Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Tweaking how HTTP requests without URIs are handled.

Browse source 
The change from #49 made it an error to not have a URI. That however
then led requests with an URI yet no version to abort as well.
Instead, we now check if the token following the method is an "HTTP/"
version identifier. If, so accept that the URI is empty (and trigger
a weird) but otherwise keep processing.

Adding test cases for both HTTP requests without URI and without
version.
This commit is contained in:
Robin Sommer 2016-01-15 12:45:19 -08:00
parent adb3fab019
commit 642ef5d3c1
12 changed files with 60 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/analyzer/protocol/http/HTTP.cc
View file

@ -1249,11 +1249,11 @@ int HTTP_Analyzer::ParseRequest(const char* line, const char* end_of_line)
break;
}
if ( end_of_uri >= end_of_line )
{
Weird("missing_HTTP_uri");
return 0;
}
if ( end_of_uri >= end_of_line && PrefixMatch(line, end_of_line, "HTTP/") )
{
Weird("missing_HTTP_uri");
end_of_uri = line; // Leave URI empty.
}
for ( version_start = end_of_uri; version_start < end_of_line; ++version_start )
{