zeek/scripts/base/protocols/irc/file-analysis.bro

23 lines
523 B
Text

@load ./dcc-send
@load base/utils/conn-ids
@load base/frameworks/files
module IRC;
export {
## Default file handle provider for IRC.
global get_file_handle: function(c: connection, is_orig: bool): string;
}
function get_file_handle(c: connection, is_orig: bool): string
{
if ( [c$id$resp_h, c$id$resp_p] !in dcc_expected_transfers )
return "";
return cat(ANALYZER_IRC_DATA, c$start_time, c$id, is_orig);
}
event bro_init() &priority=5
{
Files::register_protocol(ANALYZER_IRC_DATA, IRC::get_file_handle);
}