Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: libmagic tweaks.

Browse source 
Remove verbose file type detection and automatically strip out charset
from mime type.
This commit is contained in:
Jon Siwek 2013-04-11 13:11:46 -05:00
parent 2fba37e277
commit e81f2ae7b0
23 changed files with 27 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/frameworks/file-analysis/main.bro
View file

@ -72,11 +72,6 @@ export {
## inspection in *bof_buffer* field.
bof_buffer_size: count &log &optional;
## A file type provided by libmagic against the *bof_buffer*, or
## in the cases where no buffering of the beginning of file occurs,
## an initial guess of the file type based on the first data seen.
file_type: string &log &optional;
## A mime type provided by libmagic against the *bof_buffer*, or
## in the cases where no buffering of the beginning of file occurs,
## an initial guess of the mime type based on the first data seen.
@ -249,7 +244,6 @@ function set_info(f: fa_file)
f$info$overflow_bytes = f$overflow_bytes;
f$info$timeout_interval = f$timeout_interval;
f$info$bof_buffer_size = f$bof_buffer_size;
if ( f?$file_type ) f$info$file_type = f$file_type;
if ( f?$mime_type ) f$info$mime_type = f$mime_type;
if ( f?$conns )
for ( cid in f$conns )

5
scripts/base/init-bare.bro
View file

@ -374,11 +374,6 @@ type fa_file: record {
## This is also the buffer that's used for file/mime type detection.
bof_buffer: string &optional;
## A file type provided by libmagic against the *bof_buffer*, or
## in the cases where no buffering of the beginning of file occurs,
## an initial guess of the file type based on the first data seen.
file_type: string &optional;
## A mime type provided by libmagic against the *bof_buffer*, or
## in the cases where no buffering of the beginning of file occurs,
## an initial guess of the mime type based on the first data seen.

2
scripts/base/protocols/http/file-ident.bro
View file

@ -49,7 +49,7 @@ event file_new(f: fa_file) &priority=5
c$http$mime_type = f$mime_type;
local mime_str: string = split1(f$mime_type, /;/)[1];
local mime_str: string = c$http$mime_type;
if ( mime_str !in mime_types_extensions ) next;
if ( ! c$http?$uri ) next;