MITRECND / chopshop

Protocol Analysis/Decoder Framework

Home Page:https://chopshop.readthedocs.org/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add an option which causes http_extractor to dump data at times more friendly to partial conversations

kcreyts opened this issue · comments

http_extractor currently dumps data when there is a request with a non-zero-length body or there is a request followed by a response with a non-zero length body.

This leads to failure to parse partial conversations, or conversations which are of poor or unexpected form.

Writing an http_extractor which works flawlessly on any partial, damaged, or malformed conversations may be far out of scope, but a little flexibility in the dumping behavior would go a long ways.

There should be an option to specify the dumping behavior; by the parameter of the option, the user should be able to elect to dump parts of each transaction at the following times: after each header specified for extraction in the transaction is parsed, when all headers for a transaction are parsed, when the body length of any transaction is determined to be zero (when any transaction does not have a body), when any transaction body callback is about to complete, or when the response completes.

The simple goal is to handle partial conversations a bit more gracefully.

I'm all for this. If you want to come up with a patch I'd be more than happy to get it into the tree.