mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 02:58:20 +00:00
Reformat the world
This commit is contained in:
Tim Wojtulewicz
parent
194cb24547
commit
b2f171ec69
714 changed files with 35149 additions and 35203 deletions
|
|
@ -2,19 +2,20 @@
|
|||
|
||||
#pragma once
|
||||
|
||||
#include "zeek/analyzer/protocol/tcp/TCP.h"
|
||||
#include "zeek/analyzer/protocol/tcp/ContentLine.h"
|
||||
#include "zeek/analyzer/protocol/pia/PIA.h"
|
||||
#include "zeek/analyzer/protocol/zip/ZIP.h"
|
||||
#include "zeek/analyzer/protocol/mime/MIME.h"
|
||||
#include "zeek/binpac_zeek.h"
|
||||
#include "zeek/IPAddr.h"
|
||||
|
||||
#include "zeek/analyzer/protocol/http/events.bif.h"
|
||||
#include "zeek/analyzer/protocol/mime/MIME.h"
|
||||
#include "zeek/analyzer/protocol/pia/PIA.h"
|
||||
#include "zeek/analyzer/protocol/tcp/ContentLine.h"
|
||||
#include "zeek/analyzer/protocol/tcp/TCP.h"
|
||||
#include "zeek/analyzer/protocol/zip/ZIP.h"
|
||||
#include "zeek/binpac_zeek.h"
|
||||
|
||||
namespace zeek::analyzer::http {
|
||||
namespace zeek::analyzer::http
|
||||
{
|
||||
|
||||
enum CHUNKED_TRANSFER_STATE {
|
||||
enum CHUNKED_TRANSFER_STATE
|
||||
{
|
||||
NON_CHUNKED_TRANSFER,
|
||||
BEFORE_CHUNK,
|
||||
EXPECT_CHUNK_SIZE,
|
||||
|
|
@ -22,29 +23,32 @@ enum CHUNKED_TRANSFER_STATE {
|
|||
EXPECT_CHUNK_DATA_CRLF,
|
||||
EXPECT_CHUNK_TRAILER,
|
||||
EXPECT_NOTHING,
|
||||
};
|
||||
};
|
||||
|
||||
class HTTP_Entity;
|
||||
class HTTP_Message;
|
||||
class HTTP_Analyzer;
|
||||
|
||||
class HTTP_Entity final : public analyzer::mime::MIME_Entity {
|
||||
class HTTP_Entity final : public analyzer::mime::MIME_Entity
|
||||
{
|
||||
public:
|
||||
HTTP_Entity(HTTP_Message* msg, analyzer::mime::MIME_Entity* parent_entity,
|
||||
int expect_body);
|
||||
HTTP_Entity(HTTP_Message* msg, analyzer::mime::MIME_Entity* parent_entity, int expect_body);
|
||||
~HTTP_Entity() override
|
||||
{
|
||||
if ( zip )
|
||||
{ zip->Done(); delete zip; }
|
||||
{
|
||||
zip->Done();
|
||||
delete zip;
|
||||
}
|
||||
}
|
||||
|
||||
void EndOfData() override;
|
||||
void Deliver(int len, const char* data, bool trailing_CRLF) override;
|
||||
bool Undelivered(int64_t len);
|
||||
int64_t BodyLength() const { return body_length; }
|
||||
int64_t HeaderLength() const { return header_length; }
|
||||
void SkipBody() { deliver_body = 0; }
|
||||
const string& FileID() const { return precomputed_file_id; }
|
||||
int64_t BodyLength() const { return body_length; }
|
||||
int64_t HeaderLength() const { return header_length; }
|
||||
void SkipBody() { deliver_body = 0; }
|
||||
const string& FileID() const { return precomputed_file_id; }
|
||||
|
||||
protected:
|
||||
class UncompressedOutput;
|
||||
|
|
@ -58,7 +62,13 @@ protected:
|
|||
int expect_body;
|
||||
int64_t body_length;
|
||||
int64_t header_length;
|
||||
enum { IDENTITY, GZIP, COMPRESS, DEFLATE } encoding;
|
||||
enum
|
||||
{
|
||||
IDENTITY,
|
||||
GZIP,
|
||||
COMPRESS,
|
||||
DEFLATE
|
||||
} encoding;
|
||||
analyzer::zip::ZIP_Analyzer* zip;
|
||||
bool deliver_body;
|
||||
bool is_partial_content;
|
||||
|
|
@ -67,7 +77,10 @@ protected:
|
|||
bool send_size; // whether to send size indication to FAF
|
||||
std::string precomputed_file_id;
|
||||
|
||||
