Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

FileAnalysis: add binary input reader and BIFs for sending in data.

Browse source 
This allows the input framework to feed files in to Bro for analysis.
This commit is contained in:
Jon Siwek 2013-03-06 12:59:54 -06:00
parent c330b46128
commit 00b2d34a8e
14 changed files with 399 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/file_analysis/Info.cc
View file

@ -37,7 +37,7 @@ static RecordVal* get_conn_id_val(const Connection* conn)
int Info::file_id_idx = -1;
int Info::parent_file_id_idx = -1;
int Info::protocol_idx = -1;
int Info::source_idx = -1;
int Info::conn_uids_idx = -1;
int Info::conn_ids_idx = -1;
int Info::seen_bytes_idx = -1;
@ -59,7 +59,7 @@ void Info::InitFieldIndices()
if ( file_id_idx != -1 ) return;
file_id_idx = Idx("file_id");
parent_file_id_idx = Idx("parent_file_id");
protocol_idx = Idx("protocol");
source_idx = Idx("source");
conn_uids_idx = Idx("conn_uids");
conn_ids_idx = Idx("conn_ids");
seen_bytes_idx = Idx("seen_bytes");
@ -89,7 +89,7 @@ static void init_magic(magic_t* magic, int flags)
}
}
Info::Info(const string& unique, Connection* conn, const string& protocol)
Info::Info(const string& unique, Connection* conn, const string& source)
: file_id(unique), unique(unique), val(0), last_activity_time(network_time),
postpone_timeout(false), need_reassembly(false), done(false),
actions(this)
@ -113,8 +113,8 @@ Info::Info(const string& unique, Connection* conn, const string& protocol)
UpdateConnectionFields(conn);
if ( protocol != "" )
val->Assign(protocol_idx, new StringVal(protocol.c_str()));
if ( ! source.empty() )
val->Assign(source_idx, new StringVal(source.c_str()));
}
Info::~Info()

5
src/file_analysis/Info.h
View file

@ -117,8 +117,7 @@ protected:
/**
* Constructor; only file_analysis::Manager should be creating these.
*/
Info(const string& unique, Connection* conn = 0,
const string& protocol = "");
Info(const string& unique, Connection* conn = 0, const string& source = "");
/**
* Updates the "conn_ids" and "conn_uids" fields in #val record with the
@ -190,7 +189,7 @@ protected:
public:
static int file_id_idx;
static int parent_file_id_idx;
static int protocol_idx;
static int source_idx;
static int conn_uids_idx;
static int conn_ids_idx;
static int seen_bytes_idx;

26
src/file_analysis/Manager.cc
View file

@ -26,11 +26,11 @@ void Manager::Terminate()
}
void Manager::DataIn(const string& unique, const u_char* data, uint64 len,
uint64 offset, Connection* conn, const string& protocol)
uint64 offset, Connection* conn, const string& source)
{
if ( IsIgnored(unique) ) return;
Info* info = GetInfo(unique, conn, protocol);
Info* info = GetInfo(unique, conn, source);
if ( ! info ) return;
@ -41,9 +41,9 @@ void Manager::DataIn(const string& unique, const u_char* data, uint64 len,
}
void Manager::DataIn(const string& unique, const u_char* data, uint64 len,
Connection* conn, const string& protocol)
Connection* conn, const string& source)
{
Info* info = GetInfo(unique, conn, protocol);
Info* info = GetInfo(unique, conn, source);
if ( ! info ) return;
@ -54,18 +54,18 @@ void Manager::DataIn(const string& unique, const u_char* data, uint64 len,
}
void Manager::EndOfFile(const string& unique, Connection* conn,
const string& protocol)
const string& source)
{
// Just call GetInfo because maybe the conn/protocol args will update
// Just call GetInfo because maybe the conn/source args will update
// something in the Info record.
GetInfo(unique, conn, protocol);
GetInfo(unique, conn, source);
RemoveFile(unique);
}
void Manager::Gap(const string& unique, uint64 offset, uint64 len,
Connection* conn, const string& protocol)
Connection* conn, const string& source)
{
Info* info = GetInfo(unique, conn, protocol);
Info* info = GetInfo(unique, conn, source);
if ( ! info ) return;
@ -73,9 +73,9 @@ void Manager::Gap(const string& unique, uint64 offset, uint64 len,
}
void Manager::SetSize(const string& unique, uint64 size,
Connection* conn, const string& protocol)
Connection* conn, const string& source)
{
Info* info = GetInfo(unique, conn, protocol);
Info* info = GetInfo(unique, conn, source);
if ( ! info ) return;
@ -132,7 +132,7 @@ bool Manager::RemoveAction(const FileID& file_id, const RecordVal* args) const
}
Info* Manager::GetInfo(const string& unique, Connection* conn,
const string& protocol)
const string& source)
{
if ( IsIgnored(unique) ) return 0;
@ -140,7 +140,7 @@ Info* Manager::GetInfo(const string& unique, Connection* conn,
if ( ! rval )
{
rval = str_map[unique] = new Info(unique, conn, protocol);
rval = str_map[unique] = new Info(unique, conn, source);
FileID id = rval->GetFileID();
if ( id_map[id] )

12
src/file_analysis/Manager.h
View file

@ -35,31 +35,31 @@ public:
*/
void DataIn(const string& unique, const u_char* data, uint64 len,
uint64 offset, Connection* conn = 0,
const string& protocol = "");
const string& source = "");
/**
* Pass in sequential file data.
*/
void DataIn(const string& unique, const u_char* data, uint64 len,
Connection* conn = 0, const string& protocol = "");
Connection* conn = 0, const string& source = "");
/**
* Signal the end of file data.
*/
void EndOfFile(const string& unique, Connection* conn = 0,
const string& protocol = "");
const string& source = "");
/**
* Signal a gap in the file data stream.
*/
void Gap(const string& unique, uint64 offset, uint64 len,
Connection* conn = 0, const string& protocol = "");
Connection* conn = 0, const string& source = "");
/**
* Provide the expected number of bytes that comprise a file.
*/
void SetSize(const string& unique, uint64 size, Connection* conn = 0,
const string& protocol = "");
const string& source = "");
/**
* Starts ignoring a file, which will finally be removed from internal
@ -109,7 +109,7 @@ protected:
* record value may be updated.
*/
Info* GetInfo(const string& unique, Connection* conn = 0,
const string& protocol = "");
const string& source = "");
/**
* @return the Info object mapped to \a file_id, or a null pointer if no