Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 04:58:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: replace script-layer http file analysis.

Browse source 
Other misc:

- Remove HTTP::MD5 notice.

- Add "last_active" field to FileAnalysis::Info record.

- Replace "conn_uids", "conn_ids" fields in FileAnalysis::Info record
  with just a "conns" fields containing full connection records.

- The http-methods unit test is failing now, but I think it will be
  fixed once I change the file handle callback mechanism to use events
  instead.
This commit is contained in:
Jon Siwek 2013-03-22 16:14:06 -05:00
parent 7034785810
commit 71f0e2d276
61 changed files with 411 additions and 625 deletions
Download patch file Download diff file Expand all files Collapse all files

5
testing/btest/scripts/base/frameworks/file-analysis/actions/data_event.bro
View file

@ -43,8 +43,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/bifs/postpone_timeout.bro
View file

@ -55,8 +55,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/bifs/remove_action.bro
View file

@ -48,8 +48,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/bifs/stop.bro
View file

@ -43,8 +43,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

7
testing/btest/scripts/base/frameworks/file-analysis/ftp.bro
View file

@ -12,7 +12,7 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_NEW:
print info$file_id, info$seen_bytes, info$missing_bytes;
if ( info$source == "ftp-data" )
if ( info$source == "FTP_DATA" )
{
for ( act in actions )
FileAnalysis::add_action(info$file_id, act);
@ -34,8 +34,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_EOF:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/http/get.bro
View file

@ -44,8 +44,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/http/partial-content.bro
View file

@ -54,8 +54,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/http/pipeline.bro
View file

@ -45,8 +45,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/http/post.bro
View file

@ -42,8 +42,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

7
testing/btest/scripts/base/frameworks/file-analysis/irc.bro
View file

@ -12,7 +12,7 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_NEW:
print info$file_id, info$seen_bytes, info$missing_bytes;
if ( info$source == "irc-dcc-data" )
if ( info$source == "IRC_DATA" )
{
for ( act in actions )
FileAnalysis::add_action(info$file_id, act);
@ -34,8 +34,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_EOF:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/logging.bro
View file

@ -55,8 +55,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_DONE:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);

5
testing/btest/scripts/base/frameworks/file-analysis/smtp.bro
View file

@ -42,8 +42,9 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, info: FileAnalysis::Info)
case FileAnalysis::TRIGGER_EOF:
print info$file_id, info$seen_bytes, info$missing_bytes;
print info$conn_uids;
print info$conn_ids;
if ( info?$conns )
for ( cid in info$conns )
print cid;
if ( info?$total_bytes )
print "total bytes: " + fmt("%s", info$total_bytes);