++--- src/HTTP.cc | 4 +++- .../http.log | 6 ++++++ testing/btest/Traces/http-100-continue.trace | Bin 0 -> 68022 bytes .../base/protocols/http/100-continue.bro | 12 ++++++++++++ 5 files changed, 31 insertions(+), 4 deletions(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.100-continue/http.log create mode 100644 testing/btest/Traces/http-100-continue.trace create mode 100644 testing/btest/scripts/base/protocols/http/100-continue.bro diff --git a/scripts/base/protocols/http/main.bro b/scripts/base/protocols/http/main.bro index efaa2e12c9..982d29acda 100644 --- a/scripts/base/protocols/http/main.bro +++ b/scripts/base/protocols/http/main.bro @@ -163,8 +163,12 @@ event http_reply(c: connection, version: string, code: count, reason: string) &p local s: State; c$http_state = s; } - - ++c$http_state$current_response; + + # If the last response was an informational 1xx, we're still expecting + # the real response to the request, so don't create a new Info record yet. + if ( c$http_state$current_response !in c$http_state$pending || + c$http_state$pending[c$http_state$current_response]$status_code/100 != 1 ) + ++c$http_state$current_response; set_state(c, F, F); c$http$status_code = code; @@ -246,7 +250,10 @@ event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) & if ( ! is_orig ) { Log::write(HTTP::LOG, c$http); - delete c$http_state$pending[c$http_state$current_response]; + # If the response was an informational 1xx, we're still expecting + # the real response later, so we'll continue using the same record + if ( c$http$status_code/100 != 1 ) + delete c$http_state$pending[c$http_state$current_response]; } } diff --git a/src/HTTP.cc b/src/HTTP.cc index 0d154f1873..6f79ffb443 100644 --- a/src/HTTP.cc +++ b/src/HTTP.cc @@ -1305,7 +1305,9 @@ void HTTP_Analyzer::ReplyMade(const int interrupted, const char* msg) if ( reply_message ) reply_message->Done(interrupted, msg); - if ( ! unanswered_requests.empty() ) + // 1xx replies do not indicate the final response to a request, + // so don't pop an unanswered request in that case. + if ( reply_code/100 != 1 && ! unanswered_requests.empty() ) { Unref(unanswered_requests.front()); unanswered_requests.pop(); diff --git a/testing/btest/Baseline/scripts.base.protocols.http.100-continue/http.log b/testing/btest/Baseline/scripts.base.protocols.http.100-continue/http.log new file mode 100644 index 0000000000..a9d02efa09 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.100-continue/http.log @@ -0,0 +1,6 @@ +#separator \x09 +#path http +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string string table string string table string string file +1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 - F 0 F 100 Continue - - - - - - - - +1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 2001 F 60731 F 200 OK - - - - - text/html - - diff --git a/testing/btest/Traces/http-100-continue.trace b/testing/btest/Traces/http-100-continue.trace new file mode 100644 index 0000000000000000000000000000000000000000..3ff38fa5c554b7cbb1636522110cab1e691e33a0 GIT binary patch literal 68022 zcmeHw3vguFSzdeB-dKXc4g^2Ikh4AZO0!nK^q7$}Bds+vnjNiYc9fB3m-Vs{SKYVO zJ=5K{_ug(jc3Fe5F_bX@Y=?4O8`of7#xaJtj0*?>$DxQHgqIz{!)$>Iut}=GWvDVx z6*k}hpL6a#=ib{_EsbXFRIGWZ`##S3&wu{c`Tzg?=hOf7gFkjh?)f?W^X#*^-1G2d zEWNh+7qfO0jZm^jhHhg{3XG)0-F7zTYaHDpv4Uj5nud zPZpeRx8)XUj=$6F%oZznT*Y zU0l4kbnmgzb6%&1o(h-T&Q`B6FDA=nfS|9g?{(dIL0vYhPOs^8O1lNLRj7M@y8zJK zPSvZqwPT~pyIr@6HY??Fp^7G(oxXc)^w=mNdZs@*c+$q7`F5JL)py4x?R%g8`0Q&} zU;J|M%x~p#pZUADV#cYhORpczT>+-)UxEOZp840@)*DmXdfCgxd*7AIX*?6Cg2rir z`Ytp-m?j>%n`ZOZ|InVz+1G+5-c2;|rT-y;{O{j2n)_cb$nn28O}yYUfBp(;W%}Mh ztxS2j+*SQ^L4Ww_@2_Ius~Gqy2EK}cuT%_>diuWq{WV#t?mJjLy(^}k-u?8)7oJ^x zaenr<|0JTcG}>B&-9!K4TI7!9C%%=m$dCP+twk1|WnBcz;*%!~E%KF$ zvaiDR<--7x>!UyOwOQo4$>jRZB)Puk6{{~U-27-QmvirSVW3l6|Kjb(BBO^*eo3@s zn!n&P&(x@`2R=Kft=@|a%M3QCxboU#qvxF-tk3mEe?nB|#AU}P>vT?