diff --git a/doc/scripts/CMakeLists.txt b/doc/scripts/CMakeLists.txt index 548ed1e119..64c3de92eb 100644 --- a/doc/scripts/CMakeLists.txt +++ b/doc/scripts/CMakeLists.txt @@ -45,12 +45,6 @@ macro(REST_TARGET srcDir broInput) set(sumTextSrc ${absSrcPath}) set(ogSourceFile ${absSrcPath}) - if (${extension} STREQUAL ".bif.bro") - # set(ogSourceFile ${BIF_SRC_DIR}/${basename}) - # the summary text is taken at configure time, but .bif.bro files - # may not have been generated yet, so read .bif file instead - set(sumTextSrc ${ogSourceFile}) - endif () if (NOT relDstDir) set(docName "${basename}") diff --git a/doc/scripts/example.bro b/doc/scripts/example.bro index 4e2f533226..b7407a27a9 100644 --- a/doc/scripts/example.bro +++ b/doc/scripts/example.bro @@ -58,7 +58,7 @@ global example_ports = { event bro_init() { # Registering a well-known port is self-documenting and - # go into the generated doc's "Port Analysis" section + # goes into the generated doc's "Port Analysis" section. Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, example_ports); } diff --git a/scripts/base/frameworks/analyzer/main.bro b/scripts/base/frameworks/analyzer/main.bro index 50ff6b775d..66b3abc46e 100644 --- a/scripts/base/frameworks/analyzer/main.bro +++ b/scripts/base/frameworks/analyzer/main.bro @@ -2,25 +2,25 @@ ##! ##! The analyzer framework allows to dynamically enable or disable analyzers, as ##! well as to manage the well-known ports which automatically active a particular -##! analyzer for new connections. -##! +##! analyzer for new connections. +##! ##! Protocol analyzers are identified by unique tags of type ##! :bro:type:`Analyzer::Tag`, such as :bro:enum:`Analyzer::ANALYZER_HTTP` and ##! :bro:enum:`Analyzer::ANALYZER_HTTP`. These tags are defined internally by the -##! analyzers themselves, and documented in their analyzer-specific description along with the -##! events that they generate. +##! analyzers themselves, and documented in their analyzer-specific description +##! along with the events that they generate. ##! ##! .. todo: ``The ANALYZER_*`` are in fact not yet documented, we need to add that -##! to Broxygen. +##! to Broxygen. module Analyzer; export { ## If true, all available analyzers are initially disabled at startup. One can - ## then selectively enable them with :bro:id:`enable_analyzer`. + ## then selectively enable them with :bro:id:`enable_analyzer`. global disable_all = F &redef; ## Enables an analyzer. Once enabled, the analyzer may be used for analysis of - ## future connections as decided by Bro's dynamic protocol detection. + ## future connections as decided by Bro's dynamic protocol detection. ## ## tag: The tag of the analyzer to enable. ## @@ -28,11 +28,11 @@ export { global enable_analyzer: function(tag: Analyzer::Tag) : bool; ## Disables an analyzer. Once disabled, the analyzer will not be used - ## further for analysis of future connections. + ## further for analysis of future connections. ## - ## tag: The tag of the analyzer to disable. + ## tag: The tag of the analyzer to disable. ## - ## Returns: True if the analyzer was successfully disabled. + ## Returns: True if the analyzer was successfully disabled. global disable_analyzer: function(tag: Analyzer::Tag) : bool; ## Registers a set of well-known ports for an analyzer. If a future connection @@ -40,50 +40,50 @@ export { ## to parsing it. The function *adds* to all ports already registered, it doesn't ## replace them . ## - ## tag: The tag of the analyzer. + ## tag: The tag of the analyzer. ## - ## ports: The set of well-known ports to associate with the analyzer. + ## ports: The set of well-known ports to associate with the analyzer. ## - ## Returns: True if the ports were sucessfully registered. + ## Returns: True if the ports were sucessfully registered. global register_for_ports: function(tag: Analyzer::Tag, ports: set[port]) : bool; ## Registers an individual well-known port for an analyzer. If a future connection ## on this ports is seen, the analyzer will be automatically assigned to parsing - ## it. The function *adds* to all ports already registered, it doesn't - ## replace them . + ## it. The function *adds* to all ports already registered, it doesn't replace + ## them. ## - ## tag: The tag of the analyzer. + ## tag: The tag of the analyzer. ## - ## p: The well-known port to associate with the analyzer. + ## p: The well-known