mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 22:58:20 +00:00
a55ce01ef3
Removed "file_mime_type" and "file_mime_types" event, replacing them with a new event called "file_metadata_inferred". It has a record argument of type "inferred_file_metadata", which contains the mime type information that the earlier events used to supply. The idea here is that future extensions to the record with new metadata will be less likely to break user code than the alternatives (adding new events or new event parameters). Addresses BIT-1368.
49 lines
1.1 KiB
Text
49 lines
1.1 KiB
Text
@load ./dcc-send
|
|
@load base/utils/conn-ids
|
|
@load base/frameworks/files
|
|
|
|
module IRC;
|
|
|
|
export {
|
|
redef record Info += {
|
|
## File unique ID.
|
|
fuid: string &log &optional;
|
|
};
|
|
|
|
## Default file handle provider for IRC.
|
|
global get_file_handle: function(c: connection, is_orig: bool): string;
|
|
|
|
redef record fa_file += {
|
|
irc: IRC::Info &optional;
|
|
};
|
|
}
|
|
|
|
function get_file_handle(c: connection, is_orig: bool): string
|
|
{
|
|
return cat(Analyzer::ANALYZER_IRC_DATA, c$start_time, c$id, is_orig);
|
|
}
|
|
|
|
event bro_init() &priority=5
|
|
{
|
|
Files::register_protocol(Analyzer::ANALYZER_IRC_DATA,
|
|
[$get_file_handle = IRC::get_file_handle]);
|
|
}
|
|
|
|
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
|
|
{
|
|
if ( [c$id$resp_h, c$id$resp_p] !in dcc_expected_transfers )
|
|
return;
|
|
|
|
local irc = dcc_expected_transfers[c$id$resp_h, c$id$resp_p];
|
|
irc$fuid = f$id;
|
|
if ( irc?$dcc_file_name )
|
|
f$info$filename = irc$dcc_file_name;
|
|
|
|
f$irc = irc;
|
|
}
|
|
|
|
event file_metadata_inferred(f: fa_file, meta: inferred_file_metadata) &priority=5
|
|
{
|
|
if ( f?$irc && meta?$mime_type )
|
|
f$irc$dcc_mime_type = meta$mime_type;
|
|
}
|