mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 20:18:20 +00:00
Merge remote-tracking branch 'origin/topic/jsiwek/faf-experimental' into topic/seth/file-analysis-exe-analyzer
Conflicts: src/file_analysis.bif
This commit is contained in:
Seth Hall
commit
e0df278de6
74 changed files with 1135 additions and 1544 deletions
|
|
@ -8,10 +8,10 @@ namespace file_analysis {
|
|||
|
||||
typedef BifEnum::FileAnalysis::Action ActionTag;
|
||||
|
||||
class Info;
|
||||
class File;
|
||||
|
||||
/**
|
||||
* Base class for actions that can be attached to a file_analysis::Info object.
|
||||
* Base class for actions that can be attached to a file_analysis::File object.
|
||||
*/
|
||||
class Action {
|
||||
public:
|
||||
|
|
@ -67,9 +67,9 @@ public:
|
|||
RecordVal* Args() const { return args; }
|
||||
|
||||
/**
|
||||
* @return the file_analysis::Info object to which the action is attached.
|
||||
* @return the file_analysis::File object to which the action is attached.
|
||||
*/
|
||||
Info* GetInfo() const { return info; }
|
||||
File* GetFile() const { return file; }
|
||||
|
||||
/**
|
||||
* @return the action tag equivalent of the 'act' field from the ActionArgs
|
||||
|
|
@ -84,17 +84,17 @@ public:
|
|||
|
||||
protected:
|
||||
|
||||
Action(RecordVal* arg_args, Info* arg_info)
|
||||
Action(RecordVal* arg_args, File* arg_file)
|
||||
: tag(Action::ArgsTag(arg_args)), args(arg_args->Ref()->AsRecordVal()),
|
||||
info(arg_info)
|
||||
file(arg_file)
|
||||
{}
|
||||
|
||||
ActionTag tag;
|
||||
RecordVal* args;
|
||||
Info* info;
|
||||
File* file;
|
||||
};
|
||||
|
||||
typedef Action* (*ActionInstantiator)(RecordVal* args, Info* info);
|
||||
typedef Action* (*ActionInstantiator)(RecordVal* args, File* file);
|
||||
|
||||
} // namespace file_analysis
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
#include "ActionSet.h"
|
||||
#include "Info.h"
|
||||
#include "File.h"
|
||||
#include "Action.h"
|
||||
#include "Extract.h"
|
||||
#include "DataEvent.h"
|
||||
|
|
@ -25,7 +25,7 @@ static void action_del_func(void* v)
|
|||
delete (Action*) v;
|
||||
}
|
||||
|
||||
ActionSet::ActionSet(Info* arg_info) : info(arg_info)
|
||||
ActionSet::ActionSet(File* arg_file) : file(arg_file)
|
||||
{
|
||||
TypeList* t = new TypeList();
|
||||
t->Append(BifType::Record::FileAnalysis::ActionArgs->Ref());
|
||||
|
|
@ -54,7 +54,7 @@ bool ActionSet::AddAction(RecordVal* args)
|
|||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Instantiate action %d skipped for file id"
|
||||
" %s: already exists", Action::ArgsTag(args),
|
||||
info->GetFileID().c_str());
|
||||
file->GetID().c_str());
|
||||
delete key;
|
||||
return true;
|
||||
}
|
||||
|
|
@ -94,7 +94,7 @@ bool ActionSet::Add::Perform(ActionSet* set)
|
|||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Add action %d skipped for file id"
|
||||
" %s: already exists", act->Tag(),
|
||||
act->GetInfo()->GetFileID().c_str());
|
||||
act->GetFile()->GetID().c_str());
|
||||
Abort();
|
||||
return true;
|
||||
}
|
||||
|
|
@ -116,12 +116,12 @@ bool ActionSet::RemoveAction(ActionTag tag, HashKey* key)
|
|||
if ( ! act )
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Skip remove action %d for file id %s",
|
||||
tag, info->GetFileID().c_str());
|
||||
tag, file->GetID().c_str());
|
||||
return false;
|
||||
}
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Remove action %d for file id %s", act->Tag(),
|
||||
info->GetFileID().c_str());
|
||||
file->GetID().c_str());
|
||||
delete act;
|
||||
return true;
|
||||
}
|
||||
|
|
@ -151,12 +151,12 @@ HashKey* ActionSet::GetKey(const RecordVal* args) const
|
|||
|
||||
Action* ActionSet::InstantiateAction(RecordVal* args) const
|
||||
{
|
||||
Action* act = action_factory[Action::ArgsTag(args)](args, info);
|
||||
Action* act = action_factory[Action::ArgsTag(args)](args, file);
|
||||
|
||||
if ( ! act )
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Instantiate action %d failed for file id",
|
||||
" %s", Action::ArgsTag(args), info->GetFileID().c_str());
|
||||
" %s", Action::ArgsTag(args), file->GetID().c_str());
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
@ -166,11 +166,9 @@ Action* ActionSet::InstantiateAction(RecordVal* args) const
|
|||
void ActionSet::InsertAction(Action* act, HashKey* key)
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Add action %d for file id %s", act->Tag(),
|
||||
info->GetFileID().c_str());
|
||||
file->GetID().c_str());
|
||||
action_map.Insert(key, act);
|
||||
delete key;
|
||||
info->GetVal()->Lookup(Info::actions_idx)->AsTableVal()->Assign(act->Args(),
|
||||
new RecordVal(BifType::Record::FileAnalysis::ActionResults));
|
||||
}
|
||||
|
||||
void ActionSet::DrainModifications()
|
||||
|
|
@ -178,7 +176,7 @@ void ActionSet::DrainModifications()
|
|||
if ( mod_queue.empty() ) return;
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Start flushing action mod queue of file id %s",
|
||||
info->GetFileID().c_str());
|
||||
file->GetID().c_str());
|
||||
do
|
||||
{
|
||||
Modification* mod = mod_queue.front();
|
||||
|
|
@ -187,5 +185,5 @@ void ActionSet::DrainModifications()
|
|||
mod_queue.pop();
|
||||
} while ( ! mod_queue.empty() );
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "End flushing action mod queue of file id %s",
|
||||
info->GetFileID().c_str());
|
||||
file->GetID().c_str());
|
||||
}
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@
|
|||
|
||||
namespace file_analysis {
|
||||
|
||||
class Info;
|
||||
class File;
|
||||
declare(PDict,Action);
|
||||
|
||||
/**
|
||||
|
|
@ -21,7 +21,7 @@ declare(PDict,Action);
|
|||
class ActionSet {
|
||||
public:
|
||||
|
||||
ActionSet(Info* arg_info);
|
||||
ActionSet(File* arg_file);
|
||||
|
||||
~ActionSet();
|
||||
|
||||
|
|
@ -63,7 +63,7 @@ protected:
|
|||
void InsertAction(Action* act, HashKey* key);
|
||||
bool RemoveAction(ActionTag tag, HashKey* key);
|
||||
|
||||
Info* info;
|
||||
File* file;
|
||||
CompositeHash* action_hash; /**< ActionArgs hashes Action map lookup. */
|
||||
PDict(Action) action_map; /**< Actions indexed by ActionArgs. */
|
||||
|
||||
|
|
|
|||
|
|
@ -7,13 +7,13 @@
|
|||
|
||||
using namespace file_analysis;
|
||||
|
||||
DataEvent::DataEvent(RecordVal* args, Info* info,
|
||||
DataEvent::DataEvent(RecordVal* args, File* file,
|
||||
EventHandlerPtr ce, EventHandlerPtr se)
|
||||
: Action(args, info), chunk_event(ce), stream_event(se)
|
||||
: Action(args, file), chunk_event(ce), stream_event(se)
|
||||
{
|
||||
}
|
||||
|
||||
Action* DataEvent::Instantiate(RecordVal* args, Info* info)
|
||||
Action* DataEvent::Instantiate(RecordVal* args, File* file)
|
||||
{
|
||||
using BifType::Record::FileAnalysis::ActionArgs;
|
||||
|
||||
|
|
@ -36,7 +36,7 @@ Action* DataEvent::Instantiate(RecordVal* args, Info* info)
|
|||
if ( stream_val )
|
||||
stream = event_registry->Lookup(stream_val->AsFunc()->Name());
|
||||
|
||||
return new DataEvent(args, info, chunk, stream);
|
||||
