mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
More smaller cleanup.
This commit is contained in:
parent
2fd0b36057
commit
c6ad731562
13 changed files with 50 additions and 65 deletions
|
@ -45,12 +45,6 @@ macro(REST_TARGET srcDir broInput)
|
||||||
|
|
||||||
set(sumTextSrc ${absSrcPath})
|
set(sumTextSrc ${absSrcPath})
|
||||||
set(ogSourceFile ${absSrcPath})
|
set(ogSourceFile ${absSrcPath})
|
||||||
if (${extension} STREQUAL ".bif.bro")
|
|
||||||
# set(ogSourceFile ${BIF_SRC_DIR}/${basename})
|
|
||||||
# the summary text is taken at configure time, but .bif.bro files
|
|
||||||
# may not have been generated yet, so read .bif file instead
|
|
||||||
set(sumTextSrc ${ogSourceFile})
|
|
||||||
endif ()
|
|
||||||
|
|
||||||
if (NOT relDstDir)
|
if (NOT relDstDir)
|
||||||
set(docName "${basename}")
|
set(docName "${basename}")
|
||||||
|
|
|
@ -58,7 +58,7 @@ global example_ports = {
|
||||||
event bro_init()
|
event bro_init()
|
||||||
{
|
{
|
||||||
# Registering a well-known port is self-documenting and
|
# Registering a well-known port is self-documenting and
|
||||||
# go into the generated doc's "Port Analysis" section
|
# goes into the generated doc's "Port Analysis" section.
|
||||||
Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, example_ports);
|
Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, example_ports);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -2,25 +2,25 @@
|
||||||
##!
|
##!
|
||||||
##! The analyzer framework allows to dynamically enable or disable analyzers, as
|
##! The analyzer framework allows to dynamically enable or disable analyzers, as
|
||||||
##! well as to manage the well-known ports which automatically active a particular
|
##! well as to manage the well-known ports which automatically active a particular
|
||||||
##! analyzer for new connections.
|
##! analyzer for new connections.
|
||||||
##!
|
##!
|
||||||
##! Protocol analyzers are identified by unique tags of type
|
##! Protocol analyzers are identified by unique tags of type
|
||||||
##! :bro:type:`Analyzer::Tag`, such as :bro:enum:`Analyzer::ANALYZER_HTTP` and
|
##! :bro:type:`Analyzer::Tag`, such as :bro:enum:`Analyzer::ANALYZER_HTTP` and
|
||||||
##! :bro:enum:`Analyzer::ANALYZER_HTTP`. These tags are defined internally by the
|
##! :bro:enum:`Analyzer::ANALYZER_HTTP`. These tags are defined internally by the
|
||||||
##! analyzers themselves, and documented in their analyzer-specific description along with the
|
##! analyzers themselves, and documented in their analyzer-specific description
|
||||||
##! events that they generate.
|
##! along with the events that they generate.
|
||||||
##!
|
##!
|
||||||
##! .. todo: ``The ANALYZER_*`` are in fact not yet documented, we need to add that
|
##! .. todo: ``The ANALYZER_*`` are in fact not yet documented, we need to add that
|
||||||
##! to Broxygen.
|
##! to Broxygen.
|
||||||
module Analyzer;
|
module Analyzer;
|
||||||
|
|
||||||
export {
|
export {
|
||||||
## If true, all available analyzers are initially disabled at startup. One can
|
## If true, all available analyzers are initially disabled at startup. One can
|
||||||
## then selectively enable them with :bro:id:`enable_analyzer`.
|
## then selectively enable them with :bro:id:`enable_analyzer`.
|
||||||
global disable_all = F &redef;
|
global disable_all = F &redef;
