Method Decode

decoder/stream/http/http_reader.go:102–182

Decode parses the stream according to the HTTP protocol.

()

// Decode parses the stream according to the HTTP protocol.
func (h *httpReader) Decode() {
	// prevent nil pointer access if decoder is not initialized
	if Decoder.Writer == nil {
		return
	}

	streamutils.DecodeConversation(
		h.conversation.Ident,
		h.conversation.Data,
		func(b *bufio.Reader) error {
			return h.readRequest(b)
		},
		func(b *bufio.Reader) error {
			return h.readResponse(b)
		},
	)

	// iterate over responses
	for _, res := range h.responses { // populate types.HTTP with all infos from response
		ht := newHTTPFromResponse(res.response)

		matchedReq := h.findRequest(res.response)

		atomic.AddInt64(&streamutils.Stats.NumResponses, 1)

		// now add request information
		if matchedReq != nil && res.response.Request != nil {
			if secret.Decoder.Writer != nil {
				h.searchForLoginParams(res.response.Request)
				h.searchForBasicAuth(res.response.Request)
			}

			atomic.AddInt64(&streamutils.Stats.NumRequests, 1)
			// Use the matched request which preserves JA4H header order info
			setRequest(ht, &httpRequest{
				request:      res.response.Request,
				timestamp:    res.timestamp,
				clientIP:     res.clientIP,
				serverIP:     res.serverIP,
				clientPort:   res.clientPort,
				serverPort:   res.serverPort,
				flow:         res.flow,
				headerOrder:  matchedReq.headerOrder,
				cookieFields: matchedReq.cookieFields,
				acceptLang:   matchedReq.acceptLang,
			})
		} else {
			// response without matching request
			// don't add to output for now
			atomic.AddInt64(&streamutils.Stats.NumUnmatchedResp, 1)

			continue
		}

		// Set Community ID for cross-tool correlation
		ht.CommunityID = h.conversation.CommunityID
		writeHTTP(ht, h.conversation.Ident)
	}