Enable SMB by default by moving scripts from policy/ to base/

This commit is contained in:
Jon Siwek 2018-08-16 17:21:28 -05:00
parent 7fdf621a1d
commit a04c76c035
33 changed files with 633 additions and 552 deletions

View file

@ -62,8 +62,6 @@
@load base/protocols/rfb
@load base/protocols/sip
@load base/protocols/snmp
# This DOES NOT enable the SMB analyzer. It's just some base support
# for other protocols.
@load base/protocols/smb
@load base/protocols/smtp
@load base/protocols/socks

View file

@ -1 +1 @@
Definitions of constants used by the SMB protocol.
Support for SMB protocol analysis.

View file

@ -1,3 +1,10 @@
@load ./consts
@load ./const-dos-error
@load ./const-nt-status
@load ./main
@load ./smb1-main
@load ./smb2-main
@load ./files
@load-sigs ./dpd.sig

View file

@ -1,4 +1,6 @@
@load base/protocols/smb
@load ./consts
@load ./const-dos-error
@load ./const-nt-status
module SMB;

View file

@ -1 +0,0 @@
Support for SMB protocol analysis.

View file

@ -1,8 +0,0 @@
@load base/protocols/smb
@load ./main
@load ./smb1-main
@load ./smb2-main
@load ./files
@load-sigs ./dpd.sig

View file

@ -99,7 +99,3 @@
# Uncomment the following line to enable logging of link-layer addresses. Enabling
# this adds the link-layer address for each connection endpoint to the conn.log file.
# @load policy/protocols/conn/mac-logging
# Uncomment the following line to enable the SMB analyzer. The analyzer
# is currently considered a preview and therefore not loaded by default.
# @load policy/protocols/smb

View file

@ -80,11 +80,6 @@
@load protocols/modbus/track-memmap.bro
@load protocols/mysql/software.bro
@load protocols/rdp/indicate_ssl.bro
@load protocols/smb/__load__.bro
@load protocols/smb/files.bro
@load protocols/smb/main.bro
@load protocols/smb/smb1-main.bro
@load protocols/smb/smb2-main.bro
@load protocols/smtp/blocklists.bro
@load protocols/smtp/detect-suspicious-orig.bro
@load protocols/smtp/entities-excerpt.bro