Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Switch to recording unmodified HTTP header.

Browse source 
We used to attempt to remove any port specification before recording
HTTP host headers in logs. Doing so would (1) remove potentially useful
information, (2) not match what the documentation seemed to suggest, and
(3) fail for IP6 addresses containing colons.

We now record the original HOST header as is.

Addresses #1844.
This commit is contained in:
Robin Sommer 2021-12-21 08:32:32 +01:00
parent 1e60264548
commit a7427e95bf
No known key found for this signature in database
GPG key ID: 6BEDA4DA6B8B23E3
6 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/base/protocols/http/main.zeek
View file

@ -263,8 +263,9 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
c$http$referrer = value;
else if ( name == "HOST" )
# The split is done to remove the occasional port value that shows up here.
c$http$host = split_string1(value, /:/)[0];
# Per #1844, we record the original host header, including any port
# specification if present.
c$http$host = value;
else if ( name == "RANGE" )
c$http$range_request = T;