analyzer::mime::MIME_Entity* NewChildEntity() override { return new HTTP_Entity(http_message, this, 1); }
|
||||
analyzer::mime::MIME_Entity* NewChildEntity() override
|
||||
{
|
||||
return new HTTP_Entity(http_message, this, 1);
|
||||
}
|
||||
|
||||
void DeliverBody(int len, const char* data, bool trailing_CRLF);
|
||||
void DeliverBodyClear(int len, const char* data, bool trailing_CRLF);
|
||||
|
|
@ -78,13 +91,14 @@ protected:
|
|||
|
||||
void SubmitHeader(analyzer::mime::MIME_Header* h) override;
|
||||
void SubmitAllHeaders() override;
|
||||
};
|
||||
};
|
||||
|
||||
enum {
|
||||
enum
|
||||
{
|
||||
HTTP_BODY_NOT_EXPECTED,
|
||||
HTTP_BODY_EXPECTED,
|
||||
HTTP_BODY_MAYBE,
|
||||
};
|
||||
};
|
||||
|
||||
// Finishing HTTP Messages:
|
||||
//
|
||||
|
|
@ -97,12 +111,13 @@ enum {
|
|||
// HTTP_Message::EndEntity -> Message::Done
|
||||
// HTTP_MessageDone -> {Request,Reply}Made
|
||||
|
||||
class HTTP_Message final : public analyzer::mime::MIME_Message {
|
||||
friend class HTTP_Entity;
|
||||
class HTTP_Message final : public analyzer::mime::MIME_Message
|
||||
{
|
||||
friend class HTTP_Entity;
|
||||
|
||||
public:
|
||||
HTTP_Message(HTTP_Analyzer* analyzer, analyzer::tcp::ContentLine_Analyzer* cl,
|
||||
bool is_orig, int expect_body, int64_t init_header_length);
|
||||
HTTP_Message(HTTP_Analyzer* analyzer, analyzer::tcp::ContentLine_Analyzer* cl, bool is_orig,
|
||||
int expect_body, int64_t init_header_length);
|
||||
~HTTP_Message() override;
|
||||
void Done(bool interrupted, const char* msg);
|
||||
void Done() override { Done(false, "message ends normally"); }
|
||||
|
|
@ -123,11 +138,10 @@ public:
|
|||
void SetDeliverySize(int64_t length);
|
||||
void SkipEntityData();
|
||||
|
||||
HTTP_Analyzer* MyHTTP_Analyzer() const
|
||||
{ return (HTTP_Analyzer*) analyzer; }
|
||||
HTTP_Analyzer* MyHTTP_Analyzer() const { return (HTTP_Analyzer*)analyzer; }
|
||||
|
||||
void Weird(const char* msg);
|
||||
bool IsOrig() { return is_orig; }
|
||||
bool IsOrig() { return is_orig; }
|
||||
|
||||
protected:
|
||||
HTTP_Analyzer* analyzer;
|
||||
|
|
@ -138,8 +152,8 @@ protected:
|
|||
|
||||
double start_time;
|
||||
|
||||
int64_t body_length; // total length of entity bodies
|
||||
int64_t header_length; // total length of headers, including the request/reply line
|
||||
int64_t body_length; // total length of entity bodies
|
||||
int64_t header_length; // total length of headers, including the request/reply line
|
||||
|
||||
// Total length of content gaps that are "successfully" skipped.
|
||||
// Note: this might NOT include all content gaps!
|
||||
|
|
@ -148,9 +162,10 @@ protected:
|
|||
HTTP_Entity* current_entity;
|
||||
|
||||
RecordValPtr BuildMessageStat(bool interrupted, const char* msg);
|
||||
};
|
||||
};
|
||||
|
||||
class HTTP_Analyzer final : public analyzer::tcp::TCP_ApplicationAnalyzer {
|
||||
class HTTP_Analyzer final : public analyzer::tcp::TCP_ApplicationAnalyzer
|
||||
{
|
||||
public:
|
||||
HTTP_Analyzer(Connection* conn);
|
||||
|
||||
|
|
@ -162,7 +177,7 @@ public:
|
|||
|
||||
void SkipEntityData(bool is_orig);
|
||||
|
||||
bool IsConnectionClose() { return connection_close; }
|
||||
bool IsConnectionClose() { return connection_close; }
|
||||
int HTTP_ReplyCode() const { return reply_code; };
|
||||
|
||||
// Overriden from Analyzer.
