mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
Various minor changes related to file mime type detection.
- Improve or just remove some file magic signatures ported from libmagic that were too general and matched incorrectly too often. - Fix MHR script's use of fa_file$mime_type before checking if it's initialized. It may be uninitialized if no signatures match. - The "fa_file" record now contains a "mime_types" field that contains all magic signatures that matched the file content (where the "mime_type" field is just a shortcut for the strongest match).
This commit is contained in:
parent
0865b152bb
commit
095a68b2ec
15 changed files with 187 additions and 143 deletions
|
@ -285,6 +285,7 @@ public:
|
|||
*/
|
||||
std::string DetectMIME(const u_char* data, uint64 len) const;
|
||||
|
||||
|
||||
protected:
|
||||
friend class FileTimer;
|
||||
|
||||
|
@ -370,6 +371,12 @@ private:
|
|||
static string salt; /**< A salt added to file handles before hashing. */
|
||||
};
|
||||
|
||||
/**
|
||||
* Returns a script-layer value corresponding to the \c mime_matches type.
|
||||
* @param m The MIME match information with which to populate the value.
|
||||
*/
|
||||
VectorVal* GenMIMEMatchesVal(const RuleMatcher::MIME_Matches& m);
|
||||
|
||||
} // namespace file_analysis
|
||||
|
||||
extern file_analysis::Manager* file_mgr;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue