Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/jsiwek/autodoc-fixes' into topic/gregor/tunnel

Browse source
This commit is contained in:
Gregor Maier 2011-08-10 12:26:13 -07:00
commit 1a565fadfe
68 changed files with 248 additions and 193 deletions
Download patch file Download diff file Expand all files Collapse all files

14
CMakeLists.txt
View file

@ -35,14 +35,16 @@ endif ()
## Project/Build Configuration
set(BRO_ROOT_DIR ${CMAKE_INSTALL_PREFIX})
if (NOT POLICYDIR)
# set the default policy installation path (user did not specify one)
set(POLICYDIR ${BRO_ROOT_DIR}/share/bro)
if (NOT BRO_SCRIPT_INSTALL_PATH)
# set the default Bro script installation path (user did not specify one)
set(BRO_SCRIPT_INSTALL_PATH ${BRO_ROOT_DIR}/share/bro)
endif ()
set(BRO_SCRIPT_SOURCE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/scripts)
# sanitize the policy install directory into an absolute path
# sanitize the Bro script install directory into an absolute path
# (CMake is confused by ~ as a representation of home directory)
get_filename_component(POLICYDIR ${POLICYDIR} ABSOLUTE)
get_filename_component(BRO_SCRIPT_INSTALL_PATH ${BRO_SCRIPT_INSTALL_PATH}
ABSOLUTE)
configure_file(bro-path-dev.in ${CMAKE_CURRENT_BINARY_DIR}/bro-path-dev)
file(WRITE ${CMAKE_CURRENT_BINARY_DIR}/bro-path-dev.sh
@ -212,7 +214,7 @@ message(
"\n====================| Bro Build Summary |====================="
"\n"
"\nInstall prefix: ${CMAKE_INSTALL_PREFIX}"
"\nPolicy dir: ${POLICYDIR}"
"\nBro Script Path: ${BRO_SCRIPT_INSTALL_PATH}"
"\nDebug mode: ${ENABLE_DEBUG}"
"\n"
"\nCC: ${CMAKE_C_COMPILER}"

10
bro-path-dev.in
View file

@ -1,7 +1,7 @@
#!/bin/sh
# After configured by CMake, this file prints the absolute path to policy
# files that come with the source distributions of Bro as well as policy
# files that are generated by the BIF compiler at compile time.
# After configured by CMake, this file prints the absolute path to Bro scripts
# that come with the source distributions of Bro as well as scripts that are
# generated by the BIF compiler at compile time.
#
# The intended use of this script is to make it easier to run Bro from
# the build directory, avoiding the need to install it. This could be
@ -10,10 +10,10 @@
# BROPATH=`./bro-path-dev` ./src/bro
#
broPolicies=${PROJECT_SOURCE_DIR}/scripts:${PROJECT_SOURCE_DIR}/scripts/policy:${PROJECT_SOURCE_DIR}/scripts/site
broPolicies=${BRO_SCRIPT_SOURCE_PATH}:${BRO_SCRIPT_SOURCE_PATH}/policy:${BRO_SCRIPT_SOURCE_PATH}/site
broGenPolicies=${CMAKE_BINARY_DIR}/src
installedPolicies=${POLICYDIR}:${POLICYDIR}/site
installedPolicies=${BRO_SCRIPT_INSTALL_PATH}:${BRO_SCRIPT_INSTALL_PATH}/site
echo .:$broPolicies:$broGenPolicies

14
configure vendored
View file

@ -22,7 +22,7 @@ Usage: $0 [OPTION]... [VAR=VALUE]...
Installation Directories:
--prefix=PREFIX installation directory [/usr/local/bro]
--policydir=PATH policy file installation directory
--scriptdir=PATH root installation directory for Bro scripts
[PREFIX/share/bro]
Optional Features:
@ -85,7 +85,7 @@ CMakeCacheEntries=""
append_cache_entry CMAKE_INSTALL_PREFIX PATH /usr/local/bro
append_cache_entry BRO_ROOT_DIR PATH /usr/local/bro
append_cache_entry PY_MOD_INSTALL_DIR PATH /usr/local/bro/lib/broctl
append_cache_entry POLICYDIR STRING /usr/local/bro/share/bro
append_cache_entry BRO_SCRIPT_INSTALL_PATH STRING /usr/local/bro/share/bro
append_cache_entry ENABLE_DEBUG BOOL false
append_cache_entry BROv6 BOOL false
append_cache_entry ENABLE_PERFTOOLS BOOL false
@ -118,13 +118,13 @@ while [ $# -ne 0 ]; do
append_cache_entry CMAKE_INSTALL_PREFIX PATH $optarg
append_cache_entry BRO_ROOT_DIR PATH $optarg
append_cache_entry PY_MOD_INSTALL_DIR PATH $optarg/lib/broctl
if [ "$user_set_policydir" != "true" ]; then
append_cache_entry POLICYDIR STRING $optarg/share/bro
if [ "$user_set_scriptdir" != "true" ]; then
append_cache_entry BRO_SCRIPT_INSTALL_PATH STRING $optarg/share/bro
fi
;;
--policydir=*)
append_cache_entry POLICYDIR STRING $optarg
user_set_policydir="true"
--scriptdir=*)
append_cache_entry BRO_SCRIPT_INSTALL_PATH STRING $optarg
user_set_scriptdir="true"
;;
--enable-debug)
append_cache_entry ENABLE_DEBUG BOOL true

10
doc/scripts/CMakeLists.txt
View file

@ -57,10 +57,12 @@ macro(REST_TARGET srcDir broInput)
get_filename_component(relDstDir ${broInput} PATH)
set(sumTextSrc ${absSrcPath})
set(ogSourceFile ${absSrcPath})
if (${extension} STREQUAL ".bif.bro")
set(ogSourceFile ${BIF_SRC_DIR}/${basename})
# the summary text is taken at configure time, but .bif.bro files
# may not have been generated yet, so read .bif file instead
set(sumTextSrc ${BIF_SRC_DIR}/${basename})
set(sumTextSrc ${ogSourceFile})
endif ()
if (NOT relDstDir)
@ -124,9 +126,9 @@ macro(REST_TARGET srcDir broInput)
ARGS -E make_directory ${dstDir}
COMMAND "${CMAKE_COMMAND}"
ARGS -E copy ${restFile} ${restOutput}
# copy the bro policy script, too
# copy the bro or bif script, too
COMMAND "${CMAKE_COMMAND}"
ARGS -E copy ${absSrcPath} ${dstDir}
ARGS -E copy ${ogSourceFile} ${dstDir}
# clean up the build directory
COMMAND rm
ARGS -rf .state *.log *.rst
@ -151,6 +153,8 @@ set(MASTER_PKG_INDEX_TEXT "")
foreach (pkg ${MASTER_PKG_LIST})
# strip of the trailing /index for the link name
get_filename_component(lnktxt ${pkg} PATH)
# pretty-up the link name by removing common scripts/ prefix
string(REPLACE "scripts/" "" lnktxt "${lnktxt}")
set(MASTER_PKG_INDEX_TEXT "${MASTER_PKG_INDEX_TEXT}\n ${lnktxt} <${pkg}>")
endforeach ()
file(WRITE ${MASTER_PACKAGE_INDEX} "${MASTER_PKG_INDEX_TEXT}")

19
doc/scripts/DocSourcesList.cmake
View file

@ -13,22 +13,14 @@
set(psd ${PROJECT_SOURCE_DIR}/scripts)
rest_target(${CMAKE_CURRENT_SOURCE_DIR} example.bro internal)
rest_target(${psd} base/bro.init internal)
rest_target(${psd} base/all.bro internal)
rest_target(${psd} base/init-default.bro internal)
rest_target(${psd} base/init-bare.bro internal)
rest_target(${CMAKE_BINARY_DIR}/src bro.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src common-rw.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src const.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src dns-rw.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src event.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src finger-rw.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src ftp-rw.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src http-rw.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src ident-rw.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src logging.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src reporter.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src smb-rw.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src smtp-rw.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src strings.bif.bro)
rest_target(${CMAKE_BINARY_DIR}/src types.bif.bro)
rest_target(${psd} base/frameworks/cluster/main.bro)
@ -56,6 +48,7 @@ rest_target(${psd} base/frameworks/packet-filter/netstats.bro)
rest_target(${psd} base/frameworks/reporter/main.bro)
rest_target(${psd} base/frameworks/signatures/main.bro)
rest_target(${psd} base/frameworks/software/main.bro)
rest_target(${psd} base/frameworks/time-machine/notice.bro)
rest_target(${psd} base/protocols/conn/contents.bro)
rest_target(${psd} base/protocols/conn/inactivity.bro)
rest_target(${psd} base/protocols/conn/main.bro)
@ -72,6 +65,11 @@ rest_target(${psd} base/protocols/http/partial-content.bro)
rest_target(${psd} base/protocols/http/utils.bro)
rest_target(${psd} base/protocols/irc/dcc-send.bro)
rest_target(${psd} base/protocols/irc/main.bro)
rest_target(${psd} base/protocols/mime/base.bro)
rest_target(${psd} base/protocols/mime/file-extract.bro)
rest_target(${psd} base/protocols/mime/file-hash.bro)
rest_target(${psd} base/protocols/mime/file-ident.bro)
rest_target(${psd} base/protocols/rpc/base.bro)
rest_target(${psd} base/protocols/smtp/main.bro)
rest_target(${psd} base/protocols/ssh/main.bro)
rest_target(${psd} base/protocols/ssl/consts.bro)
@ -105,7 +103,6 @@ rest_target(${psd} policy/misc/loaded-scripts.bro)
rest_target(${psd} policy/misc/trim-trace-file.bro)
rest_target(${psd} policy/protocols/conn/known-hosts.bro)
rest_target(${psd} policy/protocols/conn/known-services.bro)
rest_target(${psd} policy/protocols/conn/scan.bro)
rest_target(${psd} policy/protocols/dns/auth-addl.bro)
rest_target(${psd} policy/protocols/dns/detect-external-names.bro)
rest_target(${psd} policy/protocols/ftp/detect.bro)

