Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 03:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

FileAnalysis: replace script-layer http file analysis.

Browse source 
Other misc:

- Remove HTTP::MD5 notice.

- Add "last_active" field to FileAnalysis::Info record.

- Replace "conn_uids", "conn_ids" fields in FileAnalysis::Info record
  with just a "conns" fields containing full connection records.

- The http-methods unit test is failing now, but I think it will be
  fixed once I change the file handle callback mechanism to use events
  instead.
This commit is contained in:
Jon Siwek 2013-03-22 16:14:06 -05:00
parent 7034785810
commit 71f0e2d276
61 changed files with 411 additions and 625 deletions
Download patch file Download diff file Expand all files Collapse all files

8
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/a.out
View file

@ -2,13 +2,7 @@ FileAnalysis::TRIGGER_NEW
7gZBKVUgy4l, 0, 0
FileAnalysis::TRIGGER_DONE
7gZBKVUgy4l, 555523, 0
{
UWkUyAuUGXf,
arKYeMETxOg
}
{
[orig_h=10.101.84.70, orig_p=10978/tcp, resp_h=129.174.93.161, resp_p=80/tcp],
[orig_h=10.101.84.70, orig_p=10978/tcp, resp_h=129.174.93.161, resp_p=80/tcp]
[orig_h=10.101.84.70, orig_p=10977/tcp, resp_h=129.174.93.161, resp_p=80/tcp]
}
total bytes: 555523
source: HTTP

10
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/b.out
View file

@ -2,12 +2,7 @@ FileAnalysis::TRIGGER_NEW
oDwT1BbzjM1, 0, 0
FileAnalysis::TRIGGER_DONE
oDwT1BbzjM1, 1022920, 0
{
UWkUyAuUGXf
}
{
[orig_h=192.168.72.14, orig_p=3254/tcp, resp_h=65.54.95.206, resp_p=80/tcp]
}
total bytes: 1022920
source: HTTP
FileAnalysis::TRIGGER_NEW
@ -15,11 +10,6 @@ oDwT1BbzjM1, 0, 0
FileAnalysis::TRIGGER_TIMEOUT
FileAnalysis::TRIGGER_EOF
oDwT1BbzjM1, 206024, 0
{
arKYeMETxOg
}
{
[orig_h=192.168.72.14, orig_p=3257/tcp, resp_h=65.54.95.14, resp_p=80/tcp]
}
total bytes: 1022920
source: HTTP

8
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/c.out
View file

@ -2,13 +2,7 @@ FileAnalysis::TRIGGER_NEW
uHS14uhRKGe, 0, 0
FileAnalysis::TRIGGER_DONE
uHS14uhRKGe, 498702, 0
{
UWkUyAuUGXf,
arKYeMETxOg
}
{
[orig_h=10.45.179.94, orig_p=19950/tcp, resp_h=129.174.93.170, resp_p=80/tcp],
[orig_h=10.45.179.94, orig_p=19950/tcp, resp_h=129.174.93.170, resp_p=80/tcp]
[orig_h=10.45.179.94, orig_p=19953/tcp, resp_h=129.174.93.170, resp_p=80/tcp]
}
total bytes: 498668
source: HTTP