Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 15:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Change semantics of FileAnalysis::stop BIF to internally mean "ignore".

Browse source 
The manager has to remember that the file is being ignored until either
EOF or timeout.
This commit is contained in:
Jon Siwek 2013-03-01 14:03:37 -06:00
parent 6cb58a5228
commit 9425c2508f
4 changed files with 93 additions and 79 deletions
Download patch file Download diff file Expand all files Collapse all files

109
src/file_analysis/Manager.cc
View file

@ -25,62 +25,70 @@ void Manager::Terminate()
Timeout(keys[i], true);
}
static void check_file_done(Info* info)
{
if ( info->IsComplete() )
{
file_mgr->RemoveFile(info->GetFileID());
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_DONE, info);
}
}
void Manager::DataIn(const string& unique, const u_char* data, uint64 len,
uint64 offset, Connection* conn, const string& protocol)
{
if ( IsIgnored(unique) ) return;
Info* info = GetInfo(unique, conn, protocol);
if ( ! info ) return;
info->DataIn(data, len, offset);
check_file_done(info);
DoRemoveFiles();
if ( info->IsComplete() )
RemoveFile(unique);
}
void Manager::DataIn(const string& unique, const u_char* data, uint64 len,
Connection* conn, const string& protocol)
{
Info* info = GetInfo(unique, conn, protocol);
if ( ! info ) return;
info->DataIn(data, len);
check_file_done(info);
DoRemoveFiles();
if ( info->IsComplete() )
RemoveFile(unique);
}
void Manager::EndOfFile(const string& unique, Connection* conn,
const string& protocol)
{
Info* info = GetInfo(unique, conn, protocol);
info->EndOfFile();
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_EOF, info);
DoRemoveFiles();
// Just call GetInfo because maybe the conn/protocol args will update
// something in the Info record.
GetInfo(unique, conn, protocol);
RemoveFile(unique);
}
void Manager::Gap(const string& unique, uint64 offset, uint64 len,
Connection* conn, const string& protocol)
{
Info* info = GetInfo(unique, conn, protocol);
if ( ! info ) return;
info->Gap(offset, len);
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_GAP, info);
DoRemoveFiles();
}
void Manager::SetSize(const string& unique, uint64 size,
Connection* conn, const string& protocol)
{
Info* info = GetInfo(unique, conn, protocol);
if ( ! info ) return;
info->SetTotalBytes(size);
check_file_done(info);
DoRemoveFiles();
if ( info->IsComplete() )
RemoveFile(unique);
}
void Manager::EvaluatePolicy(BifEnum::FileAnalysis::Trigger t, Info* info)
{
if ( IsIgnored(info->GetUnique()) ) return;
const ID* id = global_scope()->Lookup("FileAnalysis::policy");
assert(id);
const Func* hook = id->ID_Val()->AsFunc();
@ -126,6 +134,8 @@ bool Manager::RemoveAction(const FileID& file_id, const RecordVal* args) const
Info* Manager::GetInfo(const string& unique, Connection* conn,
const string& protocol)
{
if ( IsIgnored(unique) ) return 0;
Info* rval = str_map[unique];
if ( ! rval )
@ -136,12 +146,13 @@ Info* Manager::GetInfo(const string& unique, Connection* conn,
if ( id_map[id] )
{
reporter->Error("Evicted duplicate file ID: %s", id.c_str());
DoRemoveFile(id);
RemoveFile(unique);
}
id_map[id] = rval;
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_NEW, rval);
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_NEW, rval);
rval->ScheduleInactivityTimer();
if ( IsIgnored(unique) ) return 0;
}
else
{
@ -167,7 +178,7 @@ void Manager::Timeout(const FileID& file_id, bool is_terminating)
if ( ! info ) return;
Manager::EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TIMEOUT, info);
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TIMEOUT, info);
if ( info->postpone_timeout && ! is_terminating )
{
@ -181,44 +192,44 @@ void Manager::Timeout(const FileID& file_id, bool is_terminating)
DBG_LOG(DBG_FILE_ANALYSIS, "File analysis timeout for %s",
info->GetFileID().c_str());
DoRemoveFile(file_id);
RemoveFile(info->GetUnique());
}
bool Manager::DoRemoveFile(const FileID& file_id)
bool Manager::IgnoreFile(const FileID& file_id)
{
IDMap::iterator it = id_map.find(file_id);
if ( it == id_map.end() ) return false;
if ( ! str_map.erase(it->second->GetUnique()) )
reporter->Error("No string mapping for file ID %s", file_id.c_str());
DBG_LOG(DBG_FILE_ANALYSIS, "Ignore FileID %s", file_id.c_str());
DBG_LOG(DBG_FILE_ANALYSIS, "Remove FileID %s", it->first.c_str());
ignored.insert(it->second->GetUnique());
return true;
}
bool Manager::RemoveFile(const string& unique)
{
StrMap::iterator it = str_map.find(unique);
if ( it == str_map.end() ) return false;
it->second->EndOfFile();
FileID id = it->second->GetFileID();
DBG_LOG(DBG_FILE_ANALYSIS, "Remove FileID %s", id.c_str());
if ( ! id_map.erase(id) )
reporter->Error("No mapping for fileID %s", id.c_str());
ignored.erase(unique);
str_map.erase(unique);
delete it->second;
id_map.erase(it);
return true;
}
bool Manager::RemoveFile(const FileID& file_id)
bool Manager::IsIgnored(const string& unique)
{
IDMap::iterator it = id_map.find(file_id);
if ( it == id_map.end() ) return false;
DBG_LOG(DBG_FILE_ANALYSIS, "Queue removal of FileID %s",
it->first.c_str());
it->second->EndOfFile();
removing.push_back(it->first);
return true;
}
void Manager::DoRemoveFiles()
{
IDList::iterator it;
for ( it = removing.begin(); it != removing.end(); ++it )
DoRemoveFile(*it);
removing.clear();
return ignored.find(unique) != ignored.end();
}