return new DataEvent(args, file, chunk, stream);
|
||||
}
|
||||
|
||||
bool DataEvent::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
|
||||
|
|
@ -44,9 +44,10 @@ bool DataEvent::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
|
|||
if ( ! chunk_event ) return true;
|
||||
|
||||
val_list* args = new val_list;
|
||||
args->append(info->GetVal()->Ref());
|
||||
args->append(file->GetVal()->Ref());
|
||||
args->append(new StringVal(new BroString(data, len, 0)));
|
||||
args->append(new Val(offset, TYPE_COUNT));
|
||||
|
||||
mgr.QueueEvent(chunk_event, args);
|
||||
|
||||
return true;
|
||||
|
|
@ -57,8 +58,9 @@ bool DataEvent::DeliverStream(const u_char* data, uint64 len)
|
|||
if ( ! stream_event ) return true;
|
||||
|
||||
val_list* args = new val_list;
|
||||
args->append(info->GetVal()->Ref());
|
||||
args->append(file->GetVal()->Ref());
|
||||
args->append(new StringVal(new BroString(data, len, 0)));
|
||||
|
||||
mgr.QueueEvent(stream_event, args);
|
||||
|
||||
return true;
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
#include <string>
|
||||
|
||||
#include "Val.h"
|
||||
#include "Info.h"
|
||||
#include "File.h"
|
||||
#include "Action.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
|
@ -15,7 +15,7 @@ namespace file_analysis {
|
|||
class DataEvent : public Action {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(RecordVal* args, Info* info);
|
||||
static Action* Instantiate(RecordVal* args, File* file);
|
||||
|
||||
virtual bool DeliverChunk(const u_char* data, uint64 len, uint64 offset);
|
||||
|
||||
|
|
@ -23,7 +23,7 @@ public:
|
|||
|
||||
protected:
|
||||
|
||||
DataEvent(RecordVal* args, Info* info,
|
||||
DataEvent(RecordVal* args, File* file,
|
||||
EventHandlerPtr ce, EventHandlerPtr se);
|
||||
|
||||
EventHandlerPtr chunk_event;
|
||||
|
|
|
|||
|
|
@ -5,8 +5,8 @@
|
|||
|
||||
using namespace file_analysis;
|
||||
|
||||
Extract::Extract(RecordVal* args, Info* info, const string& arg_filename)
|
||||
: Action(args, info), filename(arg_filename)
|
||||
Extract::Extract(RecordVal* args, File* file, const string& arg_filename)
|
||||
: Action(args, file), filename(arg_filename)
|
||||
{
|
||||
fd = open(filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0666);
|
||||
|
||||
|
|
@ -25,7 +25,7 @@ Extract::~Extract()
|
|||
safe_close(fd);
|
||||
}
|
||||
|
||||
Action* Extract::Instantiate(RecordVal* args, Info* info)
|
||||
Action* Extract::Instantiate(RecordVal* args, File* file)
|
||||
{
|
||||
using BifType::Record::FileAnalysis::ActionArgs;
|
||||
const char* field = "extract_filename";
|
||||
|
|
@ -33,7 +33,7 @@ Action* Extract::Instantiate(RecordVal* args, Info* info)
|
|||
|
||||
if ( ! v ) return 0;
|
||||
|
||||
return new Extract(args, info, v->AsString()->CheckString());
|
||||
return new Extract(args, file, v->AsString()->CheckString());
|
||||
}
|
||||
|
||||
bool Extract::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
#include <string>
|
||||
|
||||
#include "Val.h"
|
||||
#include "Info.h"
|
||||
#include "File.h"
|
||||
#include "Action.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
|
@ -15,7 +15,7 @@ namespace file_analysis {
|
|||
class Extract : public Action {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(RecordVal* args, Info* info);
|
||||
static Action* Instantiate(RecordVal* args, File* file);
|
||||
|
||||
virtual ~Extract();
|
||||
|
||||
|
|
@ -23,7 +23,7 @@ public:
|
|||
|
||||
protected:
|
||||
|
||||
Extract(RecordVal* args, Info* info, const string& arg_filename);
|
||||
Extract(RecordVal* args, File* file, const string& arg_filename);
|
||||
|
||||
string filename;
|
||||
int fd;
|
||||
|
|
|
|||
|
|
@ -1,14 +1,15 @@
|
|||
#include <string>
|
||||
#include <openssl/md5.h>
|
||||
|
||||
#include "Info.h"
|
||||
#include "InfoTimer.h"
|
||||
#include "File.h"
|
||||
#include "FileTimer.h"
|
||||
#include "FileID.h"
|
||||
#include "Manager.h"
|
||||
#include "Reporter.h"
|
||||
#include "Val.h"
|
||||
#include "Type.h"
|
||||
#include "Analyzer.h"
|
||||
#include "Event.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
|
|
@ -32,33 +33,32 @@ static RecordVal* get_conn_id_val(const Connection* conn)
|
|||
return v;
|
||||
}
|
||||
|
||||
int Info::file_id_idx = -1;
|
||||
int Info::parent_file_id_idx = -1;
|
||||
int Info::source_idx = -1;
|
||||
int Info::conns_idx = -1;
|
||||
int Info::last_active_idx = -1;
|
||||
int Info::seen_bytes_idx = -1;
|
||||
int Info::total_bytes_idx = -1;
|
||||
int Info::missing_bytes_idx = -1;
|
||||
int Info::overflow_bytes_idx = -1;
|
||||
int Info::timeout_interval_idx = -1;
|
||||
int Info::bof_buffer_size_idx = -1;
|
||||
int Info::bof_buffer_idx = -1;
|
||||
int Info::file_type_idx = -1;
|
||||
int Info::mime_type_idx = -1;
|
||||
int Info::actions_idx = -1;
|
||||
int File::id_idx = -1;
|
||||
int File::parent_id_idx = -1;
|
||||
int File::source_idx = -1;
|
||||
int File::conns_idx = -1;
|
||||
int File::last_active_idx = -1;
|
||||
int File::seen_bytes_idx = -1;
|
||||
int File::total_bytes_idx = -1;
|
||||
int File::missing_bytes_idx = -1;
|
||||
int File::overflow_bytes_idx = -1;
|
||||
int File::timeout_interval_idx = -1;
|
||||
int File::bof_buffer_size_idx = -1;
|
||||
int File::bof_buffer_idx = -1;
|
||||
int File::file_type_idx = -1;
|
||||
int File::mime_type_idx = -1;
|
||||
|
||||
magic_t Info::magic = 0;
|
||||
magic_t Info::magic_mime = 0;
|
||||
magic_t File::magic = 0;
|
||||
magic_t File::magic_mime = 0;
|
||||
|
||||
string Info::salt;
|
||||
string File::salt;
|
||||
|
||||
void Info::StaticInit()
|
||||
void File::StaticInit()
|
||||
{
|
||||
if ( file_id_idx != -1 ) return;
|
||||
if ( id_idx != -1 ) return;
|
||||
|
||||
file_id_idx = Idx("file_id");
|
||||
parent_file_id_idx = Idx("parent_file_id");
|
||||
id_idx = Idx("id");
|
||||
parent_id_idx = Idx("parent_id");
|
||||
source_idx = Idx("source");
|
||||
conns_idx = Idx("conns");
|
||||
last_active_idx = Idx("last_active");
|
||||
|
|
@ -71,7 +71,6 @@ void Info::StaticInit()
|
|||
bof_buffer_idx = Idx("bof_buffer");
|
||||
file_type_idx = Idx("file_type");
|
||||
mime_type_idx = Idx("mime_type");
|
||||
actions_idx = Idx("actions");
|
||||
|
||||
bro_init_magic(&magic, MAGIC_NONE);
|
||||
bro_init_magic(&magic_mime, MAGIC_MIME);
|
||||
|
|
@ -79,26 +78,26 @@ void Info::StaticInit()
|
|||
salt = BifConst::FileAnalysis::salt->CheckString();
|
||||
}
|
||||
|
||||
Info::Info(const string& unique, Connection* conn, AnalyzerTag::Tag tag)
|
||||
: file_id(""), unique(unique), val(0), postpone_timeout(false),
|
||||
first_chunk(true), need_type(false), need_reassembly(false), done(false),
|
||||
File::File(const string& unique, Connection* conn, AnalyzerTag::Tag tag)
|
||||
: id(""), unique(unique), val(0), postpone_timeout(false),
|
||||
first_chunk(true), missed_bof(false), need_reassembly(false), done(false),
|
||||
actions(this)
|
||||
{
|
||||
StaticInit();
|
||||
|
||||
char id[20];
|
||||
char tmp[20];
|
||||
uint64 hash[2];
|
||||
string msg(unique + salt);
