rsmmr
commented
4 years ago So turns out support for sending Spicy maps to Zeek wasn't implemented yet. I just pushed a fix for that to #339. With that, I can make http_all_headers work per the following diff:
diff --git a/spicy/lib/protocols/http.spicy b/spicy/lib/protocols/http.spicy
index 4655028..143535b 100644
--- a/spicy/lib/protocols/http.spicy
+++ b/spicy/lib/protocols/http.spicy
@@ -79,6 +79,7 @@ type Message = unit(body_default: bool, is_request: bool) {
var delivery_mode: DeliveryMode = DeliveryMode::EndOfData;
var multipart_boundary: bytes &optional;
var transfer_encoding: bytes &optional;
+ var header_list: map<uint64, tuple<bytes,bytes>>;
on %init {
self.has_body = body_default;
@@ -134,6 +135,11 @@ type Header = unit(inout msg: Message) {
msg.content_type_parameter = ct[1].strip();
}
}
+
+ on %done {
+ msg.header_list[|msg.header_list|] = (self.name, self.content);
+ }
+
};
type Body = unit(inout msg: Message, delivery_mode: DeliveryMode, is_request: bool) {
diff --git a/zeek/plugin/lib/protocols/http.evt b/zeek/plugin/lib/protocols/http.evt
index a3ae3e5..a336c24 100644
--- a/zeek/plugin/lib/protocols/http.evt
+++ b/zeek/plugin/lib/protocols/http.evt
@@ -10,6 +10,7 @@ import Zeek_HTTP;
on HTTP::Message::%init -> event http_begin_entity($conn, $is_orig) &priority=5;
on HTTP::Message -> event http_end_entity($conn, $is_orig) &priority=5;
+on HTTP::Message -> event http_all_headers($conn, $is_orig, self.header_list) &priority=5;
on HTTP::Message::%error -> event http_end_entity($conn, $is_orig) &priority=5;
on HTTP::Message -> event http_message_done($conn, $is_orig, Zeek_HTTP::create_http_message_stats(self));(I may commit this later as well)
http.evt doesn’t have http_all_headers event, could you give us a sample, how to handle type mime_header_list?
I tried this in rtsp protocol parser.
I define correspond spicy type:
run:
spicyz -D zeek rtsp.evt rtsp.spicygot two errors: