diff --git a/CHANGES b/CHANGES
index 3699c76cf5..42f965c90d 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,23 @@
+5.1.0-dev.393 | 2022-08-17 08:59:11 +0200
+
+ * files.log: Unroll and introduce uid and id fields (Arne Welzel, Corelight)
+
+ This is a script-only change that unrolls File::Info records into
+ multiple files.log entries if the same file was seen over different
+ connections by a single worker. Consequently, the File::Info record
+ gets the commonly used uid and id fields added. These fields are
+ optional for File::Info - a file may be analyzed without relation
+ to a network connection (e.g by using Input::add_analysis()).
+
+ The existing tx_hosts, rx_hosts and conn_uids fields of Files::Info
+ are not meaningful after this change and removed by default. Therefore,
+ files.log will have them removed, too.
+
+ The tx_hosts, rx_hosts and conn_uids fields can be revived by using the
+ policy script frameworks/files/deprecated-txhosts-rxhosts-connuids.zeek
+ included in the distribution. However, with v6.1 this script will be
+ removed.
+
5.1.0-dev.391 | 2022-08-16 09:17:06 -0700
* Fix a swath of AUTO_CAUSES_COPY issues reported by Coverity (Tim Wojtulewicz, Corelight)
diff --git a/NEWS b/NEWS
index e883b43a8e..0ebccac0a8 100644
--- a/NEWS
+++ b/NEWS
@@ -21,9 +21,32 @@ Breaking Changes
- The Dictionary and PDict classes are now C++ templates. This may cause
plugin/package builds to fail due to needing to modify uses of them to match.
-- The low-level singleton Telemetry BIFs have been removed with the assumption that
- there haven't been any users. Singleton metrics can be instantiated by providing
- an empty label vector instead and aren't in any way a special concept.
+- By default, ``files.log`` does not have the fields ``tx_hosts``, ``rx_hosts``
+ and ``conn_uids`` anymore. These have been replaced with the more commonly
+ used ``uid`` and ``id`` fields. They can be re-instantiated by loading the
+ following policy script through ``local.zeek``:
+
+ @load frameworks/files/deprecated-txhosts-rxhosts-connuids
+
+ Note, however, that this script will be removed with Zeek 6.1. Consumers
+ of ``files.log`` should convert to using the singular ``uid`` and ``id``
+ fields instead.
+
+- The ``files.log`` is now unrolled consistently. That is, when Zeek associates
+ multiple connections with a single file, each of these connections will result
+ in individual ``files.log`` entries with unique connection uids, all sharing
+ the same file uid.
+
+ This unrolling behavior always existed in a Zeek cluster when the network
+ connections involved in a file transfer are load-balanced to different workers.
+ Due to this affecting only a marginal ratio of files on real-world networks,
+ unrolling the log was chosen as the more efficient approach over making
+ the current logic cluster aware.
+
+ The ``seen_bytes`` and ``missing_bytes`` fields of a ``File::Info`` record
+ continue to represent the total number across all connections seen by the
+ current instance of Zeek.
+
New Functionality
-----------------
diff --git a/VERSION b/VERSION
index 4247311f58..4430767cc5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.1.0-dev.391
+5.1.0-dev.393
diff --git a/scripts/base/frameworks/files/main.zeek b/scripts/base/frameworks/files/main.zeek
index 5f799a26c4..315386c501 100644
--- a/scripts/base/frameworks/files/main.zeek
+++ b/scripts/base/frameworks/files/main.zeek
@@ -41,18 +41,13 @@ export {
## An identifier associated with a single file.
fuid: string &log;
- ## If this file was transferred over a network
- ## connection this should show the host or hosts that
- ## the data sourced from.
- tx_hosts: set[addr] &default=addr_set() &log;
+ ## If this file, or parts of it, were transferred over a
+ ## network connection, this is the uid for the connection.
+ uid: string &log &optional;
- ## If this file was transferred over a network
- ## connection this should show the host or hosts that
- ## the data traveled to.
- rx_hosts: set[addr] &default=addr_set() &log;
-
- ## Connection UIDs over which the file was transferred.
- conn_uids: set[string] &default=string_set() &log;
+ ## If this file, or parts of it, were transferred over a
+ ## network connection, this shows the connection.
