[Oisf-devel] Malformed HTTP log with latest git

[Chris Wakelin]

On 02/04/2012 20:49, Chris Wakelin wrote:
> I've just noticed something rather odd in the latest git:
>
>> 04/02/2012-20:44:30.333641s0.2mdn.net [**] /instream/afv_text_ads_manager_1_58.swf [**] Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) [**] http://s0.2mdn.net/instream/adsapi_2_11_17.swf [**] GET [**] HTTP/1.1 [**] 200 [**] 27057 bytes [**] xxx.xxx.xxx.xxx:nnn ->  173.194.34.156:80
>> 04/02/2012-20:44:30.334133safebrowsing-cache.google.com [**] /safebrowsing/rd/ChFnb29nLXBoaXNoLXNoYXZhchAAGPvLDCCEzAwyBvslAwD_Aw [**] Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.53.11 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10 [**]<no referer>  [**] GET [**] HTTP/1.1 [**] 200 [**] 3703 bytes [**] xxx.xxx.xxx.xxx:nnn ->  74.125.230.103:80
>
> We've lost a space between the date and the host. Probably trivial to
> fix - I'll have a look in a minute, but thought I'd better flag this up
> ASAP!

5 mins to find the flaw, 30 minutes to work out how to make a git patch 
(attched) :-)

Best Wishes,
Chris

-- 
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 2908
Whiteknights, Reading, RG6 2AF, UK              Fax: +44 (0)118 975 3094
-------------- next part --------------
>From 76b1b6df8ab891f0c1af4d324049e7a3b5dd63c5 Mon Sep 17 00:00:00 2001
From: Chris Wakelin <c.d.wakelin at reading.ac.uk>
Date: Mon, 2 Apr 2012 21:35:19 +0100
Subject: [PATCH] Fix missing space in HTTP log
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------------1.7.0.4"

This is a multi-part message in MIME format.
--------------1.7.0.4
Content-Type: text/plain; charset=UTF-8; format=fixed
Content-Transfer-Encoding: 8bit

---
 src/log-httplog.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)


--------------1.7.0.4
Content-Type: text/x-patch; name="0001-Fix-missing-space-in-HTTP-log.patch"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="0001-Fix-missing-space-in-HTTP-log.patch"

diff --git a/src/log-httplog.c b/src/log-httplog.c
index 5438df3..0d4baa5 100644
--- a/src/log-httplog.c
+++ b/src/log-httplog.c
@@ -285,7 +285,7 @@ static TmEcode LogHttpLogIPWrapper(ThreadVars *tv, Packet *p, void *data, Packet
 
         /* time */
         PrintBufferData(aft->data, &aft->data_offset, OUTPUT_BUFFER_SIZE,
-                         "%s", timebuf);
+                         "%s ", timebuf);
 
         /* hostname */
         if (tx->parsed_uri != NULL &&

--------------1.7.0.4--