2
doc/scripts/README
View file

@ -44,7 +44,7 @@ of documentation targets. This script should be run after adding new
Bro script source files, and the changes commited to git.
If a script shouldn't have documentation generated for it, there's also a
blacklist variable that can be maintained in the ``genDocSourcesList.sh``
blacklist manifest that can be maintained in the ``genDocSourcesList.sh``
script.
The blacklist can also be used if you want to define a certain grouping for

33
doc/scripts/genDocSourcesList.sh
View file

@ -11,8 +11,31 @@
# Specific scripts can be blacklisted below when e.g. they currently aren't
# parseable or they just aren't meant to be documented.
blacklist="__load__.bro|test-all.bro|all.bro"
blacklist_addl="hot.conn.bro"
blacklist ()
{
if [[ "$blacklist" == "" ]]; then
blacklist="$1"
else
blacklist="$blacklist|$1"
fi
}
# files passed into this function are meant to be temporary workarounds
# because they're not finished or otherwise can't be loaded for some reason
tmp_blacklist ()
{
echo "Warning: temporarily blacklisted files named '$1'" 1>&2
blacklist $1
}
blacklist __load__.bro
blacklist test-all.bro
blacklist all.bro
blacklist init-default.bro
blacklist init-bare.bro
tmp_blacklist hot.conn.bro
tmp_blacklist scan.bro
statictext="\
# DO NOT EDIT
@ -30,8 +53,8 @@ statictext="\
set(psd \${PROJECT_SOURCE_DIR}/scripts)
rest_target(\${CMAKE_CURRENT_SOURCE_DIR} example.bro internal)
rest_target(\${psd} base/bro.init internal)
rest_target(\${psd} base/all.bro internal)
rest_target(\${psd} base/init-default.bro internal)
rest_target(\${psd} base/init-bare.bro internal)
"
if [[ $# -ge 1 ]]; then
@ -58,7 +81,7 @@ scriptfiles=`( cd ${sourcedir}/scripts && find . -name \*\.bro | sort )`
for file in $scriptfiles
do
f=${file:2}
if [[ (! $f =~ $blacklist) && (! $f =~ $blacklist_addl) ]]; then
if [[ ! $f =~ $blacklist ]]; then
echo "rest_target(\${psd} $f)" >> $outfile
fi
done

7
doc/scripts/group_index_generator.py
View file

@ -1,9 +1,8 @@
#! /usr/bin/env python
# This script automatically generates a reST documents that lists
# a collection of Bro policy scripts that are "grouped" together.
# The summary text (##! comments) of the policy script is embedded
# in the list.
# a collection of Bro scripts that are "grouped" together.
# The summary text (##! comments) of the script is embedded in the list
#
# 1st argument is the file containing list of groups
# 2nd argument is the directory containing ${group}_files lists of
@ -57,6 +56,6 @@ with open(group_list, 'r') as f_group_list:
f_group_file.write("\n");
with open(group_file, 'a') as f_group_file:
f_group_file.write("\n:doc:`/policy/%s`\n" % doc_names[i])
f_group_file.write("\n:doc:`/scripts/%s`\n" % doc_names[i])
for line in summary_comments:
f_group_file.write(" " + line)

2
doc/scripts/source/index.rst
View file

@ -14,7 +14,7 @@ Contents:
internal
bifs
packages
policy/index
scripts/index
Indices and tables
==================

4
doc/scripts/source/internal.rst
View file

@ -1,5 +1,5 @@
.. This is a stub doc to which the build process can append.
Internal Policy Scripts
=======================
Internal Scripts
================

14
doc/scripts/source/packages.rst
View file

@ -1,11 +1,15 @@
.. This is a stub doc to which the build process can append.
Policy Script Packages
======================
Bro Script Packages
===================
Bro has the following policy script packages (e.g. collections of related
policy scripts). If the package contains a ``__load__.bro`` script, it
supports being loaded in mass as a whole directory for convenience.
Bro has the following script packages (e.g. collections of related scripts in
a common directory). If the package directory contains a ``__load__.bro``
script, it supports being loaded in mass as a whole directory for convenience.
Packages/scripts in the ``base/`` directory are all loaded by default, while
ones in ``policy/`` provide functionality and customization options that are
more appropriate for users to decide whether they'd like to load it or not.
.. toctree::
:maxdepth: 1

6
doc/scripts/source/policy/index.rst
View file

@ -1,6 +0,0 @@
Index of All Policy Script Documentation
========================================
.. toctree::
:maxdepth: 1

6
doc/scripts/source/scripts/index.rst Normal file
View file

@ -0,0 +1,6 @@
Index of All Bro Script Documentation
=====================================
.. toctree::
:maxdepth: 1