|
||||
|
|
@ -176,19 +191,20 @@ public:
|
|||
void ConnectionReset() override;
|
||||
void PacketWithRST() override;
|
||||
|
||||
struct HTTP_VersionNumber {
|
||||
struct HTTP_VersionNumber
|
||||
{
|
||||
uint8_t major = 0;
|
||||
uint8_t minor = 0;
|
||||
|
||||
bool operator==(const HTTP_VersionNumber& other) const
|
||||
{ return minor == other.minor && major == other.major; }
|
||||
{
|
||||
return minor == other.minor && major == other.major;
|
||||
}
|
||||
|
||||
bool operator!=(const HTTP_VersionNumber& other) const
|
||||
{ return ! operator==(other); }
|
||||
bool operator!=(const HTTP_VersionNumber& other) const { return ! operator==(other); }
|
||||
|
||||
double ToDouble() const
|
||||
{ return major + minor * 0.1; }
|
||||
};
|
||||
double ToDouble() const { return major + minor * 0.1; }
|
||||
};
|
||||
|
||||
double GetRequestVersion() { return request_version.ToDouble(); };
|
||||
double GetReplyVersion() { return reply_version.ToDouble(); };
|
||||
|
|
@ -197,14 +213,14 @@ public:
|
|||
int GetRequestOngoing() { return request_ongoing; };
|
||||
int GetReplyOngoing() { return reply_ongoing; };
|
||||
|
||||
static analyzer::Analyzer* Instantiate(Connection* conn)
|
||||
{ return new HTTP_Analyzer(conn); }
|
||||
static analyzer::Analyzer* Instantiate(Connection* conn) { return new HTTP_Analyzer(conn); }
|
||||
|
||||
static bool Available()
|
||||
{ return (http_request || http_reply || http_header ||
|
||||
http_all_headers || http_begin_entity || http_end_entity ||
|
||||
http_content_type || http_entity_data || http_message_done ||
|
||||
http_event || http_stats); }
|
||||
{
|
||||
return (http_request || http_reply || http_header || http_all_headers ||
|
||||
http_begin_entity || http_end_entity || http_content_type || http_entity_data ||
|
||||
http_message_done || http_event || http_stats);
|
||||
}
|
||||
|
||||
protected:
|
||||
void GenStats();
|
||||
|
|
@ -212,13 +228,11 @@ protected:
|
|||
int HTTP_RequestLine(const char* line, const char* end_of_line);
|
||||
int HTTP_ReplyLine(const char* line, const char* end_of_line);
|
||||
|
||||
void InitHTTPMessage(analyzer::tcp::ContentLine_Analyzer* cl, HTTP_Message*& message, bool is_orig,
|
||||
int expect_body, int64_t init_header_length);
|
||||
void InitHTTPMessage(analyzer::tcp::ContentLine_Analyzer* cl, HTTP_Message*& message,
|
||||
bool is_orig, int expect_body, int64_t init_header_length);
|
||||
|
||||
const char* PrefixMatch(const char* line, const char* end_of_line,
|
||||
const char* prefix);
|
||||
const char* PrefixWordMatch(const char* line, const char* end_of_line,
|
||||
const char* prefix);
|
||||
const char* PrefixMatch(const char* line, const char* end_of_line, const char* prefix);
|
||||
const char* PrefixWordMatch(const char* line, const char* end_of_line, const char* prefix);
|
||||
|
||||
bool ParseRequest(const char* line, const char* end_of_line);
|
||||
HTTP_VersionNumber HTTP_Version(int len, const char* data);
|
||||
|
|
@ -250,7 +264,7 @@ protected:
|
|||
int request_ongoing, reply_ongoing;
|
||||
|
||||
bool connect_request;
|
||||
analyzer::pia::PIA_TCP *pia;
|
||||
analyzer::pia::PIA_TCP* pia;
|
||||
// set to true after a connection was upgraded
|
||||
bool upgraded;
|
||||
// set to true when encountering an "connection" header in a reply.
|
||||
|
|
@ -278,7 +292,7 @@ protected:
|
|||
|
||||
HTTP_Message* request_message;
|
||||
HTTP_Message* reply_message;
|
||||
};
|
||||
};
|
||||
|
||||
extern bool is_reserved_URI_char(unsigned char ch);
|
||||
extern bool is_unreserved_URI_char(unsigned char ch);
|
||||
|
|
@ -286,4 +300,4 @@ extern void escape_URI_char(unsigned char ch, unsigned char*& p);
|
|||
extern String* unescape_URI(const u_char* line, const u_char* line_end,
|
||||
analyzer::Analyzer* analyzer);
|
||||
|
||||
} // namespace zeek::analyzer::http
|
||||
} // namespace zeek::analyzer::http
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue