Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: change file handle -> file id mapping process.

Browse source 
They're now actually directly related via a hash function that will
produce the same results among different instances in a cluster.
This commit is contained in:
Jon Siwek 2013-03-14 14:08:26 -05:00
parent 637fe69cf9
commit e0f3713912
4 changed files with 29 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

22
src/file_analysis/Info.cc
View file

@ -1,4 +1,5 @@
#include <string>
#include <openssl/md5.h>
#include "Info.h"
#include "InfoTimer.h"
@ -54,9 +55,12 @@ int Info::actions_idx = -1;
magic_t Info::magic = 0;
magic_t Info::magic_mime = 0;
void Info::InitFieldIndices()
string Info::salt;
void Info::StaticInit()
{
if ( file_id_idx != -1 ) return;
file_id_idx = Idx("file_id");
parent_file_id_idx = Idx("parent_file_id");
source_idx = Idx("source");
@ -72,6 +76,11 @@ void Info::InitFieldIndices()
file_type_idx = Idx("file_type");
mime_type_idx = Idx("mime_type");
actions_idx = Idx("actions");
bro_init_magic(&magic, MAGIC_NONE);
bro_init_magic(&magic_mime, MAGIC_MIME);
salt = BifConst::FileAnalysis::salt->CheckString();
}
Info::Info(const string& unique, Connection* conn)
@ -79,13 +88,14 @@ Info::Info(const string& unique, Connection* conn)
postpone_timeout(false), need_reassembly(false), done(false),
actions(this)
{
InitFieldIndices();
bro_init_magic(&magic, MAGIC_NONE);
bro_init_magic(&magic_mime, MAGIC_MIME);
StaticInit();
char id[20];
uitoa_n(calculate_unique_id(), id, sizeof(id), 62);
uint64 hash[2];
string msg(unique + salt);
MD5(reinterpret_cast<const u_char*>(msg.data()), msg.size(),
reinterpret_cast<u_char*>(hash));
uitoa_n(hash[0], id, sizeof(id), 62);
DBG_LOG(DBG_FILE_ANALYSIS, "Creating new Info object %s", id);