Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

fix-lowercase-intel-bug

Browse source
This commit is contained in:
Antonio Nappa 2020-03-26 15:55:01 -04:00
parent 66156b4eee
commit dd6d379b40
1 changed files with 6 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/base/frameworks/intel/main.zeek
View file

@ -9,7 +9,6 @@ module Intel;
export {
redef enum Log::ID += { LOG };
## Enum type to represent various types of intelligence data.
type Type: enum {
## An IP address.
@ -523,8 +522,8 @@ function item_exists(item: Item): bool
return have_full_data ? to_subnet(item$indicator) in data_store$subnet_data :
to_subnet(item$indicator) in min_data_store$subnet_data;
default:
return have_full_data ? [item$indicator, item$indicator_type] in data_store$string_data :
[item$indicator, item$indicator_type] in min_data_store$string_data;
return have_full_data ? [to_lower(item$indicator), item$indicator_type] in data_store$string_data :
[to_lower(item$indicator), item$indicator_type] in min_data_store$string_data;
}
}
@ -550,8 +549,8 @@ function remove_meta_data(item: Item): bool
delete data_store$subnet_data[net][item$meta$source];
return (|data_store$subnet_data[net]| == 0);
default:
delete data_store$string_data[item$indicator, item$indicator_type][item$meta$source];
return (|data_store$string_data[item$indicator, item$indicator_type]| == 0);
delete data_store$string_data[to_lower(item$indicator), item$indicator_type][item$meta$source];
return (|data_store$string_data[to_lower(item$indicator), item$indicator_type]| == 0);
}
}
@ -588,7 +587,7 @@ function remove(item: Item, purge_indicator: bool)
delete data_store$subnet_data[net];
break;
default:
delete data_store$string_data[item$indicator, item$indicator_type];
delete data_store$string_data[to_lower(item$indicator), item$indicator_type];
break;
}
# Trigger deletion in minimal data stores
@ -610,7 +609,7 @@ event remove_indicator(item: Item)
delete min_data_store$subnet_data[net];
break;
default:
delete min_data_store$string_data[item$indicator, item$indicator_type];
delete min_data_store$string_data[to_lower(item$indicator), item$indicator_type];
break;
}
}