zeek/scripts/base/protocols/http/files.bro

@load ./main
@load ./entities
@load ./utils
@load base/utils/conn-ids
@load base/frameworks/files

module HTTP;

export {
	## Default file handle provider for HTTP.
	global get_file_handle: function(c: connection, is_orig: bool): string;

	## Default file describer for HTTP.
	global describe_file: function(f: fa_file): string;
}

function get_file_handle(c: connection, is_orig: bool): string
	{
	if ( ! c?$http )
		return "";

	if ( c$http$range_request && ! is_orig )
		{
		# Any multipart responses from the server are pieces of same file
		# that correspond to range requests, so don't use mime depth to
		# identify the file.
		return cat(Analyzer::ANALYZER_HTTP, is_orig, c$id$orig_h, build_url(c$http));
		}
	else
		{
		local mime_depth = is_orig ? c$http$orig_mime_depth : c$http$resp_mime_depth;
		return cat(Analyzer::ANALYZER_HTTP, c$start_time, is_orig,
		           c$http$trans_depth, mime_depth, id_string(c$id));
		}
	}

function describe_file(f: fa_file): string
	{
	# This shouldn't be needed, but just in case...
	if ( f$source != "HTTP" )
		return "";

	for ( cid in f$conns )
		{
		if ( f$conns[cid]?$http )
			return build_url_http(f$conns[cid]$http);
		}
	return "";
	}

event bro_init() &priority=5
	{
	Files::register_protocol(Analyzer::ANALYZER_HTTP,
	                         [$get_file_handle = HTTP::get_file_handle,
	                          $describe        = HTTP::describe_file]);
	}