port to associate with the analyzer. ## ## Returns: True if the port was sucessfully registered. global register_for_port: function(tag: Analyzer::Tag, p: port) : bool; ## Returns a set of all well-known ports currently registered for a - ## specific analyzer. - ## - ## tag: The tag of the analyzer. + ## specific analyzer. + ## + ## tag: The tag of the analyzer. ## ## Returns: The set of ports. global registered_ports: function(tag: Analyzer::Tag) : set[port]; - ## Returns a table of all ports-to-analyzer mappings currently registered. - ## + ## Returns a table of all ports-to-analyzer mappings currently registered. + ## ## Returns: A table mapping each analyzer to the set of ports ## registered for it. - global all_registered_ports: function() : table[Analyzer::Tag] of set[port]; + global all_registered_ports: function() : table[Analyzer::Tag] of set[port]; - ## Translates an analyzer type to a string with the analyzer's. + ## Translates an analyzer type to a string with the analyzer's name. ## ## tag: The analyzer tag. ## - ## Returns: The analyzer name corresponding to the tag. + ## Returns: The analyzer name corresponding to the tag. global name: function(tag: Analyzer::Tag) : string; ## Schedules an analyzer for a future connection originating from a given IP - ## address and port. + ## address and port. ## - ## orig: The IP address originating a connection in the future. + ## orig: The IP address originating a connection in the future. ## 0.0.0.0 can be used as a wildcard to match any originator address. ## ## resp: The IP address responding to a connection from *orig*. @@ -99,8 +99,8 @@ export { global schedule_analyzer: function(orig: addr, resp: addr, resp_p: port, analyzer: Analyzer::Tag, tout: interval) : bool; - ## A set of analyzers to disable by at startup. The default set - ## contains legacy analyzers that are no longer supported. + ## A set of analyzers to disable by default at startup. The default set contains + ## legacy analyzers that are no longer supported. global disabled_analyzers: set[Analyzer::Tag] = { ANALYZER_INTERCONN, ANALYZER_STEPPINGSTONE, @@ -115,11 +115,11 @@ export { global ports: table[Analyzer::Tag] of set[port]; -event bro_init() &priority=-5 +event bro_init() &priority=5 { if ( disable_all ) __disable_all_analyzers(); - + for ( a in disabled_analyzers ) disable_analyzer(a); } @@ -137,8 +137,8 @@ function disable_analyzer(tag: Analyzer::Tag) : bool function register_for_ports(tag: Analyzer::Tag, ports: set[port]) : bool { local rc = T; - - for ( p in ports ) + + for ( p in ports ) { if ( ! register_for_port(tag, p) ) rc = F; @@ -154,7 +154,7 @@ function register_for_port(tag: Analyzer::Tag, p: port) : bool if ( tag !in ports ) ports[tag] = set(); - + add ports[tag][p]; return T; } diff --git a/scripts/base/frameworks/dpd/main.bro b/scripts/base/frameworks/dpd/main.bro index b4da2ff492..c3282a1da4 100644 --- a/scripts/base/frameworks/dpd/main.bro +++ b/scripts/base/frameworks/dpd/main.bro @@ -23,12 +23,12 @@ export { analyzer: string &log; ## The textual reason for the analysis failure. failure_reason: string &log; - - ## Disabled analyzer IDs. This is only for internal tracking + + ## Disabled analyzer IDs. This is only for internal tracking ## so as to not attempt to disable analyzers multiple times. disabled_aids: set[count]; }; - + ## Ignore violations which go this many bytes into the connection. ## Set to 0 to never ignore protocol violations. const ignore_violations_after = 10 * 1024 &redef; @@ -43,11 +43,6 @@ event bro_init() &priority=5 Log::create_stream(DPD::LOG, [$columns=Info]); } -function foo() : string - { - return "HTTP"; - } - event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count) &priority=10 { local analyzer = Analyzer::name(atype); @@ -66,10 +61,10 @@ event protocol_violation(c: connection, atype: Analyzer::Tag, aid: count, # for the protocol violation. if ( analyzer !in c$service ) return; - + delete c$service[analyzer]; add c$service[fmt("-%s", analyzer)]; - + local info: Info; info$ts=network_time(); info$uid=c$uid; @@ -88,7 +83,7 @@ event protocol_violation(c: connection, atype: Analyzer::Tag, aid: count, reason local size = c$orig$size + c$resp$size; if ( ignore_violations_after > 0 && size > ignore_violations_after ) return; - + # Disable the analyzer that raised the last core-generated event. disable_analyzer(c$id, aid); add