Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: finish switching hooks to events.

Browse source
This commit is contained in:
Jon Siwek 2013-04-10 11:13:43 -05:00
parent 641154f8e8
commit a2d9b47bcd
39 changed files with 219 additions and 305 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/base/protocols/smtp/entities-excerpt.bro
View file

@ -16,10 +16,8 @@ export {
const default_entity_excerpt_len = 0 &redef;
}
hook FileAnalysis::policy(trig: FileAnalysis::Trigger, f: fa_file)
&priority=5
event file_new(f: fa_file) &priority=5
{
if ( trig != FileAnalysis::TRIGGER_NEW ) return;
if ( ! f?$source ) return;
if ( f$source != "SMTP" ) return;
@ -27,10 +25,8 @@ hook FileAnalysis::policy(trig: FileAnalysis::Trigger, f: fa_file)
f$bof_buffer_size = default_entity_excerpt_len;
}
hook FileAnalysis::policy(trig: FileAnalysis::Trigger, f: fa_file)
&priority=5
event file_bof_buffer(f: fa_file) &priority=5
{
if ( trig != FileAnalysis::TRIGGER_BOF_BUFFER ) return;
if ( ! f?$bof_buffer ) return;
if ( ! f?$source ) return;
if ( f$source != "SMTP" ) return;

8
scripts/base/protocols/smtp/entities.bro
View file

@ -95,10 +95,8 @@ event mime_begin_entity(c: connection) &priority=10
set_session(c, T);
}
hook FileAnalysis::policy(trig: FileAnalysis::Trigger, f: fa_file)
&priority=5
event file_new(f: fa_file) &priority=5
{
if ( trig != FileAnalysis::TRIGGER_NEW ) return;
if ( ! f?$source ) return;
if ( f$source != "SMTP" ) return;
if ( ! f?$conns ) return;
@ -165,10 +163,8 @@ function check_md5_by_type(f: fa_file)
FileAnalysis::add_action(f, [$act=FileAnalysis::ACTION_MD5]);
}
hook FileAnalysis::policy(trig: FileAnalysis::Trigger, f: fa_file)
&priority=5
event file_type(f: fa_file) &priority=5
{
if ( trig != FileAnalysis::TRIGGER_TYPE ) return;
if ( ! f?$mime_type ) return;
if ( ! f?$source ) return;
if ( f$source != "SMTP" ) return;