Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 08:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix HTTP evasion

Browse source 
- Happen when there is no CRLF at the end of HTTP
    - Fix by adding CRLF when packet is complete (in relation to content-length in header)
This commit is contained in:
jerome Grandvalet 2021-07-23 09:28:29 +02:00
parent 9383c926ad
commit 8cabecec40
8 changed files with 74 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
testing/btest/scripts/base/protocols/http/http-no-crlf.zeek Normal file
View file

@ -0,0 +1,10 @@
# This tests that the HTTP analyzer handles HTTP with no CRLF at end correctly.
# @TEST-EXEC: zeek -b -r $TRACES/http/no_crlf.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff http.log
# @TEST-EXEC: test ! -f weird.log
@load base/protocols/conn
@load base/protocols/http
@load base/frameworks/dpd