|
||||||
|
|
||||||
## Enables an analyzer. Once enabled, the analyzer may be used for analysis of
|
## Enables an analyzer. Once enabled, the analyzer may be used for analysis of
|
||||||
## future connections as decided by Bro's dynamic protocol detection.
|
## future connections as decided by Bro's dynamic protocol detection.
|
||||||
##
|
##
|
||||||
## tag: The tag of the analyzer to enable.
|
## tag: The tag of the analyzer to enable.
|
||||||
##
|
##
|
||||||
|
@ -28,11 +28,11 @@ export {
|
||||||
global enable_analyzer: function(tag: Analyzer::Tag) : bool;
|
global enable_analyzer: function(tag: Analyzer::Tag) : bool;
|
||||||
|
|
||||||
## Disables an analyzer. Once disabled, the analyzer will not be used
|
## Disables an analyzer. Once disabled, the analyzer will not be used
|
||||||
## further for analysis of future connections.
|
## further for analysis of future connections.
|
||||||
##
|
##
|
||||||
## tag: The tag of the analyzer to disable.
|
## tag: The tag of the analyzer to disable.
|
||||||
##
|
##
|
||||||
## Returns: True if the analyzer was successfully disabled.
|
## Returns: True if the analyzer was successfully disabled.
|
||||||
global disable_analyzer: function(tag: Analyzer::Tag) : bool;
|
global disable_analyzer: function(tag: Analyzer::Tag) : bool;
|
||||||
|
|
||||||
## Registers a set of well-known ports for an analyzer. If a future connection
|
## Registers a set of well-known ports for an analyzer. If a future connection
|
||||||
|
@ -40,50 +40,50 @@ export {
|
||||||
## to parsing it. The function *adds* to all ports already registered, it doesn't
|
## to parsing it. The function *adds* to all ports already registered, it doesn't
|
||||||
## replace them .
|
## replace them .
|
||||||
##
|
##
|
||||||
## tag: The tag of the analyzer.
|
## tag: The tag of the analyzer.
|
||||||
##
|
##
|
||||||
## ports: The set of well-known ports to associate with the analyzer.
|
## ports: The set of well-known ports to associate with the analyzer.
|
||||||
##
|
##
|
||||||
## Returns: True if the ports were sucessfully registered.
|
## Returns: True if the ports were sucessfully registered.
|
||||||
global register_for_ports: function(tag: Analyzer::Tag, ports: set[port]) : bool;
|
global register_for_ports: function(tag: Analyzer::Tag, ports: set[port]) : bool;
|
||||||
|
|
||||||
## Registers an individual well-known port for an analyzer. If a future connection
|
## Registers an individual well-known port for an analyzer. If a future connection
|
||||||
## on this ports is seen, the analyzer will be automatically assigned to parsing
|
## on this ports is seen, the analyzer will be automatically assigned to parsing
|
||||||
## it. The function *adds* to all ports already registered, it doesn't
|
## it. The function *adds* to all ports already registered, it doesn't replace
|
||||||
## replace them .
|
## them.
|
||||||
##
|
##
|
||||||
## tag: The tag of the analyzer.
|
## tag: The tag of the analyzer.
|
||||||
##
|
##
|
||||||
## p: The well-known port to associate with the analyzer.
|
## p: The well-known port to associate with the analyzer.
|
||||||
##
|
##
|
||||||
## Returns: True if the port was sucessfully registered.
|
## Returns: True if the port was sucessfully registered.
|
||||||
global register_for_port: function(tag: Analyzer::Tag, p: port) : bool;
|
global register_for_port: function(tag: Analyzer::Tag, p: port) : bool;
|
||||||
|
|
||||||
## Returns a set of all well-known ports currently registered for a
|
## Returns a set of all well-known ports currently registered for a
|
||||||
## specific analyzer.
|
## specific analyzer.
|
||||||
##
|
##
|
||||||
## tag: The tag of the analyzer.
|
## tag: The tag of the analyzer.
|
||||||
##
|
##
|
||||||
## Returns: The set of ports.
|
## Returns: The set of ports.
|
||||||
global registered_ports: function(tag: Analyzer::Tag) : set[port];
|
global registered_ports: function(tag: Analyzer::Tag) : set[port];
|
||||||
|
|
||||||
## Returns a table of all ports-to-analyzer mappings currently registered.
|
## Returns a table of all ports-to-analyzer mappings currently registered.
|
||||||
##
|
##
|
||||||
## Returns: A table mapping each analyzer to the set of ports
|
## Returns: A table mapping each analyzer to the set of ports
|
||||||
## registered for it.
|
## registered for it.
|
||||||
global all_registered_ports: function() : table[Analyzer::Tag] of set[port];
|
global all_registered_ports: function() : table[Analyzer::Tag] of set[port];
|
||||||
|
|
||||||
## Translates an analyzer type to a string with the analyzer's.
|
## Translates an analyzer type to a string with the analyzer's name.
|
||||||
##
|
##
|
||||||
## tag: The analyzer tag.
|
## tag: The analyzer tag.
|
||||||
##
|
##
|
||||||
## Returns: The analyzer name corresponding to the tag.
|
## Returns: The analyzer name corresponding to the tag.
|
||||||
global name: function(tag: Analyzer::Tag) : string;
|
global name: function(tag: Analyzer::Tag) : string;
|
||||||
|
|
||||||
## Schedules an analyzer for a future connection originating from a given IP
|
## Schedules an analyzer for a future connection originating from a given IP
|
||||||
## address and port.
|
## address and port.
|
||||||
##
|
##
|
||||||
## orig: The IP address originating a connection in the future.
|
## orig: The IP address originating a connection in the future.
|
||||||
## 0.0.0.0 can be used as a wildcard to match any originator address.
|
## 0.0.0.0 can be used as a wildcard to match any originator address.
|
||||||
##
|
##
|
||||||
## resp: The IP address responding to a connection from *orig*.
|
## resp: The IP address responding to a connection from *orig*.
|
||||||
|
@ -99,8 +99,8 @@ export {
|
||||||
global schedule_analyzer: function(orig: addr, resp: addr, resp_p: port,
|
global schedule_analyzer: function(orig: addr, resp: addr, resp_p: port,
|
||||||
analyzer: Analyzer::Tag, tout: interval) : bool;
|
analyzer: Analyzer::Tag, tout: interval) : bool;
|
||||||
|
|
||||||
## A set of analyzers to disable by at startup. The default set
|
## A set of analyzers to disable by default at startup. The default set contains
|
||||||
## contains legacy analyzers that are no longer supported.
|
## legacy analyzers that are no longer supported.
|
||||||
global disabled_analyzers: set[Analyzer::Tag] = {
|
global disabled_analyzers: set[Analyzer::Tag] = {
|
||||||
ANALYZER_INTERCONN,
|
ANALYZER_INTERCONN,
|
||||||
ANALYZER_STEPPINGSTONE,
|
ANALYZER_STEPPINGSTONE,
|
||||||
|
@ -115,11 +115,11 @@ export {
|
||||||
|
|
||||||
global ports: table[Analyzer::Tag] of set[port];
|
global ports: table[Analyzer::Tag] of set[port];
|
||||||
|
|
||||||
event bro_init() &priority=-5
|
event bro_init() &priority=5
|
||||||
{
|
{
|
||||||
if ( disable_all )
|
if ( disable_all )
|
||||||
__disable_all_analyzers();
|
__disable_all_analyzers();
|
||||||
|
|
||||||
for ( a in disabled_analyzers )
|
for ( a in disabled_analyzers )
|
||||||
disable_analyzer(a);
|
disable_analyzer(a);
|
||||||
}
|
}
|
||||||
|
@ -137,8 +137,8 @@ function disable_analyzer(tag: Analyzer::Tag) : bool
|
||||||
function register_for_ports(tag: Analyzer::Tag, ports: set[port]) : bool
|
function register_for_ports(tag: Analyzer::Tag, ports: set[port]) : bool
|
||||||
{
|
{
|
||||||
local rc = T;
|
local rc = T;
|
||||||
|
|
||||||
for ( p in ports )
|
for ( p in ports )
|
||||||
{
|
{
|
||||||
if ( ! register_for_port(tag, p) )
|
if ( ! register_for_port(tag, p) )
|
||||||
rc = F;
|
rc = F;
|
||||||
|
@ -154,7 +154,7 @@ function register_for_port(tag: Analyzer::Tag, p: port) : bool
|
||||||
|
|
||||||
if ( tag !in ports )
|
if ( tag !in ports )
|
||||||
ports[tag] = set();
|
ports[tag] = set();
|
||||||
|
|
||||||
add ports[tag][p];
|
add ports[tag][p];
|
||||||
return T;
|
return T;
|
||||||
}
|
}
|
||||||
|
|
|
@ -23,12 +23,12 @@ export {
|
||||||
analyzer: string &log;
|
analyzer: string &log;
