zeek/scripts/policy/frameworks/signatures/iso-9660.zeek
Arne Welzel 1a5ce65e3d signatures: Move ISO 9660 signature to policy
The previous "fix" caused significant performance degradation without
the signature ever having a chance to trigger. Moving it to policy
seems the best compromise, the alternative being outright removing it.
2024-02-26 13:35:23 +01:00

8 lines
289 B
Text

##! Load signature for ISO 9660 disk image and increase
##! default_file_bof_buffer_size to make it functional.
@load-sigs ./iso-9660
# CD001 string is in the 17th sector.
@if ( default_file_bof_buffer_size < (16 + 1) * 2048 )
redef default_file_bof_buffer_size = (16 + 1) * 2048;
@endif