Convert more redef-able constants to runtime options

This commit is contained in:
Daniel Thayer 2018-08-24 16:05:44 -05:00
parent 4912513517
commit 01a899255e
36 changed files with 72 additions and 72 deletions

View file

@ -28,11 +28,11 @@ export {
};
## Analyzers which you don't want to throw
const ignore_violations: set[Analyzer::Tag] = set() &redef;
option ignore_violations: set[Analyzer::Tag] = set();
## Ignore violations which go this many bytes into the connection.
## Set to 0 to never ignore protocol violations.
const ignore_violations_after = 10 * 1024 &redef;
option ignore_violations_after = 10 * 1024;
}
redef record connection += {

View file

@ -130,7 +130,7 @@ export {
const analyze_by_mime_type_automatically = T &redef;
## The default setting for file reassembly.
const enable_reassembler = T &redef;
option enable_reassembler = T;
## The default per-file reassembly buffer size.
const reassembly_buffer_size = 524288 &redef;

View file

@ -26,7 +26,7 @@ export {
## Notice types which should have the "remote" location looked up.
## If GeoIP support is not built in, this does nothing.
const lookup_location_types: set[Notice::Type] = {} &redef;
option lookup_location_types: set[Notice::Type] = {};
}
hook policy(n: Notice::Info) &priority=10

View file

@ -14,7 +14,7 @@ export {
## Email address to send notices with the :bro:enum:`Notice::ACTION_PAGE`
## action.
const mail_page_dest = "" &redef;
option mail_page_dest = "";
}
hook notice(n: Notice::Info) &priority=-5

View file

@ -173,13 +173,13 @@ export {
};
## Ignored notice types.
const ignored_types: set[Notice::Type] = {} &redef;
option ignored_types: set[Notice::Type] = {};
## Emailed notice types.
const emailed_types: set[Notice::Type] = {} &redef;
option emailed_types: set[Notice::Type] = {};
## Alarmed notice types.
const alarmed_types: set[Notice::Type] = {} &redef;
option alarmed_types: set[Notice::Type] = {};
## Types that should be suppressed for the default suppression interval.
const not_suppressed_types: set[Notice::Type] = {} &redef;
option not_suppressed_types: set[Notice::Type] = {};
## This table can be used as a shorthand way to modify suppression
## intervals for entire notice types.
const type_suppression_intervals: table[Notice::Type] of interval = {} &redef;
@ -190,7 +190,7 @@ export {
## Local system sendmail program.
##
## Note that this is overridden by the BroControl SendMail option.
const sendmail = "/usr/sbin/sendmail" &redef;
option sendmail = "/usr/sbin/sendmail";
## Email address to send notices with the
## :bro:enum:`Notice::ACTION_EMAIL` action or to send bulk alarm logs
## on rotation with :bro:enum:`Notice::ACTION_ALARM`.

View file

@ -255,14 +255,14 @@ export {
## To completely ignore a specific weird for a host, add the host
## and weird name into this set.
const ignore_hosts: set[addr, string] &redef;
option ignore_hosts: set[addr, string];
## Don't ignore repeats for weirds in this set. For example,
## it's handy keeping track of clustered checksum errors.
const weird_do_not_ignore_repeats = {
option weird_do_not_ignore_repeats = {
"bad_IP_checksum", "bad_TCP_checksum", "bad_UDP_checksum",
"bad_ICMP_checksum",
} &redef;
};
## This table is used to track identifier and name pairs that should be
## temporarily ignored because the problem has already been reported.

View file

@ -104,7 +104,7 @@ export {
} &redef &default = SIG_ALARM;
## Signature IDs that should always be ignored.
const ignored_ids = /NO_DEFAULT_MATCHES/ &redef;
option ignored_ids = /NO_DEFAULT_MATCHES/;
## Generate a notice if, for a pair [orig, signature], the number of
## different responders has reached one of the thresholds.
@ -120,7 +120,7 @@ export {
## The interval between when :bro:enum:`Signatures::Signature_Summary`
## notices are generated.
const summary_interval = 1 day &redef;
option summary_interval = 1 day;
## This event can be handled to access/alter data about to be logged
## to the signature logging stream.

View file

@ -68,7 +68,7 @@ export {
## Hosts whose software should be detected and tracked.
## Choices are: LOCAL_HOSTS, REMOTE_HOSTS, ALL_HOSTS, NO_HOSTS.
const asset_tracking = LOCAL_HOSTS &redef;
option asset_tracking = LOCAL_HOSTS;
## Other scripts should call this function when they detect software.
##