(XXYm>^HVe8 z{>$sfM%P?_+x6$gQrD?A+|p#RT%4H`HASviSj&)j|f%DMGNR+k06Ay%)Qy|i*pSH0`cZ;=N zEx$N=hCADBw>rT>N&}U-xjFe>UeucYLcZ1W`7PI};pMj5a{z9yTW}xmH@6q^v_7CE zM-PjOying3@*yHl167V6xV;4|acaOqp)xr$nHQzS(b17Jy=JfFE_zk@dB#aSnC#RF^VIkYo!CaC(&Zcori)BqlEww*P;niqjzUC4uEXG_ga zwRAlwVUf1Ir`jv|UcZC2(?(UcztL*;+#((rER{MnBEt*;e1}`b}Ca^8}q+(=&9Y z)$H65zS~;J2fe+P8#G+EmlqA+t*dFN20^Lk2ED?jZlq8yo+8w{Zl{R5d2?#{I|GIW z`H>0H^}Xwo_46Q4Am^}s@(?n+jx>#9$Z1K=Nf;vl0H?zx>Q7)dj`%$-3 zYt|oQdLYUF=6|0l`RgqC|J0WJ-+1-uk4r7`p&!oW40=1%9Fl9};IoxR=b#=%=MXhS zUSNWd(65pJgZvkGswl<40PGtAf#EV}jzqyAddIUR$pCUVL{ju80}>B&L7K;DnNTVE zXh9~fEQ^zmEee5F(rNRSVJ$S>lM%c&eGuf5QpKs;4#lZKP#7|uh1zA3_|a68ASVHF z0A?p%A9+o)-SzyQh-AE)Skfq^-t`-W$4Z+RNtA(K zrF*OWpy#y(WRZZ{6}?6?5M5`>WumGzx5<%QXt*T#KMu)1*j@U9Z=xmY%l^z>qQ2%8 zpZ)D`zKh(YfBv*wIlR*Sx~!E$gZ0NVw*L6$yR`lg|2CI%YOW91pCk&}gjuu2w$;2i zet~}kJk{gU4r^l|L8$@Lk^d`pJ6k72$1C`5*L8ZL+}#z0x!LY6b7$A7Nzd{Tl2MqJvK;X4tze7*(^BxS)ddu6H7ma4E=5|yg{#FyKg))76 z3jgpIs69@ol@=E+Jc)lJx~o&Fqjs|sb{}3dKvLJDHhH>wZoAupg{)g`JF0)TEwDcF z7$_5SJzBqX9Upf3KoHORFz~B>zrCrOjRU*WtWiv1YDS|eM23M2qg$g_W6m-ZX0yFj zir(J<&S9(;x0>}6z(37sVOO-=IxKXrdzuVe7J|m_7@is!5!PIdiXKta_`FDmZXb$* zVD(xpQ2_7=H!a5jo3F&`i_0V~vP^TP%WO8V0{ot%`-4H|*K^mX(wbe9?g z!U++pY%-h`lSI27mQB2*bv8lK{hrJ40Fm>e0MV-kqrg!ON5B}QdevW?(G8%583ezM4PR_;VO0(KN zsKR0cVX|#TmBNLBxDI0M`>uF$RLwS~kEfbj9*rKB&liLKW~0C#k;H3?PEw zIN5A@)f=ZdGWbi~Ov!(pCI4q^$uE9cOa2f2AXW~B^ena=2uI~l07y_(=9L0T{Q_$S z4XcTbqKnQm7bf|(s57TPbjbBFs%~Em{B|tN5)77trX#D=s|#N zu=hm|uhqnwn{75dJeCKzJ!0IVg~>dWGb9Dwi3m$F4iVSXAea=X+T9~gt{{je9`w@k z{Q2V-mgvvvQKiU9UQ0cG{K854b9z)gI6F;$@U`y;c(Loj_2BxaM7xnwn=?(G4cvBtNE) zp@nLXq)&jTv|KrqpUBi7E!H1@Wb2Q6 zI$D2x;&ZtiK(`D#o^LH_h*=5A{M*2CYj6BBi^~R)AuHJ`g0=D!54nEL={OSs7G(tlg_?CamLd(Z zumuy?lH*wTE-x*gT|OJie?lIuE!)TjD|EeXzvcK6rF6C9?gY^{cN>d7DWphx80$?K zAIbzUkQ+yt?uxA~)BZ{UacOxe1d-vJ?9_TqM9s*EgE1Ga>ce@KOXd-!6Xs@Y`Ip{^ zC}MW|?G7N2?Py_0q|GXF(0eV!0uyf$5;EVSl~-XF?L7S^DGaE|C6s(Jv(R$3&j=$EUtq z>W}fc7iD>#I;=nbz}6oVd96SG0hx&)k5<#bM;QW>#1F_+PhJSOe6}&8(GgAn3r=&6 zkh>`-DL!=F1Pd){M;WEC_NbA#L`o>;1T4Y{1)9;^+#KwG(>H~C_^Vl)^5{F_bt_?e7*I83AN!F&CA~FK>KhXJUW4W$z zBBiE<6)kPp(GtB+ULU57j8|=%(!HZ+O;j20b}`)0%TQ*fCO4%hgDM$#r6voonc?W2 z=SOIo)O6^kd6o^cHLf8NCT(bI#s(akoLWCCT9$mc8O=#W zd(n*6O_O+Fqe3ET@T4>9c-kdL%W>##=!WfVEk5D;USX@>!+MbC00@ceDYc5#xF^%n zKz%V}Scnv9%Y{$Uiu8E3T1CzRI;feHz`iyaD0f4}tzOrQCF@;42g8Is)&rZTN75EK zdH~ceQ&UJccmue$U=j7E+o~ax1H2aEjiy}lRk+?}!-Cy`p~nYw_Yz_Q+nH?|}aJl{;m6Hl=CD^T?5{)Md&4`?ln-{Jxg_ z|M`z{IZf4)YsfschfbW+B?l@7^CbS6h!aJHI(<>GBJ(HZ`b?FN5gsCr9MHDRy3jqC zT?FPZ&F8(H9-vkYNokvMYKZdEZScGX_PbO)9xL|0FAlMR9 z5NEcF79;yH^lX$b;7>>ohX3W%6}jaayi#&ATGmlvI5zdu zc~m-%hI_W|AUvTNEntL26VjO9xLX{7URv zQgMn(aoUs;r2pu?`whc`rYpL=72nA+x$iPXLj5$AWqSbw#T#L;>c+>QU-Kj&( zkhTGpg-He>nS>E~VN!W;w>#}_KU6xBX;fU(a1IzE$9zqxU{gdzE;hx0S~S}7mJGVE z_sFknEmx=YYBkhjB>Ddal7F!0>3!#E}9zewX%0CQ-AoZKR#{i zk5g~a`s4jGxm*-?4TE#a!KqMO>@^Tt#mWvTXZRm`y6}G$YjYP%_o7!V5HEs^Sh>XA zOa^c6AGZt<84rgm7Ur0kMy7@~#IBkr>FkDS#|Diye4?ieKZ3rf2bw+>ZjkktDT>1m zq7f!y2+HWHoKg!&tz}~%hGen-RA36oA`4Rs;6u^TQ4E-2V#}OnY0!g(X@DaN1e3Pn zp>L!S3Jy>+D0NgON3co~Vd}x4(GFl7MM49hEX+c`8$fo8LAzCu6M$FJcv26B)e{nS z-Ce`Yje)3lq#-KpeSJ-XXc&_5R@iqlAyO|F$UUPtKx1K=d^)(MdQ~A9CInn1irc>} z>s=;j^(ubhZvvKnD?*K&9JTsSJZY@!Ld!ey6eJ#R%wT;E>+1%3Wj2?>SR7a39b8VV z`9-*fAT%fzOK;io>g%SXW&0tU4k3EeDzu>a00?B;F{g`$e%-x?<#~u965h0*%^h(G>84CW;r&e?PaBlv{5o!CdvPjS7b{59!vh;vnBt+qL%z( zBbOrrwQ-}C;OZjdrowcm44hLc%&8IOH8ep)2rxuaVTu;T;Nn^39o5pfa>`z@g1!^U6@Ms`8u2(K`;0#RsFF_zI)D8u7VBB`9ABWO%5JN{?I!FFGDdVd0wLh^XuKgq2dJS%h;-R-oKVfW zu%1F{j9ZaPASt_veEkfzp5#!xn1U-ZOw?6V@!NQ|`VJe_v}!eKkY-2`{5qu{F;Qqv zAa{hy+<>?2G|esUo5QamTRuvK)D$|UQ@+yr9U;kIcvYt4-)71GJGSIM`$aAJf4q~+ z=`l{)Vi;4w3R-4C?_ z-g-pFzoG|aT+bZ13Yw=`}Ygr(R!}X(pfV9GCu{$~< z9|#(>_b+-v+6Mf<=!ip9i1~^c4icgBFnqMX3?KC?3?PMW*;2n z+`tOKl%uYhgv}`SucHeYDc@}MK?lYt=>iiXqf(^~3a8j@^@D3^PL3)+PHn4r(6)!(z*Zu@z74 z662&$Y^vowtKqKJ?A@5$6z%?y`)%P^LrQT?EQor)!`qt2PmGQTOgI+LqI56+qK&qQ z5Q?#FBnj7$rWT9|1bR?S2izG5k3%2Wl!gQrfkgy%@$zeXUZ3{t2B;R)tnUeA?IBTt zcPzUt7u%+K0XCdqBZisV$}d(CuyqjlYQx|{1DwWNBq<1x2o`|Rcd2LEg5>}dY+itt zufaw~(A=xb4b!?4ehoqdaJhaJ`+9X#;b`W?qj`v>{DjDpg2+E+^yO^AbtK$fxIQ7A zcD#P8CftrglFEczcpY)!%GJw4_liycE$^cd8d(9det~JiE$;PN^H`Dj2yOMT&39Tn zHKDE}#WC&r=78rn2R!ef+|g32>7enR-*;8(WFD{5&U3mZJ1mvty;6xVD<@c^1gHS0 zP(k=#QNy)>l9UySKo)9`^Oeo(7#op^iI;IjCjo9xV8gr<1P?lG7u(f2U0Kiz2WSAZ zgoY}Qa@+%-Cc{rt_*CRS;iU&3!;k8QCjtY+2z|lH*mxV8d9y&qY=I*9VSLQ1mVgRs z$7rKSHM8_q?{#mf)f!jN#yXSJKM+N-Kb@qd`!hPi1B3hGDLQP2G75jdE~&@Ec4#K2 zJxAS|`Dw=f0NFc9{tuy~S6Ip`S=HhRmi)hIOa2F6rzQVS|3~=wO|sZ`whn_kxky(S z8;UfTdxg?{QKbP^kSbw6p*j-945)^HdYFsNp=^Po zx(36(+DdO$)cQ&I{my02dthz+1PfB^I9Ta4dy?fwBuwr zzUB5Vt_R~|#Bh@S$4)TcjtqPZtQ+k6kV)F{hp~%5L#jLR(KiZU81OepD(TxnqgmIl zfZ;}7`O5JzGNDbV5s&Vz(e~f*u_%ReYyxWV)nnb=F*zvnMLCWGzh;kYsMiT((y41Z z%^pg&_>j8v-udQsF#afpLc`F}bUZe8VgeVpJZ}qi53TD`kdqBClD5qn=#!qEkW50l zkop!zN&vJn$tV{oni?6Krk#0XtNybJ1@{=-Dw3<CjMpm*W^0(YTP*`Jq3_l>FGCfOew2*HHP4_}`H-Fl~ z5IuYr(a4k+P`GDn%k^U~^t>&w4;~-q4&=_>2T{Az=nKmc_3nxL20s--G@tQ|Zs@c^ zF4LYp1d?$MtRg9}Y19T#=^xY3qUJ0_Bkc$3Tq8{44%5dITu5qHf8w=&rH_kk9Y31~dSHD_z zH`1(+Us`$e#$$Ic#E_%z^GyTgA;x9XG{@kf_?Xg#+mmFQQJpFbtA>Sj6@_$fEJ$vYb52tsTQVNx-IAy>1gB$(T$5N7yMp!?QDu=l)S8sC_?39o z>u~nZf?@>K2~*ZcG>nLq46c8Y5E!=Uby)XMmc#wzX^z=Ao2)*I=k{Lpee3UYTe)3OchS2-R@61{`yq@*P$87!a$VavQ_}!&k zj$|SRN0u!13n>t#DmGy^2CfE8$YL+b0$1V?}R`5N?XZ zR_B}Buo_-)cxEvdwhk z=??NCu`cE|m8&|G6Zx9grg}7c@Yrf^06)m(+`@8-fPg&?oNOWLK1@De`9Tl_iPds6 zT^I@XN3#?3;7*mvhbZvK--@I^o|(#&{NK%z|2J&OzpIQr1X)H{Rvmur+P1*0s(v~UF3aW00 z*zb*1xyKZRH_1nY(v8J#qiZ;RNJyW#wDRC<#nt6Y3wejgfTHqwvA(i?X?Y-IA{A%b9=71Vjxz%8sZzh69>kgYLwbM0K}l2 zVUhSC9A^iHie9=0hA>YsXygE(4M}cSUFl=OR_t4aPd9b+KoV@?D&k7;D%~OySFavD zcq?2N5zzc0Caf&eiasWF@x=7H)9S%_vF5t)F^0vr^$2}8 z@cMogMG2KkXE2*J38PGlk`Sich$`@rYQ^{n7CBJ61*(!}JQ6+|$BC?eXY|K@0$H+~ z>oF)~S;&-WXIyU%mAbL#6aEhU9FSOHpjhGawrka->$bxI>EVZPbKM8de3~p{x12_xO~`9Fht=3GSj zxXRGU3qm(}_48tpeo=}7#TIpS^D`v}6V%m^qvO*8So2OFFQkmYPMF#E|sq9A$fzXQjLKNxGdy#ffN)VB)`bl zR{7b1P?O|8_h6>ve-lgokJ^&|`ZHScf7b}SJxozFQvucIcQ-*l*yAPzVK{c0rHAD` zVi|rY6);JWTs(c#+YPB?P^0%8+mp5OaJR4NE6vEs}9&rqc z2rcBXD2&>(BmtmBgiedekaUQA*#{)EbQbb8G(CTQ{?dG{k_Y3pVboI;6r<#h&hp9>aHUz3Lt4RV<*Leyg`p z_xT)z5PmG+;P5&K5QADmQTknI%c$i2@Z-`=LZ-J=U3)!2$U7ejIJ+}ByH0?a%IoQG zno|qf2sM|IG`ea)Bz#Doxi}H8ws^+WAvV3OF`Z%&OFH6ANxcwJ;Td^E0T=+}#?Q*# z+Bk!PVyn=&aCP%D`9;~5p@q;M9dKZPq)3`2e_Cs17lM*`c~}~SbU~Be;~{2D#9+)a z167eFRy|n8>UXxh{NnxInUZ`Y0_#jEfjwLT&xem-Bu&%=*Pcn@tWu;o?CFT6Cj2Bn z@F@|1kaQ^P%(x{1`v^h;Dv1SAJUB%10}6%jEuDpB;s~Wu>wPMd8ua>*0KK3D3CtH@ zHOea_>@cMOQ^B03mrP;r;IurRLIFf~!DToJtZ? zL!tYCB>&qV%9Q+XX375%Tk?0`rX~NU|0b8~D3f>}Xjm=a*cQ$#gML6!t9FUM(7_q- zKw;-)kxpun5blX9TR@GTBdUUL47nO#Eay{7FygSA712D8NrHAtSoDaVf{#En) zBA=!)sB@Y-D8|HQXd$4BJWprLbo!NPZn!Ja|0&dj zWzS*W+|t^GB^(gJ>+3jUt?}i|F39+Uun7)DW@XDn2}1@08*C-Fs5)2 z1`@YrLKI}~RsITJJyaRe9l$L^bmI3A5h!%4<>?}Q3edP8M+S1A8*T@PVD(aRSDn4m zLrr&Qt=C41NVVREEkKqqWsHz>1zH5>HgTNz2R1S#|M#=x|5aP^Z(q=o|4Z=pl+YXe z+d~W`3tz!D;Kfd&8k`8m=b{sIVffQvsE{P?niC2giit@VF{T*N3>_Ltse(r?UXtQq zfN)8dE%!fQ$`<7Fw>wQzxBNlegH_*Yae<_EjYk3tf=vK9lJvzc2%ktCiAK~I9d{PC zw-f{(GzqPPOuQthRVm0ScHL@K0&aE@hmtDyy0^(Eg%G-xW+d=%j*L{g0#_29iFNpv`ZqEzR3&WP`U&By{oIv|E!Qwdujcu1hhK*)dEpCI-byV!` zcsnv6^#Hz&{AetLne*? zwKXGQ0E!MIXs*4^6f||Gisd-g%TB$HmM+MzB}n~xoiMKDjB=@w&3~+sDf!>RlK)q1 z$^Ya(YRT_@8oL4_caNfhG*lnl6xxqO8c=|WX*WUj^(L>e&Z>|5y=`cruo)A5lBdq< za3oCB%ocCKGOG8SNFGO%w!S3JyW4Kd>yp0C>>Ow}kO8k}ALbHbYRVnI-@6d|kqF2y zLf%`1pTrES!=9nNeaghmu|%R4>LVDti#8KIkt?~ zkgrthW7DRiJrWPmdVF9XB>6w+y&xku^z)n>I+Kzc`i2isZs=2gCv!vJGkaH7Zs=QC zfBdqoKi=>Gtv{YZ_3D&}PB_KV69h$ne7ouQ`mjt$|Izt$9C%kZVqNv&|- z6EzpQ$l3)l%gKKjJ9*e>gW|+#yM`lS&@y9KdBC#*_SB*v1ZSWaFlB(;22Lx5LwF+{ z(=h@MCfn$cR3sdFykA%p5 z-a=pyixJAS$}gVRpHtskTQ}_Sd)SunL7qO1Fm_85W(rfPCIZ^VKUZq{&f^%_ z8LAe-356+daAsnF)1hhI%CBK?_>nJDP?-*P%41V~Zy~>e2C;~zU=4CVz>fjaTWJ&h zW*_?vQ0J45BLl0_`Uf>ydJVCJgh!k?