5
scripts/CMakeLists.txt
View file

@ -1,9 +1,8 @@
include(InstallPackageConfigFile)
install(DIRECTORY ./ DESTINATION ${POLICYDIR} FILES_MATCHING
install(DIRECTORY ./ DESTINATION ${BRO_SCRIPT_INSTALL_PATH} FILES_MATCHING
PATTERN "all.bro" EXCLUDE
PATTERN "site/local.bro" EXCLUDE
PATTERN "bro.init"
PATTERN "*.bro"
PATTERN "*.sig"
PATTERN "*.osf"
@ -13,6 +12,6 @@ install(DIRECTORY ./ DESTINATION ${POLICYDIR} FILES_MATCHING
# user modify-able.
InstallPackageConfigFile(
${CMAKE_CURRENT_SOURCE_DIR}/site/local.bro
${POLICYDIR}/site
${BRO_SCRIPT_INSTALL_PATH}/site
local.bro)

2
scripts/base/frameworks/cluster/setup-connections.bro
View file

@ -1,3 +1,5 @@
@load base/frameworks/communication
module Cluster;
event bro_init() &priority=9

2
scripts/base/frameworks/metrics/conn-example.bro
View file

@ -1,4 +1,4 @@
@load frameworks/metrics
@load base/frameworks/metrics
redef enum Metrics::ID += {
CONNS_ORIGINATED,

2
scripts/base/frameworks/metrics/http-example.bro
View file

@ -1,4 +1,4 @@
@load frameworks/metrics
@load base/frameworks/metrics
redef enum Metrics::ID += {
HTTP_REQUESTS_BY_STATUS_CODE,

1
scripts/base/frameworks/notice/actions/email_admin.bro
View file

@ -1,4 +1,3 @@
module Notice;
export {

2
scripts/base/frameworks/notice/extend-email/hostnames.bro
View file

@ -8,7 +8,7 @@ event Notice::notice(n: Notice::Info) &priority=10
return;
# This should only be done for notices that are being sent to email.
if ( ACTION_EMAIL !in n$action )
if ( ACTION_EMAIL !in n$actions )
return;
local output = "";

1
scripts/base/frameworks/notice/weird.bro
View file

@ -1,4 +1,3 @@
module Weird;
export {

0
scripts/base/bro.init → scripts/base/init-bare.bro
View file

15
scripts/base/all.bro → scripts/base/init-default.bro
View file

@ -1,10 +1,8 @@
##! This script loads everything in the base/ script directory. If you want
##! to run Bro without all of these scripts loaded by default, you can define
##! the BRO_NO_BASE_SCRIPTS environment variable to any value. You can also
##! copy the "@load" lines from this script to your own script to load only
##! the scripts that you actually want.
@if ( getenv("BRO_NO_BASE_SCRIPTS") == "" )
##! to run Bro without all of these scripts loaded by default, you can use
##! the -b (--bare-mode) command line argument. You can also copy the "@load"
##! lines from this script to your own script to load only the scripts that
##! you actually want.
@load base/utils/site
@load base/utils/addrs
@ -17,7 +15,8 @@
@load base/utils/strings
@load base/utils/thresholds
# This has some weird interplay between types and BiFs so it's loaded in bro.init
# This has some deep interplay between types and BiFs so it's
# loaded in base/init-bare.bro
#@load base/frameworks/logging
@load base/frameworks/notice
@load base/frameworks/dpd
@ -40,5 +39,3 @@
@load base/protocols/ssh
@load base/protocols/ssl
@load base/protocols/syslog
@endif

2
scripts/base/protocols/mime/base.bro
View file

@ -1,7 +1,7 @@
##! The mime script does analysis of MIME encoded messages seen in certain
##! protocols (only SMTP and POP3 at the moment).
@load utils/strings
@load base/utils/strings
module MIME;

4
scripts/base/protocols/mime/file-extract.bro
View file

@ -1,5 +1,5 @@
@load protocols/mime/file-ident
@load utils/files
@load ./file-ident
@load base/utils/files
module MIME;

2
scripts/base/protocols/mime/file-hash.bro
View file

@ -1,4 +1,4 @@
@load protocols/mime/file-ident
@load ./file-ident
module MIME;

2
scripts/base/protocols/mime/file-ident.bro
View file

@ -1,4 +1,4 @@
@load protocols/mime/base
@load ./base
module MIME;

2
scripts/policy/frameworks/communication/listen-clear.bro
View file

@ -1,5 +1,7 @@
##! Listen for other Bro instances to make unencrypted connections.
@load base/frameworks/communication
module Communication;
export {

2
scripts/policy/frameworks/communication/listen-ssl.bro
View file

@ -1,5 +1,7 @@
##! Listen for other Bro instances and encrypt the connection with SSL.
@load base/frameworks/communication
module Communication;
export {

1
scripts/policy/frameworks/control/controller.bro
View file

@ -1,3 +1,4 @@
@load base/frameworks/communication
module Control;

