1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94
|
/* David Leonard, 2002. Public domain. */
/* $Id: tcp_http.c 1209 2012-03-04 14:31:19Z d $ */
#if HAVE_CONFIG_H
# include "config.h"
#endif
#if STDC_HEADERS
# include <stdio.h>
# include <string.h>
# include <ctype.h>
#endif
#if HAVE_SYS_TYPES_H
# include <sys/types.h>
#endif
#if TIME_WITH_SYS_TIME
# include <sys/time.h>
# include <time.h>
#else
# if HAVE_SYS_TIME_H
# include <sys/time.h>
# else
# include <time.h>
# endif
#endif
#include "type.h"
#include "flow.h"
#include "tcp.h"
/*
* Look for HTTP command words (e.g. GET, POST etc) and use it and the
* following object argument as a description for the flow.
*/
void
tcp_http(f, data, end, toserver)
struct flow *f;
const char *data;
const char *end;
int toserver;
{
const char *d;
#define startswith(data, text) \
(data + sizeof text - 1 <= end && \
memcmp(data, text, sizeof text - 1) == 0)
/* Look for HTTP requests at the beginning of a packet */
if (toserver &&
(startswith(data, "GET ") ||
startswith(data, "POST ") ||
startswith(data, "OPTIONS ") ||
startswith(data, "CONNECT ") ||
startswith(data, "HEAD ")))
{
/* Find the object of the request (usually a URI) */
for (d = data; d < end && *d != ' '; d++)
;
if (d < end)
d++;
for (; d < end && *d != '\r' && *d != ' '
&& *d != ';'; d++)
;
snprintf(f->desc, sizeof f->desc, "%.*s",
(int)(d - data), data);
}
/* Record responses of form "HTTP/#.# ###" */
if (!toserver &&
data + 12 <= end &&
memcmp(data, "HTTP/", 5) == 0 &&
isdigit(data[5]) &&
data[6] == '.' &&
isdigit(data[7]) &&
data[8] == ' ' &&
isdigit(data[9]) &&
isdigit(data[10]) &&
isdigit(data[11]))
{
if (isdigit(f->desc[0])) {
/* Replace the existing code */
f->desc[0] = data[9];
f->desc[1] = data[10];
f->desc[2] = data[11];
} else {
/* Insert the 3 digit result before the uri */
char cp[DESCLEN];
memcpy(cp, f->desc, sizeof cp);
snprintf(f->desc, sizeof f->desc, "%c%c%c %.*s",
data[9], data[10], data[11],
(int)sizeof cp, cp);
}
}
}
|