(Lt#pMJv$$NC3yqggzHkj@DdxS=D7Bk5d*f zM6LpZgOjIbkt|130-(aE0HsbOLV?L6AP9Ut2V72(t7|B{$3qB-!yq`C&S?mVcV#4E zjrYD`Zs;gR9CI;2+2I%+OhQ6RG?5fc*R&yzhTs%|S)IH<$K}eOI8f$(M}uC@G^Sva zz`d-s76<1M!k?mOh5RA?v9_Ek`Tq?|{$I2u|MzWb$^V%@&gDX)m3!z67|3qXqf$HW zKGHav5HWNSHwmW-v>fJs=p&e{+tj|0u}BWI;?Vo3 z;?X=xFQK%HdO<*JsAr-|ML1_;7EjpA!0cdC=O#vsY$z#Wse2jeB%p5z6fT4o1BDBS zkxwx+a`TJVu<-Zk+C81kpnEzpYvp%jBR~uBQb2-qRNz&nBTV54yhH>;PObzZqDBrA z9wCx=MveIz#@dvY%7Ddy1X!;KOqTPD>)2Q@StigYLd%FCydC{btNy0BKgLO6;O-K3bJDdoqQ|V#$wYqT|u_UWxT? zPn4kzl~4O7ne}NLJV-K=@gemiYAsTo(DnQ! z(rsUEgA0nBrVv>Q%hBbE(yw6ijW(-YDbAW5Jol)$N4H=i?r zo@2F0hYqCSLdAGvTa$SI(amW8(b3LJIXN#WX$_JIYl z&-_>kbc~p>3DD`OW-nC4ZO|A*Q3aIWOH+fP#{7C^;j#OVNZxRhB2eyA9lV{x?ebB68RdkS-r+k2#*LH^*BQp<* zqY)+Ew@gI10WHtQ8~gd+@WPB;0lzs$6{G*vr;-(;f9^rr6|lN4cLf~3eENpL8tx9+ zdtdPsWY|I>#Z}aYFjzO;$-M7HnKjd=P9mhC_LNkhtK^25m8EM34GD?~xgJmyXbsKc-kdV;I7z{DiYlGlDS(Mot_&3l{CIiU`T_vzXI2IqdZ5 zTwAS}?|HoM^-f>(cEpO<^7wR3wV_Df8Fv0OGI?WD$~&9}*|yp2swhk4!HRb`%HsOZ~#l-6RrEo;iJp=uQTAGBAF z_f#44Oo9Z5Dfn8Bv^?YnFq=HzLPk}Cc%R@l0ja>ACE;%_l=wT(m zK?j?y^YqAKoDV7$NFE&drZ5 z*rg-+x^2+{S^Mz>j%$W%)})QwL(Pd=9C})=>20xlC~QIX&9FVz1_%R7dnm#KJ|!__ z^A}LHA2r7zq`h?kypx+v9Pm}*I0E~{vH%BFU4rQ5Ex@IVvI>BSTR$!HG)BT=GorR_EObs$5KTcdF*cqhB23SVR;QW%-w!l zR%6kSQQaL06y{i5mQN(`I1(?xguqsExEq$uD`1Y8-6#gCc2cGfu+jG39JDAXFQQ zcs2%YQ5+tGjJ5M%bQv^bIuRJ|_m4ahM@BoI% z3nF$bSc=Y8g-TfNyFS?G0h0W8?_^5;pJ2)V9$WJN#}N1%T$faMYGee>S#7KFEm!7r=90AbX2TY*TeiI(iM1!pRFY7whF#z`-A@ zZnDi{E5=Ia%ST)2%5(zXEoi~n2cLRHZ2Z}uVXciX73ib^00!JDE!^{@$Z>gA$H+Obg~eH>V^f!v%h~NCwh&Ybui4y28jX34l7W7 z8D|=#5Kz-?)zqna21!H`i!SN|4pf8CZv~WA4bM0T9B3du5d@A-I{P5?!~)>1kOcSX5f+NR4HhUgD^Fi*q==*N1l1HwF;>b&fgYE{y%#| zrsV%Ami#wu$^XgUW6A%r!p%2b$>o^+@A$Mmk zhogp+`qF}jMr$5VB+alSLgKTzpYp~5MMElYtmg+9Z^LVBt-I80s4+?rpQ)}qTT3hb z8Xv5wOyPY}MmS_rAY&m+(M?4gh8-jTzTWq-W!vmVrwN=_@hxw5hI0cSJi` z8UI+C+h@+qNgnM}~B}syXyQf`;@>G>eydK;QVIVa5EHlhW%nmx{DKVwt9_){A@XHXYFHL56zzgxN}(E zq~}zoDOJe8p^HXJ=vg19dj&;RT}MP&oYKg!%|4<}vWRTcjAcCiXZr1|FG;$N(Ruvq z0HPmyX-V`(eLDTlb5C-GXIl6?TYYq{izM5Iflpe>=5RKAPaM#9tET$L02{#)$g(uh< zfOAB+q-~&%eL+PP&y(?25P{|WWjNCNu&di4mtG#+#hx3nD))VG3}^TzEwHoqmC`w# zf_9T4kQi81#TCdIkel6Pm3<$srL@u^2nOyP?367tEF%$SNPh;zcEr;qV!gy{*{=;C zy2uet%#`q~rxZ>O`n-2X($AXw!tszp6E1;fVK|G3jqZ;xDS}39OMN0h(r_UO_fVZ& zMCIvTqrlW$co+w`q4Xrx;+EGH8*q&XoM`XUYFATk?PAueIc#{OMc{3I+LACf5xiwvUW0DP6%w86esp$cGQDL>C6J z=MeBo#>txaSjWfZsgnhxdwBLaZA%!}BuELFb@1+%Vd{8$bPP>?G5S1^4=tY&k=TAp zGd{cr5nHCTW!ejyC2O)!#>c|Q6T!@bVFvSZR%3Ah*BqRS1@@J{4-aI#-SBt_d7P#? z$Ax1)8Dha`#fmt|lVy@3B26p|B^BgMn%qZ|3tI}fQ_Iw0HJnW1P{*Ul6b5C!Bu%p; zVIiZ#P^W>&hEr-;v|%-jBn_p-WJ(AQRFF9#(ooYE56zioXDaIsnn30&a-;ib5cU4; zCKHoH1WEoszBZb*AM67x`QK?v{?EQgOa8z96yn5j3O$$#LgFl9kcpN4FjoHn^+Bf# zB1}xkcMiXxNNF4_mBQ@Up6zZTYmDQ#;4(fufUn?0Os~%y6iu|V+)dN}iHC?}Qj|ml z#c`w=Ba7!OOcrdi#YW{bZhLXO>a}T~XyAFB6K6`eLiCqtoFFh`#RL|9vN{wCBCl*> zoHM)AywU6uj_Jh95`8NnVPk_5B5>LRT=E-H1|v4A>8A$*L%k=U%pAUgWe;xr{-%th zGyWg(`s=tL&NUny8L5t$q2`UBG*OGu4?;PF>Ga}i!|QnvhWHo<6tC{T^yTge!AU|g z$3Vv&ZFF1C-Uii^xUai#esa2eYH8|xW$Enl-0aC&P#7f(Sm$~fL(AyKv{`WgPGO~R zg$}`ypZExzbi7EqNP=y)$JzQ`9Z@7~2SuwZl>b60GPpvU6$gq|G@Gz|X$%ZX8i~@= z_IQ)iVcw73&H9>RamT4Lg+mUfX`R}!(aOo`Q^!WZui-hwwg#Yc5u$q%g-4)=N%G(K z&}c@q;1g#lTCnzu$!NjnAEIc%OL0~JwQ|QsrvCVO)*nA=>yOVrr1i(ke=V2OBE_U7 ztXa~Jn>w78NM}z(STr$w{C*ETb#UH0mY30ILiCY$wSs~lbQbV7C3_oRZcArZ>h)%o zI#M5QODBcqKaYR!UtuO904Amg;*)V!U_qyPuCdOTjyge%+gFO=yIpGt-T zM~E|L9(fk3r#{xrAlMo!DRLRyhi(@tlT)WEr)Fnn<~o(>$tk3Tl`C@_Q|0nx`BY_g zV`g^lq+K>+uADd4)M}UE60APj9SgOGGj9=Y;e65fRWtfWyb)r+$OMmXn92{2QjQEr zUr4NH>MS4jMrzjDHex!MqNl=75;~InpYSpz{|8y}zr&XNe?6)t|III`y#-OWluRf^ z+`vWXoJhJ5c&%p5&YRlY3nM*9m{T#IrIx!Jl>jM-%gf=n5O5l(nc#zQM)%n6)1?