2
scripts/policy/protocols/conn/scan.bro
View file

@ -1,4 +1,4 @@
@load frameworks/notice
@load base/frameworks/notice
@load port-name
module Scan;

30
scripts/site/local.bro
View file

@ -1,4 +1,5 @@
##! Local site policy. Customize as appropriate.
##! Local site policy. Customize as appropriate. This file will not be
##! overwritten when upgrading or reinstalling.
# Load the script to log which script were loaded during each run
@load misc/loaded-scripts
@ -8,7 +9,8 @@
# Vulnerable versions of software to generate notices for when discovered.
# The default is to only monitor software found in the address space defined
# as "local". Refer to the software framework's documentation for more information.
# as "local". Refer to the software framework's documentation for more
# information.
@load frameworks/software/vulnerable
redef Software::vulnerable_versions += {
["Flash"] = [$major=10,$minor=2,$minor2=153,$addl="1"],
@ -18,3 +20,27 @@ redef Software::vulnerable_versions += {
# This adds signatures to detect cleartext forward and reverse windows shells.
redef signature_files += "frameworks/signatures/detect-windows-shells.sig";
# Load all of the scripts that detect software in various protocols.
@load protocols/http/software
@load protocols/ftp/software
@load protocols/smtp/software
@load protocols/ssh/software
# Load the script to detect DNS results pointing toward your Site::local_nets
# where the name is not part of your local DNS zone and is being hosted
# externally. Requires that the Site::local_zones variable is defined.
@load protocols/dns/detect-external-names
# Script to detect various activity in FTP sessions.
@load protocols/ftp/detect
# Detect software changing (e.g. attacker installing hacked SSHD).
@load frameworks/software/version-changes
# Scripts that do asset tracking.
@load protocols/conn/known-hosts
@load protocols/conn/known-services
@load protocols/ssl/known-certs
# Load the script to enable SSL/TLS certificate validation.
@load protocols/ssl/validate-certs

20
src/BroDoc.cc
View file

@ -20,8 +20,8 @@ BroDoc::BroDoc(const std::string& rel, const std::string& abs)
if ( rel[0] == '/' || rel[0] == '.' )
{
// The Bro script must not be on a subpath of the policy/ dir of
// BROPATH, so just use the basename as the document title.
// The Bro script isn't being loaded via BROPATH, so just use basename
// as the document title.
doc_title = source_filename;
}
else
@ -33,8 +33,14 @@ BroDoc::BroDoc(const std::string& rel, const std::string& abs)
doc_title = rel + "/" + source_filename;
}
downloadable_filename = source_filename;
size_t ext_pos = downloadable_filename.find(".bif.bro");
if ( std::string::npos != ext_pos )
downloadable_filename.erase(ext_pos + 4);
reST_filename = doc_title;
size_t ext_pos = reST_filename.find(".bro");
ext_pos = reST_filename.find(".bro");
if ( std::string::npos == ext_pos )
reST_filename += ".rst";
@ -103,14 +109,14 @@ void BroDoc::AddImport(const std::string& s)
{
if ( subpath[0] == '/' || subpath[0] == '.' )
{
// it's not a subpath of policy/, so just add the name of it
// it's not a subpath of scripts/, so just add the name of it
// as it's given in the @load directive
imports.push_back(lname);
}
else
{
// combine the base file name of script in the @load directive
// with the subpath of BROPATH's policy/ directory
// with the subpath of BROPATH's scripts/ directory
string fname(subpath);
char* othertmp = copy_string(lname.c_str());
fname.append("/").append(basename(othertmp));
@ -167,7 +173,7 @@ void BroDoc::WriteDocFile() const
WriteSectionHeading(doc_title.c_str(), '=');
WriteToDoc("\n:download:`Original Source File <%s>`\n\n",
source_filename.c_str());
downloadable_filename.c_str());
WriteSectionHeading("Overview", '-');
WriteStringList("%s\n", "%s\n\n", summary);
@ -185,7 +191,7 @@ void BroDoc::WriteDocFile() const
size_t pos = pretty.find("/index");
if ( pos != std::string::npos && pos + 6 == pretty.size() )
pretty = pretty.substr(0, pos);
WriteToDoc(":doc:`%s </policy/%s>`", pretty.c_str(), it->c_str());
WriteToDoc(":doc:`%s </scripts/%s>`", pretty.c_str(), it->c_str());
}
WriteToDoc("\n");
}

8
src/BroDoc.h
View file

@ -24,10 +24,9 @@ public:
* If the filename doesn't end in ".bro", then ".rst" is just appended.
* Any '/' characters in the reST file name that result from choice of
* the 'rel' parameter are replaced with '^'.
* @param subpath A string representing a subpath of BROPATH's policy/
* directory in which the source file is located. It can
* also be full path to the file or a full path that's in BROPATH,
* but in either of those cases, the parameter is essentially
* @param rel A string representing a subpath of the root Bro script
* source/install directory in which the source file is located.
* It can also be an absolute path, but then the parameter is
* ignored and the document title is just derived from file name
* @param abs The absolute path to the Bro script for which to generate
* documentation.
@ -211,6 +210,7 @@ protected:
FILE* reST_file;
std::string reST_filename;
std::string source_filename; // points to the basename of source file
std::string downloadable_filename; // file that will be linked for download
std::string doc_title;
std::string packet_filter;

