Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix handling of HTTP 1xx response codes (addresses #411).

Browse source 
Changed the parser to not treat 1xx response codes as a final answer
to an unanswered request -- a later response is still expected.

The scripting layer will also not finish a request-reply pair when
seeing 1xx's, instead it logs both the 1xx and final response messages
with associated information of the current request as they're seen.
This commit is contained in:
Jon Siwek 2011-09-26 17:37:29 -05:00
parent 24bb14390b
commit 64e821624b
5 changed files with 31 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/protocols/http/main.bro
View file

@ -163,8 +163,12 @@ event http_reply(c: connection, version: string, code: count, reason: string) &p
local s: State;
c$http_state = s;
}
++c$http_state$current_response;
# If the last response was an informational 1xx, we're still expecting
# the real response to the request, so don't create a new Info record yet.
if ( c$http_state$current_response !in c$http_state$pending ||
c$http_state$pending[c$http_state$current_response]$status_code/100 != 1 )
++c$http_state$current_response;
set_state(c, F, F);
c$http$status_code = code;
@ -246,7 +250,10 @@ event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &
if ( ! is_orig )
{
Log::write(HTTP::LOG, c$http);
delete c$http_state$pending[c$http_state$current_response];
# If the response was an informational 1xx, we're still expecting
# the real response later, so we'll continue using the same record
if ( c$http$status_code/100 != 1 )
delete c$http_state$pending[c$http_state$current_response];
}
}