mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 11:08:20 +00:00
Fix handling of HTTP 1xx response codes (addresses #411).
Changed the parser to not treat 1xx response codes as a final answer to an unanswered request -- a later response is still expected. The scripting layer will also not finish a request-reply pair when seeing 1xx's, instead it logs both the 1xx and final response messages with associated information of the current request as they're seen.
This commit is contained in:
parent
24bb14390b
commit
64e821624b
5 changed files with 31 additions and 4 deletions
12
testing/btest/scripts/base/protocols/http/100-continue.bro
Normal file
12
testing/btest/scripts/base/protocols/http/100-continue.bro
Normal file
|
@ -0,0 +1,12 @@
|
|||
# This tests that the HTTP analyzer does not generate an unmatched_HTTP_reply
|
||||
# weird as a result of seeing both a 1xx response and the real response to
|
||||
# a given request. The http scripts should also be able log such replies
|
||||
# in a way that correlates the final response with the request.
|
||||
#
|
||||
# @TEST-EXEC: bro -r $TRACES/http-100-continue.trace %INPUT
|
||||
# @TEST-EXEC: grep -q unmatched_HTTP_reply weird.log && exit 1 || exit 0
|
||||
# @TEST-EXEC: btest-diff http.log
|
||||
|
||||
# The base analysis scripts are loaded by default.
|
||||
#@load base/protocols/http
|
||||
|
Loading…
Add table
Add a link
Reference in a new issue