Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix IRC analyzer supplying wrong type to irc_dcc_message event.

Browse source 
And other IRC policy tweaks.
This commit is contained in:
Jon Siwek 2011-07-20 13:19:44 -05:00
parent a73ef6f0e1
commit 063ad9a103
3 changed files with 31 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

21
policy/protocols/irc/base.bro
View file

@ -71,6 +71,13 @@ event irc_nick_message(c: connection, is_orig: bool, who: string, newnick: strin
{ {
c$irc$command = "NICK"; c$irc$command = "NICK";
c$irc$value = newnick; c$irc$value = newnick;
}
}
event irc_nick_message(c: connection, is_orig: bool, who: string, newnick: string) &priority=-5
{
if ( is_orig )
{
Log::write(IRC, c$irc); Log::write(IRC, c$irc);
c$irc$nick = newnick; c$irc$nick = newnick;
} }
@ -84,6 +91,13 @@ event irc_user_message(c: connection, is_orig: bool, user: string, host: string,
c$irc$command = "USER"; c$irc$command = "USER";
c$irc$value = user; c$irc$value = user;
c$irc$addl=fmt("%s %s %s", host, server, real_name); c$irc$addl=fmt("%s %s %s", host, server, real_name);
}
}
event irc_user_message(c: connection, is_orig: bool, user: string, host: string, server: string, real_name: string) &priority=-5
{
if ( is_orig )
{
Log::write(IRC, c$irc); Log::write(IRC, c$irc);
c$irc$user = user; c$irc$user = user;
} }
@ -93,8 +107,13 @@ event irc_join_message(c: connection, is_orig: bool, info_list: irc_join_list) &
{ {
set_session(c); set_session(c);
if ( is_orig ) if ( is_orig )
{
c$irc$command = "JOIN"; c$irc$command = "JOIN";
}
event irc_join_message(c: connection, is_orig: bool, info_list: irc_join_list) &priority=5
{
if ( is_orig )
{
for ( l in info_list ) for ( l in info_list )
{ {
c$irc$value = l$channel; c$irc$value = l$channel;

17
policy/protocols/irc/dcc-send.bro
View file

@ -52,7 +52,7 @@ event file_transferred(c: connection, prefix: string, descr: string,
irc$dcc_mime_type = mime_type; irc$dcc_mime_type = mime_type;
if ( extract_file_types in mime_type ) if ( extract_file_types == mime_type )
{ {
irc$extract_file = T; irc$extract_file = T;
add irc$tags[EXTRACTED_FILE]; add irc$tags[EXTRACTED_FILE];
@ -61,12 +61,8 @@ event file_transferred(c: connection, prefix: string, descr: string,
local fname = generate_extraction_filename(extraction_prefix, c, suffix); local fname = generate_extraction_filename(extraction_prefix, c, suffix);
irc$extraction_file = open(fname); irc$extraction_file = open(fname);
} }
local tmp = c$irc$command;
c$irc$command = "DCC";
Log::write(IRC, c$irc);
c$irc$command = tmp;
} }
event file_transferred(c: connection, prefix: string, descr: string, event file_transferred(c: connection, prefix: string, descr: string,
mime_type: string) &priority=-4 mime_type: string) &priority=-4
{ {
@ -76,9 +72,14 @@ event file_transferred(c: connection, prefix: string, descr: string,
local irc = dcc_expected_transfers[id$resp_h, id$resp_p]; local irc = dcc_expected_transfers[id$resp_h, id$resp_p];
local tmp = irc$command;
irc$command = "DCC";
Log::write(IRC, irc);
irc$command = tmp;
if ( irc$extract_file && irc?$extraction_file ) if ( irc$extract_file && irc?$extraction_file )
set_contents_file(id, CONTENTS_RESP, irc$extraction_file); set_contents_file(id, CONTENTS_RESP, irc$extraction_file);
# Delete these values in case another DCC transfer # Delete these values in case another DCC transfer
# happens during the IRC session. # happens during the IRC session.
delete irc$extract_file; delete irc$extract_file;
@ -99,7 +100,7 @@ event irc_dcc_message(c: connection, is_orig: bool,
c$irc$dcc_file_name = argument; c$irc$dcc_file_name = argument;
c$irc$dcc_file_size = size; c$irc$dcc_file_size = size;
local p = to_port(dest_port, tcp); local p = to_port(dest_port, tcp);
expect_connection(c$id$orig_h, address, p, ANALYZER_FILE, 5 min); expect_connection(to_addr("0.0.0.0"), address, p, ANALYZER_FILE, 5 min);
dcc_expected_transfers[address, p] = c$irc; dcc_expected_transfers[address, p] = c$irc;
} }

4
src/IRC.cc
View file

@ -668,9 +668,9 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
vl->append(new Val(atoi(parts[4].c_str()), TYPE_COUNT)); vl->append(new Val(atoi(parts[4].c_str()), TYPE_COUNT));
if ( parts.size() >= 6 ) if ( parts.size() >= 6 )
vl->append(new Val(atoi(parts[5].c_str()), vl->append(new Val(atoi(parts[5].c_str()),
TYPE_INT)); TYPE_COUNT));
else else
vl->append(new Val(0, TYPE_INT)); vl->append(new Val(0, TYPE_COUNT));
ConnectionEvent(irc_dcc_message, vl); ConnectionEvent(irc_dcc_message, vl);
} }