mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
af1714853f
When http_reply events are received before http_request events, either through faking traffic or possible re-ordering, it is possible to trigger unbounded state growth due to later http_requests never being matched again with responses. Prevent this by synchronizing request/response counters when late requests come in. Also forcefully flush pending requests when http_replies are never observed either due to the analyzer having been disabled or because half-duplex traffic. Fixes #1705
15 lines
560 B
Text
15 lines
560 B
Text
# @TEST-DOC: Pcap has a gap for the server side. This previously caused unbounded state growth in c$http_state$pending.
|
|
#
|
|
# @TEST-EXEC: zcat <$TRACES/http/1000-requests-one-dropped-response.pcap.gz | zeek -C -b -r - %INPUT >out
|
|
# @TEST-EXEC: echo "total http.log lines" >>out
|
|
# @TEST-EXEC: grep -v '^#' http.log | wc -l | sed 's/ //g' >>out
|
|
# @TEST-EXEC: btest-diff out
|
|
# @TEST-EXEC: btest-diff weird.log
|
|
|
|
@load base/protocols/http
|
|
|
|
event connection_state_remove(c: connection)
|
|
{
|
|
if ( c?$http_state )
|
|
print "http_state pending", |c$http_state$pending|;
|
|
}
|