Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

GH-854: provide access to original HTTP/MIME header names

Browse source 
The "http_header" event now has an "original_name" parameter that allows
access to the original header name (the "name" parameter reamins the
same as before: it's the uppercased header name).

The "mime_header_rec" record type now also includes an "original_name"
field to similarly provide access to original header name in the
following events: "http_all_headers", "mime_one_header", and
"mime_all_headers".
This commit is contained in:
Jon Siwek 2020-04-20 16:56:41 -07:00
parent 8843f69002
commit 5032993b94
8 changed files with 148 additions and 142 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/analyzer/protocol/http/HTTP.cc
View file

@ -1672,6 +1672,7 @@ void HTTP_Analyzer::HTTP_Header(bool is_orig, mime::MIME_Header* h)
EnqueueConnEvent(http_header,
IntrusivePtr{AdoptRef{}, BuildConnVal()},
IntrusivePtr{AdoptRef{}, val_mgr->GetBool(is_orig)},
IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_name())},
IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_name())->ToUpper()},
IntrusivePtr{AdoptRef{}, mime::new_string_val(h->get_value())}
);