HTTP1.1 example
client side
'GET' <HTTP_RECV>
'HEAD' <HTTP_RECV>
'P' \
'OST' <HTTP_SEND>
'UT' <HTTP_SEND>
'DELETE' <HTTP_RECV>
'OPTIONS' <HTTP_RECV>
'CONNECT' <HTTP_RECV>
<@HTTP_RECV>
[ \t]+ url:substring(1024, " \t") [ \t]+ "HTTP/" ver1:u32 "." ver2:u32 "\r"? "\n"
"\r"? "\n" $
[ \t]+ header_continuation:string(50) "\r"? "\n"
'Host:' [ \t]+ host:string(32) "\r"? "\n"
'Referer:' [ \t]+ referer:string(128) "\r"? "\n"
'Cookie' cookie:string(128) "\r"? "\n"
header_name:substring(32, ":") ":" [ \t]+ header_value:string(128) "\r"? "\n"
<@HTTP_SEND>
[ \t]+ url:substring(1024, " \t") [ \t]+ "HTTP/" http_ver1:u32 "." http_ver2:u32 "\r"? "\n"
"\r"? "\n"
{ if( state->cont_len == 0 ) return false; }
body:data(state->cont_len) { state->content_length = 0; } $
body:data $
[ \t]+ header_continuation:string(50) "\r"? "\n"
'Host:' [ \t]+ host:string(32) "\r"? "\n"
'Referer:' [ \t]+ referer:string(128) "\r"? "\n"
'Co' \
'okie' cookie:string(128) "\r"? "\n"
'ntent-' \
'Length:' [ \t]+ cont_len:u64 [ \t]* "\r"? "\n"
'Encoding:' [ \t]+ content_encoding:string(64) [ \t]* "\r"? "\n"
default: header_name:substring(32, ":") ":" [ \t]+ header_val:string(128) "\r"? "\n"
server side
"HTTP/" ver1:u32 "." ver2:u32 [ \t]+ rc:substring(3," ") [ \t]+ rt:string(16) "\r"? "\n"
"\r"? "\n"
{ if( state->cont_len == 0 ) return false; }
body:data(state->cont_length) { state->cont_len = 0; } $
{ if( state->retcode[0] != '5' ) return false; } $ # error answer
{ if( strstr(state->transf_enc, "chunked") == NULL ) return false; }
chunklen:h32 [ \t]* "\r"? "\n" \
{ if( state->chunklen != 0 ) return false; } "\r"? "\n"
{ state->transf_enc.clear(); } $
chunk:data(state->chunklen) "\r"? "\n"
body:data $
[ \t]+ header_continuation:string(128) "\r"? "\n"
'Host:' [ \t]+ host:string(32) "\r"? "\n"
'Set-Cookie:' [ \t]+ set_cookie:string(128) "\r"? "\n"
'Transfer-Encoding:' [ \t]+ transf_enc:string(32) [ \t]* "\r"? "\n"
'Content-' \
'Length:' [ \t]+ content_length:u64 [ \t]* "\r"? "\n"
'Encoding:' [ \t]+ content_encoding:string(64) [ \t]* "\r"? "\n"
default: header_name:substring(32, ":") ":" [ \t]+ header_value:string(128) "\r"? "\n"