Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Make x509 intel seen script robust against file analyzer ordering.

Browse source 
Now it consistently works, even if the SHA1 file analyzer gets the data
before the X509 file analyzer.
This commit is contained in:
Johanna Amann 2016-08-11 16:08:01 -07:00
parent 19057c663f
commit 2756dfe581
2 changed files with 11 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/file_analysis/File.cc
View file

@ -375,8 +375,10 @@ void File::DeliverStream(const u_char* data, uint64 len)
while ( (a = analyzers.NextEntry(c)) )
{
DBG_LOG(DBG_FILE_ANALYSIS, "stream delivery to analyzer %s", file_mgr->GetComponentName(a->Tag()).c_str());
if ( ! a->GotStreamDelivery() )
{
DBG_LOG(DBG_FILE_ANALYSIS, "skipping stream delivery to analyzer %s", file_mgr->GetComponentName(a->Tag()).c_str());
int num_bof_chunks_behind = bof_buffer.chunks.size();
if ( ! bof_was_full )
@ -465,6 +467,7 @@ void File::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
while ( (a = analyzers.NextEntry(c)) )
{
DBG_LOG(DBG_FILE_ANALYSIS, "chunk delivery to analyzer %s", file_mgr->GetComponentName(a->Tag()).c_str());
if ( ! a->DeliverChunk(data, len, offset) )
{
analyzers.QueueRemove(a->Tag(), a->Args());