diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc index 0009db0e55..cbe8320ed5 100644 --- a/src/analyzer/protocol/http/HTTP.cc +++ b/src/analyzer/protocol/http/HTTP.cc @@ -609,10 +609,10 @@ void HTTP_Message::Done(const int interrupted, const char* detail) int HTTP_Message::Undelivered(int64_t len) { - if ( ! top_level ) - return 0; + HTTP_Entity* e = current_entity ? current_entity + : static_cast(top_level); - if ( ((HTTP_Entity*) top_level)->Undelivered(len) ) + if ( e && e->Undelivered(len) ) { content_gap_length += len; return 1; diff --git a/testing/btest/Traces/http/content-range-gap-skip.trace b/testing/btest/Traces/http/content-range-gap-skip.trace new file mode 100644 index 0000000000..1bb0268259 Binary files /dev/null and b/testing/btest/Traces/http/content-range-gap-skip.trace differ diff --git a/testing/btest/scripts/base/protocols/http/content-range-gap-skip.bro b/testing/btest/scripts/base/protocols/http/content-range-gap-skip.bro new file mode 100644 index 0000000000..b96b8f02a6 --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/content-range-gap-skip.bro @@ -0,0 +1,26 @@ +# @TEST-EXEC: bro -r $TRACES/http/content-range-gap-skip.trace %INPUT + +# In this trace, we should be able to determine that a gap lies +# entirely within the body of an entity that specifies Content-Range, +# and so further deliveries after the gap can still be made. + +global got_gap = F; +global got_data_after_gap = F; + +event http_entity_data(c: connection, is_orig: bool, length: count, + data: string) + { + if ( got_gap ) + got_data_after_gap = T; + } + +event content_gap(c: connection, is_orig: bool, seq: count, length: count) + { + got_gap = T; + } + +event bro_done() + { + if ( ! got_data_after_gap ) + exit(1); + }