Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
7254 commits 388 branches 195 tags 264 MiB
Commit graph

12 commits

Author SHA1 Message Date
Johanna Amann
cdb6a1b6e6 Baseline updates after hash function change. 2016-07-13 10:11:37 -07:00
Johanna Amann
642542ab17 Merge branch 'topic/http-evasion' of https://github.com/0xcc-labs/bro 
* 'topic/http-evasion' of https://github.com/0xcc-labs/bro:
  updated weird message and tests
  update of http btest
  detect possible HTTP evasion attempts
 2016-03-07 13:09:56 -08:00
wglodek
9ebe7b2a21 updated weird message and tests 2016-03-04 18:03:24 -05:00
wglodek
78c0e2355c update of http btest 2016-02-07 11:26:06 -05:00
Robin Sommer
642ef5d3c1 Tweaking how HTTP requests without URIs are handled. 
The change from #49 made it an error to not have a URI. That however
then led requests with an URI yet no version to abort as well.
Instead, we now check if the token following the method is an "HTTP/"
version identifier. If, so accept that the URI is empty (and trigger
a weird) but otherwise keep processing.

Adding test cases for both HTTP requests without URI and without
version.
 2016-01-15 12:59:11 -08:00
Robin Sommer
adb3fab019 Updating test baselines for http.log now including version. 2016-01-15 12:18:16 -08:00
Jon Siwek
df60015333 Remove "unmatched_HTTP_reply" weird. 
BIT-725 #close
 2015-03-20 11:13:50 -05:00
Jon Siwek
22bf3e1196 Increase UIDs to 96 bits w/ C/F prefix - BIT-1016 
- The bit-length is adjustable via redef'ing bits_per_uid.

- Prefix 'C' is used for connection UIDS (including IP tunnels) and
  'F' for files.
 2013-08-26 15:36:31 -05:00
Robin Sommer
e2d20cb7bc Changing the HTTP parser to accept methods that align with the RFC. 2012-12-07 19:42:03 -08:00
Robin Sommer
57510464a1 Adapting the HTTP request line parsing to only accept methods 
consisting of letters [A-Za-z].

I had some bogus HTTP sessions now with the test-suite that reported
data as HTTP because it started with "<!... ". Requiring letters seems
a reasonable constraint.
 2012-12-05 16:56:54 -08:00
Robin Sommer
177c014cb7 Merge remote-tracking branch 'vlad/topic/vladg/http-verbs' 
* vlad/topic/vladg/http-verbs:
  A test for HTTP methods, including some horribly illegal requests.
  Remove hardcoded HTTP verbs from the analyzer (#741)

I added a "bad_HTTP_request" weird for HTTP request lines that don't
have more than a single word.

Closes #741.
 2012-12-05 15:27:42 -08:00
Vlad Grigorescu
318f38df43 A test for HTTP methods, including some horribly illegal requests. 2012-11-30 22:06:54 -05:00