Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 15:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix file_over_new_connection event to trigger when entire file is missed.

Browse source 
If a file is nothing but gaps (e.g. due to missing/dropped packets), Bro
can sometimes detect a file is supposed to have been present and never
saw any of its content, but failed to raise file_over_new_connection
events for it.  This was mostly apparent because the tx_hosts/rx_hosts
fields in files.log would not be populated in such cases (but are now
with this change).
This commit is contained in:
Jon Siwek 2014-01-24 16:47:00 -06:00
parent 6d46144c3b
commit e09763e061
1 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/file_analysis/File.cc
View file

@ -103,7 +103,6 @@ File::~File()
DBG_LOG(DBG_FILE_ANALYSIS, "Destroying File object %s", id.c_str()); DBG_LOG(DBG_FILE_ANALYSIS, "Destroying File object %s", id.c_str());
Unref(val); Unref(val);
// Queue may not be empty in the case where only content gaps were seen.
while ( ! fonc_queue.empty() ) while ( ! fonc_queue.empty() )
{ {
delete_vals(fonc_queue.front().second); delete_vals(fonc_queue.front().second);
@ -460,20 +459,27 @@ void File::FileEvent(EventHandlerPtr h)
FileEvent(h, vl); FileEvent(h, vl);
} }
static void flush_file_event_queue(queue<pair<EventHandlerPtr, val_list*> >& q)
{
while ( ! q.empty() )
{
pair<EventHandlerPtr, val_list*> p = q.front();
mgr.QueueEvent(p.first, p.second);
q.pop();
}
}
void File::FileEvent(EventHandlerPtr h, val_list* vl) void File::FileEvent(EventHandlerPtr h, val_list* vl)
{ {
if ( h == file_state_remove )
flush_file_event_queue(fonc_queue);
mgr.QueueEvent(h, vl); mgr.QueueEvent(h, vl);
if ( h == file_new ) if ( h == file_new )
{ {
did_file_new_event = true; did_file_new_event = true;
flush_file_event_queue(fonc_queue);
while ( ! fonc_queue.empty() )
{
pair<EventHandlerPtr, val_list*> p = fonc_queue.front();
mgr.QueueEvent(p.first, p.second);
fonc_queue.pop();
}
} }
if ( h == file_new || h == file_timeout || h == file_extraction_limit ) if ( h == file_new || h == file_timeout || h == file_extraction_limit )