5
src/CMakeLists.txt
View file

@ -409,7 +409,8 @@ set(bro_SRCS
collect_headers(bro_HEADERS ${bro_SRCS})
add_definitions(-DPOLICYDEST="${POLICYDIR}")
add_definitions(-DBRO_SCRIPT_INSTALL_PATH="${BRO_SCRIPT_INSTALL_PATH}")
add_definitions(-DBRO_SCRIPT_SOURCE_PATH="${BRO_SCRIPT_SOURCE_PATH}")
add_executable(bro ${bro_SRCS} ${bro_HEADERS})
@ -424,7 +425,7 @@ set(brolibs
target_link_libraries(bro ${brolibs})
install(TARGETS bro DESTINATION bin)
install(FILES ${INSTALL_BIF_OUTPUTS} DESTINATION ${POLICYDIR})
install(FILES ${INSTALL_BIF_OUTPUTS} DESTINATION ${BRO_SCRIPT_INSTALL_PATH})
set(BRO_EXE bro
CACHE STRING "Bro executable binary" FORCE)

14
src/main.cc
View file

@ -138,6 +138,7 @@ void usage()
fprintf(stderr, "bro version %s\n", bro_version());
fprintf(stderr, "usage: %s [options] [file ...]\n", prog);
fprintf(stderr, " <file> | policy file, or read stdin\n");
fprintf(stderr, " -b|--bare-mode | don't load scripts from the base/ directory\n");
fprintf(stderr, " -d|--debug-policy | activate policy file debugging\n");
fprintf(stderr, " -e|--exec <bro code> | augment loaded policies by given code\n");
fprintf(stderr, " -f|--filter <filter> | tcpdump filter\n");
@ -349,6 +350,7 @@ int main(int argc, char** argv)
char* seed_load_file = getenv("BRO_SEED_FILE");
char* seed_save_file = 0;
char* user_pcap_filter = 0;
int bare_mode = false;
int seed = 0;
int dump_cfg = false;
int to_xml = 0;
@ -358,6 +360,7 @@ int main(int argc, char** argv)
int RE_level = 4;
static struct option long_opts[] = {
{"bare-mode", no_argument, 0, 'b'},
{"debug-policy", no_argument, 0, 'd'},
{"dump-config", no_argument, 0, 'g'},
{"exec", required_argument, 0, 'e'},
@ -438,7 +441,7 @@ int main(int argc, char** argv)
opterr = 0;
char opts[256];
safe_strncpy(opts, "B:D:e:f:I:i:K:n:p:R:r:s:T:t:U:w:x:X:y:Y:z:CFGLOPSWdghvZ",
safe_strncpy(opts, "B:D:e:f:I:i:K:n:p:R:r:s:T:t:U:w:x:X:y:Y:z:CFGLOPSWbdghvZ",
sizeof(opts));
#ifdef USE_PERFTOOLS
@ -448,6 +451,10 @@ int main(int argc, char** argv)
int op;
while ( (op = getopt_long(argc, argv, opts, long_opts, &long_optsind)) != EOF )
switch ( op ) {
case 'b':
bare_mode = true;
break;
case 'd':
fprintf(stderr, "Policy file debugging ON.\n");
g_policy_debug = true;
@ -675,8 +682,9 @@ int main(int argc, char** argv)
timer_mgr = new PQ_TimerMgr("<GLOBAL>");
// timer_mgr = new CQ_TimerMgr();
add_input_file("base/bro.init");
add_input_file("base/all.bro");
add_input_file("base/init-bare.bro");
if ( ! bare_mode )
add_input_file("base/init-default.bro");
if ( optind == argc &&
read_files.length() == 0 && flow_files.length() == 0 &&