|
||||
MD5(reinterpret_cast<const u_char*>(msg.data()), msg.size(),
|
||||
reinterpret_cast<u_char*>(hash));
|
||||
uitoa_n(hash[0], id, sizeof(id), 62);
|
||||
uitoa_n(hash[0], tmp, sizeof(tmp), 62);
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Creating new Info object %s (%s)", id,
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Creating new File object %s (%s)", tmp,
|
||||
unique.c_str());
|
||||
|
||||
val = new RecordVal(BifType::Record::FileAnalysis::Info);
|
||||
val->Assign(file_id_idx, new StringVal(id));
|
||||
file_id = FileID(id);
|
||||
val = new RecordVal(fa_file_type);
|
||||
val->Assign(id_idx, new StringVal(tmp));
|
||||
id = FileID(tmp);
|
||||
|
||||
if ( conn )
|
||||
{
|
||||
|
|
@ -113,23 +112,23 @@ Info::Info(const string& unique, Connection* conn, AnalyzerTag::Tag tag)
|
|||
UpdateLastActivityTime();
|
||||
}
|
||||
|
||||
Info::~Info()
|
||||
File::~File()
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Destroying Info object %s", file_id.c_str());
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Destroying File object %s", id.c_str());
|
||||
Unref(val);
|
||||
}
|
||||
|
||||
void Info::UpdateLastActivityTime()
|
||||
void File::UpdateLastActivityTime()
|
||||
{
|
||||
val->Assign(last_active_idx, new Val(network_time, TYPE_TIME));
|
||||
}
|
||||
|
||||
double Info::GetLastActivityTime() const
|
||||
double File::GetLastActivityTime() const
|
||||
{
|
||||
return val->Lookup(last_active_idx)->AsTime();
|
||||
}
|
||||
|
||||
void Info::UpdateConnectionFields(Connection* conn)
|
||||
void File::UpdateConnectionFields(Connection* conn)
|
||||
{
|
||||
if ( ! conn ) return;
|
||||
|
||||
|
|
@ -148,14 +147,13 @@ void Info::UpdateConnectionFields(Connection* conn)
|
|||
{
|
||||
conns->AsTableVal()->Assign(idx, conn->BuildConnVal());
|
||||
if ( ! is_first )
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_NEW_CONN,
|
||||
this);
|
||||
file_mgr->FileEvent(file_over_new_connection, this);
|
||||
}
|
||||
|
||||
Unref(idx);
|
||||
}
|
||||
|
||||
uint64 Info::LookupFieldDefaultCount(int idx) const
|
||||
uint64 File::LookupFieldDefaultCount(int idx) const
|
||||
{
|
||||
Val* v = val->LookupWithDefault(idx);
|
||||
uint64 rval = v->AsCount();
|
||||
|
|
@ -163,7 +161,7 @@ uint64 Info::LookupFieldDefaultCount(int idx) const
|
|||
return rval;
|
||||
}
|
||||
|
||||
double Info::LookupFieldDefaultInterval(int idx) const
|
||||
double File::LookupFieldDefaultInterval(int idx) const
|
||||
{
|
||||
Val* v = val->LookupWithDefault(idx);
|
||||
double rval = v->AsInterval();
|
||||
|
|
@ -171,46 +169,31 @@ double Info::LookupFieldDefaultInterval(int idx) const
|
|||
return rval;
|
||||
}
|
||||
|
||||
int Info::Idx(const string& field)
|
||||
int File::Idx(const string& field)
|
||||
{
|
||||
int rval = BifType::Record::FileAnalysis::Info->FieldOffset(field.c_str());
|
||||
int rval = fa_file_type->FieldOffset(field.c_str());
|
||||
if ( rval < 0 )
|
||||
reporter->InternalError("Unknown FileAnalysis::Info field: %s",
|
||||
field.c_str());
|
||||
reporter->InternalError("Unknown fa_file field: %s", field.c_str());
|
||||
return rval;
|
||||
}
|
||||
|
||||
double Info::GetTimeoutInterval() const
|
||||
double File::GetTimeoutInterval() const
|
||||
{
|
||||
return LookupFieldDefaultInterval(timeout_interval_idx);
|
||||
}
|
||||
|
||||
RecordVal* Info::GetResults(RecordVal* args) const
|
||||
{
|
||||
TableVal* actions_table = val->Lookup(actions_idx)->AsTableVal();
|
||||
RecordVal* rval = actions_table->Lookup(args)->AsRecordVal();
|
||||
|
||||
if ( ! rval )
|
||||
{
|
||||
rval = new RecordVal(BifType::Record::FileAnalysis::ActionResults);
|
||||
actions_table->Assign(args, rval);
|
||||
}
|
||||
|
||||
return rval;
|
||||
}
|
||||
|
||||
void Info::IncrementByteCount(uint64 size, int field_idx)
|
||||
void File::IncrementByteCount(uint64 size, int field_idx)
|
||||
{
|
||||
uint64 old = LookupFieldDefaultCount(field_idx);
|
||||
val->Assign(field_idx, new Val(old + size, TYPE_COUNT));
|
||||
}
|
||||
|
||||
void Info::SetTotalBytes(uint64 size)
|
||||
void File::SetTotalBytes(uint64 size)
|
||||
{
|
||||
val->Assign(total_bytes_idx, new Val(size, TYPE_COUNT));
|
||||
}
|
||||
|
||||
bool Info::IsComplete() const
|
||||
bool File::IsComplete() const
|
||||
{
|
||||
Val* total = val->Lookup(total_bytes_idx);
|
||||
if ( ! total ) return false;
|
||||
|
|
@ -219,42 +202,27 @@ bool Info::IsComplete() const
|
|||
return false;
|
||||
}
|
||||
|
||||
void Info::ScheduleInactivityTimer() const
|
||||
void File::ScheduleInactivityTimer() const
|
||||
{
|
||||
timer_mgr->Add(new InfoTimer(network_time, file_id, GetTimeoutInterval()));
|
||||
timer_mgr->Add(new FileTimer(network_time, id, GetTimeoutInterval()));
|
||||
}
|
||||
|
||||
bool Info::AddAction(RecordVal* args)
|
||||
bool File::AddAction(RecordVal* args)
|
||||
{
|
||||
return done ? false : actions.QueueAddAction(args);
|
||||
}
|
||||
|
||||
bool Info::RemoveAction(const RecordVal* args)
|
||||
bool File::RemoveAction(const RecordVal* args)
|
||||
{
|
||||
return done ? false : actions.QueueRemoveAction(args);
|
||||
}
|
||||
|
||||
bool Info::BufferBOF(const u_char* data, uint64 len)
|
||||
bool File::BufferBOF(const u_char* data, uint64 len)
|
||||
{
|
||||
if ( bof_buffer.full || bof_buffer.replayed ) return false;
|
||||
|
||||
if ( bof_buffer.chunks.size() == 0 )
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_BOF, this);
|
||||
|
||||
uint64 desired_size = LookupFieldDefaultCount(bof_buffer_size_idx);
|
||||
|
||||
/* Leaving out this optimization (I think) for now to keep things simpler.
|
||||
// If first chunk satisfies desired size, do everything now without copying.
|
||||
if ( bof_buffer.chunks.empty() && len >= desired_size )
|
||||
{
|
||||
bof_buffer.full = bof_buffer.replayed = true;
|
||||
val->Assign(bof_buffer_idx, new StringVal(new BroString(data, len, 0)));
|
||||
file_mgr->EvaluatePolicy(TRIGGER_BOF_BUFFER, this);
|
||||
// TODO: libmagic stuff
|
||||
return false;
|
||||
}
|
||||
*/
|
||||
|
||||
bof_buffer.chunks.push_back(new BroString(data, len, 0));
|
||||
bof_buffer.size += len;
|
||||
|
||||
|
|
@ -267,7 +235,7 @@ bool Info::BufferBOF(const u_char* data, uint64 len)
|
|||
return true;
|
||||
}
|
||||
|
||||
bool Info::DetectTypes(const u_char* data, uint64 len)
|
||||
bool File::DetectTypes(const u_char* data, uint64 len)
|
||||
{
|
||||
const char* desc = bro_magic_buffer(magic, data, len);
|
||||
const char* mime = bro_magic_buffer(magic_mime, data, len);
|
||||
|
|
@ -281,7 +249,7 @@ bool Info::DetectTypes(const u_char* data, uint64 len)
|
|||
return desc || mime;
|
||||
}
|
||||
|
||||
void Info::ReplayBOF()
|
||||
void File::ReplayBOF()
|
||||
{
|
||||
if ( bof_buffer.replayed ) return;
|
||||
bof_buffer.replayed = true;
|
||||
|
|
@ -289,36 +257,33 @@ void Info::ReplayBOF()
|
|||
if ( bof_buffer.chunks.empty() )
|
||||
{
|
||||
// Since we missed the beginning, try file type detect on next data in.
