Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 20:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Infrastructure for modularizing protocol analyzers.

Browse source 
There's now a new directory "src/protocols/", and the plan is for each
protocol analyzer to eventually have its own subdirectory in there
that contains everything it defines (C++/pac/bif). The infrastructure
to make that happen is in place, and two analyzers have been
converted to the new model, HTTP and SSL; there's no further
HTTP/SSL-specific code anywhere else in the core anymore (I believe :-)

Further changes:

    - -N lists available plugins, -NN lists more details on what these
      plugins provide (analyzers, bif elements). (The latter does not
      work for analyzers that haven't been converted yet).

    - *.bif.bro files now go into scripts/base/bif/; and
      scripts/base/bif/plugins/ for bif files provided by plugins.

    - I've factored out the bifcl/binpac CMake magic from
      src/CMakeLists.txt to cmake/{BifCl,Binpac}

    - There's a new cmake/BroPlugin that contains magic to allow
      plugins to have a simple CMakeLists.txt. The hope is that
      eventually the same CMakeLists.txt can be used for compiling a
      plugin either statically or dynamically.

    - bifcl has a new option -c that changes the code it generates so
      that it can be used with a plugin.

TODOs:
    - "make install" is probably broken.
    - Broxygen is probably broken for plugin-defined events.
    - event groups are broken (do we want to keep them?)
This commit is contained in:
Robin Sommer 2013-03-28 21:47:44 -07:00
parent 2be985433c
commit 19c1816ebb
44 changed files with 974 additions and 663 deletions
Download patch file Download diff file Expand all files Collapse all files

129
src/protocols/BuiltInAnalyzers.cc Normal file
View file

@ -0,0 +1,129 @@
// TODO: This file will eventually go away once we've converrted all
// analyzers into separate plugins.
#include "BuiltInAnalyzers.h"
#include "analyzer/PluginComponent.h"
#include "../binpac_bro.h"
#include "AYIYA.h"
#include "BackDoor.h"
#include "BitTorrent.h"
#include "BitTorrentTracker.h"
#include "Finger.h"
#include "InterConn.h"
#include "NTP.h"
#include "ICMP.h"
#include "SteppingStone.h"
#include "IRC.h"
#include "SMTP.h"
#include "FTP.h"
#include "FileAnalyzer.h"
#include "DNS.h"
#include "DNS-binpac.h"
#include "DHCP-binpac.h"
#include "Telnet.h"
#include "Rlogin.h"
#include "RSH.h"
#include "DCE_RPC.h"
#include "Gnutella.h"
#include "Ident.h"
#include "Modbus.h"
#include "NCP.h"
#include "NetbiosSSN.h"
#include "SMB.h"
#include "NFS.h"
#include "Portmap.h"
#include "POP3.h"
#include "SOCKS.h"
#include "SSH.h"
#include "Syslog-binpac.h"
#include "Teredo.h"
#include "ConnSizeAnalyzer.h"
#include "GTPv1.h"
using namespace analyzer;
BuiltinAnalyzers builtin_analyzers;
#define DEFINE_ANALYZER(name, factory, enabled, partial) \
AddComponent(new PluginComponent(name, factory, enabled, partial))
void BuiltinAnalyzers::Init()
{
plugin::Description desc;
desc.name = "Core-Analyzers";
desc.description = "Built-in protocol analyzers";
desc.version = BRO_PLUGIN_VERSION_BUILTIN;
SetDescription(desc);
DEFINE_ANALYZER("PIA_TCP", PIA_TCP::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("PIA_UDP", PIA_UDP::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("ICMP", ICMP_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("TCP", TCP_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("UDP", UDP_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("BITTORRENT", BitTorrent_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("BITTORRENTTRACKER", BitTorrentTracker_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("DCE_RPC", DCE_RPC_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("DNS", DNS_Analyzer::InstantiateAnalyzer, ! FLAGS_use_binpac, false);
DEFINE_ANALYZER("FINGER", Finger_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("FTP", FTP_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("GNUTELLA", Gnutella_Analyzer::InstantiateAnalyzer, true, false);
// DEFINE_ANALYZER("HTTP", HTTP_Analyzer::InstantiateAnalyzer, ! FLAGS_use_binpac, false);
DEFINE_ANALYZER("IDENT", Ident_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("IRC", IRC_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("LOGIN", 0, true, false); // just a base class
DEFINE_ANALYZER("NCP", NCP_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("NETBIOSSSN", NetbiosSSN_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("NFS", NFS_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("NTP", NTP_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("POP3", POP3_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("PORTMAPPER", Portmapper_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("RLOGIN", Rlogin_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("RPC", 0, true, false);
DEFINE_ANALYZER("RSH", Rsh_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("SMB", SMB_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("SMTP", SMTP_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("SSH", SSH_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("TELNET", Telnet_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("DHCP_BINPAC", DHCP_Analyzer_binpac::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("DNS_TCP_BINPAC", DNS_TCP_Analyzer_binpac::InstantiateAnalyzer, FLAGS_use_binpac, false);
DEFINE_ANALYZER("DNS_UDP_BINPAC", DNS_UDP_Analyzer_binpac::InstantiateAnalyzer, FLAGS_use_binpac, false);
// DEFINE_ANALYZER("HTTP_BINPAC", HTTP_Analyzer_binpac::InstantiateAnalyzer, FLAGS_use_binpac, false);
// DEFINE_ANALYZER("SSL", SSL_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("SYSLOG_BINPAC", Syslog_Analyzer_binpac::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("MODBUS", ModbusTCP_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("AYIYA", AYIYA_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("SOCKS", SOCKS_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("TEREDO", Teredo_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("GTPV1", GTPv1_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("FILE", File_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("BACKDOOR", BackDoor_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("INTERCONN", InterConn_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("STEPPINGSTONE", SteppingStone_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("TCPSTATS", TCPStats_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("CONNSIZE", ConnSize_Analyzer::InstantiateAnalyzer, true, false);
DEFINE_ANALYZER("CONTENTS", 0, true, false);
DEFINE_ANALYZER("CONTENTLINE", 0, true, false);
DEFINE_ANALYZER("NVT", 0, true, false);
DEFINE_ANALYZER("ZIP", 0, true, false);
DEFINE_ANALYZER("CONTENTS_DNS", 0, true, false);
DEFINE_ANALYZER("CONTENTS_NETBIOSSSN", 0, true, false);
DEFINE_ANALYZER("CONTENTS_NCP", 0, true, false);
DEFINE_ANALYZER("CONTENTS_RLOGIN", 0, true, false);
DEFINE_ANALYZER("CONTENTS_RSH", 0, true, false);
DEFINE_ANALYZER("CONTENTS_DCE_RPC", 0, true, false);
DEFINE_ANALYZER("CONTENTS_SMB", 0, true, false);
DEFINE_ANALYZER("CONTENTS_RPC", 0, true, false);
DEFINE_ANALYZER("CONTENTS_NFS", 0, true, false);
DEFINE_ANALYZER("FTP_ADAT", 0, true, false);
}