c$dpd$disabled_aids[aid]; diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro index 09c08befa6..d5abbef1ff 100644 --- a/scripts/base/init-bare.bro +++ b/scripts/base/init-bare.bro @@ -2946,7 +2946,7 @@ const dpd_buffer_size = 1024 &redef; const dpd_match_only_beginning = T &redef; ## If true, don't consider any ports for deciding which protocol analyzer to -## use. +## use. ## ## .. bro:see:: dpd_reassemble_first_packets dpd_buffer_size ## dpd_match_only_beginning @@ -3065,12 +3065,12 @@ module GLOBAL; ## Number of bytes per packet to capture from live interfaces. const snaplen = 8192 &redef; -# Load these frameworks here because it uses fairly deep integration with +# Load these frameworks here because they use fairly deep integration with # BiFs and script-land defined types. @load base/frameworks/logging @load base/frameworks/input @load base/frameworks/analyzer @load base/frameworks/file-analysis -# Load BiF defined by plugins. +# Load BiFs defined by plugins. @load base/bif/plugins diff --git a/scripts/base/protocols/irc/dcc-send.bro b/scripts/base/protocols/irc/dcc-send.bro index f5dc72e9ce..0e1d52af59 100644 --- a/scripts/base/protocols/irc/dcc-send.bro +++ b/scripts/base/protocols/irc/dcc-send.bro @@ -175,7 +175,7 @@ event irc_dcc_message(c: connection, is_orig: bool, c$irc$dcc_file_name = argument; c$irc$dcc_file_size = size; local p = count_to_port(dest_port, tcp); - Analyzer::schedule_analyzer(to_addr("0.0.0.0"), address, p, Analyzer::ANALYZER_IRC_DATA, 5 min); + Analyzer::schedule_analyzer(0.0.0.0, address, p, Analyzer::ANALYZER_IRC_DATA, 5 min); dcc_expected_transfers[address, p] = c$irc; } diff --git a/src/Base64.cc b/src/Base64.cc index cef11dab92..50732534ab 100644 --- a/src/Base64.cc +++ b/src/Base64.cc @@ -82,8 +82,6 @@ int* Base64Converter::InitBase64Table(const string& alphabet) return base64_table; } - - Base64Converter::Base64Converter(analyzer::Analyzer* arg_analyzer, const string& arg_alphabet) { if ( arg_alphabet.size() > 0 ) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index 5573855740..0303a88cfe 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -375,6 +375,7 @@ install(TARGETS bro DESTINATION bin) set(BRO_EXE bro CACHE STRING "Bro executable binary" FORCE) +# Target to create all the autogenerated files. add_custom_target(generate_outputs DEPENDS ${bro_ALL_GENERATED_OUTPUTS}) # Build __load__.bro files for plugins/*.bif.bro. diff --git a/src/RuleAction.h b/src/RuleAction.h index ec7e5c3735..67ceadc6f1 100644 --- a/src/RuleAction.h +++ b/src/RuleAction.h @@ -50,8 +50,6 @@ public: analyzer::Tag ChildAnalyzer() const { return child_analyzer; } private: - // FIXME: This is in fact an analyzer::ID but we can't include "analyzer/Analyzer.h" - // at this point due to circular dependenides. Fix that! analyzer::Tag analyzer; analyzer::Tag child_analyzer; }; diff --git a/src/analyzer/Tag.h b/src/analyzer/Tag.h index 3465ddd008..9b2fea4a9b 100644 --- a/src/analyzer/Tag.h +++ b/src/analyzer/Tag.h @@ -14,7 +14,7 @@ class Manager; class Component; /** - * Class to identify an analyzdr type. + * Class to identify an analyzer type. * * Each analyzer type gets a tag consisting of a main type and subtype. The * former is an identifier that's unique all analyzer classes. The latter is diff --git a/src/analyzer/analyzer.bif b/src/analyzer/analyzer.bif index 69c648f7d3..7f3cc6ed94 100644 --- a/src/analyzer/analyzer.bif +++ b/src/analyzer/analyzer.bif @@ -1,4 +1,4 @@ -##! Internal functions and types used by the logging framework. +##! Internal functions and types used by the analyzer framework. module Analyzer; diff --git a/src/analyzer/protocol/arp/ARP.cc b/src/analyzer/protocol/arp/ARP.cc index 9173e853aa..b3ef5383ce 100644 --- a/src/analyzer/protocol/arp/ARP.cc +++ b/src/analyzer/protocol/arp/ARP.cc @@ -1,6 +1,5 @@ // See the file "COPYING" in the main distribution directory for copyright. - #include "ARP.h" #include "Event.h" #include "Reporter.h" diff --git a/src/plugin/Macros.h b/src/plugin/Macros.h index 64f04d7645..423efbfc71 100644 --- a/src/plugin/Macros.h +++ b/src/plugin/Macros.h @@ -16,8 +16,8 @@ #define BRO_PLUGIN_VERSION_BUILTIN -1 /** - * The current plugin API version. Plugins that won't match this versions - * will be rejected. + * The current plugin API version. Plugins that won't match this version will + * be rejected. */ #define BRO_PLUGIN_API_VERSION 1