|
||||
need_type = true;
|
||||
missed_bof = true;
|
||||
return;
|
||||
}
|
||||
|
||||
BroString* bs = concatenate(bof_buffer.chunks);
|
||||
val->Assign(bof_buffer_idx, new StringVal(bs));
|
||||
bool have_type = DetectTypes(bs->Bytes(), bs->Len());
|
||||
|
||||
using BifEnum::FileAnalysis::TRIGGER_BOF_BUFFER;
|
||||
file_mgr->EvaluatePolicy(TRIGGER_BOF_BUFFER, this);
|
||||
DetectTypes(bs->Bytes(), bs->Len());
|
||||
|
||||
if ( have_type )
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TYPE, this);
|
||||
file_mgr->FileEvent(file_new, this);
|
||||
mgr.Drain(); // need immediate feedback about actions to add
|
||||
|
||||
for ( size_t i = 0; i < bof_buffer.chunks.size(); ++i )
|
||||
DataIn(bof_buffer.chunks[i]->Bytes(), bof_buffer.chunks[i]->Len());
|
||||
}
|
||||
|
||||
void Info::DataIn(const u_char* data, uint64 len, uint64 offset)
|
||||
void File::DataIn(const u_char* data, uint64 len, uint64 offset)
|
||||
{
|
||||
actions.DrainModifications();
|
||||
|
||||
if ( first_chunk )
|
||||
{
|
||||
if ( DetectTypes(data, len) )
|
||||
{
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TYPE, this);
|
||||
actions.DrainModifications();
|
||||
}
|
||||
|
||||
// TODO: this should all really be delayed until we attempt reassembly
|
||||
DetectTypes(data, len);
|
||||
file_mgr->FileEvent(file_new, this);
|
||||
mgr.Drain(); // need immediate feedback about actions to add
|
||||
actions.DrainModifications();
|
||||
first_chunk = false;
|
||||
}
|
||||
|
||||
|
|
@ -344,21 +309,19 @@ void Info::DataIn(const u_char* data, uint64 len, uint64 offset)
|
|||
IncrementByteCount(len, seen_bytes_idx);
|
||||
}
|
||||
|
||||
void Info::DataIn(const u_char* data, uint64 len)
|
||||
void File::DataIn(const u_char* data, uint64 len)
|
||||
{
|
||||
actions.DrainModifications();
|
||||
|
||||
if ( BufferBOF(data, len) ) return;
|
||||
|
||||
if ( need_type )
|
||||
if ( missed_bof )
|
||||
{
|
||||
if ( DetectTypes(data, len) )
|
||||
{
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TYPE, this);
|
||||
actions.DrainModifications();
|
||||
}
|
||||
|
||||
need_type = false;
|
||||
DetectTypes(data, len);
|
||||
file_mgr->FileEvent(file_new, this);
|
||||
mgr.Drain(); // need immediate feedback about actions to add
|
||||
actions.DrainModifications();
|
||||
missed_bof = false;
|
||||
}
|
||||
|
||||
Action* act = 0;
|
||||
|
|
@ -383,7 +346,7 @@ void Info::DataIn(const u_char* data, uint64 len)
|
|||
IncrementByteCount(len, seen_bytes_idx);
|
||||
}
|
||||
|
||||
void Info::EndOfFile()
|
||||
void File::EndOfFile()
|
||||
{
|
||||
if ( done ) return;
|
||||
|
||||
|
|
@ -403,15 +366,12 @@ void Info::EndOfFile()
|
|||
actions.QueueRemoveAction(act->Args());
|
||||
}
|
||||
|
||||
if ( IsComplete() )
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_DONE, this);
|
||||
else
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_EOF, this);
|
||||
file_mgr->FileEvent(file_state_remove, this);
|
||||
|
||||
actions.DrainModifications();
|
||||
}
|
||||
|
||||
void Info::Gap(uint64 offset, uint64 len)
|
||||
void File::Gap(uint64 offset, uint64 len)
|
||||
{
|
||||
actions.DrainModifications();
|
||||
|
||||
|
|
@ -428,7 +388,7 @@ void Info::Gap(uint64 offset, uint64 len)
|
|||
actions.QueueRemoveAction(act->Args());
|
||||
}
|
||||
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_GAP, this);
|
||||
file_mgr->FileEvent(file_gap, this);
|
||||
|
||||
actions.DrainModifications();
|
||||
IncrementByteCount(len, missing_bytes_idx);
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
#ifndef FILE_ANALYSIS_INFO_H
|
||||
#define FILE_ANALYSIS_INFO_H
|
||||
#ifndef FILE_ANALYSIS_FILE_H
|
||||
#define FILE_ANALYSIS_FILE_H
|
||||
|
||||
#include <string>
|
||||
#include <vector>
|
||||
|
|
@ -15,12 +15,14 @@
|
|||
namespace file_analysis {
|
||||
|
||||
/**
|
||||
* Wrapper class around \c FileAnalysis::Info record values from script layer.
|
||||
* Wrapper class around \c fa_file record values from script layer.
|
||||
*/
|
||||
class Info {
|
||||
class File {
|
||||
friend class Manager;
|
||||
|
||||
public:
|
||||
|
||||
~Info();
|
||||
~File();
|
||||
|
||||
/**
|
||||
* @return the #val record.
|
||||
|
|
@ -33,16 +35,9 @@ public:
|
|||
double GetTimeoutInterval() const;
|
||||
|
||||
/**
|
||||
* @return value of the "file_id" field from #val record.
|
||||
* @return value of the "id" field from #val record.
|
||||
*/
|
||||
FileID GetFileID() const { return file_id; }
|
||||
|
||||
/**
|
||||
* @return looks up the value of the "actions" field in the #val record at
|
||||
* the index corresponding to \a args. If there was no value at
|
||||
* the index, it is created.
|
||||
*/
|
||||
RecordVal* GetResults(RecordVal* args) const;
|
||||
FileID GetID() const { return id; }
|
||||
|
||||
/**
|
||||
* @return the string which uniquely identifies the file.
|
||||
|
|
@ -113,12 +108,10 @@ public:
|
|||
|
||||
protected:
|
||||
|
||||
friend class Manager;
|
||||
|
||||
/**
|
||||
* Constructor; only file_analysis::Manager should be creating these.
|
||||
*/
|
||||
Info(const string& unique, Connection* conn = 0,
|
||||
File(const string& unique, Connection* conn = 0,
|
||||
AnalyzerTag::Tag tag = AnalyzerTag::Error);
|
||||
|
||||
/**
|
||||
|
|
@ -162,12 +155,12 @@ protected:
|
|||
*/
|
||||
bool DetectTypes(const u_char* data, uint64 len);
|
||||
|
||||
FileID file_id; /**< A pretty hash that likely identifies file*/
|
||||
FileID id; /**< A pretty hash that likely identifies file */
|
||||
string unique; /**< A string that uniquely identifies file */
|
||||
RecordVal* val; /**< \c FileAnalysis::Info from script layer. */
|
||||
RecordVal* val; /**< \c fa_file from script layer. */
|
||||
bool postpone_timeout; /**< Whether postponing timeout is requested. */
|
||||
bool first_chunk; /**< Track first non-linear chunk. */
|
||||
bool need_type; /**< Flags next data input to be magic typed. */
|
||||
bool missed_bof; /**< Flags that we missed start of file. */
|
||||
bool need_reassembly; /**< Whether file stream reassembly is needed. */
|
||||
bool done; /**< If this object is about to be deleted. */
|
||||
ActionSet actions;
|
||||
|
|
@ -198,9 +191,8 @@ protected:
|
|||
|
||||
static string salt;
|
||||
|
||||
public:
|
||||
static int file_id_idx;
|
||||
static int parent_file_id_idx;
|
||||
static int id_idx;
|
||||
static int parent_id_idx;
|
||||
static int source_idx;
|
||||
static int conns_idx;
|
||||
static int last_active_idx;
|
||||
|
|
@ -213,7 +205,6 @@ public:
|
|||
static int bof_buffer_idx;
|
||||
static int file_type_idx;
|
||||
static int mime_type_idx;
|
||||
static int actions_idx;
|
||||
};
|
||||
|
||||
} // namespace file_analysis
|
||||
|
|
@ -1,23 +1,23 @@
|
|||
#include "Manager.h"
|
||||
#include "Info.h"
|
||||
#include "File.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
|
||||
InfoTimer::InfoTimer(double t, const FileID& id, double interval)
|
||||
FileTimer::FileTimer(double t, const FileID& id, double interval)
|
||||
: Timer(t + interval, TIMER_FILE_ANALYSIS_INACTIVITY), file_id(id)
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "New %f second timeout timer for %s",
|
||||
file_id.c_str(), interval);
|
||||
}
|
||||
|
||||
void InfoTimer::Dispatch(double t, int is_expire)
|
||||
void FileTimer::Dispatch(double t, int is_expire)
|
||||
{
|
||||
Info* info = file_mgr->Lookup(file_id);
|
||||
File* file = file_mgr->Lookup(file_id);
|
||||
|
||||
if ( ! info ) return;
|
||||
if ( ! file ) return;
|
||||
|
||||
double last_active = info->GetLastActivityTime();
|
||||
double last_active = file->GetLastActivityTime();
|
||||
double inactive_time = t > last_active ? t - last_active : 0.0;
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Checking inactivity for %s, last active at %f, "
|
||||
|
|
@ -26,13 +26,13 @@ void InfoTimer::Dispatch(double t, int is_expire)
|
|||
if ( last_active == 0.0 )
|
||||
{
|
||||
// was created when network_time was zero, so re-schedule w/ valid time
|
||||
info->UpdateLastActivityTime();
|
||||
info->ScheduleInactivityTimer();
|
||||
file->UpdateLastActivityTime();
|
||||
file->ScheduleInactivityTimer();
|
||||
return;
|
||||
}
|
||||
|
||||
if ( inactive_time >= info->GetTimeoutInterval() )
|
||||
if ( inactive_time >= file->GetTimeoutInterval() )
|
||||
file_mgr->Timeout(file_id);
|
||||
else if ( ! is_expire )
|
||||
info->ScheduleInactivityTimer();
|
||||
file->ScheduleInactivityTimer();
|
||||
}
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
#ifndef FILE_ANALYSIS_INFOTIMER_H
|
||||
#define FILE_ANALYSIS_INFOTIMER_H
|
||||
#ifndef FILE_ANALYSIS_FILETIMER_H
|
||||
#define FILE_ANALYSIS_FILETIMER_H
|
||||
|
||||
#include <string>
|
||||
#include "Timer.h"
|
||||
|
|
@ -10,13 +10,13 @@ namespace file_analysis {
|
|||
/**
|
||||
* Timer to periodically check if file analysis for a given file is inactive.