~5 zRN7X-Ygm1+J9G*ur8?8p_8LA)1E~Y=>hO$WZ>tJ11ypj1p1F)C+)lIKrW`qxY;bzm z6i{<~9N>n75huhN^4t5tjXiPYVo}Q(2Gg>7BFl122USGB6^AZvmJClSD2h*KY6tz*xiPxe%-!3e=loj{g66g^LxSNF8}CviCA|bQ>0ZZ;sji3 zgEx|nha^Mxp+2Y#V{v<7xuOy(HEz2luS05F4zq;4q3#w6LYJ=5*^c)kf0@tKxv$f2 zFI38?2y#DOA+Y#9qOg1lSL*CDL;f$cWr#M+|;+(yq+> zmHU3E076M&KtfdPQnoxBgXbAU9H84np^B&q+oVyhWa<=U;airWlq50wrHg5oqLm1d zn_GZ=`(;Cki3{Xk5rU+aVPs(X$*yAkAK_wd(%5xXNk>L<+=(l(3-(v@oAEjN7=8*r zSd7d$ICalMkxLo-G-xp&uX$nLqXQ^p<%vnVwgglYWk-_0ku4YC-Sy}+J{&SPcvl{z zHQf*SV*tQrGSK9#?RF29VxBGWFq(T$)$8t^#?gG`xrvNDdEY6PJE+wOd2-Q#E4nf> zEglw?NjeT1we0$?_)gj)Nc!Vvzh^Y}rRV4PU+$$}y!6CO?ygro@*eTR+;Z;ufA!3V zN%Ft;jke_f2cISX%L_O6rgAynXgI-}@5J;Jjx9suCo9v1$+^kGm5VD^w9XIFfoap` zeQb2=4HRYVlB*KGsmKWzDyfOhJ)C(MbNBoDsB4{6X!$zM;n@0q2lXp>D?D*-G0}qQ zsVh&-xjSIR-$;nuv0gR1|CD5J%|`=9ih*)Q9cVl zP*G8exm;aa6F5h##*3v}>S7jYB3(^TT>l2iik!p%ObcBES_FGIP_GRwZXVCfvL9s& zLwX-T;Ukz6=`uTf5*IF+kWM3O7~6n&8UW)e;wm4oeId*~i&WCt9J>!Sn&9b_Nq z9C1pVFI`6+VcCkg4<~zH&*CWd(W9C@1;DN?6=qIC;!GB1@~1~-AM3tTz2W-fCr-ma zQCoYoQa)4K^lE!Bp-Oau@8Yr1^0Colqa+5u<&9Zp^e?TE8D0D7q#6BB(_}_JuOrRq zE8myZ%47FYDRDSP|I;)?^0%zM TxN!4RznRNjy7ZEJa=HHtmp=5l literal 0 HcmV?d00001 diff --git a/testing/btest/scripts/base/protocols/http/100-continue.bro b/testing/btest/scripts/base/protocols/http/100-continue.bro new file mode 100644 index 0000000000..7b7b5bde89 --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/100-continue.bro @@ -0,0 +1,12 @@ +# This tests that the HTTP analyzer does not generate an unmatched_HTTP_reply +# weird as a result of seeing both a 1xx response and the real response to +# a given request. The http scripts should also be able log such replies +# in a way that correlates the final response with the request. +# +# @TEST-EXEC: bro -r $TRACES/http-100-continue.trace %INPUT +# @TEST-EXEC: grep -q unmatched_HTTP_reply weird.log && exit 1 || exit 0 +# @TEST-EXEC: btest-diff http.log + +# The base analysis scripts are loaded by default. +#@load base/protocols/http + From 7af3977a5006002593e2b61c0c86265872b2cdcb Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Tue, 27 Sep 2011 14:15:23 -0500 Subject: [PATCH 2/2] Change logging of HTTP 1xx responses to occur in their own columns. Instead of as entirely new log lines (addresses #411). --- scripts/base/protocols/http/main.bro | 13 ++++++++++++- .../Baseline/istate.events-ssl/receiver.http.log | 6 +++--- .../Baseline/istate.events-ssl/sender.http.log | 6 +++--- .../btest/Baseline/istate.events/receiver.http.log | 6 +++--- .../btest/Baseline/istate.events/sender.http.log | 6 +++--- .../http.log | 6 +++--- .../http.log | 7 +++---- .../http.log | 14 +++++++------- .../http.log | 14 +++++++------- 9 files changed, 44 insertions(+), 34 deletions(-) diff --git a/scripts/base/protocols/http/main.bro b/scripts/base/protocols/http/main.bro index 982d29acda..0cf51cda90 100644 --- a/scripts/base/protocols/http/main.bro +++ b/scripts/base/protocols/http/main.bro @@ -48,6 +48,10 @@ export { status_code: count &log &optional; ## The status message returned by the server. status_msg: string &log &optional; + ## The last 1xx informational reply code returned by the server. + info_code: count &log &optional; + ## The last 1xx informational reply message returned by the server. + info_msg: string &log &optional; ## The filename given in the Content-Disposition header ## sent by the server. filename: string &log &optional; @@ -173,6 +177,11 @@ event http_reply(c: connection, version: string, code: count, reason: string) &p c$http$status_code = code; c$http$status_msg = reason; + if ( code/100 == 1 ) + { + c$http$info_code = code; + c$http$info_msg = reason; + } } event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=5 @@ -249,11 +258,13 @@ event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) & # The reply body is done so we're ready to log. if ( ! is_orig ) { - Log::write(HTTP::LOG, c$http); # If the response was an informational 1xx, we're still expecting # the real response later, so we'll continue using the same record if ( c$http$status_code/100 != 1 ) + { + Log::write(HTTP::LOG, c$http); delete