Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 04:58:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: separating IRC/FTP data analyzers.

Browse source 
It simplifies the file handle string callbacks.
This commit is contained in:
Jon Siwek 2013-03-20 11:12:06 -05:00
parent 59ed5c75f1
commit 661677d452
37 changed files with 156 additions and 95 deletions
Download patch file Download diff file Expand all files Collapse all files

4
testing/btest/Baseline/scripts.base.frameworks.file-analysis.ftp/out
View file

@ -1,5 +1,5 @@
FileAnalysis::TRIGGER_NEW
XRXY932iwza, 0, 0
sidhzrR4IT8, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
The Nationa
@ -7,7 +7,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_EOF
XRXY932iwza, 16557, 0
sidhzrR4IT8, 16557, 0
{
arKYeMETxOg
}

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.get/KPVibShQgUc-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.get/Cx92a0ym5R8-file
View file

4
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.get/get-gzip.out
View file

@ -1,5 +1,5 @@
FileAnalysis::TRIGGER_NEW
LMA6EHLacYc, 0, 0
kg59rqyYxN, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
{^J "origin
@ -7,7 +7,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_EOF
LMA6EHLacYc, 197, 0
kg59rqyYxN, 197, 0
{
UWkUyAuUGXf
}

4
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.get/get.out
View file

@ -1,5 +1,5 @@
FileAnalysis::TRIGGER_NEW
KPVibShQgUc, 0, 0
Cx92a0ym5R8, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
^J0.26 | 201
@ -7,7 +7,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_DONE
KPVibShQgUc, 4705, 0
Cx92a0ym5R8, 4705, 0
{
UWkUyAuUGXf
}

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.get/LMA6EHLacYc-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.get/kg59rqyYxN-file
View file

4
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/a.out
View file

@ -1,7 +1,7 @@
FileAnalysis::TRIGGER_NEW
uj9AtyGOiZ8, 0, 0
7gZBKVUgy4l, 0, 0
FileAnalysis::TRIGGER_DONE
uj9AtyGOiZ8, 555523, 0
7gZBKVUgy4l, 555523, 0
{
UWkUyAuUGXf,
arKYeMETxOg

2
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/a.size
View file

@ -1 +1 @@
555523 uj9AtyGOiZ8-file0
555523 7gZBKVUgy4l-file0

8
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/b.out
View file

@ -1,7 +1,7 @@
FileAnalysis::TRIGGER_NEW
ns7As4DOZcj, 0, 0
oDwT1BbzjM1, 0, 0
FileAnalysis::TRIGGER_DONE
ns7As4DOZcj, 1022920, 0
oDwT1BbzjM1, 1022920, 0
{
UWkUyAuUGXf
}
@ -11,10 +11,10 @@ UWkUyAuUGXf
total bytes: 1022920
source: HTTP
FileAnalysis::TRIGGER_NEW
ns7As4DOZcj, 0, 0
oDwT1BbzjM1, 0, 0
FileAnalysis::TRIGGER_TIMEOUT
FileAnalysis::TRIGGER_EOF
ns7As4DOZcj, 206024, 0
oDwT1BbzjM1, 206024, 0
{
arKYeMETxOg
}

2
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/b.size
View file

@ -1 +1 @@
1022920 ns7As4DOZcj-file0
1022920 oDwT1BbzjM1-file0

4
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/c.out
View file

@ -1,7 +1,7 @@
FileAnalysis::TRIGGER_NEW
MHMkq2nFxej, 0, 0
uHS14uhRKGe, 0, 0
FileAnalysis::TRIGGER_DONE
MHMkq2nFxej, 498702, 0
uHS14uhRKGe, 498702, 0
{
UWkUyAuUGXf,
arKYeMETxOg

2
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/c.size
View file

@ -1 +1 @@
498668 MHMkq2nFxej-file0
498668 uHS14uhRKGe-file0

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/WLJWC1FMBq9-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/CCU3vUEr06l-file
View file

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/Ac8PLL9KL49-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/HCzA0dVwDPj-file
View file

Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 94 B

After

Width:  |  Height:  |  Size: 94 B

Before After
Before After

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/NV2MvAX0Is4-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/a1Zu1fteVEf-file
View file

Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 2.3 KiB

After

Width:  |  Height:  |  Size: 2.3 KiB

Before After
Before After

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/Z3kT1FyLnfk-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/aFQKI8SPOL2-file
View file

