[Bro-Dev] [JIRA] (BIT-1257) Same file id generated for potentially different files

[Jimmy Jones (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1257?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18205#comment-18205 ] 

Jimmy Jones commented on BIT-1257:
----------------------------------

scripts/base/protocols/http/files.bro:
{quote}
Any multipart responses from the server are pieces of same file
that correspond to range requests, so don't use mime depth to
identify the file.
{quote}
Might be true for multipart responses, however this code is also catching completely separate HTTP sessions, where the URL could be dynamically generated content, so would merge different pieces of content into a corrupt output, which I don't think is a safe default.

> Same file id generated for potentially different files
> ------------------------------------------------------
>
>                 Key: BIT-1257
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1257
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: git/master, 2.3
>         Environment: CentOS 6
>            Reporter: Jimmy Jones
>         Attachments: fa.bro, sample-samefileid.pcap
>
>
> Attached sample contains two HTTP downloads of the same URL from the same client, but there are no guarantees that the files is actually the same (no Etags etc - in this case it actually is the same, but lets pretend they were different...). However the file analysis framework seems to give the same file ID in file_name and file_chunk for both downloads.
> Think this is something to do with Range requests as doesn't happen if do "normal" HTTP requests.



--
This message was sent by Atlassian JIRA
(v6.4-OD-05-009#64003)