Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Add an is_orig parameter to file_over_new_connection event.

Browse source
This commit is contained in:
Jon Siwek 2013-07-09 15:58:28 -05:00
parent efe878f3de
commit 73155c321b
12 changed files with 21 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/ftp/files.bro
View file

@ -28,7 +28,7 @@ event bro_init() &priority=5
}
event file_over_new_connection(f: fa_file, c: connection) &priority=5
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( [c$id$resp_h, c$id$resp_p] !in ftp_data_expected )
return;
@ -37,4 +37,4 @@ event file_over_new_connection(f: fa_file, c: connection) &priority=5
ftp$fuid = f$id;
if ( f?$mime_type )
ftp$mime_type = f$mime_type;
}
}

2
scripts/base/protocols/http/entities.bro
View file

@ -53,7 +53,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
}
}
event file_over_new_connection(f: fa_file, c: connection) &priority=5
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( f$source == "HTTP" && c$http?$entity )
{

4
scripts/base/protocols/http/files.bro
View file

@ -40,7 +40,7 @@ event bro_init() &priority=5
Files::register_protocol(Analyzer::ANALYZER_HTTP, HTTP::get_file_handle);
}
event file_over_new_connection(f: fa_file, c: connection) &priority=5
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( c?$http )
{
@ -49,4 +49,4 @@ event file_over_new_connection(f: fa_file, c: connection) &priority=5
else
c$http$resp_fuids[|c$http$resp_fuids|] = f$id;
}
}
}

4
scripts/base/protocols/irc/files.bro
View file

@ -27,7 +27,7 @@ event bro_init() &priority=5
Files::register_protocol(Analyzer::ANALYZER_IRC_DATA, IRC::get_file_handle);
}
event file_over_new_connection(f: fa_file, c: connection) &priority=5
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( [c$id$resp_h, c$id$resp_p] !in dcc_expected_transfers )
return;
@ -38,4 +38,4 @@ event file_over_new_connection(f: fa_file, c: connection) &priority=5
f$info$filename = irc$dcc_file_name;
if ( f?$mime_type )
irc$dcc_mime_type = f$mime_type;
}
}

2
scripts/base/protocols/smtp/entities.bro
View file

@ -31,7 +31,7 @@ event mime_begin_entity(c: connection) &priority=10
++c$smtp_state$mime_depth;
}
event file_over_new_connection(f: fa_file, c: connection) &priority=5
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( f$source != "SMTP" )
return;

4
scripts/base/protocols/smtp/files.bro
View file

@ -27,8 +27,8 @@ event bro_init() &priority=5
Files::register_protocol(Analyzer::ANALYZER_SMTP, SMTP::get_file_handle);
}
event file_over_new_connection(f: fa_file, c: connection) &priority=5
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( c?$smtp )
c$smtp$fuids[|c$smtp$fuids|] = f$id;
}
}