Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Renamed HTTP::build_url function to HTTP::build_url_http

Browse source 
- HTTP::build_url no longer prepends http:// to the url.
This commit is contained in:
Seth Hall 2011-06-17 23:26:54 -04:00
parent 291920b013
commit e17193ff3e
5 changed files with 11 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

3
policy/detectors/http-MHR.bro
View file

@ -18,14 +18,13 @@ event log_http(rec: HTTP::Info)
{ {
if ( rec?$md5 ) if ( rec?$md5 )
{ {
local url = HTTP::build_url(rec);
local hash_domain = fmt("%s.malware.hash.cymru.com", rec$md5); local hash_domain = fmt("%s.malware.hash.cymru.com", rec$md5);
when ( local addrs = lookup_hostname(hash_domain) ) when ( local addrs = lookup_hostname(hash_domain) )
{ {
# 127.0.0.2 indicates that the md5 sum was found in the MHR. # 127.0.0.2 indicates that the md5 sum was found in the MHR.
if ( 127.0.0.2 in addrs ) if ( 127.0.0.2 in addrs )
{ {
local url = HTTP::build_url_http(rec);
local message = fmt("%s %s %s", rec$id$orig_h, rec$md5, url); local message = fmt("%s %s %s", rec$id$orig_h, rec$md5, url);
NOTICE([$note=Malware_Hash_Registry_Match, NOTICE([$note=Malware_Hash_Registry_Match,
$msg=message, $id=rec$id, $URL=url]); $msg=message, $id=rec$id, $URL=url]);

2
policy/protocols/http/detect-webapps.bro
View file

@ -26,7 +26,7 @@ event signature_match(state: signature_state, msg: string, data: string) &priori
local c = state$conn; local c = state$conn;
local si = Software::parse(msg, c$id$resp_h, WEB_APPLICATION); local si = Software::parse(msg, c$id$resp_h, WEB_APPLICATION);
si$url = build_url(c$http); si$url = build_url_http(c$http);
if ( c$id$resp_h in Software::tracked && if ( c$id$resp_h in Software::tracked &&
si$name in Software::tracked[c$id$resp_h] ) si$name in Software::tracked[c$id$resp_h] )
{ {

2
policy/protocols/http/file-hash.bro
View file

@ -72,7 +72,7 @@ event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) &
if ( c$http$calculating_md5 ) if ( c$http$calculating_md5 )
{ {
local url = build_url(c$http); local url = build_url_http(c$http);
c$http$calculating_md5 = F; c$http$calculating_md5 = F;
c$http$md5 = md5_hash_finish(c$id); c$http$md5 = md5_hash_finish(c$id);

2
policy/protocols/http/file-ident.bro
View file

@ -58,7 +58,7 @@ event signature_match(state: signature_state, msg: string, data: string) &priori
if ( msg in mime_types_extensions && if ( msg in mime_types_extensions &&
c$http?$uri && mime_types_extensions[msg] !in c$http$uri ) c$http?$uri && mime_types_extensions[msg] !in c$http$uri )
{ {
local url = build_url(c$http); local url = build_url_http(c$http);
local message = fmt("%s %s %s", msg, c$http$method, url); local message = fmt("%s %s %s", msg, c$http$method, url);
NOTICE([$note=IncorrectFileType, NOTICE([$note=IncorrectFileType,
$msg=message, $msg=message,

8
policy/protocols/http/utils.bro
View file

@ -7,6 +7,7 @@ module HTTP;
export { export {
global extract_keys: function(data: string, kv_splitter: pattern): string_vec; global extract_keys: function(data: string, kv_splitter: pattern): string_vec;
global build_url: function(h: Info): string; global build_url: function(h: Info): string;
global build_url_http: function(h: Info): string;
} }
@ -30,5 +31,10 @@ function build_url(h: Info): string
local host = h?$host ? h$host : fmt("%s", h$id$resp_h); local host = h?$host ? h$host : fmt("%s", h$id$resp_h);
if ( h$id$resp_p != 80/tcp ) if ( h$id$resp_p != 80/tcp )
host = fmt("%s:%s", host, h$id$resp_p); host = fmt("%s:%s", host, h$id$resp_p);
return fmt("http://%s%s", host, uri); return fmt("%s%s", host, uri);
}
function build_url_http(h: Info): string
{
return fmt("http://%s", build_url);
} }