Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 21:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: change terminology s/action/analyzer

Browse source
This commit is contained in:
Jon Siwek 2013-04-11 14:53:54 -05:00
parent e81f2ae7b0
commit b8c98b8bf7
30 changed files with 575 additions and 570 deletions
Download patch file Download diff file Expand all files Collapse all files

8
testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/file_analysis.log
View file

@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path file_analysis
#open 2013-04-11-17-29-51
#fields id parent_id source last_active seen_bytes total_bytes missing_bytes overflow_bytes timeout_interval bof_buffer_size mime_type timedout conn_uids actions_taken extracted_files md5 sha1 sha256
#open 2013-04-11-19-37-28
#fields id parent_id source last_active seen_bytes total_bytes missing_bytes overflow_bytes timeout_interval bof_buffer_size mime_type timedout conn_uids analyzers extracted_files md5 sha1 sha256
#types string string string time count count count count interval count string bool table[string] table[enum] table[string] string string string
Cx92a0ym5R8 - HTTP 1362692527.009775 4705 4705 0 0 120.000000 1024 set F UWkUyAuUGXf FileAnalysis::ACTION_SHA1,FileAnalysis::ACTION_EXTRACT,FileAnalysis::ACTION_DATA_EVENT,FileAnalysis::ACTION_MD5,FileAnalysis::ACTION_SHA256 Cx92a0ym5R8-file 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 4e7c7ef0984119447e743e3ec77e1de52713e345cde03fe7df753a35849bed18
#close 2013-04-11-17-29-51
Cx92a0ym5R8 - HTTP 1362692527.009775 4705 4705 0 0 120.000000 1024 set F UWkUyAuUGXf FileAnalysis::ANALYZER_SHA1,FileAnalysis::ANALYZER_EXTRACT,FileAnalysis::ANALYZER_DATA_EVENT,FileAnalysis::ANALYZER_MD5,FileAnalysis::ANALYZER_SHA256 Cx92a0ym5R8-file 397168fd09991a0e712254df7bc639ac 1dd7ac0398df6cbc0696445a91ec681facf4dc47 4e7c7ef0984119447e743e3ec77e1de52713e345cde03fe7df753a35849bed18
#close 2013-04-11-19-37-28

6
testing/btest/scripts/base/frameworks/file-analysis/bifs/remove_action.bro
View file

@ -10,9 +10,9 @@ redef test_get_file_name = function(f: fa_file): string
event file_new(f: fa_file) &priority=-10
{
for ( act in test_file_actions )
FileAnalysis::remove_action(f, act);
for ( tag in test_file_analyzers )
FileAnalysis::remove_analyzer(f, tag);
local filename = test_get_file_name(f);
FileAnalysis::remove_action(f, [$act=FileAnalysis::ACTION_EXTRACT,
FileAnalysis::remove_analyzer(f, [$tag=FileAnalysis::ANALYZER_EXTRACT,
$extract_filename=filename]);
}

22
testing/scripts/file-analysis-test.bro
View file

@ -1,7 +1,7 @@
global test_file_analysis_source: string = "" &redef;
global test_file_actions: set[FileAnalysis::ActionArgs];
global test_file_analyzers: set[FileAnalysis::AnalyzerArgs];
global test_get_file_name: function(f: fa_file): string =
function(f: fa_file): string { return ""; } &redef;
@ -29,16 +29,16 @@ event file_new(f: fa_file)
if ( test_file_analysis_source == "" ||
f$source == test_file_analysis_source )
{
for ( act in test_file_actions )
FileAnalysis::add_action(f, act);
for ( tag in test_file_analyzers )
FileAnalysis::add_analyzer(f, tag);
local filename: string = test_get_file_name(f);
if ( filename != "" )
FileAnalysis::add_action(f, [$act=FileAnalysis::ACTION_EXTRACT,
$extract_filename=filename]);
FileAnalysis::add_action(f, [$act=FileAnalysis::ACTION_DATA_EVENT,
$chunk_event=file_chunk,
$stream_event=file_stream]);
FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_EXTRACT,
$extract_filename=filename]);
FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_DATA_EVENT,
$chunk_event=file_chunk,
$stream_event=file_stream]);
}
if ( f?$bof_buffer )
@ -96,7 +96,7 @@ event file_state_remove(f: fa_file)
event bro_init()
{
add test_file_actions[[$act=FileAnalysis::ACTION_MD5]];
add test_file_actions[[$act=FileAnalysis::ACTION_SHA1]];
add test_file_actions[[$act=FileAnalysis::ACTION_SHA256]];
add test_file_analyzers[[$tag=FileAnalysis::ANALYZER_MD5]];
add test_file_analyzers[[$tag=FileAnalysis::ANALYZER_SHA1]];
add test_file_analyzers[[$tag=FileAnalysis::ANALYZER_SHA256]];
}