+ id: conn_id &log &optional;
## An identification of the source of the file data. E.g. it
## may be a network protocol over which it was transferred, or a
@@ -94,6 +89,8 @@ export {
is_orig: bool &log &optional;
## Number of bytes provided to the file analysis engine for the file.
+ ## The value refers to the total number of bytes processed for this
+ ## file across all connections seen by the current Zeek instance.
seen_bytes: count &log &default=0;
## Total number of bytes that are supposed to comprise the full file.
@@ -101,6 +98,8 @@ export {
## The number of bytes in the file stream that were completely missed
## during the process of analysis e.g. due to dropped packets.
+ ## The value refers to number of bytes missed for this file
+ ## across all connections seen by the current Zeek instance.
missing_bytes: count &log &default=0;
## The number of bytes in the file stream that were not delivered to
@@ -532,13 +531,9 @@ event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priori
{
set_info(f);
- add f$info$conn_uids[c$uid];
local cid = c$id;
- add f$info$tx_hosts[f$is_orig ? cid$orig_h : cid$resp_h];
if( |Site::local_nets| > 0 )
f$info$local_orig=Site::is_local_addr(f$is_orig ? cid$orig_h : cid$resp_h);
-
- add f$info$rx_hosts[f$is_orig ? cid$resp_h : cid$orig_h];
}
event file_sniff(f: fa_file, meta: fa_metadata) &priority=10
@@ -572,5 +567,28 @@ event file_state_remove(f: fa_file) &priority=10
event file_state_remove(f: fa_file) &priority=-10
{
- Log::write(Files::LOG, f$info);
+ # No network connection for this file? Just write it out once without
+ # uid and c$id fields.
+ if ( ! f?$conns || |f$conns| == 0 )
+ {
+ Log::write(Files::LOG, f$info);
+ return;
+ }
+
+ # If f was seen over multiple connections, unroll them here as
+ # multiple files.log entries. In previous versions of Zeek, there
+ # would only be a single files.log entry (per worker) with multiple
+ # tx_hosts, rx_hosts and conn_uids associated. This changed with v5.1
+ # to have individual log entries that all share the same fuid value.
+ for ( [cid], c in f$conns )
+ {
+ # Make a copy of the record when there's more than one
+ # connection so that the log_files event doesn't see
+ # the same record multiple times due to it being queued
+ # by reference in Log::write() rather than by copy.
+ local info = |f$conns| > 1 ? copy(f$info) : f$info;
+ info$uid = c$uid;
+ info$id = cid;
+ Log::write(Files::LOG, info);
+ }
}
diff --git a/scripts/policy/frameworks/files/deprecated-txhosts-rxhosts-connuids.zeek b/scripts/policy/frameworks/files/deprecated-txhosts-rxhosts-connuids.zeek
new file mode 100644
index 0000000000..93d81a29f7
--- /dev/null
+++ b/scripts/policy/frameworks/files/deprecated-txhosts-rxhosts-connuids.zeek
@@ -0,0 +1,64 @@
+##! This script can be used to add back the fields ``tx_hosts``, ``rx_hosts``
+##! and ``conn_uids`` to the :zeek:see:`Files::Info` record and thereby also
+##! back into the ``files.log``. These fields have been removed in Zeek 5.1
+##! and replaced with the more commonly used ``uid`` and ``id`` fields.
+##!
+##! It's only purpose is to provide an easy way to add back the fields such that
+##! existing downstream processes continue to work without the need to adapt them.
+##! This script will be removed with Zeek 6.1 at which point downstream processes
+##! hopefully have switched over to use ``uid`` and ``id`` instead.
+
+# Remove in v6.1.
+
+@load base/frameworks/files
+
+module Files;
+
+# Add back the fields to Files::Info.
+redef record Info += {
+ ## If this file was transferred over a network
+ ## connection this should show the host or hosts that
+ ## the data sourced from.
+ tx_hosts: set[addr] &default=addr_set() &log;
+
+ ## If this file was transferred over a network
+ ## connection this should show the host or hosts that
+ ## the data traveled to.
+ rx_hosts: set[addr] &default=addr_set() &log;
+
+ ## Connection UIDs over which the file was transferred.
+ conn_uids: set[string] &default=string_set() &log;
+};
+
+event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=9
+ {
+ local cid = c$id;
+ add f$info$conn_uids[c$uid];
+ add f$info$tx_hosts[f$is_orig ? cid$orig_h : cid$resp_h];
+ add f$info$rx_hosts[f$is_orig ? cid$resp_h : cid$orig_h];
+ }
+
+# For every log write to files.log, ensure tx_hosts, rx_hosts and conn_uids
+# hold just a single value. Use a high priority for this handler to ensure
+# this happens before any user defined hooks.
