diff --git a/CHANGES b/CHANGES index 9c9e5169aa..532c18bcc6 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,12 @@ +2.5-569 | 2018-05-10 11:24:07 -0500 + + * BIT-1927: relocate notice/extend-email/ scripts to policy/ dir and + load it from local.bro to allow users to control whether it is used. + (Stephen Hosom) + + * Sort output of the missing-file-initially.bro test (Daniel Thayer) + 2.5-565 | 2018-05-08 15:29:53 -0500 * BIT-1926: add unit tests for misc. HTTP patches (Corelight) diff --git a/VERSION b/VERSION index 05811b62f0..beed657a9e 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.5-565 +2.5-569 diff --git a/scripts/base/frameworks/notice/__load__.bro b/scripts/base/frameworks/notice/__load__.bro index bcf3cd6898..aea3d6d2f3 100644 --- a/scripts/base/frameworks/notice/__load__.bro +++ b/scripts/base/frameworks/notice/__load__.bro @@ -8,10 +8,6 @@ @load ./actions/page @load ./actions/add-geodata -# There shouldn't be any default overhead from loading these since they -# *should* only do anything when notices have the ACTION_EMAIL action applied. -@load ./extend-email/hostnames - # The cluster framework must be loaded first. @load base/frameworks/cluster @@ -22,4 +18,4 @@ @endif # Load here so that it can check whether clustering is enabled. -@load ./actions/pp-alarms \ No newline at end of file +@load ./actions/pp-alarms diff --git a/scripts/policy/frameworks/notice/__load__.bro b/scripts/policy/frameworks/notice/__load__.bro new file mode 100644 index 0000000000..fef1dc894e --- /dev/null +++ b/scripts/policy/frameworks/notice/__load__.bro @@ -0,0 +1,3 @@ +# There shouldn't be any default overhead from loading these since they +# *should* only do anything when notices have the ACTION_EMAIL action applied. +@load ./extend-email/hostnames diff --git a/scripts/base/frameworks/notice/extend-email/hostnames.bro b/scripts/policy/frameworks/notice/extend-email/hostnames.bro similarity index 98% rename from scripts/base/frameworks/notice/extend-email/hostnames.bro rename to scripts/policy/frameworks/notice/extend-email/hostnames.bro index 18442f453d..d8dac39e43 100644 --- a/scripts/base/frameworks/notice/extend-email/hostnames.bro +++ b/scripts/policy/frameworks/notice/extend-email/hostnames.bro @@ -3,7 +3,7 @@ ##! :bro:type:`Notice::Info`'s *src* and *dst* fields as determined by a ##! DNS lookup. -@load ../main +@load base/frameworks/notice/main module Notice; diff --git a/scripts/site/local.bro b/scripts/site/local.bro index 9f8be4bc3b..5064d6a330 100644 --- a/scripts/site/local.bro +++ b/scripts/site/local.bro @@ -85,6 +85,9 @@ # Detect SHA1 sums in Team Cymru's Malware Hash Registry. @load frameworks/files/detect-MHR +# Extend email alerting to include hostnames +@load policy/frameworks/notice/extend-email/hostnames + # Uncomment the following line to enable detection of the heartbleed attack. Enabling # this might impact performance a bit. # @load policy/protocols/ssl/heartbleed diff --git a/scripts/test-all-policy.bro b/scripts/test-all-policy.bro index adaafaea7f..413ed8e969 100644 --- a/scripts/test-all-policy.bro +++ b/scripts/test-all-policy.bro @@ -34,6 +34,8 @@ @load frameworks/files/entropy-test-all-files.bro #@load frameworks/files/extract-all-files.bro @load frameworks/files/hash-all-files.bro +@load frameworks/notice/__load__.bro +@load frameworks/notice/extend-email/hostnames.bro @load files/x509/log-ocsp.bro @load frameworks/packet-filter/shunt.bro @load frameworks/software/version-changes.bro diff --git a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log index 10985d24f7..8e353a8c3d 100644 --- a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log +++ b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log @@ -226,7 +226,6 @@ scripts/base/init-default.bro scripts/base/frameworks/notice/actions/email_admin.bro scripts/base/frameworks/notice/actions/page.bro scripts/base/frameworks/notice/actions/add-geodata.bro - scripts/base/frameworks/notice/extend-email/hostnames.bro scripts/base/frameworks/notice/non-cluster.bro scripts/base/frameworks/notice/actions/pp-alarms.bro scripts/base/frameworks/dpd/__load__.bro diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output index 9d53995f7c..05097df859 100644 --- a/testing/btest/Baseline/plugins.hooks/output +++ b/testing/btest/Baseline/plugins.hooks/output @@ -626,7 +626,6 @@ 0.000000 MetaHookPost LoadFile(0, .<...>/gridftp.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/hll_unique.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/hooks.bif.bro) -> -1 -0.000000 MetaHookPost LoadFile(0, .<...>/hostnames.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/inactivity.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/info.bro) -> -1 0.000000 MetaHookPost LoadFile(0, .<...>/init.bro) -> -1 @@ -1420,7 +1419,6 @@ 0.000000 MetaHookPre LoadFile(0, .<...>/gridftp.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/hll_unique.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/hooks.bif.bro) -0.000000 MetaHookPre LoadFile(0, .<...>/hostnames.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/inactivity.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/info.bro) 0.000000 MetaHookPre LoadFile(0, .<...>/init.bro) @@ -2218,7 +2216,6 @@ 0.000000 | HookLoadFile .<...>/gridftp.bro 0.000000 | HookLoadFile .<...>/hll_unique.bro 0.000000 | HookLoadFile .<...>/hooks.bif.bro -0.000000 | HookLoadFile .<...>/hostnames.bro 0.000000 | HookLoadFile .<...>/image.sig 0.000000 | HookLoadFile .<...>/inactivity.bro 0.000000 | HookLoadFile .<...>/info.bro