From b12d2c768e269e2c5494c380c977358228a5c41e Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Mon, 14 Nov 2011 15:24:15 -0500 Subject: [PATCH] Tiny bugfix for http file extraction along with test. --- scripts/base/protocols/http/file-extract.bro | 2 +- ...64.125:56730-125.190.109.199:80_resp_1.dat | 304 ++++++++++++++++++ .../http.log | 5 + .../protocols/http/http-extract-files.bro | 5 + 4 files changed, 315 insertions(+), 1 deletion(-) create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat create mode 100644 testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http.log create mode 100644 testing/btest/scripts/base/protocols/http/http-extract-files.bro diff --git a/scripts/base/protocols/http/file-extract.bro b/scripts/base/protocols/http/file-extract.bro index d36d95e475..4bf036fab8 100644 --- a/scripts/base/protocols/http/file-extract.bro +++ b/scripts/base/protocols/http/file-extract.bro @@ -33,7 +33,7 @@ export { event http_entity_data(c: connection, is_orig: bool, length: count, data: string) &priority=5 { # Client body extraction is not currently supported in this script. - if ( is_orig || ! c$http$first_chunk ) return; + if ( is_orig ) return; if ( c$http$first_chunk ) { diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat b/testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat new file mode 100644 index 0000000000..73c369dd14 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat @@ -0,0 +1,304 @@ + +ICIR + +ICIR
+

+ICIR (The ICSI Center for Internet Research) +is a +non-profit +research institute at +ICSI +in +Berkeley, +California.
+For the three years from 1999 to 2001 we were named +ACIRI, the AT&T Center for Internet Research at ICSI, +and were funded by AT&T.
+ +The goals of ICIR are to: +

+

+ +

+ +
+ + + + + + + + + + +
+ +

+People +

+ + +		 + +

+Publications +

+ + +

+Projects +

+ + + +		 + +

Research

+   Transport and Congestion + + +   Traffic and Topology +
    +
  • +IDMaps +(Internet Distance Mapping). +
  • The +Internet Traffic Archive. +
  • +MINC +(Multicast-based Inference of Network-internal Characteristics). +
  • +NIMI +(National Internet Measurement Infrastructure). +
+ +

+ +Collaborators +

+ + + +
+
+ +
+

Information for visitors and local users.

+
+Last modified: June 2004. Copyright notice. + +Older versions of this web page, in its ACIRI incarnation.. +
+For more information about this server, mail www@aciri.org. +
+To report unusual activity by any of our hosts, mail abuse@aciri.org. + diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http.log b/testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http.log new file mode 100644 index 0000000000..386eaf8901 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http.log @@ -0,0 +1,5 @@ +#separator \x09 +#path http +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied mime_type md5 extraction_file +#types time string addr port addr port count string string string string string count count count string count string string table string string table string string file +1128727435.634189 arKYeMETxOg 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - - - - - text/html - http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat diff --git a/testing/btest/scripts/base/protocols/http/http-extract-files.bro b/testing/btest/scripts/base/protocols/http/http-extract-files.bro new file mode 100644 index 0000000000..4338cddb47 --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/http-extract-files.bro @@ -0,0 +1,5 @@ +# @TEST-EXEC: bro -C -r $TRACES/web.trace %INPUT +# @TEST-EXEC: btest-diff http.log +# @TEST-EXEC: btest-diff http-item_141.42.64.125:56730-125.190.109.199:80_resp_1.dat + +redef HTTP::extract_file_types += /text\/html/; \ No newline at end of file