mirror of
https://github.com/zeek/zeek.git
synced 2025-10-13 20:18:20 +00:00
641154f8e8
- FileAnalysis::Info is now just a record used for logging, the fa_file record type is defined in init-bare.bro as the analogue to a connection record. - Starting to transfer policy hook triggers and analyzer results to events.
69 lines
1.6 KiB
Text
69 lines
1.6 KiB
Text
##! Calculate hashes for HTTP body transfers.
|
|
|
|
@load ./main
|
|
@load ./file-analysis
|
|
|
|
module HTTP;
|
|
|
|
export {
|
|
redef record Info += {
|
|
## MD5 sum for a file transferred over HTTP calculated from the
|
|
## response body.
|
|
md5: string &log &optional;
|
|
|
|
## This value can be set per-transfer to determine per request
|
|
## if a file should have an MD5 sum generated. It must be
|
|
## set to T at the time of or before the first chunk of body data.
|
|
calc_md5: bool &default=F;
|
|
};
|
|
|
|
## Generate MD5 sums for these filetypes.
|
|
const generate_md5 = /application\/x-dosexec/ # Windows and DOS executables
|
|
| /application\/x-executable/ # *NIX executable binary
|
|
&redef;
|
|
}
|
|
|
|
hook FileAnalysis::policy(trig: FileAnalysis::Trigger, f: fa_file)
|
|
&priority=5
|
|
{
|
|
if ( trig != FileAnalysis::TRIGGER_TYPE ) return;
|
|
if ( ! f?$mime_type ) return;
|
|
if ( ! f?$source ) return;
|
|
if ( f$source != "HTTP" ) return;
|
|
|
|
if ( generate_md5 in f$mime_type )
|
|
FileAnalysis::add_action(f, [$act=FileAnalysis::ACTION_MD5]);
|
|
else if ( f?$conns )
|
|
{
|
|
for ( cid in f$conns )
|
|
{
|
|
local c: connection = f$conns[cid];
|
|
|
|
if ( ! c?$http ) next;
|
|
|
|
if ( c$http$calc_md5 )
|
|
{
|
|
FileAnalysis::add_action(f, [$act=FileAnalysis::ACTION_MD5]);
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
event file_state_remove(f: fa_file) &priority=4
|
|
{
|
|
if ( ! f?$source ) return;
|
|
if ( f$source != "HTTP" ) return;
|
|
if ( ! f?$conns ) return;
|
|
if ( ! f?$info ) return;
|
|
if ( ! f$info?$md5 ) return;
|
|
|
|
for ( cid in f$conns )
|
|
{
|
|
local c: connection = f$conns[cid];
|
|
|
|
if ( ! c?$http ) next;
|
|
|
|
c$http$md5 = f$info$md5;
|
|
}
|
|
}
|