Merge pull request #329 from CybercentreCanada/debian_pcap

Debian Buster patch for correctly identifying pcaps
CybercentreCanada · Aug 23, 2021 · f249702 · f249702
2 parents 5091a61 + 67db48d
commit f249702
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/assemblyline/common/identify.py b/assemblyline/common/identify.py
@@ -297,7 +297,7 @@
     ['ar', r'ar archive'],
     ['xz', r'^XZ compressed data'],
     ['zip', r'^zip archive data'],
-    ['tcpdump', r'^tcpdump'],
+    ['tcpdump', r'^(tcpdump|pcap)'],
     ['pdf', r'^pdf document'],
     ['bmp', r'^pc bitmap'],
     ['gif', r'^gif image data'],
@@ -372,7 +372,7 @@
     ['java', r'jar |java'],
     ['code',
      r'Autorun|HTML |KML |LLVM |SGML |Visual C|XML |awk|batch |bytecode|perl|php|program|python'
-     r'|ruby|scheme|script text exe|shell script|tcl'],
+     r'|ruby|color scheme|script text exe|shell script|tcl'],
     ['network', r'capture'],
     ['unknown', r'CoreFoundation|Dreamcast|KEYBoard|OSF/Rose|Zope|quota|uImage'],
     ['unknown', r'disk|file[ ]*system|floppy|tape'],

diff --git a/test/test_identify.py b/test/test_identify.py
@@ -581,7 +581,7 @@ def test_tag_to_extension(tag, ext):
         ('ar', r'ar archive'),
         ('xz', r'^XZ compressed data'),
         ('zip', r'^zip archive data'),
-        ('tcpdump', r'^tcpdump'),
+        ('tcpdump', r'^(tcpdump|pcap)'),
         ('pdf', r'^pdf document'),
         ('bmp', r'^pc bitmap'),
         ('gif', r'^gif image data'),
@@ -664,7 +664,7 @@ def test_sl_to_tl(sl, tl):
      ('java', r'jar |java'),
      ('code',
       r'Autorun|HTML |KML |LLVM |SGML |Visual C|XML |awk|batch |bytecode|perl|php|program|python'
-      r'|ruby|scheme|script text exe|shell script|tcl'),
+      r'|ruby|color scheme|script text exe|shell script|tcl'),
      ('network', r'capture'),
      ('unknown', r'CoreFoundation|Dreamcast|KEYBoard|OSF/Rose|Zope|quota|uImage'),
      ('unknown', r'disk|file[ ]*system|floppy|tape'),