|
||||
*/
|
||||
class InfoTimer : public Timer {
|
||||
class FileTimer : public Timer {
|
||||
public:
|
||||
|
||||
InfoTimer(double t, const FileID& id, double interval);
|
||||
FileTimer(double t, const FileID& id, double interval);
|
||||
|
||||
/**
|
||||
* Check inactivity of file_analysis::Info corresponding to #file_id,
|
||||
* Check inactivity of file_analysis::File corresponding to #file_id,
|
||||
* reschedule if active, else call file_analysis::Manager::Timeout.
|
||||
*/
|
||||
void Dispatch(double t, int is_expire);
|
||||
|
|
@ -2,15 +2,13 @@
|
|||
|
||||
#include "Hash.h"
|
||||
#include "util.h"
|
||||
#include "Event.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
Hash::Hash(RecordVal* args, Info* info, HashVal* hv, const char* field)
|
||||
: Action(args, info), hash(hv), fed(false)
|
||||
Hash::Hash(RecordVal* args, File* file, HashVal* hv, const char* arg_kind)
|
||||
: Action(args, file), hash(hv), fed(false), kind(arg_kind)
|
||||
{
|
||||
using BifType::Record::FileAnalysis::ActionResults;
|
||||
if ( (result_field_idx = ActionResults->FieldOffset(field)) < 0 )
|
||||
reporter->InternalError("Missing ActionResults field: %s", field);
|
||||
hash->Init();
|
||||
}
|
||||
|
||||
|
|
@ -45,6 +43,10 @@ void Hash::Finalize()
|
|||
{
|
||||
if ( ! hash->IsValid() || ! fed ) return;
|
||||
|
||||
StringVal* sv = hash->Get();
|
||||
info->GetResults(args)->Assign(result_field_idx, sv);
|
||||
val_list* vl = new val_list();
|
||||
vl->append(file->GetVal()->Ref());
|
||||
vl->append(new StringVal(kind));
|
||||
vl->append(hash->Get());
|
||||
|
||||
mgr.QueueEvent(file_hash, vl);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
|
||||
#include "Val.h"
|
||||
#include "OpaqueVal.h"
|
||||
#include "Info.h"
|
||||
#include "File.h"
|
||||
#include "Action.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
|
@ -26,51 +26,51 @@ public:
|
|||
|
||||
protected:
|
||||
|
||||
Hash(RecordVal* args, Info* info, HashVal* hv, const char* field);
|
||||
Hash(RecordVal* args, File* file, HashVal* hv, const char* kind);
|
||||
|
||||
void Finalize();
|
||||
|
||||
HashVal* hash;
|
||||
bool fed;
|
||||
int result_field_idx;
|
||||
const char* kind;
|
||||
};
|
||||
|
||||
class MD5 : public Hash {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(RecordVal* args, Info* info)
|
||||
{ return new MD5(args, info); }
|
||||
static Action* Instantiate(RecordVal* args, File* file)
|
||||
{ return file_hash ? new MD5(args, file) : 0; }
|
||||
|
||||
protected:
|
||||
|
||||
MD5(RecordVal* args, Info* info)
|
||||
: Hash(args, info, new MD5Val(), "md5")
|
||||
MD5(RecordVal* args, File* file)
|
||||
: Hash(args, file, new MD5Val(), "md5")
|
||||
{}
|
||||
};
|
||||
|
||||
class SHA1 : public Hash {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(RecordVal* args, Info* info)
|
||||
{ return new SHA1(args, info); }
|
||||
static Action* Instantiate(RecordVal* args, File* file)
|
||||
{ return file_hash ? new SHA1(args, file) : 0; }
|
||||
|
||||
protected:
|
||||
|
||||
SHA1(RecordVal* args, Info* info)
|
||||
: Hash(args, info, new SHA1Val(), "sha1")
|
||||
SHA1(RecordVal* args, File* file)
|
||||
: Hash(args, file, new SHA1Val(), "sha1")
|
||||
{}
|
||||
};
|
||||
|
||||
class SHA256 : public Hash {
|
||||
public:
|
||||
|
||||
static Action* Instantiate(RecordVal* args, Info* info)
|
||||
{ return new SHA256(args, info); }
|
||||
static Action* Instantiate(RecordVal* args, File* file)
|
||||
{ return file_hash ? new SHA256(args, file) : 0; }
|
||||
|
||||
protected:
|
||||
|
||||
SHA256(RecordVal* args, Info* info)
|
||||
: Hash(args, info, new SHA256Val(), "sha256")
|
||||
SHA256(RecordVal* args, File* file)
|
||||
: Hash(args, file, new SHA256Val(), "sha256")
|
||||
{}
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
#include <string>
|
||||
|
||||
#include "Manager.h"
|
||||
#include "Info.h"
|
||||
#include "File.h"
|
||||
#include "Action.h"
|
||||
#include "Var.h"
|
||||
#include "Event.h"
|
||||
|
|
@ -29,78 +29,58 @@ void Manager::Terminate()
|
|||
Timeout(keys[i], true);
|
||||
}
|
||||
|
||||
void Manager::ReceiveHandle(const string& handle)
|
||||
void Manager::SetHandle(const string& handle)
|
||||
{
|
||||
if ( pending.empty() )
|
||||
reporter->InternalError("File analysis underflow");
|
||||
|
||||
PendingFile* pf = pending.front();
|
||||
if ( ! handle.empty() )
|
||||
pf->Finish(handle);
|
||||
delete pf;
|
||||
pending.pop();
|
||||
}
|
||||
|
||||
void Manager::EventDrainDone()
|
||||
{
|
||||
if ( pending.empty() ) return;
|
||||
|
||||
reporter->Error("Too few return_file_handle() calls, discarding pending"
|
||||
" file analysis input.");
|
||||
|
||||
while ( ! pending.empty() )
|
||||
{
|
||||
delete pending.front();
|
||||
pending.pop();
|
||||
}
|
||||
current_handle = handle;
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
AnalyzerTag::Tag tag, Connection* conn, bool is_orig)
|
||||
{
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingDataInChunk(data, len, offset, tag, conn));
|
||||
|
||||
GetFileHandle(tag, conn, is_orig);
|
||||
DataIn(data, len, offset, GetFile(current_handle, conn, tag));
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
const string& unique)
|
||||
{
|
||||
DataIn(data, len, offset, GetInfo(unique));
|
||||
DataIn(data, len, offset, GetFile(unique));
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
Info* info)
|
||||
File* file)
|
||||
{
|
||||
if ( ! info ) return;
|
||||
if ( ! file ) return;
|
||||
|
||||
info->DataIn(data, len, offset);
|
||||
file->DataIn(data, len, offset);
|
||||
|
||||
if ( info->IsComplete() )
|
||||
RemoveFile(info->GetUnique());
|
||||
if ( file->IsComplete() )
|
||||
RemoveFile(file->GetUnique());
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, AnalyzerTag::Tag tag,
|
||||
Connection* conn, bool is_orig)
|
||||
{
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingDataInStream(data, len, tag, conn));
|
||||
GetFileHandle(tag, conn, is_orig);
|
||||
DataIn(data, len, GetFile(current_handle, conn, tag));
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, const string& unique)
|
||||
{
|
||||
DataIn(data, len, GetInfo(unique));
|
||||
DataIn(data, len, GetFile(unique));
|
||||
}
|
||||
|
||||
void Manager::DataIn(const u_char* data, uint64 len, Info* info)
|
||||
void Manager::DataIn(const u_char* data, uint64 len, File* file)
|
||||
{
|
||||
if ( ! info ) return;
|
||||
if ( ! file ) return;
|
||||
|
||||
info->DataIn(data, len);
|
||||
file->DataIn(data, len);
|
||||
|
||||
if ( info->IsComplete() )
|
||||
RemoveFile(info->GetUnique());
|
||||
if ( file->IsComplete() )
|
||||
RemoveFile(file->GetUnique());
|
||||
}
|
||||
|
||||