c$http_state$pending[c$http_state$current_response]; + } } } diff --git a/testing/btest/Baseline/istate.events-ssl/receiver.http.log b/testing/btest/Baseline/istate.events-ssl/receiver.http.log index 4d8421ac86..a18242e8da 100644 --- a/testing/btest/Baseline/istate.events-ssl/receiver.http.log +++ b/testing/btest/Baseline/istate.events-ssl/receiver.http.log @@ -1,5 +1,5 @@ #separator \x09 #path http -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port string string string string string count bool count bool count string string table string string table string string file -1316124231.969273 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 0 F 9130 F 200 OK - - - - - text/html - - +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string count string string table string string table string string file +1317149787.593092 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 0 F 9130 F 200 OK - - - - - - - text/html - - diff --git a/testing/btest/Baseline/istate.events-ssl/sender.http.log b/testing/btest/Baseline/istate.events-ssl/sender.http.log index 4d8421ac86..a18242e8da 100644 --- a/testing/btest/Baseline/istate.events-ssl/sender.http.log +++ b/testing/btest/Baseline/istate.events-ssl/sender.http.log @@ -1,5 +1,5 @@ #separator \x09 #path http -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port string string string string string count bool count bool count string string table string string table string string file -1316124231.969273 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 0 F 9130 F 200 OK - - - - - text/html - - +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string count string string table string string table string string file +1317149787.593092 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 0 F 9130 F 200 OK - - - - - - - text/html - - diff --git a/testing/btest/Baseline/istate.events/receiver.http.log b/testing/btest/Baseline/istate.events/receiver.http.log index f1b0fd02ab..3896ee8c3a 100644 --- a/testing/btest/Baseline/istate.events/receiver.http.log +++ b/testing/btest/Baseline/istate.events/receiver.http.log @@ -1,5 +1,5 @@ #separator \x09 #path http -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port string string string string string count bool count bool count string string table string string table string string file -1316124240.720195 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 0 F 9130 F 200 OK - - - - - text/html - - +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string count string string table string string table string string file +1317149750.648989 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 0 F 9130 F 200 OK - - - - - - - text/html - - diff --git a/testing/btest/Baseline/istate.events/sender.http.log b/testing/btest/Baseline/istate.events/sender.http.log index f1b0fd02ab..3896ee8c3a 100644 --- a/testing/btest/Baseline/istate.events/sender.http.log +++ b/testing/btest/Baseline/istate.events/sender.http.log @@ -1,5 +1,5 @@ #separator \x09 #path http -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port string string string string string count bool count bool count string string table string string table string string file -1316124240.720195 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 0 F 9130 F 200 OK - - - - - text/html - - +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string count string string table string string table string string file +1317149750.648989 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 GET www.icir.org / - Wget/1.10 0 F 9130 F 200 OK - - - - - - - text/html - - diff --git a/testing/btest/Baseline/scripts.base.frameworks.logging.ascii-escape-odd-url/http.log b/testing/btest/Baseline/scripts.base.frameworks.logging.ascii-escape-odd-url/http.log index 4f7215e3c7..0f167ded6a 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.logging.ascii-escape-odd-url/http.log +++ b/testing/btest/Baseline/scripts.base.frameworks.logging.ascii-escape-odd-url/http.log @@ -1,5 +1,5 @@ #separator \x09 #path http -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port string string string string string count bool count bool count string string table string string table string string file -1315799856.264750 UWkUyAuUGXf 10.0.1.104 64216 193.40.5.162 80 GET lepo.it.da.ut.ee /~cect/teoreetilised seminarid_2010/arheoloogia_uurimisr\xfchma_seminar/Joyce et al - The Languages of Archaeology ~ Dialogue, Narrative and Writing.pdf - Wget/1.12 (darwin10.8.0) 0 F 346 F 404 Not Found - - - - - text/html - - +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string count string string table string string table string string file +1315799856.264750 UWkUyAuUGXf 10.0.1.104 64216 193.40.5.162 80 GET lepo.it.da.ut.ee /~cect/teoreetilised seminarid_2010/arheoloogia_uurimisr\xfchma_seminar/Joyce et al - The Languages of Archaeology ~ Dialogue, Narrative and Writing.pdf - Wget/1.12 (darwin10.8.0) 0 F 346 F 404 Not Found - - - - - - - text/html - - diff --git a/testing/btest/Baseline/scripts.base.protocols.http.100-continue/http.log b/testing/btest/Baseline/scripts.base.protocols.http.100-continue/http.log index a9d02efa09..10a6afcb37 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.100-continue/http.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.100-continue/http.log @@ -1,6 +1,5 @@ #separator \x09 #path http -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port string string string string string count bool count bool count string string table string string table string string file -1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 - F 0 F 100 Continue - - - - - - - - -1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 2001 F 60731 F 200 OK - - - - - text/html - - +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string count string string table string string table string string file +1237440095.634312 UWkUyAuUGXf 192.168.3.103 54102 128.146.216.51 80 POST www.osu.edu / - curl/7.17.1 (i386-apple-darwin8.11.1) libcurl/7.17.1 zlib/1.2.3 2001 F 60731 F 200 OK 100 Continue - - - - - text/html - - diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-mime-and-md5/http.log b/testing/btest/Baseline/scripts.base.protocols.http.http-mime-and-md5/http.log index d69b3e5b1a..3c58932940 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.http-mime-and-md5/http.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-mime-and-md5/http.log @@ -1,9 +1,9 @@ #separator \x09 #path http -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied mime_type md5 extraction_file -#types time string addr port addr port string string string string string count bool count bool count string string table string string table string string file -1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 2675 F 200 OK - - - - - FAKE_MIME - - -1258577884.960135 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /script/urchin.js http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 21421 F 200 OK - - - - - FAKE_MIME - - -1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 94 F 200 OK - - - - - FAKE_MIME - - -1258577885.349639 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/key-point-top.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 2349 F 200 OK - - - - - image/png e0029eea80812e9a8e57b8d05d52938a - -1258577885.394612 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /projects/calendar/images/header-sunbird.png http://www.mozilla.org/projects/calendar/calendar.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 27579 F 200 OK - - - - - image/png 30aa926344f58019d047e85ba049ca1e - +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string count string string table string string table string string file +1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 2675 F 200 OK - - - - - - - FAKE_MIME - - +1258577884.960135 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /script/urchin.js http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 21421 F 200 OK - - - - - - - FAKE_MIME - - +1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 94 F 200 OK - - - - - - - FAKE_MIME - - +1258577885.349639 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/key-point-top.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 2349 F 200 OK - - - - - - - image/png e0029eea80812e9a8e57b8d05d52938a - +1258577885.394612 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /projects/calendar/images/header-sunbird.png http://www.mozilla.org/projects/calendar/calendar.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 27579 F 200 OK - - - - - - - image/png 30aa926344f58019d047e85ba049ca1e - diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-pipelining/http.log b/testing/btest/Baseline/scripts.base.protocols.http.http-pipelining/http.log index 4ef6d2ee1c..e5e3579a7b 100644 --- a/testing/btest/Baseline/scripts.base.protocols.http.http-pipelining/http.log +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-pipelining/http.log @@ -1,9 +1,9 @@ #separator \x09 #path http -#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg filename tags username password proxied md5 extraction_file -#types time string addr port addr port string string string string string count bool count bool count string string table string string table string file -1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 2675 F 200 OK - - - - - - - -1258577884.960135 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /script/urchin.js http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 21421 F 200 OK - - - - - - - -1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 94 F 200 OK - - - - - - - -1258577885.349639 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/key-point-top.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 2349 F 200 OK - - - - - - - -1258577885.394612 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /projects/calendar/images/header-sunbird.png http://www.mozilla.org/projects/calendar/calendar.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 27579 F 200 OK - - - - - - - +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p method host uri referrer user_agent request_body_len request_body_interrupted response_body_len response_body_interrupted status_code status_msg info_code info_msg filename tags username password proxied md5 extraction_file +#types time string addr port addr port string string string string string count bool count bool count string count string string table string string table string file +1258577884.844956 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /style/enhanced.css http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 2675 F 200 OK - - - - - - - - - +1258577884.960135 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /script/urchin.js http://www.mozilla.org/projects/calendar/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 21421 F 200 OK - - - - - - - - - +1258577885.317160 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/bullet_utility.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 94 F 200 OK - - - - - - - - - +1258577885.349639 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /images/template/screen/key-point-top.png http://www.mozilla.org/style/screen.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 2349 F 200 OK - - - - - - - - - +1258577885.394612 UWkUyAuUGXf 192.168.1.104 1673 63.245.209.11 80 GET www.mozilla.org /projects/calendar/images/header-sunbird.png http://www.mozilla.org/projects/calendar/calendar.css Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 0 F 27579 F 200 OK - - - - - - - - -