6 commits

Author	SHA1	Message	Date
Robin Sommer	f51dc5cbb8	Fixing (harmless) Coverity warning.	2015-01-17 08:07:18 -08:00
Jon Siwek	cbbe7b52dc	Review/fix/change file reassembly functionality. ... - Re-arrange how some fa_file fields (e.g. source, connection info, mime type) get updated/set for consistency. - Add more robust mechanisms for flushing the reassembly buffer. The goal being to report all gaps and deliveries to file analyzers regardless of the state of the reassembly buffer at the time it has to be flushed.	2014-12-16 14:05:15 -06:00
Seth Hall	cafd35e746	Updates the files event api and brings file reassembly up to master.	2014-09-26 00:40:37 -04:00
Seth Hall	fb0a658a7c	Merge remote-tracking branch 'origin/master' into topic/seth/files-tracking ... Conflicts: src/Reassem.cc src/Reassem.h src/analyzer/protocol/tcp/TCP_Reassembler.cc testing/btest/Baseline/scripts.base.frameworks.file-analysis.bifs.set_timeout_interval/bro..stdout testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/b.out testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.partial-content/c.out testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/files.log	2014-05-17 02:12:52 -04:00
Seth Hall	38dbba7622	More file reassembly work. ... - The reassembly behavior can be modified per-file by enabling or disabling the reassembler and/or modifying the size of the reassembly buffer. - Changed the file extraction analyzer to use the stream to avoid issues with the chunk based approach not immediately triggering the file_new event due to mime-type detection delay. Early chunks frequently ended up lost before. - Generally things are working now and I'd consider this in testing.	2014-01-05 04:58:01 -05:00
Seth Hall	0b78f444a1	Initial commit of file reassembly.	2013-12-20 00:05:08 -05:00