Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 02:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix incorrect data delivery skips after gap in HTTP Content-Range.

Browse source 
The logic for determining whether a gap was entirely within a MIME
entity body was not asking the current entity, which may be better able
to answer that question if it was using the Content-Range header and
thus knows if the gap exceeds the length of the body that's still
expected.

Addresses BIT-1247
This commit is contained in:
Jon Siwek 2014-09-11 14:53:47 -05:00
parent 1e02d5d5b5
commit af9d31dcc1
3 changed files with 29 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/analyzer/protocol/http/HTTP.cc
View file

@ -609,10 +609,10 @@ void HTTP_Message::Done(const int interrupted, const char* detail)
int HTTP_Message::Undelivered(int64_t len)
{
if ( ! top_level )
return 0;
HTTP_Entity* e = current_entity ? current_entity
: static_cast<HTTP_Entity*>(top_level);
if ( ((HTTP_Entity*) top_level)->Undelivered(len) )
if ( e && e->Undelivered(len) )
{
content_gap_length += len;
return 1;

BIN
testing/btest/Traces/http/content-range-gap-skip.trace Normal file
View file

Binary file not shown.

26
testing/btest/scripts/base/protocols/http/content-range-gap-skip.bro Normal file
View file

@ -0,0 +1,26 @@
# @TEST-EXEC: bro -r $TRACES/http/content-range-gap-skip.trace %INPUT
# In this trace, we should be able to determine that a gap lies
# entirely within the body of an entity that specifies Content-Range,
# and so further deliveries after the gap can still be made.
global got_gap = F;
global got_data_after_gap = F;
event http_entity_data(c: connection, is_orig: bool, length: count,
data: string)
{
if ( got_gap )
got_data_after_gap = T;
}
event content_gap(c: connection, is_orig: bool, seq: count, length: count)
{
got_gap = T;
}
event bro_done()
{
if ( ! got_data_after_gap )
exit(1);
}