mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
037d582b0e
- It's derived from the magic database of libmagic 5.14, but with most everything not related to mime types removed. - The custom database is always used by default for mime detection, but the more verbose file type detection will fall back on the default libmagic installation's database. The result is: mime type strings are now guaranteed to be consistent across platforms, but the verbose file type descriptions are not. - The custom database gets installed in $prefix/share/bro/magic, and should even be extensible if files with new patterns are added inside the directory. - The search path for the mime magic database can be controlled via BROMAGIC environment variable. - Remove mime_desc field from ftp.log. - Stop using the mime/file type canonifier with unit tests. - libmagic >= 5.04 is now a requirement.
100 lines
2.3 KiB
Text
100 lines
2.3 KiB
Text
|
|
global test_file_analysis_source: string = "" &redef;
|
|
|
|
global test_file_analyzers: set[FileAnalysis::AnalyzerArgs];
|
|
|
|
global test_get_file_name: function(f: fa_file): string =
|
|
function(f: fa_file): string { return ""; } &redef;
|
|
|
|
global test_print_file_data_events: bool = F &redef;
|
|
|
|
event file_chunk(f: fa_file, data: string, off: count)
|
|
{
|
|
if ( test_print_file_data_events )
|
|
print "file_chunk", f$id, |data|, off, data;
|
|
}
|
|
|
|
event file_stream(f: fa_file, data: string)
|
|
{
|
|
if ( test_print_file_data_events )
|
|
print "file_stream", f$id, |data|, data;
|
|
}
|
|
|
|
event file_new(f: fa_file)
|
|
{
|
|
print "FILE_NEW";
|
|
|
|
print f$id, f$seen_bytes, f$missing_bytes;
|
|
|
|
if ( test_file_analysis_source == "" ||
|
|
f$source == test_file_analysis_source )
|
|
{
|
|
for ( tag in test_file_analyzers )
|
|
FileAnalysis::add_analyzer(f, tag);
|
|
|
|
local filename: string = test_get_file_name(f);
|
|
if ( filename != "" )
|
|
FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_EXTRACT,
|
|
$extract_filename=filename]);
|
|
FileAnalysis::add_analyzer(f, [$tag=FileAnalysis::ANALYZER_DATA_EVENT,
|
|
$chunk_event=file_chunk,
|
|
$stream_event=file_stream]);
|
|
}
|
|
|
|
if ( f?$bof_buffer )
|
|
{
|
|
print "FILE_BOF_BUFFER";
|
|
print f$bof_buffer[0:10];
|
|
}
|
|
|
|
if ( f?$mime_type )
|
|
{
|
|
print "MIME_TYPE";
|
|
print f$mime_type;
|
|
}
|
|
}
|
|
|
|
event file_over_new_connection(f: fa_file, c: connection)
|
|
{
|
|
print "FILE_OVER_NEW_CONNECTION";
|
|
}
|
|
|
|
event file_timeout(f: fa_file)
|
|
{
|
|
print "FILE_TIMEOUT";
|
|
}
|
|
|
|
event file_gap(f: fa_file, offset: count, len: count)
|
|
{
|
|
print "FILE_GAP";
|
|
}
|
|
|
|
event file_state_remove(f: fa_file)
|
|
{
|
|
print "FILE_STATE_REMOVE";
|
|
print f$id, f$seen_bytes, f$missing_bytes;
|
|
if ( f?$conns )
|
|
for ( cid in f$conns )
|
|
print cid;
|
|
|
|
if ( f?$total_bytes )
|
|
print "total bytes: " + fmt("%s", f$total_bytes);
|
|
if ( f?$source )
|
|
print "source: " + f$source;
|
|
|
|
if ( ! f?$info ) return;
|
|
|
|
if ( f$info?$md5 )
|
|
print fmt("MD5: %s", f$info$md5);
|
|
if ( f$info?$sha1 )
|
|
print fmt("SHA1: %s", f$info$sha1);
|
|
if ( f$info?$sha256 )
|
|
print fmt("SHA256: %s", f$info$sha256);
|
|
}
|
|
|
|
event bro_init()
|
|
{
|
|
add test_file_analyzers[[$tag=FileAnalysis::ANALYZER_MD5]];
|
|
add test_file_analyzers[[$tag=FileAnalysis::ANALYZER_SHA1]];
|
|
add test_file_analyzers[[$tag=FileAnalysis::ANALYZER_SHA256]];
|
|
}
|