Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

FileAnalysis: add more params to some events.

Browse source
This commit is contained in:
Jon Siwek 2013-04-11 11:24:18 -05:00
parent 2747e839fb
commit e2fbee9054
8 changed files with 113 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

11
scripts/base/protocols/http/file-ident.bro
View file

@ -66,23 +66,18 @@ event file_new(f: fa_file) &priority=5
}
}
event file_over_new_connection(f: fa_file) &priority=5
event file_over_new_connection(f: fa_file, c: connection) &priority=5
{
if ( ! f?$source ) return;
if ( f$source != "HTTP" ) return;
if ( ! f?$mime_type ) return;
if ( ! f?$conns ) return;
if ( ! c?$http ) return;
# Spread the mime around (e.g. for partial content, file_type event only
# happens once for the first connection, but if there's subsequent
# connections to transfer the same file, they'll be lacking the mime_type
# field if we don't do this).
for ( cid in f$conns )
{
local c: connection = f$conns[cid];
if ( ! c?$http ) next;
c$http$mime_type = f$mime_type;
}
c$http$mime_type = f$mime_type;
}
# Tracks byte-range request / partial content response mime types, indexed