+hook Log::log_stream_policy(rec: any, id: Log::ID) &priority=100
+ {
+ if ( id != Files::LOG )
+ return;
+
+ local info = rec as Files::Info;
+
+ # In the common case of a single connection (or the less common case
+ # of no connection), there's nothing to do in this hook.
+ if ( |info$conn_uids| == 1 || ! info?$id )
+ return;
+
+ # Make singular tx_hosts, rx_hosts and conn_uids fields based on
+ # the active uid. Note, this currently assumes that Files::Info$is_orig
+ # is the same for all connections. This seems reasonable given that
+ # all connections will use the same protocol.
+ local cid = info$id;
+ info$conn_uids = set(info$uid);
+ info$tx_hosts = set(info$is_orig ? cid$orig_h : cid$resp_h);
+ info$rx_hosts = set(info$is_orig ? cid$resp_h : cid$orig_h);
+ }
diff --git a/scripts/test-all-policy.zeek b/scripts/test-all-policy.zeek
index ef752bece9..cd7638eea4 100644
--- a/scripts/test-all-policy.zeek
+++ b/scripts/test-all-policy.zeek
@@ -57,6 +57,7 @@
@load frameworks/intel/seen/where-locations.zeek
@load frameworks/intel/seen/x509.zeek
@load frameworks/netcontrol/catch-and-release.zeek
+@load frameworks/files/deprecated-txhosts-rxhosts-connuids.zeek
@load frameworks/files/detect-MHR.zeek
@load frameworks/files/entropy-test-all-files.zeek
#@load frameworks/files/extract-all-files.zeek
diff --git a/testing/btest/Baseline/core.tcp.large-file-reassembly/files.log b/testing/btest/Baseline/core.tcp.large-file-reassembly/files.log
index 93cf2a5d0a..7780de5df1 100644
--- a/testing/btest/Baseline/core.tcp.large-file-reassembly/files.log
+++ b/testing/btest/Baseline/core.tcp.large-file-reassembly/files.log
@@ -5,8 +5,8 @@
#unset_field -
#path files
#open XXXX-XX-XX-XX-XX-XX
-#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size
-#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string bool count
-XXXXXXXXXX.XXXXXX FnoIda1WW6kUCpRjRc 192.168.56.101 192.168.56.1 ClEkJM2Vm5giqnMf4h FTP_DATA 0 DATA_EVENT text/plain - 0.000000 - F 270 - 0 0 F - - - - - - -
-XXXXXXXXXX.XXXXXX F1jSMF2ntWAIdj4juj 192.168.56.101 192.168.56.1 C4J4Th3PJpwUYZZ6gc FTP_DATA 0 DATA_EVENT text/plain - 150.490904 - F 23822 - 5416642848 0 F - - - - - - -
+#fields ts fuid uid id.orig_h id.orig_p id.resp_h id.resp_p source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size
+#types time string string addr port addr port string count set[string] string string interval bool bool count count count count bool string string string string string bool count
+XXXXXXXXXX.XXXXXX FnoIda1WW6kUCpRjRc ClEkJM2Vm5giqnMf4h 192.168.56.1 59763 192.168.56.101 63988 FTP_DATA 0 DATA_EVENT text/plain - 0.000000 - F 270 - 0 0 F - - - - - - -
+XXXXXXXXXX.XXXXXX F1jSMF2ntWAIdj4juj C4J4Th3PJpwUYZZ6gc 192.168.56.1 59764 192.168.56.101 37150 FTP_DATA 0 DATA_EVENT text/plain - 150.490904 - F 23822 - 5416642848 0 F - - - - - - -
#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output
index b51a05a930..2333adc739 100644
--- a/testing/btest/Baseline/plugins.hooks/output
+++ b/testing/btest/Baseline/plugins.hooks/output
@@ -4720,10 +4720,10 @@ XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX
XXXXXXXXXX.XXXXXX | HookDrainEvents
XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::__enable_reassembly, , (FMnxxt3xjVcWNS2141)) ->
XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::__set_reassembly_buffer, , (FMnxxt3xjVcWNS2141, 524288)) ->
-XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::enable_reassembly, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=])) ->
+XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::enable_reassembly, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, uid=, id=, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=])) ->
XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) ->
-XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::set_info, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next Log::write(HTTP::LOG, to_any_coerceHTTP::info)}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=