void Manager::EndOfFile(AnalyzerTag::Tag tag, Connection* conn)
|
||||
|
|
@ -112,8 +92,9 @@ void Manager::EndOfFile(AnalyzerTag::Tag tag, Connection* conn)
|
|||
void Manager::EndOfFile(AnalyzerTag::Tag tag, Connection* conn, bool is_orig)
|
||||
{
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingEOF(tag, conn));
|
||||
|
||||
GetFileHandle(tag, conn, is_orig);
|
||||
EndOfFile(current_handle);
|
||||
}
|
||||
|
||||
void Manager::EndOfFile(const string& unique)
|
||||
|
|
@ -125,102 +106,98 @@ void Manager::Gap(uint64 offset, uint64 len, AnalyzerTag::Tag tag,
|
|||
Connection* conn, bool is_orig)
|
||||
{
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingGap(offset, len, tag, conn));
|
||||
|
||||
GetFileHandle(tag, conn, is_orig);
|
||||
Gap(offset, len, GetFile(current_handle, conn, tag));
|
||||
}
|
||||
|
||||
void Manager::Gap(uint64 offset, uint64 len, const string& unique)
|
||||
{
|
||||
Gap(offset, len, GetInfo(unique));
|
||||
Gap(offset, len, GetFile(unique));
|
||||
}
|
||||
|
||||
void Manager::Gap(uint64 offset, uint64 len, Info* info)
|
||||
void Manager::Gap(uint64 offset, uint64 len, File* file)
|
||||
{
|
||||
if ( ! info ) return;
|
||||
if ( ! file ) return;
|
||||
|
||||
info->Gap(offset, len);
|
||||
file->Gap(offset, len);
|
||||
}
|
||||
|
||||
void Manager::SetSize(uint64 size, AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig)
|
||||
{
|
||||
if ( IsDisabled(tag) ) return;
|
||||
if ( ! QueueHandleEvent(tag, conn, is_orig) ) return;
|
||||
pending.push(new PendingSize(size, tag, conn));
|
||||
|
||||
GetFileHandle(tag, conn, is_orig);
|
||||
SetSize(size, GetFile(current_handle, conn, tag));
|
||||
}
|
||||
|
||||
void Manager::SetSize(uint64 size, const string& unique)
|
||||
{
|
||||
SetSize(size, GetInfo(unique));
|
||||
SetSize(size, GetFile(unique));
|
||||
}
|
||||
|
||||
void Manager::SetSize(uint64 size, Info* info)
|
||||
void Manager::SetSize(uint64 size, File* file)
|
||||
{
|
||||
if ( ! info ) return;
|
||||
if ( ! file ) return;
|
||||
|
||||
info->SetTotalBytes(size);
|
||||
file->SetTotalBytes(size);
|
||||
|
||||
if ( info->IsComplete() )
|
||||
RemoveFile(info->GetUnique());
|
||||
if ( file->IsComplete() )
|
||||
RemoveFile(file->GetUnique());
|
||||
}
|
||||
|
||||
void Manager::EvaluatePolicy(BifEnum::FileAnalysis::Trigger t, Info* info)
|
||||
void Manager::FileEvent(EventHandlerPtr h, File* file)
|
||||
{
|
||||
if ( IsIgnored(info->GetUnique()) ) return;
|
||||
if ( ! h ) return;
|
||||
if ( IsIgnored(file->GetUnique()) ) return;
|
||||
|
||||
const ID* id = global_scope()->Lookup("FileAnalysis::policy");
|
||||
assert(id);
|
||||
const Func* hook = id->ID_Val()->AsFunc();
|
||||
val_list * vl = new val_list();
|
||||
vl->append(file->GetVal()->Ref());
|
||||
|
||||
val_list vl(2);
|
||||
vl.append(new EnumVal(t, BifType::Enum::FileAnalysis::Trigger));
|
||||
vl.append(info->val->Ref());
|
||||
|
||||
info->postpone_timeout = false;
|
||||
|
||||
Val* result = hook->Call(&vl);
|
||||
Unref(result);
|
||||
mgr.QueueEvent(h, vl);
|
||||
}
|
||||
|
||||
bool Manager::PostponeTimeout(const FileID& file_id) const
|
||||
{
|
||||
Info* info = Lookup(file_id);
|
||||
File* file = Lookup(file_id);
|
||||
|
||||
if ( ! info ) return false;
|
||||
if ( ! file ) return false;
|
||||
|
||||
info->postpone_timeout = true;
|
||||
file->postpone_timeout = true;
|
||||
return true;
|
||||
}
|
||||
|
||||
bool Manager::AddAction(const FileID& file_id, RecordVal* args) const
|
||||
{
|
||||
Info* info = Lookup(file_id);
|
||||
File* file = Lookup(file_id);
|
||||
|
||||
if ( ! info ) return false;
|
||||
if ( ! file ) return false;
|
||||
|
||||
return info->AddAction(args);
|
||||
return file->AddAction(args);
|
||||
}
|
||||
|
||||
bool Manager::RemoveAction(const FileID& file_id, const RecordVal* args) const
|
||||
{
|
||||
Info* info = Lookup(file_id);
|
||||
File* file = Lookup(file_id);
|
||||
|
||||
if ( ! info ) return false;
|
||||
if ( ! file ) return false;
|
||||
|
||||
return info->RemoveAction(args);
|
||||
return file->RemoveAction(args);
|
||||
}
|
||||
|
||||
Info* Manager::GetInfo(const string& unique, Connection* conn,
|
||||
File* Manager::GetFile(const string& unique, Connection* conn,
|
||||
AnalyzerTag::Tag tag)
|
||||
{
|
||||
if ( unique.empty() ) return 0;
|
||||
if ( IsIgnored(unique) ) return 0;
|
||||
|
||||
Info* rval = str_map[unique];
|
||||
File* rval = str_map[unique];
|
||||
|
||||
if ( ! rval )
|
||||
{
|
||||
rval = str_map[unique] = new Info(unique, conn, tag);
|
||||
FileID id = rval->GetFileID();
|
||||
rval = str_map[unique] = new File(unique, conn, tag);
|
||||
FileID id = rval->GetID();
|
||||
|
||||
if ( id_map[id] )
|
||||
{
|
||||
|
|
@ -229,7 +206,6 @@ Info* Manager::GetInfo(const string& unique, Connection* conn,
|
|||
}
|
||||
|
||||
id_map[id] = rval;
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_NEW, rval);
|
||||
rval->ScheduleInactivityTimer();
|
||||
if ( IsIgnored(unique) ) return 0;
|
||||
}
|
||||
|
|
@ -242,7 +218,7 @@ Info* Manager::GetInfo(const string& unique, Connection* conn,
|
|||
return rval;
|
||||
}
|
||||
|
||||
Info* Manager::Lookup(const FileID& file_id) const
|
||||
File* Manager::Lookup(const FileID& file_id) const
|
||||
{
|
||||
IDMap::const_iterator it = id_map.find(file_id);
|
||||
|
||||
|
|
@ -253,25 +229,28 @@ Info* Manager::Lookup(const FileID& file_id) const
|
|||
|
||||
void Manager::Timeout(const FileID& file_id, bool is_terminating)
|
||||
{
|
||||
Info* info = Lookup(file_id);
|
||||
File* file = Lookup(file_id);
|
||||
|
||||
if ( ! info ) return;
|
||||
if ( ! file ) return;
|
||||
|
||||
file_mgr->EvaluatePolicy(BifEnum::FileAnalysis::TRIGGER_TIMEOUT, info);
|
||||
file->postpone_timeout = false;
|
||||
|
||||
if ( info->postpone_timeout && ! is_terminating )
|
||||
FileEvent(file_timeout, file);
|
||||
mgr.Drain(); // need immediate feedback about whether to postpone
|
||||
|
||||
if ( file->postpone_timeout && ! is_terminating )
|
||||
{
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Postpone file analysis timeout for %s",
|
||||
info->GetFileID().c_str());
|
||||
info->UpdateLastActivityTime();
|
||||
info->ScheduleInactivityTimer();
|
||||
file->GetID().c_str());
|
||||
file->UpdateLastActivityTime();
|
||||
file->ScheduleInactivityTimer();
|
||||
return;
|
||||
}
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "File analysis timeout for %s",
|
||||
info->GetFileID().c_str());
|
||||
file->GetID().c_str());
|
||||
|
||||
RemoveFile(info->GetUnique());
|
||||
RemoveFile(file->GetUnique());
|
||||
}
|
||||
|
||||
bool Manager::IgnoreFile(const FileID& file_id)
|
||||
|
|
@ -295,7 +274,7 @@ bool Manager::RemoveFile(const string& unique)
