Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/master' into topic/johanna/gh-859

Browse source
This commit is contained in:
Johanna Amann 2021-06-29 15:09:56 +01:00
commit e4b2fa50a9
571 changed files with 40145 additions and 11997 deletions
Download patch file Download diff file Expand all files Collapse all files

24
src/file_analysis/Manager.cc
View file

@ -149,7 +149,7 @@ string Manager::DataIn(const u_char* data, uint64_t len, const analyzer::Tag& ta
}
void Manager::DataIn(const u_char* data, uint64_t len, const string& file_id,
const string& source)
const string& source, const string& mime_type)
{
File* file = GetFile(file_id, nullptr, analyzer::Tag::Error, false, false,
source.c_str());
@ -157,12 +157,34 @@ void Manager::DataIn(const u_char* data, uint64_t len, const string& file_id,
if ( ! file )
return;
if ( ! mime_type.empty() )
file->SetMime(mime_type);
file->DataIn(data, len);
if ( file->IsComplete() )
RemoveFile(file->GetID());
}
void Manager::DataIn(const u_char* data, uint64_t len, uint64_t offset,
const string& file_id, const string& source,
const string& mime_type)
{
File* file = GetFile(file_id, nullptr, analyzer::Tag::Error, false, false,
source.c_str());
if ( ! file )
return;
if ( ! mime_type.empty() )
file->SetMime(mime_type);
file->DataIn(data, len, offset);
if ( file->IsComplete() )
RemoveFile(file->GetID());
}
void Manager::EndOfFile(const analyzer::Tag& tag, Connection* conn)
{
EndOfFile(tag, conn, true);

27
src/file_analysis/Manager.h
View file

@ -150,9 +150,34 @@ public:
* @param source uniquely identifies the file and should also describe
* in human-readable form where the file input is coming from (e.g.
* a local file path).
* @param mime_type may be set to the mime type of the file, if already known due
* to the protocol. This is, e.g., the case in TLS connections where X.509
* certificates are passed as files; here the type of the file is set by
* the protocol. If this parameter is give, mime type detection will be
* disabled.
* This parameter is only used for the first bit of data for each file.
*/
void DataIn(const u_char* data, uint64_t len, const std::string& file_id,
const std::string& source);
const std::string& source, const std::string& mime_type = "");
/**
* Pass in sequential file data from external source (e.g. input framework).
* @param data pointer to start of a chunk of file data.
* @param len number of bytes in the data chunk.
* @param offset number of bytes from start of file that data chunk occurs.
* @param file_id an identifier for the file (usually a hash of \a source).
* @param source uniquely identifies the file and should also describe
* in human-readable form where the file input is coming from (e.g.
* a local file path).
* @param mime_type may be set to the mime type of the file, if already known due
* to the protocol. This is, e.g., the case in TLS connections where X.509
* certificates are passed as files; here the type of the file is set by
* the protocol. If this parameter is give, mime type detection will be
* disabled.
* This parameter is only used for the first bit of data for each file.
*/
void DataIn(const u_char* data, uint64_t len, uint64_t offset, const std::string& file_id,
const std::string& source, const std::string& mime_type = "");
/**
* Signal the end of file data regardless of which direction it is being