Object HttpHeader

The HTTPHeader object wraps the HTTP request and response headers along with status codes and other information. You do not construct this object directly , this is passed to you when you are working with HTTP File Extraction scripts

name	input params	return value	description
is_request	–	boolean	True if the header is a HTTP request header
is_response	–	boolean	True if the header is a HTTP response header
get_path	–	string	The path in the HTTP request URI
get_value	string	string	Get the value of the requested HTTP header, Returns nil if header not found.
get_all_headers	–	table	Return a table of attribute => value pairs
get_method	–	string	For requests GET/POST/HEAD or other methods
get_status	–	number	HTTP Status Code 200=OK
is_method	string	bool	Check header method. hdr:is_method("POST") is short cut for hdr:get_method()=="POST" @
match_value	string – header_name, string value_regex	bool	Short cut for get_value + match(..) check if the header value matches the specified regex (see example 3 below). The regex must be Google RE2 compatible

Usage examples

To check whether content type contains a video*

Note we are checking for a nil value because the HTTP Header Content-Type may not be present in that header.

..
  local ct = header:get_value("Content-Type")

  if ct and ct:match("video")   then
      print(">>>>>  Saving video file for analysis "..ct.."flow - "..flowkey:id() )
      return true
  else
      return false
  end

Printing all the headers

Here is a sample debug session where you can inspect the HTTP Header methods

The built in debugger is invoked as

dbg = require('debugger')
..
onfile_http = function(... req_header, resp_header, ...)

    dbg()

end

The objects of type HTTPHeader can be used as shown below

debugger.lua> 
debugger.lua> p req_header:get_all_headers()

req_header:get_all_headers() => {"Host" = "toolbar.google.com", "User-Agent" = "Mozilla/4.0 (compatible; GoogleToolbar 4.0.1601.4978-big; Windows XP 5.1; MSIE 6.0.2900.2180)", "Referer" = "navclient.update/en/4.0.1601.4978-big"}

debugger.lua> p resp_header:get_all_headers()

resp_header:get_all_headers() => {"Transfer-Encoding" = "chunked", "Date" = "Tue, 12 Feb 2008 14:30:02 GMT", "Content-Type" = "text/plain", "Server" = "GFE/1.3", "Cache-control" = "private"}

debugger.lua>

Function match_value

Matches a field against a regex (partial match).

Purpose

Just a convenience function that you will find very handy when inspecting HTTP , SMTP headers etc.

Parameters

header_name	string	name of the HTTP header field
regex	string	a RE2 compatible regex against which the value of header_name above will be matched. The Regex algorithm used is PartialMatch

Return value

True

the header value matches the regex

False

the header does not exist or the value does not match

Example

Say we want to match the following

1. Content-Type := application/x-shockwave-flash

2. Content-Type := application/x-msdownload

   --
   -- without using match_value
   -- get content type, check for nil, and then use LUA regex match(..)
   --
   local ct = header:get_value("Content-Type")
   if ct and ct:match("application/x-shockwave-flash") or ct:match("application/x-msdownload")   then  
       print(">>>>>  Saving video file for analysis "..ct.."flow - "..flowkey:id() )
       return true
   end
   
   -- using match_value
   --
   if header:match_value("Content-Type","(shockwave|msdownload") then
       print(">>>>>  Saving video file for analysis "..ct.."flow - "..flowkey:id() )
       return true
   end