Merge remote-tracking branch 'security/topic/awelzel/127-http-timeout-again'

* security/topic/awelzel/127-http-timeout-again:
  testing/http: http-11-request-then-cruft
  testing/http: Add pcap extracted from m5-long external test-suite
  testing/external: m57-long baseline update
  analyzers/http: Update request_version on subsequent SetVersion() calls

CHANGES

@@ -1,3 +1,32 @@
+5.2.0-dev.602 | 2023-02-01 10:47:41 -0700
+
+  * testing/http: http-11-request-then-cruft (Arne Welzel, Corelight)
+
+    A client sends a "proper" HTTP/1.1 request and afterwards a few T /\n\n sequences.
+    The latter ones aren't logged.
+
+  * testing/http: Add pcap extracted from m5-long external test-suite (Arne Welzel, Corelight)
+
+    This tests that the HTTP version is now updated if it changes in the
+    course of a connection.
+
+  * testing/external: m57-long baseline update (Arne Welzel, Corelight)
+
+    There's a HTTP server that first replies with HTTP/1.1, then HTTP/1.0.
+    Seems actually nicer to have the real value within the log/event.
+
+  * analyzers/http: Update request_version on subsequent SetVersion() calls (Arne Welzel, Corelight)
+
+    The #124 PR introduced special treatment when HTTP version 0.9
+    was set. With #127, a reproducer that set HTTP/1.0 in the first
+    request was created and subsequent requests wouldn't reset to
+    HTTP version 0.9.
+
+    This is subtle, but doesn't seem like things fall apart.
+
+    Improves runtime from 20 seconds to 2 seconds for the given
+    reproducer.
+
 5.2.0-dev.597 | 2023-02-01 10:47:21 -0700
 
   * testing/ftp: Add tests and pcaps with invalid reply lines (Arne Welzel, Corelight)

VERSION

@@ -1 +1 @@
-5.2.0-dev.597
+5.2.0-dev.602

src/analyzer/protocol/http/HTTP.cc

@@ -1339,7 +1339,10 @@ void HTTP_Analyzer::SetVersion(HTTP_VersionNumber* version, HTTP_VersionNumber n
 		*version = new_version;
 
 	else if ( *version != new_version )
+		{
 		Weird("HTTP_version_mismatch");
+		*version = new_version;
+		}
 
 	if ( version->major > 1 || (version->major == 1 && version->minor > 0) )
 		keep_alive = 1;

testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/dpd.log

@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	dpd
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	analyzer	failure_reason
+#types	time	string	addr	port	addr	port	enum	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.12.5	51792	192.0.78.212	80	tcp	HTTP	not a http request line
+#close XXXX-XX-XX-XX-XX-XX

testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/http.log

@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	http
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	trans_depth	method	host	uri	referrer	version	user_agent	origin	request_body_len	response_body_len	status_code	status_msg	info_code	info_msg	tags	username	password	proxied	orig_fuids	orig_filenames	orig_mime_types	resp_fuids	resp_filenames	resp_mime_types
+#types	time	string	addr	port	addr	port	count	string	string	string	string	string	string	string	count	count	count	string	count	string	set[enum]	string	string	set[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.12.5	51792	192.0.78.212	80	1	GET	zeek.org	/	-	1.1	-	-	0	162	301	Moved Permanently	-	-	(empty)	-	-	-	-	-	-	FAKHufE4EVGbXF6P	-	text/html
+#close XXXX-XX-XX-XX-XX-XX

testing/btest/Baseline/scripts.base.protocols.http.http-11-request-then-cruft/weird.log

@@ -0,0 +1,12 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	weird
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	name	addl	notice	peer	source
+#types	time	string	addr	port	addr	port	string	string	bool	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.12.5	51792	192.0.78.212	80	HTTP_version_mismatch	-	F	zeek	HTTP
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.12.5	51792	192.0.78.212	80	bad_HTTP_request	-	F	zeek	HTTP
+#close XXXX-XX-XX-XX-XX-XX

testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/http.log

@@ -0,0 +1,12 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	http
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	trans_depth	method	host	uri	referrer	version	user_agent	origin	request_body_len	response_body_len	status_code	status_msg	info_code	info_msg	tags	username	password	proxied	orig_fuids	orig_filenames	orig_mime_types	resp_fuids	resp_filenames	resp_mime_types
+#types	time	string	addr	port	addr	port	count	string	string	string	string	string	string	string	count	count	count	string	count	string	set[enum]	string	string	set[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.1.102	1482	74.201.118.102	80	1	GET	ad.afy11.net	/srad.js?azId=1000000326207	http://d3.zedo.com/jsc/d3/ff2.html?n=1073;c=1;s=1;d=7;w=160;h=600	1.1	Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5	-	0	12122	200	OK	-	-	(empty)	-	-	-	-	-	-	FdVLuk3tKSr7YHlidh	-	text/plain
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.1.102	1482	74.201.118.102	80	2	GET	ad.afy11.net	/ad?asId=1000000326207&sd=2x160x600&ct=7&enc=1&sf=0&sfd=0&ynw=0&anw=1&rand=71014409&rk1=46812516&rk2=XXXXXXXXXX.XXXXXX&pt=0	http://d3.zedo.com/jsc/d3/ff2.html?n=1073;c=1;s=1;d=7;w=160;h=600	1.0	Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5	-	0	1254	200	OK	-	-	(empty)	-	-	-	-	-	-	F5aMef27icyTRBKeQa	-	application/javascript
+#close XXXX-XX-XX-XX-XX-XX

testing/btest/Baseline/scripts.base.protocols.http.version-mismatch/weird.log

@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	weird
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	name	addl	notice	peer	source
+#types	time	string	addr	port	addr	port	string	string	bool	string	string
+XXXXXXXXXX.XXXXXX	CHhAvVGS1DHFjwGM9	192.168.1.102	1482	74.201.118.102	80	HTTP_version_mismatch	-	F	zeek	HTTP
+#close XXXX-XX-XX-XX-XX-XX

testing/btest/scripts/base/protocols/http/http-11-request-then-cruft.pcap

@@ -0,0 +1,7 @@
+# @TEST-EXEC: zeek -b -r $TRACES/http/http-11-request-then-cruft.pcap %INPUT > output
+# @TEST-EXEC: btest-diff http.log
+# @TEST-EXEC: btest-diff weird.log
+# @TEST-EXEC: btest-diff dpd.log
+
+@load base/protocols/http
+@load base/frameworks/notice/weird

testing/btest/scripts/base/protocols/http/version-mismatch.zeek

@@ -0,0 +1,7 @@
+# @TEST-DOC: Pcap extracted from 2009-M57-day11-18.trace: The server replies with HTTP/1.1, then HTTP/1.0 (also different Server headers).
+# @TEST-EXEC: zeek -b -Cr $TRACES/http/version-mismatch.pcap %INPUT
+# @TEST-EXEC: btest-diff http.log
+# @TEST-EXEC: btest-diff weird.log
+
+@load base/protocols/http
+@load base/frameworks/notice/weird

testing/external/commit-hash.zeek-testing

@@ -1 +1 @@
-623d90bdb4d3d84ee4f7743e653c93bd25e162ea
+2c6d83b6856a3aab110dc76bba0223c4193231a3