mirror of
https://github.com/zeek/zeek.git
synced 2025-10-10 02:28:21 +00:00
File extraction tweaks.
- Default extraction limit of 100MB now provided via a tuning script loaded in local.bro so that command-line Bro is unlimited by default. - Extraction directory is now created on request of file extraction rather than unconditionally in bro_init().
This commit is contained in:
parent
927f534833
commit
17d0ecd388
5 changed files with 11 additions and 6 deletions
|
@ -8,8 +8,8 @@ export {
|
|||
const prefix = "./extract_files/" &redef;
|
||||
|
||||
## The default max size for extracted files (they won't exceed this
|
||||
## number of bytes), 100MB.
|
||||
const default_limit = 104857600;
|
||||
## number of bytes), unlimited.
|
||||
const default_limit = 0 &redef;
|
||||
|
||||
redef record Files::Info += {
|
||||
## Local filenames of extracted file.
|
||||
|
@ -54,12 +54,10 @@ function on_add(f: fa_file, args: Files::AnalyzerArgs)
|
|||
|
||||
f$info$extracted = args$extract_filename;
|
||||
args$extract_filename = build_path_compressed(prefix, args$extract_filename);
|
||||
mkdir(prefix);
|
||||
}
|
||||
|
||||
event bro_init() &priority=10
|
||||
{
|
||||
Files::register_analyzer_add_callback(Files::ANALYZER_EXTRACT, on_add);
|
||||
|
||||
# Create the extraction directory.
|
||||
mkdir(prefix);
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue