zeek/scripts/policy/protocols/http/headers.bro
Jon Siwek 47500ceef4 Add a test that checks each individual script can be loaded in bare-mode.
Fixed most @load dependency issues in the process.  The test is still
failing in a "known" way due to hot.conn.bro and scan.bro.

Adressess #545
2011-08-10 15:38:21 -05:00

25 lines
622 B
Text

##! Extract and include the header keys used for each request in the log.
@load base/protocols/http/main
module HTTP;
export {
redef record Info += {
## The vector of HTTP headers. No header values are included here, just
## the header names.
## TODO: with an empty vector as &default, the vector isn't coerced to the
## correct type.
headers: vector of string &log &optional;
};
}
event http_header(c: connection, is_orig: bool, name: string, value: string) &priority=4
{
if ( ! is_orig )
return;
if ( ! c$http?$headers )
c$http$headers = vector();
c$http$headers[|c$http$headers|] = name;
}