Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 21:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

frameworks/notice: Handle fa_file with no or more than a single connection better

Browse source 
* When a file is transferred over multiple connection, have
  create_file_info() just pick the first one instead of none.

* Do not unconditionally assume cid and cuid as set on a
  Notice::FileInfo object.
This commit is contained in:
Arne Welzel 2022-12-02 14:21:53 +01:00
parent dbbb6cd6f0
commit 1e06c8bfda
7 changed files with 65 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

26
testing/btest/scripts/base/frameworks/notice/file-info-multiple-conns.zeek Normal file
View file

@ -0,0 +1,26 @@
# @TEST-DOC: Call create_file_info() and populate_file_info2() when a file is transferred over multiple connections.
# @TEST-EXEC: zeek -b %INPUT -r $TRACES/http/concurrent-range-requests-complete.pcap > output
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: btest-diff files.log
# @TEST-EXEC: btest-diff notice.log
@load base/protocols/http
@load base/frameworks/files
redef enum Notice::Type += { NoticeTestType };
event file_new(f: fa_file)
{
Files::add_analyzer(f, Files::ANALYZER_SHA1);
}
event file_hash(f: fa_file, kind: string, hash: string)
{
print "file_hash", kind, f?$conns ? |f$conns| : 0;
local fi = Notice::create_file_info(f);
print fi;
local n: Notice::Info = Notice::Info($note=NoticeTestType, $msg="test");
Notice::populate_file_info2(fi, n);
NOTICE(n);
}