Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Preservation of Case in HTTP headers #854

Open
benjeems opened this issue Mar 10, 2020 · 1 comment
Open

Preservation of Case in HTTP headers #854

benjeems opened this issue Mar 10, 2020 · 1 comment

Comments

@benjeems
Copy link

@benjeems benjeems commented Mar 10, 2020

Bumping this as an issue here:
Currently zeek Upper Cases HTTP header names. This removes information which can be important in use cases where Case matters. Lot's of good discussion including some use cases here:
https://bro-tracker.atlassian.net/browse/BIT-1431
and here
https://bro-tracker.atlassian.net/browse/BIT-1923

It seems like we need to keep the existing uppercase headers as they may be used downstream , however can we also make the case preserved version available ?

@jsiwek jsiwek added this to Unassigned / Todo in Release 3.2.0 via automation Mar 10, 2020
@jsiwek jsiwek added this to the 3.2.0 milestone Mar 10, 2020
@jsiwek

This comment has been minimized.

Copy link
Member

@jsiwek jsiwek commented Mar 10, 2020

Yeah, like what was suggested in earlier, I'd steer towards adding new parameters to all events to pass along the case-preserved header (think that may be http_header, http_all_headers, mime_one_header, and mime_all_headers events).

Changing event signature is currently a breaking change (unless we implement something like #418 / #262), but I wouldn't worry much in this case since it should be "easy" to adapt scripts to it (and we do have some clunkier ways people can use @if directives if they need to support multiple Zeek versions).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Release 3.2.0
  
Unassigned / Todo
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
You can’t perform that action at this time.