diff --git a/CHANGES b/CHANGES index 8e10385099..64a51fd9b9 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,12 @@ +3.1.0-dev.209 | 2019-10-28 09:17:15 +0000 + + * Fix HTTP::build_url. (Alexey Mokeev) + + * Free memory allocated by glob() in plugin manager. (Arne Welzel) + + * Remove always-false condition in plugin manager. (Arne Welzel) + 3.1.0-dev.203 | 2019-10-25 10:41:10 -0700 * Change usage of old bro:see directive to zeek:see (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index c84ae57562..3cbcab6c0d 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.1.0-dev.203 +3.1.0-dev.209 diff --git a/scripts/base/protocols/http/utils.zeek b/scripts/base/protocols/http/utils.zeek index a48841cef5..dcdbe4bc8e 100644 --- a/scripts/base/protocols/http/utils.zeek +++ b/scripts/base/protocols/http/utils.zeek @@ -55,9 +55,13 @@ function extract_keys(data: string, kv_splitter: pattern): string_vec function build_url(rec: Info): string { local uri = rec?$uri ? rec$uri : "/"; + if ( strstr(uri, "://") != 0 ) + return uri; + local host = rec?$host ? rec$host : addr_to_uri(rec$id$resp_h); - if ( rec$id$resp_p != 80/tcp ) - host = fmt("%s:%s", host, rec$id$resp_p); + local resp_p = port_to_count(rec$id$resp_p); + if ( resp_p != 80 ) + host = fmt("%s:%d", host, resp_p); return fmt("%s%s", host, uri); } diff --git a/testing/btest/Baseline/scripts.base.protocols.http.build-url/output b/testing/btest/Baseline/scripts.base.protocols.http.build-url/output new file mode 100644 index 0000000000..90e04842a8 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.build-url/output @@ -0,0 +1,4 @@ +Have: 192.150.187.43/download/CHANGES.bro-aux.txt Expected: 192.150.187.43/download/CHANGES.bro-aux.txt -> SUCCESS +Have: 192.150.187.43:123/download/CHANGES.bro-aux.txt Expected: 192.150.187.43:123/download/CHANGES.bro-aux.txt -> SUCCESS +Have: 192.150.187.43:123/ Expected: 192.150.187.43:123/ -> SUCCESS +Have: http://proxied.host/some/document Expected: http://proxied.host/some/document -> SUCCESS diff --git a/testing/btest/scripts/base/protocols/http/build-url.zeek b/testing/btest/scripts/base/protocols/http/build-url.zeek new file mode 100644 index 0000000000..0a1b5b53cf --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/build-url.zeek @@ -0,0 +1,23 @@ +# @TEST-EXEC: zeek -r $TRACES/http/get.trace %INPUT >output +# @TEST-EXEC: btest-diff output + +function test(rec: HTTP::Info, expect: string) + { + local result = HTTP::build_url(rec); + print fmt("Have: %s Expected: %s -> %s", result, expect, (result == expect ? "SUCCESS" : "FAIL")); + } + +event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string) &priority=5 + { + test(c$http, "192.150.187.43/download/CHANGES.bro-aux.txt"); + + # We fake some request instances for testing. + c$http$id$resp_p = 123/tcp; + test(c$http, "192.150.187.43:123/download/CHANGES.bro-aux.txt"); + + c$http$uri = "/"; + test(c$http, "192.150.187.43:123/"); + + c$http$uri = "http://proxied.host/some/document"; + test(c$http, "http://proxied.host/some/document"); + }