[Bro] check rx and tx hosts for files

[Johanna Amann]

Hi Brian,

you should be able to just use the event file_over_new_connection, which
includes the connection record. With that, you don't have to loop over
complex data structures and can just use Site::is_local_addr.

This would probably look similar to:

event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
    {
    if ( is_orig && Site::is_local_addr(c$id$orig_h) )
        	Files::add_analyzer(f, Files::ANALYZER_EXTRACT);
    }

I hope this helps,
 Johanna