Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 09:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

FileAnalysis: move unique file handle string generation to script-layer

Browse source 
And add minimal integration with HTTP analyzer.
This commit is contained in:
Jon Siwek 2013-03-12 13:40:18 -05:00
parent 1f6cac9b6d
commit 3dd513e26e
18 changed files with 365 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

35
scripts/base/frameworks/file-analysis/main.bro
View file

@ -5,6 +5,11 @@
# TODO: do logging here?
@load base/frameworks/logging
# dependendies for file handle determination
@load base/protocols/http/main
@load base/protocols/http/utils
@load base/protocols/ftp/main
module FileAnalysis;
export {
@ -105,5 +110,35 @@ export {
## TODO: document
global policy: hook(trig: Trigger, info: Info);
global get_handle: function(c: connection, is_orig: bool): string &redef;
# TODO: wrapper functions for BiFs ?
}
function conn_str(c: connection): string
{
return fmt("%s:%s -> %s:%s", c$id$orig_h, c$id$orig_p,
c$id$resp_h, c$id$resp_p);
}
function get_handle(c: connection, is_orig: bool): string
{
local rval: string = "";
local cid: conn_id = c$id;
if ( "ftp-data" in c$service )
rval = fmt("%s: %s", "ftp-data", conn_str(c));
else if ( c?$http )
{
if ( c$http$range_request )
rval = fmt("http(%s): %s: %s", is_orig, c$id$orig_h,
HTTP::build_url(c$http));
else
rval = fmt("http(%s, %s): %s", is_orig, c$http$trans_depth,
conn_str(c));
}
#print fmt("file handle: %s", rval);
return rval;
}