20
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/out
View file

@ -1,5 +1,5 @@
FileAnalysis::TRIGGER_NEW
Z3kT1FyLnfk, 0, 0
aFQKI8SPOL2, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
/*^J********
@ -7,7 +7,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_EOF
Z3kT1FyLnfk, 2675, 0
aFQKI8SPOL2, 2675, 0
{
UWkUyAuUGXf
}
@ -19,7 +19,7 @@ SHA1: 0e42ae17eea9b074981bd3a34535ad3a22d02706
MD5: b932c3310ce47e158d1a5a42e0b01279
SHA256: 5b037a2c5e36f56e63a3012c73e46a04b27741d8ff8f8b62c832fb681fc60f42
FileAnalysis::TRIGGER_NEW
WLJWC1FMBq9, 0, 0
CCU3vUEr06l, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
//-- Google
@ -27,7 +27,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_EOF
WLJWC1FMBq9, 21421, 0
CCU3vUEr06l, 21421, 0
{
UWkUyAuUGXf
}
@ -39,7 +39,7 @@ SHA1: 8f241117afaa8ca5f41dc059e66d75c283dcc983
MD5: e732f7bf1d7cb4eedcb1661697d7bc8c
SHA256: 6a509fd05aa7c8fa05080198894bb19e638554ffcee0e0b3d7bc8ff54afee1da
FileAnalysis::TRIGGER_NEW
Ac8PLL9KL49, 0, 0
HCzA0dVwDPj, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
GIF89a^D\0^D\0\xb3
@ -47,7 +47,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_DONE
Ac8PLL9KL49, 94, 0
HCzA0dVwDPj, 94, 0
{
UWkUyAuUGXf
}
@ -60,7 +60,7 @@ SHA1: 81f5f056ce5e97d940854bb0c48017b45dd9f15e
MD5: d903de7e30db1691d3130ba5eae6b9a7
SHA256: 6fb22aa9d780ea63bd7a2e12b92b16fcbf1c4874f1d3e11309a5ba984433c315
FileAnalysis::TRIGGER_NEW
NV2MvAX0Is4, 0, 0
a1Zu1fteVEf, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
\x89PNG^M^J^Z^J\0\0\0
@ -68,7 +68,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_DONE
NV2MvAX0Is4, 2349, 0
a1Zu1fteVEf, 2349, 0
{
UWkUyAuUGXf
}
@ -81,7 +81,7 @@ SHA1: 560eab5a0177246827a94042dd103916d8765ac7
MD5: e0029eea80812e9a8e57b8d05d52938a
SHA256: e0b4500c1fd1d675da4137461cbe64d3c8489f4180d194e47683b20e7fb876f4
FileAnalysis::TRIGGER_NEW
YLndcRpw5Ge, 0, 0
xXlF7wFdsR, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
\x89PNG^M^J^Z^J\0\0\0
@ -89,7 +89,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_DONE
YLndcRpw5Ge, 27579, 0
xXlF7wFdsR, 27579, 0
{
UWkUyAuUGXf
}

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/YLndcRpw5Ge-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.pipeline/xXlF7wFdsR-file
View file

Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 27 KiB

After

Width:  |  Height:  |  Size: 27 KiB

Before After
Before After

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.post/LkolCF6OeHh-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.post/PZS1XGHkIf1-file
View file

8
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.post/out
View file

@ -1,5 +1,5 @@
FileAnalysis::TRIGGER_NEW
WDJLxTGN0m8, 0, 0
v5HLI7MxPQh, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
hello world
@ -7,7 +7,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_DONE
WDJLxTGN0m8, 11, 0
v5HLI7MxPQh, 11, 0
{
UWkUyAuUGXf
}
@ -20,7 +20,7 @@ SHA1: 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
MD5: 5eb63bbbe01eeed093cb22bb8f5acdc3
SHA256: b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9
FileAnalysis::TRIGGER_NEW
LkolCF6OeHh, 0, 0
PZS1XGHkIf1, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
{^J "origin
@ -28,7 +28,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_DONE
LkolCF6OeHh, 366, 0
PZS1XGHkIf1, 366, 0
{
UWkUyAuUGXf
}

0
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.post/WDJLxTGN0m8-file → testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.post/v5HLI7MxPQh-file
View file

4
testing/btest/Baseline/scripts.base.frameworks.file-analysis.irc/out
View file

@ -1,5 +1,5 @@
FileAnalysis::TRIGGER_NEW
6w2n1vAlfzk, 0, 0
wqKMAamJVSb, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
PK^C^D^T\0\0\0^H\0\xae
@ -7,7 +7,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_EOF
6w2n1vAlfzk, 42208, 0
wqKMAamJVSb, 42208, 0
{
arKYeMETxOg
}

12
testing/btest/Baseline/scripts.base.frameworks.file-analysis.smtp/out
View file

