Net::Inspect::L7::HTTP - guesses and handles HTTP traffic
my $req = Net::Inspect::L7::HTTP::Request::Simple->new(..); my $http = Net::Inspect::L7::HTTP->new($req); my $guess = Net::Inspect::L5::GuessProtocol->new; $guess->attach($http); ...
This class extracts HTTP requests from TCP connections. It provides all hooks required for Net::Inspect::L4::TCP and is usually used together with it. It provides the guess_protocol hook so it can be used with Net::Inspect::L5::GuessProtocol.
Net::Inspect::L4::TCP
guess_protocol
Net::Inspect::L5::GuessProtocol
Attached flow is usually a Net::Inspect::L7::HTTP::Request::* object.
Net::Inspect::L7::HTTP::Request::*
Hooks provided:
This returns an object for the connection.
Processes new data and returns number of bytes processed. Any data not processed must be sent again with the next call.
$data are the data as string. In some cases $data can be [ 'gap' => $len ], e.g. only the information, that there would be $len bytes of data w/o submitting the data. These should only be submitted in request and response bodies and only if the attached layer can handle these gaps in the in_request_body and in_response_body methods.
$data
[ 'gap' => $len ]
$len
in_request_body
in_response_body
Gaps on other places are not allowed, because all other data are needed for interpreting the placement of request, response and data inside the connection.
Hooks called:
This should return an request object. The reference to the connection object is given in case the request object likes to call fatal to end the connection.
fatal
The function should not get hold of $conn, e.g. only store a weak reference, otherwise memory might leak.
Called when the full request header is read. $header is the string of the header.
%hdr_meta contains information extracted from the header:
Called when the full response header is read. $header is the string of the header.
Called for a chunk of data of the request body. $eobody is true if this is the last chunk of the request body. If the request body is empty the method will be called once with ''. If no body exists because of CONNECT or HTTP Upgrade in_data will be called, not in_request_body.
''
in_data
$data can be [ 'gap' => $len ] if the input to this layer were gaps.
Called for a chunk of data of the response body. $eof is true if this is the last chunk of the connection. $eobody is true if this is the last chunk of the response body. If the response body is empty the method will be called once with ''. If no body exists because of CONNECT or HTTP Upgrade in_data will be called, not in_response_body.
will be called with the chunk header for chunked encoding. Usually one is not interested in the chunk framing, only in the content so that this method will be empty. Will be called before the chunk data.
will be called with the chunk trailer for chunked encoding. Usually one is not interested in the chunk framing, only in the content so that this method will be empty. Will be called after in_response_body/in_request_body got called with eof true.
Will be called for any data after successful CONNECT or Upgrade, Websockets... $dir is 0 for data from client, 1 for data from server.
$dir
Will be called for legally ignored junk (empty lines) in front of request or response body. $dir is 0 for data from client, 1 for data from server.
will be called on fatal errors, mostly protocol iregularities.
Methods suitable for overwriting:
default implementation will just call new_request from the attached flow
Helpful methods
collects the state of the open connections. If defined wantarray it will return a message, otherwise output it via xdebug
returns the current offset(s) in the data stream, that is the position behind the within the in_* methods forwarded data.
If the next bytes of the input stream are not needed to interpret the HTTP protocol (i.e. plain body data) this gives the offsets up to which data are "gapable". If no gaps are possible at the current state 0 will be returned. If everything can be gaps (usually because end of body is caused by end of connection) -1 will be returned.
0
-1
This is similar to gap_offset but will return the difference from the current position, i.e. how large the next gap can be. -1 again means an unlimited gap.
gap_offset
in array context returns the objects for the open requests, in scalar context the number of open requests. If index is given only the specified objects will be returned, e.g. index -1 is the object currently receiving response data while index 0 specifies the object currently receiving request data (both are the same unless pipelining is used)
This constant is an array reference of all request methods which will not have a request body, i.e. which have an implicit and non-changeble content-length of 0.
This constant is an array reference of all request methods which must have a specified request body, even if the content-lenth is explicitly set to 0.
Methods which are not in METHODS_WITH_RQBODY or METHODS_WITHOUT_RQBODY might have a request body, that is if no content-length is explicitly given (or chunked transfer encoding is used) it is assumed that they don't have a body.
This constant is an array reference of all request methods which don't require a response body, i.e. which have an implicit and non-changeble content-length of 0.
This constant is an array reference of all response codes which will not have a response body, i.e. which have an implicit and non-changeble content-length of 0.
This function parses the given message header (without request or status line!) and extracts the key:value pairs into %fields. Each key in %fields is the lower-case representation of the key from the HTTP message and the value in %fields is a list with all values, i.e. a list with a single element if the specific key was only used once the header, but with multiple elements if the key was used multiple times. Any continuation lines will be transformed into a single line.
key:value
%fields
It will return any remaining data in $header which could not be interpreted as proper key:value pairs. If the message contains no errors it will thus return ''.
$header
100 Continue, 101 Upgrade are not yet implemented.
100 Continue
101 Upgrade
To install Net::Inspect, copy and paste the appropriate command in to your terminal.
cpanm
cpanm Net::Inspect
CPAN shell
perl -MCPAN -e shell install Net::Inspect
For more information on module installation, please visit the detailed CPAN module installation guide.