86
src/util.cc
View file

@ -757,9 +757,9 @@ const char* bro_path()
const char* path = getenv("BROPATH");
if ( ! path )
path = ".:"
POLICYDEST ":"
POLICYDEST "/policy" ":"
POLICYDEST "/site";
BRO_SCRIPT_INSTALL_PATH ":"
BRO_SCRIPT_INSTALL_PATH "/policy" ":"
BRO_SCRIPT_INSTALL_PATH "/site";
return path;
}
@ -891,60 +891,36 @@ const char* normalize_path(const char* path)
return copy_string(new_path.c_str());
}
// Returns the subpath of BROPATH's policy/ directory in which the loaded
// file in located. If it's not under a subpath of policy/ then the full
// path is returned, else the subpath of policy/ concatentated with any
// directory prefix of the file is returned.
void get_policy_subpath(const char* dir, const char* file, const char** subpath)
// Returns the subpath of the root Bro script install/source directory in
// which the loaded file is located. If it's not under a subpath of that
// directory (e.g. cwd or custom path) then the full path is returned.
void get_script_subpath(const std::string& full_filename, const char** subpath)
{
// first figure out if this is a subpath of policy/
const char* ploc = strstr(dir, "policy");
if ( ploc )
if ( ploc[6] == '\0' )
*subpath = copy_string(ploc + 6);
else if ( ploc[6] == '/' )
*subpath = copy_string(ploc + 7);
else
*subpath = copy_string(dir);
else
*subpath = copy_string(dir);
size_t p;
std::string my_subpath(full_filename);
// and now add any directory parts of the filename
char full_filename_buf[1024];
safe_snprintf(full_filename_buf, sizeof(full_filename_buf),
"%s/%s", dir, file);
char* tmp = copy_string(file);
const char* fdir = 0;
if ( is_dir(full_filename_buf) )
fdir = file;
if ( ! fdir )
fdir = dirname(tmp);
if ( ! streq(fdir, ".") )
// get the parent directory of file (if not already a directory)
if ( ! is_dir(full_filename.c_str()) )
{
size_t full_subpath_len = strlen(*subpath) + strlen(fdir) + 1;
bool needslash = false;
if ( strlen(*subpath) != 0 && (*subpath)[strlen(*subpath) - 1] != '/' )
{
++full_subpath_len;
needslash = true;
}
char* full_subpath = new char[full_subpath_len];
strcpy(full_subpath, *subpath);
if ( needslash )
strcat(full_subpath, "/");
strcat(full_subpath, fdir);
delete [] *subpath;
*subpath = full_subpath;
}
const char* normalized_subpath = normalize_path(*subpath);
char* tmp = copy_string(full_filename.c_str());
my_subpath = dirname(tmp);
delete [] tmp;
delete [] *subpath;
*subpath = normalized_subpath;
}
// first check if this is some subpath of the installed scripts root path,
// if not check if it's a subpath of the script source root path,
// if neither, will just use the given directory
if ( (p=my_subpath.find(BRO_SCRIPT_INSTALL_PATH)) != std::string::npos )
my_subpath.erase(0, strlen(BRO_SCRIPT_INSTALL_PATH));
else if ( (p=my_subpath.find(BRO_SCRIPT_SOURCE_PATH)) != std::string::npos )
my_subpath.erase(0, strlen(BRO_SCRIPT_SOURCE_PATH));
// if root path found, remove path separators until next path component
if ( p != std::string::npos )
while ( my_subpath.size() && my_subpath[0] == '/' )
my_subpath.erase(0, 1);
*subpath = normalize_path(my_subpath.c_str());
}
extern string current_scanned_file_path;
@ -1001,7 +977,7 @@ FILE* search_for_file(const char* filename, const char* ext,
! is_dir(full_filename_buf) )
{
if ( bropath_subpath )
get_policy_subpath(dir_beginning, filename, bropath_subpath);
get_script_subpath(full_filename_buf, bropath_subpath);
return open_file(full_filename_buf, full_filename, load_pkgs);
}
@ -1010,7 +986,7 @@ FILE* search_for_file(const char* filename, const char* ext,
if ( access(full_filename_buf, R_OK) == 0 )
{
if ( bropath_subpath )
get_policy_subpath(dir_beginning, filename, bropath_subpath);
get_script_subpath(full_filename_buf, bropath_subpath);
return open_file(full_filename_buf, full_filename, load_pkgs);
}

2
src/util.h
View file

@ -179,7 +179,7 @@ extern const char* bro_path();
extern const char* bro_prefixes();
std::string dot_canon(std::string path, std::string file, std::string prefix = "");
const char* normalize_path(const char* path);
void get_policy_subpath(const char* dir, const char* file, const char** subpath);
void get_script_subpath(const std::string& full_filename, const char** subpath);
extern FILE* search_for_file(const char* filename, const char* ext,
const char** full_filename, bool load_pkgs, const char** bropath_subpath);

8
testing/btest/Baseline/core.load-prefixes/output
View file

@ -1,4 +1,4 @@
loaded lcl2.site.bro
loaded lcl.site.bro
loaded lcl2.protocols.http.bro
loaded lcl.protocols.http.bro
loaded lcl2.base.utils.site.bro
loaded lcl.base.utils.site.bro
loaded lcl2.base.protocols.http.bro
loaded lcl.base.protocols.http.bro