@ -1,5 +1,5 @@
FileAnalysis::TRIGGER_NEW
wBZuaIADU0b, 0, 0
9VCisPgrqVj, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
Hello^M^J^M^J ^M
@ -7,7 +7,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_EOF
wBZuaIADU0b, 79, 0
9VCisPgrqVj, 79, 0
{
arKYeMETxOg
}
@ -19,7 +19,7 @@ SHA1: b7e497be8a9f5e2c4b6980fceb015360f98f4a13
MD5: 92bca2e6cdcde73647125da7dccbdd07
SHA256: 785a8a044d1454ec88837108f443bbb30cc4f529393ffd57118261036bfe59f5
FileAnalysis::TRIGGER_NEW
i3lOtWMsCWb, 0, 0
ZAOEQmRyxv1, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
<html xmlns
@ -27,7 +27,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_EOF
i3lOtWMsCWb, 1918, 0
ZAOEQmRyxv1, 1918, 0
{
arKYeMETxOg
}
@ -39,7 +39,7 @@ SHA1: e54af6c6616525611364b80bd6557a7ea21dae94
MD5: d194c6359c85bb88b54caee18b1e9b44
SHA256: b9556e92ddbe52379b64804136f830d111cafe7fcd78e54817fe40f3bc24268d
FileAnalysis::TRIGGER_NEW
LgCRm1TGd09, 0, 0
Ltd7QO7jEv3, 0, 0
FileAnalysis::TRIGGER_BOF
FileAnalysis::TRIGGER_BOF_BUFFER
Version 4.9
@ -47,7 +47,7 @@ FileAnalysis::TRIGGER_TYPE
file type is set
mime type is set
FileAnalysis::TRIGGER_EOF
LgCRm1TGd09, 10823, 0
Ltd7QO7jEv3, 10823, 0
{
arKYeMETxOg
}

4
testing/btest/scripts/base/frameworks/file-analysis/http/get.bro
View file

@ -2,8 +2,8 @@
# @TEST-EXEC: bro -r $TRACES/http/get-gzip.trace %INPUT >get-gzip.out
# @TEST-EXEC: btest-diff get.out
# @TEST-EXEC: btest-diff get-gzip.out
# @TEST-EXEC: btest-diff KPVibShQgUc-file
# @TEST-EXEC: btest-diff LMA6EHLacYc-file
# @TEST-EXEC: btest-diff Cx92a0ym5R8-file
# @TEST-EXEC: btest-diff kg59rqyYxN-file
global actions: set[FileAnalysis::ActionArgs];

6
testing/btest/scripts/base/frameworks/file-analysis/http/partial-content.bro
View file

@ -1,16 +1,16 @@
# @TEST-EXEC: bro -r $TRACES/http/206_example_a.pcap %INPUT >a.out
# @TEST-EXEC: btest-diff a.out
# @TEST-EXEC: wc -c uj9AtyGOiZ8-file0 >a.size
# @TEST-EXEC: wc -c 7gZBKVUgy4l-file0 >a.size
# @TEST-EXEC: btest-diff a.size
# @TEST-EXEC: bro -r $TRACES/http/206_example_b.pcap %INPUT >b.out
# @TEST-EXEC: btest-diff b.out
# @TEST-EXEC: wc -c ns7As4DOZcj-file0 >b.size
# @TEST-EXEC: wc -c oDwT1BbzjM1-file0 >b.size
# @TEST-EXEC: btest-diff b.size
# @TEST-EXEC: bro -r $TRACES/http/206_example_c.pcap %INPUT >c.out
# @TEST-EXEC: btest-diff c.out
# @TEST-EXEC: wc -c MHMkq2nFxej-file0 >c.size
# @TEST-EXEC: wc -c uHS14uhRKGe-file0 >c.size
# @TEST-EXEC: btest-diff c.size
global actions: set[FileAnalysis::ActionArgs];

10
testing/btest/scripts/base/frameworks/file-analysis/http/pipeline.bro
View file

@ -1,10 +1,10 @@
# @TEST-EXEC: bro -r $TRACES/http/pipelined-requests.trace %INPUT >out
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: btest-diff Z3kT1FyLnfk-file
# @TEST-EXEC: btest-diff WLJWC1FMBq9-file
# @TEST-EXEC: btest-diff Ac8PLL9KL49-file
# @TEST-EXEC: btest-diff NV2MvAX0Is4-file
# @TEST-EXEC: btest-diff YLndcRpw5Ge-file
# @TEST-EXEC: btest-diff aFQKI8SPOL2-file
# @TEST-EXEC: btest-diff CCU3vUEr06l-file
# @TEST-EXEC: btest-diff HCzA0dVwDPj-file
# @TEST-EXEC: btest-diff a1Zu1fteVEf-file
# @TEST-EXEC: btest-diff xXlF7wFdsR-file
global actions: set[FileAnalysis::ActionArgs];

4
testing/btest/scripts/base/frameworks/file-analysis/http/post.bro
View file

@ -1,7 +1,7 @@
# @TEST-EXEC: bro -r $TRACES/http/post.trace %INPUT >out
# @TEST-EXEC: btest-diff out
# @TEST-EXEC: btest-diff WDJLxTGN0m8-file
# @TEST-EXEC: btest-diff LkolCF6OeHh-file
# @TEST-EXEC: btest-diff v5HLI7MxPQh-file
# @TEST-EXEC: btest-diff PZS1XGHkIf1-file
global actions: set[FileAnalysis::ActionArgs];