Dear sir,<br><br>I have found a bug in the event called http_header. The value : string it returns has a space at the beginning. Like "<a href="http://www.yahoo.com">www.yahoo.com</a>" will be returned as " <a href="http://www.yahoo.com">www.yahoo.com</a>".<br>
<br>I am posting You a script where I found it<br><br><br>@load weird<br>@load alarm<br>@load http<br>global path: string;<br><br>global urls: set[string] ={"<a href="http://www.yahoo.com">www.yahoo.com</a>","<a href="http://mail.google.com">mail.google.com</a>","<a href="http://www.ieee.org">www.ieee.org</a>","<a href="http://www.youtube.com">www.youtube.com</a>","<a href="http://www.bro-ids.org">www.bro-ids.org</a>"} ;<br>
<br>global shanz_log = open_log_file("http") &redef;<br>redef ignore_checksums = T;<br>event http_request(c: connection, method: string, original_URI: string,<br> unescaped_URI: string, version: string)<br>
{<br><br> path = original_URI;<br> <br> }<br>event http_header(c: connection, is_orig: bool, name: string, value: string)<br> {<br> if(name == "HOST" )<br> { <br>
<span style="background-color: rgb(255, 255, 153);"> local v = edit(value," ");</span><br> <br> <span style="background-color: rgb(255, 255, 153);"> if( v in urls)</span><span style="background-color: rgb(255, 255, 204);"></span><br>
{ <br>print shanz_log, fmt("%s:%s->%s:%s",c$id$orig_h,c$id$orig_p,c$id$resp_h,c$id$resp_p);<br> <br>} <br>}<br>}<br><br><br>If I simply compare the value it doesn't match. or even if I print the value its printing with one whitespace prefixed at the beginning.<br>
<br><br>Regards,<br>Sanmeet<br>