Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix a bug where orig file information in http wasn't working right.

Browse source
This commit is contained in:
Seth Hall 2013-07-12 16:12:26 -04:00
parent b14f5a853e
commit 4dd4c5344e
1 changed files with 15 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

31
scripts/base/protocols/http/entities.bro
View file

@ -15,24 +15,23 @@ export {
redef record Info += {
## An ordered vector of file unique IDs.
orig_fuids: vector of string &log &optional;
orig_fuids: vector of string &log &optional;
## An ordered vector of mime types.
orig_mime_types: vector of string &log &optional;
## An ordered vector of file unique IDs.
resp_fuids: vector of string &log &optional;
resp_fuids: vector of string &log &optional;
## An ordered vector of mime types.
resp_mime_types: vector of string &log &optional;
## The current entity being seen.
entity: Entity &optional;
## The current entity.
current_entity: Entity &optional;
## Current number of MIME entities in the HTTP request message body.
orig_mime_depth: count &default=0;
orig_mime_depth: count &default=0;
## Current number of MIME entities in the HTTP response message body.
resp_mime_depth: count &default=0;
resp_mime_depth: count &default=0;
};
}
@ -45,7 +44,7 @@ event http_begin_entity(c: connection, is_orig: bool) &priority=10
else
++c$http$resp_mime_depth;
c$http$entity = Entity();
c$http$current_entity = Entity();
}
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=3
@ -53,12 +52,12 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
if ( name == "CONTENT-DISPOSITION" &&
/[fF][iI][lL][eE][nN][aA][mM][eE]/ in value )
{
c$http$entity$filename = extract_filename_from_content_disposition(value);
c$http$current_entity$filename = extract_filename_from_content_disposition(value);
}
else if ( name == "CONTENT-TYPE" &&
/[nN][aA][mM][eE][:blank:]*=/ in value )
{
c$http$entity$filename = extract_filename_from_content_disposition(value);
c$http$current_entity$filename = extract_filename_from_content_disposition(value);
}
}
@ -66,13 +65,13 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
{
if ( f$source == "HTTP" && c?$http )
{
if ( c$http?$entity && c$http$entity?$filename )
f$info$filename = c$http$entity$filename;
if ( c$http?$current_entity && c$http$current_entity?$filename )
f$info$filename = c$http$current_entity$filename;
if ( f$is_orig )
{
if ( ! c$http?$resp_mime_types )
c$http$resp_fuids = string_vec(f$id);
if ( ! c$http?$orig_mime_types )
c$http$orig_fuids = string_vec(f$id);
else
c$http$orig_fuids[|c$http$orig_fuids|] = f$id;
@ -105,6 +104,6 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
event http_end_entity(c: connection, is_orig: bool) &priority=5
{
if ( c?$http && c$http?$entity )
delete c$http$entity;
if ( c?$http && c$http?$current_entity )
delete c$http$current_entity;
}