2
testing/btest/Baseline/doc.autogen-reST-example/example.rst
View file

@ -29,7 +29,7 @@ each of "columns", "event", "filter" depending on exactly what it's doing.
:Author: Jon Siwek <jsiwek@ncsa.illinois.edu>
:Imports: :doc:`frameworks/notice </policy/frameworks/notice/index>`
:Imports: :doc:`policy/frameworks/software/vulnerable </scripts/policy/frameworks/software/vulnerable>`
Summary
~~~~~~~

0
testing/btest/Baseline/doc.blacklist-reminder/.stderr Normal file
View file

4
testing/btest/Baseline/policy.misc.default-loaded-scripts/canonified_loaded_scripts.log
View file

@ -1,5 +1,5 @@
# depth name
0 scripts/base/bro.init
0 scripts/base/init-bare.bro
1 build/src/const.bif.bro
1 build/src/types.bif.bro
1 build/src/strings.bif.bro
@ -10,7 +10,7 @@
2 scripts/base/frameworks/logging/./main.bro
3 build/src/logging.bif.bro
2 scripts/base/frameworks/logging/./writers/ascii.bro
0 scripts/base/all.bro
0 scripts/base/init-default.bro
1 scripts/base/utils/site.bro
2 scripts/base/utils/./patterns.bro
1 scripts/base/utils/addrs.bro

4
testing/btest/core/load-prefixes.bro
View file

@ -9,11 +9,11 @@
@TEST-END-FILE
@TEST-START-FILE lcl.base.utils.site.bro
print "loaded lcl.base.site.bro";
print "loaded lcl.base.utils.site.bro";
@TEST-END-FILE
@TEST-START-FILE lcl2.base.utils.site.bro
print "loaded lcl2.base.site.bro";
print "loaded lcl2.base.utils.site.bro";
@TEST-END-FILE
@TEST-START-FILE lcl.base.protocols.http.bro

8
testing/btest/doc/blacklist-reminder.test Normal file
View file

@ -0,0 +1,8 @@
# This test will fail if there are Bro scripts that have been temporarily
# blacklisted from the documentation generation process for some reason
# (e.g. they're a work-in-progress or otherwise fail to parse). It's meant
# to serve as a reminder that some future action may be needed to generate
# documentation for the blacklisted scripts.
#
# @TEST-EXEC: $DIST/doc/scripts/genDocSourcesList.sh
# @TEST-EXEC: btest-diff .stderr

2
testing/btest/policy/frameworks/logging/adapt-filter.bro
View file

@ -1,5 +1,5 @@
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh-new-default.log
# @TEST-EXEC: test '!' -e ssh.log

2
testing/btest/policy/frameworks/logging/ascii-binary.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/ascii-empty.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
redef LogAscii::output_to_stdout = F;

2
testing/btest/policy/frameworks/logging/ascii-escape.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
redef LogAscii::separator = "||";

2
testing/btest/policy/frameworks/logging/ascii-options.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
redef LogAscii::output_to_stdout = F;

2
testing/btest/policy/frameworks/logging/ascii-timestamps.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff test.log
module Test;

2
testing/btest/policy/frameworks/logging/attr-extend.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/attr.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/disable-stream.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: test '!' -e ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/empty-event.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/events.bro
View file

@ -1,5 +1,5 @@
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT >output
# @TEST-EXEC: bro -b %INPUT >output
# @TEST-EXEC: btest-diff output
module SSH;

2
testing/btest/policy/frameworks/logging/exclude.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/file.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/include.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/no-local.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: test '!' -e ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/path-func.bro
View file

@ -1,5 +1,5 @@
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: ( ls static-*; cat static-* ) >output
# @TEST-EXEC: btest-diff output

2
testing/btest/policy/frameworks/logging/pred.bro
View file

@ -1,5 +1,5 @@
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.success.log
# @TEST-EXEC: btest-diff ssh.failure.log

2
testing/btest/policy/frameworks/logging/remove.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro -B logging %INPUT
# @TEST-EXEC: bro -b -B logging %INPUT
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff ssh.failure.log

2
testing/btest/policy/frameworks/logging/rotate-custom.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro -r %DIR/rotation.trace %INPUT | egrep "test|test2" | sort >out
# @TEST-EXEC: bro -b -r %DIR/rotation.trace %INPUT | egrep "test|test2" | sort >out
# @TEST-EXEC: for i in `ls test*.log | sort`; do printf '> %s\n' $i; cat $i; done | sort | uniq >>out
# @TEST-EXEC: btest-diff out

2
testing/btest/policy/frameworks/logging/stdout.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT >output
# @TEST-EXEC: bro -b %INPUT >output
# @TEST-EXEC: btest-diff output
# @TEST-EXEC: test '!' -e ssh.log

2
testing/btest/policy/frameworks/logging/test-logging.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;

2
testing/btest/policy/frameworks/logging/types.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
#
# Testing all possible types.

2
testing/btest/policy/frameworks/logging/unset-record.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff testing.log
redef enum Log::ID += { TESTING };

2
testing/btest/policy/frameworks/logging/vec.bro
View file

@ -1,5 +1,5 @@
#
# @TEST-EXEC: BRO_NO_BASE_SCRIPTS=1 bro %INPUT
# @TEST-EXEC: bro -b %INPUT
# @TEST-EXEC: btest-diff ssh.log
module SSH;