|
|||
|
||||
it->second->EndOfFile();
|
||||
|
||||
FileID id = it->second->GetFileID();
|
||||
FileID id = it->second->GetID();
|
||||
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Remove FileID %s", id.c_str());
|
||||
|
||||
|
|
@ -313,6 +292,21 @@ bool Manager::IsIgnored(const string& unique)
|
|||
return ignored.find(unique) != ignored.end();
|
||||
}
|
||||
|
||||
void Manager::GetFileHandle(AnalyzerTag::Tag tag, Connection* c, bool is_orig)
|
||||
{
|
||||
current_handle.clear();
|
||||
|
||||
if ( ! get_file_handle ) return;
|
||||
|
||||
val_list* vl = new val_list();
|
||||
vl->append(new Val(tag, TYPE_COUNT));
|
||||
vl->append(c->BuildConnVal());
|
||||
vl->append(new Val(is_orig, TYPE_BOOL));
|
||||
|
||||
mgr.QueueEvent(get_file_handle, vl);
|
||||
mgr.Drain(); // need file handle immediately so we don't have to buffer data
|
||||
}
|
||||
|
||||
bool Manager::IsDisabled(AnalyzerTag::Tag tag)
|
||||
{
|
||||
if ( ! disabled )
|
||||
|
|
@ -329,17 +323,3 @@ bool Manager::IsDisabled(AnalyzerTag::Tag tag)
|
|||
|
||||
return rval;
|
||||
}
|
||||
|
||||
bool Manager::QueueHandleEvent(AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig)
|
||||
{
|
||||
if ( ! get_file_handle ) return false;
|
||||
|
||||
val_list* vl = new val_list();
|
||||
vl->append(new Val(tag, TYPE_COUNT));
|
||||
vl->append(conn->BuildConnVal());
|
||||
vl->append(new Val(is_orig, TYPE_BOOL));
|
||||
|
||||
mgr.QueueEvent(get_file_handle, vl);
|
||||
return true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,11 +12,11 @@
|
|||
#include "Val.h"
|
||||
#include "Analyzer.h"
|
||||
#include "Timer.h"
|
||||
#include "EventHandler.h"
|
||||
|
||||
#include "Info.h"
|
||||
#include "InfoTimer.h"
|
||||
#include "File.h"
|
||||
#include "FileTimer.h"
|
||||
#include "FileID.h"
|
||||
#include "PendingFile.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
||||
|
|
@ -24,6 +24,8 @@ namespace file_analysis {
|
|||
* Main entry point for interacting with file analysis.
|
||||
*/
|
||||
class Manager {
|
||||
friend class FileTimer;
|
||||
|
||||
public:
|
||||
|
||||
Manager();
|
||||
|
|
@ -36,17 +38,9 @@ public:
|
|||
void Terminate();
|
||||
|
||||
/**
|
||||
* Associates a handle with the next element in the #pending queue, which
|
||||
* will immediately push that element all the way through the file analysis
|
||||
* framework, possibly evaluating any policy hooks.
|
||||
* Take in a unique file handle string to identifiy incoming file data.
|
||||
*/
|
||||
void ReceiveHandle(const string& handle);
|
||||
|
||||
/**
|
||||
* Called when all events have been drained from the event queue.
|
||||
* There should be no pending file input/data at this point.
|
||||
*/
|
||||
void EventDrainDone();
|
||||
void SetHandle(const string& handle);
|
||||
|
||||
/**
|
||||
* Pass in non-sequential file data.
|
||||
|
|
@ -56,7 +50,7 @@ public:
|
|||
void DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
const string& unique);
|
||||
void DataIn(const u_char* data, uint64 len, uint64 offset,
|
||||
Info* info);
|
||||
File* file);
|
||||
|
||||
/**
|
||||
* Pass in sequential file data.
|
||||
|
|
@ -64,7 +58,7 @@ public:
|
|||
void DataIn(const u_char* data, uint64 len, AnalyzerTag::Tag tag,
|
||||
Connection* conn, bool is_orig);
|
||||
void DataIn(const u_char* data, uint64 len, const string& unique);
|
||||
void DataIn(const u_char* data, uint64 len, Info* info);
|
||||
void DataIn(const u_char* data, uint64 len, File* file);
|
||||
|
||||
/**
|
||||
* Signal the end of file data.
|
||||
|
|
@ -79,7 +73,7 @@ public:
|
|||
void Gap(uint64 offset, uint64 len, AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig);
|
||||
void Gap(uint64 offset, uint64 len, const string& unique);
|
||||
void Gap(uint64 offset, uint64 len, Info* info);
|
||||
void Gap(uint64 offset, uint64 len, File* file);
|
||||
|
||||
/**
|
||||
* Provide the expected number of bytes that comprise a file.
|
||||
|
|
@ -87,7 +81,7 @@ public:
|
|||
void SetSize(uint64 size, AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig);
|
||||
void SetSize(uint64 size, const string& unique);
|
||||
void SetSize(uint64 size, Info* info);
|
||||
void SetSize(uint64 size, File* file);
|
||||
|
||||
/**
|
||||
* Starts ignoring a file, which will finally be removed from internal
|
||||
|
|
@ -97,8 +91,8 @@ public:
|
|||
bool IgnoreFile(const FileID& file_id);
|
||||
|
||||
/**
|
||||
* If called during \c FileAnalysis::policy evaluation for a
|
||||
* \c FileAnalysis::TRIGGER_TIMEOUT, requests deferral of analysis timeout.
|
||||
* If called during a \c file_timeout event handler, requests deferral of
|
||||
* analysis timeout.
|
||||
*/
|
||||
bool PostponeTimeout(const FileID& file_id) const;
|
||||
|
||||
|
|
@ -117,44 +111,40 @@ public:
|
|||
bool RemoveAction(const FileID& file_id, const RecordVal* args) const;
|
||||
|
||||
/**
|
||||
* Calls the \c FileAnalysis::policy hook.
|
||||
* Queues an event related to the file's life-cycle.
|
||||
*/
|
||||
void EvaluatePolicy(BifEnum::FileAnalysis::Trigger t, Info* info);
|
||||
void FileEvent(EventHandlerPtr h, File* file);
|
||||
|
||||
protected:
|
||||
|
||||
friend class InfoTimer;
|
||||
friend class PendingFile;
|
||||
|
||||
typedef map<string, Info*> StrMap;
|
||||
typedef map<string, File*> StrMap;
|
||||
typedef set<string> StrSet;
|
||||
typedef map<FileID, Info*> IDMap;
|
||||
typedef queue<PendingFile*> PendingQueue;
|
||||
typedef map<FileID, File*> IDMap;
|
||||
|
||||
/**
|
||||
* @return the Info object mapped to \a unique or a null pointer if analysis
|
||||
* is being ignored for the associated file. An Info object may be
|
||||
* @return the File object mapped to \a unique or a null pointer if analysis
|
||||
* is being ignored for the associated file. An File object may be
|
||||
* created if a mapping doesn't exist, and if it did exist, the
|
||||
* activity time is refreshed along with any connection-related
|
||||
* fields.
|
||||
*/
|
||||
Info* GetInfo(const string& unique, Connection* conn = 0,
|
||||
File* GetFile(const string& unique, Connection* conn = 0,
|
||||
AnalyzerTag::Tag tag = AnalyzerTag::Error);
|
||||
|
||||
/**
|
||||
* @return the Info object mapped to \a file_id, or a null pointer if no
|
||||
* @return the File object mapped to \a file_id, or a null pointer if no
|
||||
* mapping exists.
|
||||
*/
|
||||
Info* Lookup(const FileID& file_id) const;
|
||||
File* Lookup(const FileID& file_id) const;
|
||||
|
||||
/**
|
||||
* Evaluate timeout policy for a file and remove the Info object mapped to
|
||||
* Evaluate timeout policy for a file and remove the File object mapped to
|
||||
* \a file_id if needed.
