Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

FileAnalysis: replace script-layer IRC file analysis.

Browse source
This commit is contained in:
Jon Siwek 2013-03-27 14:02:20 -05:00
parent 7e895a3a2f
commit 27e47f0a57
7 changed files with 138 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/ftp/file-extract.bro
View file

@ -77,7 +77,7 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
}
hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
&priority=5
&priority=-5
{
if ( trig != FileAnalysis::TRIGGER_EOF &&
trig != FileAnalysis::TRIGGER_DONE ) return;

4
scripts/base/protocols/ftp/main.bro
View file

@ -359,9 +359,7 @@ event file_transferred(c: connection, prefix: string, descr: string,
event connection_state_remove(c: connection) &priority=-5
{
local id = c$id;
if ( [id$resp_h, id$resp_p] in ftp_data_expected )
delete ftp_data_expected[id$resp_h, id$resp_p];
delete ftp_data_expected[c$id$resp_h, c$id$resp_p];
}
# Use state remove event to cover connections terminated by RST.