base/protocols/http/utils.zeek

HTTP

Utilities specific for HTTP processing.

Namespace:

HTTP

Imports:

base/protocols/http/main.zeek, base/utils/addrs.zeek

Summary

Functions

HTTP::build_url: function	Creates a URL from an HTTP::Info record.
HTTP::build_url_http: function	Creates a URL from an HTTP::Info record.
HTTP::describe: function	Create an extremely shortened representation of a log line.
HTTP::extract_keys: function	Given a string containing a series of key-value pairs separated by “=”, this function can be used to parse out all of the key names.

Detailed Interface

Functions

HTTP::build_url

Type:

function (rec: HTTP::Info) : string

Creates a URL from an HTTP::Info record. This should handle edge cases such as proxied requests appropriately.

Parameters:

rec – An HTTP::Info record.

Returns:

A URL, not prefixed by "http://".

HTTP::build_url_http

Type:

function (rec: HTTP::Info) : string

Creates a URL from an HTTP::Info record. This should handle edge cases such as proxied requests appropriately.

Parameters:

rec – An HTTP::Info record.

Returns:

A URL prefixed with "http://".

HTTP::describe

Type:

function (rec: HTTP::Info) : string

Create an extremely shortened representation of a log line.

HTTP::extract_keys

Type:

function (data: string, kv_splitter: pattern) : string_vec

Given a string containing a series of key-value pairs separated by “=”, this function can be used to parse out all of the key names.

Parameters:

• data – The raw data, such as a URL or cookie value.

• kv_splitter – A regular expression representing the separator between key-value pairs.

Returns:

A vector of strings containing the keys.