|
||||
*/
|
||||
void Timeout(const FileID& file_id, bool is_terminating = ::terminating);
|
||||
|
||||
/**
|
||||
* Immediately remove file_analysis::Info object associated with \a unique.
|
||||
* Immediately remove file_analysis::File object associated with \a unique.
|
||||
* @return false if file string did not map to anything, else true.
|
||||
*/
|
||||
bool RemoveFile(const string& unique);
|
||||
|
|
@ -164,22 +154,22 @@ protected:
|
|||
*/
|
||||
bool IsIgnored(const string& unique);
|
||||
|
||||
/**
|
||||
* Sets #current_handle to a unique file handle string based on what the
|
||||
* \c get_file_handle event derives from the connection params. The
|
||||
* event queue is flushed so that we can get the handle value immediately.
|
||||
*/
|
||||
void GetFileHandle(AnalyzerTag::Tag tag, Connection* c, bool is_orig);
|
||||
|
||||
/**
|
||||
* @return whether file analysis is disabled for the given analyzer.
|
||||
*/
|
||||
static bool IsDisabled(AnalyzerTag::Tag tag);
|
||||
|
||||
/**
|
||||
* Queues \c get_file_handle event in order to retrieve unique file handle.
|
||||
* @return true if there is a handler for the event, else false.
|
||||
*/
|
||||
static bool QueueHandleEvent(AnalyzerTag::Tag tag, Connection* conn,
|
||||
bool is_orig);
|
||||
|
||||
StrMap str_map; /**< Map unique strings to \c FileAnalysis::Info records. */
|
||||
IDMap id_map; /**< Map file IDs to \c FileAnalysis::Info records. */
|
||||
StrMap str_map; /**< Map unique string to file_analysis::File. */
|
||||
IDMap id_map; /**< Map file ID to file_analysis::File records. */
|
||||
StrSet ignored; /**< Ignored files. Will be finally removed on EOF. */
|
||||
PendingQueue pending; /**< Files awaiting a unique handle. */
|
||||
string current_handle; /**< Last file handle set by get_file_handle event.*/
|
||||
|
||||
static TableVal* disabled; /**< Table of disabled analyzers. */
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,111 +0,0 @@
|
|||
#include "PendingFile.h"
|
||||
#include "Manager.h"
|
||||
|
||||
using namespace file_analysis;
|
||||
|
||||
static void copy_data(const u_char** dst, const u_char* src, uint64 len)
|
||||
{
|
||||
u_char* tmp = new u_char[len];
|
||||
memcpy(tmp, src, len);
|
||||
*dst = tmp;
|
||||
}
|
||||
|
||||
static string conn_str(Connection* c)
|
||||
{
|
||||
char op[256], rp[256];
|
||||
modp_ulitoa10(ntohs(c->OrigPort()), op);
|
||||
modp_ulitoa10(ntohs(c->RespPort()), rp);
|
||||
string rval = c->OrigAddr().AsString() + ":" + op + "->" +
|
||||
c->RespAddr().AsString() + ":" + rp;
|
||||
return rval;
|
||||
}
|
||||
|
||||
PendingFile::PendingFile(Connection* arg_conn, AnalyzerTag::Tag arg_tag)
|
||||
: conn(arg_conn), tag(arg_tag)
|
||||
{
|
||||
Ref(conn);
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "New pending file: %s", conn_str(conn).c_str());
|
||||
}
|
||||
|
||||
PendingFile::~PendingFile()
|
||||
{
|
||||
Unref(conn);
|
||||
DBG_LOG(DBG_FILE_ANALYSIS, "Delete pending file: %s",
|
||||
conn_str(conn).c_str());
|
||||
}
|
||||
|
||||
Info* PendingFile::GetInfo(const string& handle) const
|
||||
{
|
||||
return file_mgr->GetInfo(handle, conn, tag);
|
||||
}
|
||||
|
||||
PendingDataInChunk::PendingDataInChunk(const u_char* arg_data, uint64 arg_len,
|
||||
uint64 arg_offset,
|
||||
AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag), len(arg_len),
|
||||
offset(arg_offset)
|
||||
{
|
||||
copy_data(&data, arg_data, len);
|
||||
}
|
||||
|
||||
void PendingDataInChunk::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->DataIn(data, len, offset, GetInfo(handle));
|
||||
}
|
||||
|
||||
PendingDataInChunk::~PendingDataInChunk()
|
||||
{
|
||||
delete [] data;
|
||||
}
|
||||
|
||||
PendingDataInStream::PendingDataInStream(const u_char* arg_data, uint64 arg_len,
|
||||
AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag), len(arg_len)
|
||||
{
|
||||
copy_data(&data, arg_data, len);
|
||||
}
|
||||
|
||||
void PendingDataInStream::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->DataIn(data, len, GetInfo(handle));
|
||||
}
|
||||
|
||||
PendingDataInStream::~PendingDataInStream()
|
||||
{
|
||||
delete [] data;
|
||||
}
|
||||
|
||||
PendingGap::PendingGap(uint64 arg_offset, uint64 arg_len,
|
||||
AnalyzerTag::Tag arg_tag, Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag), offset(arg_offset),
|
||||
len(arg_len)
|
||||
{
|
||||
}
|
||||
|
||||
void PendingGap::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->Gap(offset, len, GetInfo(handle));
|
||||
}
|
||||
|
||||
PendingEOF::PendingEOF(AnalyzerTag::Tag arg_tag, Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag)
|
||||
{
|
||||
}
|
||||
|
||||
void PendingEOF::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->EndOfFile(handle);
|
||||
}
|
||||
|
||||
PendingSize::PendingSize(uint64 arg_size, AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn)
|
||||
: PendingFile(arg_conn, arg_tag), size(arg_size)
|
||||
{
|
||||
}
|
||||
|
||||
void PendingSize::Finish(const string& handle) const
|
||||
{
|
||||
file_mgr->SetSize(size, GetInfo(handle));
|
||||
}
|
||||
|
|
@ -1,103 +0,0 @@
|
|||
#ifndef FILE_ANALYSIS_PENDINGFILE_H
|
||||
#define FILE_ANALYSIS_PENDINGFILE_H
|
||||
|
||||
#include "AnalyzerTags.h"
|
||||
#include "Conn.h"
|
||||
#include "Info.h"
|
||||
|
||||
namespace file_analysis {
|
||||
|
||||
/**
|
||||
* Provides buffering for file contents until the script-layer is able to
|
||||
* return a unique file handle for it.
|
||||
*/
|
||||
class PendingFile {
|
||||
public:
|
||||
|
||||
virtual ~PendingFile();
|
||||
|
||||
virtual void Finish(const string& handle) const = 0;
|
||||
|
||||
protected:
|
||||
|
||||
PendingFile(Connection* arg_conn,
|
||||
AnalyzerTag::Tag arg_tag = AnalyzerTag::Error);
|
||||
|
||||
Info* GetInfo(const string& handle) const;
|
||||
|
||||
Connection* conn;
|
||||
AnalyzerTag::Tag tag;
|
||||
};
|
||||
|
||||
class PendingDataInChunk : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingDataInChunk(const u_char* arg_data, uint64 arg_len,
|
||||
uint64 arg_offset, AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn);
|
||||
|
||||
virtual ~PendingDataInChunk();
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
|
||||
protected:
|
||||
|
||||
const u_char* data;
|
||||
uint64 len;
|
||||
uint64 offset;
|
||||
};
|
||||
|
||||
class PendingDataInStream : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingDataInStream(const u_char* arg_data, uint64 arg_len,
|
||||
AnalyzerTag::Tag arg_tag, Connection* arg_conn);
|
||||
|
||||
virtual ~PendingDataInStream();
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
|
||||
protected:
|
||||
|
||||
const u_char* data;
|
||||
uint64 len;
|
||||
};
|
||||
|
||||
class PendingGap : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingGap(uint64 arg_offset, uint64 arg_len, AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn);
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
|
||||
protected:
|
||||
|
||||
uint64 offset;
|
||||
uint64 len;
|
||||
};
|
||||
|
||||
class PendingEOF : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingEOF(AnalyzerTag::Tag arg_tag, Connection* arg_conn);
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
};
|
||||
|
||||
class PendingSize : public PendingFile {
|
||||
public:
|
||||
|
||||
PendingSize(uint64 arg_size, AnalyzerTag::Tag arg_tag,
|
||||
Connection* arg_conn);
|
||||
|
||||
virtual void Finish(const string& handle) const;
|
||||
|
||||
protected:
|
||||
|
||||
uint64 size;
|
||||
};
|
||||
|
||||
} // namespace file_analysis
|
||||
|
||||
#endif
|
||||
Loading…
Add table
Add a link
Reference in a new issue