|
||||||
## The textual reason for the analysis failure.
|
## The textual reason for the analysis failure.
|
||||||
failure_reason: string &log;
|
failure_reason: string &log;
|
||||||
|
|
||||||
## Disabled analyzer IDs. This is only for internal tracking
|
## Disabled analyzer IDs. This is only for internal tracking
|
||||||
## so as to not attempt to disable analyzers multiple times.
|
## so as to not attempt to disable analyzers multiple times.
|
||||||
disabled_aids: set[count];
|
disabled_aids: set[count];
|
||||||
};
|
};
|
||||||
|
|
||||||
## Ignore violations which go this many bytes into the connection.
|
## Ignore violations which go this many bytes into the connection.
|
||||||
## Set to 0 to never ignore protocol violations.
|
## Set to 0 to never ignore protocol violations.
|
||||||
const ignore_violations_after = 10 * 1024 &redef;
|
const ignore_violations_after = 10 * 1024 &redef;
|
||||||
|
@ -43,11 +43,6 @@ event bro_init() &priority=5
|
||||||
Log::create_stream(DPD::LOG, [$columns=Info]);
|
Log::create_stream(DPD::LOG, [$columns=Info]);
|
||||||
}
|
}
|
||||||
|
|
||||||
function foo() : string
|
|
||||||
{
|
|
||||||
return "HTTP";
|
|
||||||
}
|
|
||||||
|
|
||||||
event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count) &priority=10
|
event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count) &priority=10
|
||||||
{
|
{
|
||||||
local analyzer = Analyzer::name(atype);
|
local analyzer = Analyzer::name(atype);
|
||||||
|
@ -66,10 +61,10 @@ event protocol_violation(c: connection, atype: Analyzer::Tag, aid: count,
|
||||||
# for the protocol violation.
|
# for the protocol violation.
|
||||||
if ( analyzer !in c$service )
|
if ( analyzer !in c$service )
|
||||||
return;
|
return;
|
||||||
|
|
||||||
delete c$service[analyzer];
|
delete c$service[analyzer];
|
||||||
add c$service[fmt("-%s", analyzer)];
|
add c$service[fmt("-%s", analyzer)];
|
||||||
|
|
||||||
local info: Info;
|
local info: Info;
|
||||||
info$ts=network_time();
|
info$ts=network_time();
|
||||||
info$uid=c$uid;
|
info$uid=c$uid;
|
||||||
|
@ -88,7 +83,7 @@ event protocol_violation(c: connection, atype: Analyzer::Tag, aid: count, reason
|
||||||
local size = c$orig$size + c$resp$size;
|
local size = c$orig$size + c$resp$size;
|
||||||
if ( ignore_violations_after > 0 && size > ignore_violations_after )
|
if ( ignore_violations_after > 0 && size > ignore_violations_after )
|
||||||
return;
|
return;
|
||||||
|
|
||||||
# Disable the analyzer that raised the last core-generated event.
|
# Disable the analyzer that raised the last core-generated event.
|
||||||
disable_analyzer(c$id, aid);
|
disable_analyzer(c$id, aid);
|
||||||
add c$dpd$disabled_aids[aid];
|
add c$dpd$disabled_aids[aid];
|
||||||
|
|
|
@ -2946,7 +2946,7 @@ const dpd_buffer_size = 1024 &redef;
|
||||||
const dpd_match_only_beginning = T &redef;
|
const dpd_match_only_beginning = T &redef;
|
||||||
|
|
||||||
## If true, don't consider any ports for deciding which protocol analyzer to
|
## If true, don't consider any ports for deciding which protocol analyzer to
|
||||||
## use.
|
## use.
|
||||||
##
|
##
|
||||||
## .. bro:see:: dpd_reassemble_first_packets dpd_buffer_size
|
## .. bro:see:: dpd_reassemble_first_packets dpd_buffer_size
|
||||||
## dpd_match_only_beginning
|
## dpd_match_only_beginning
|
||||||
|
@ -3065,12 +3065,12 @@ module GLOBAL;
|
||||||
## Number of bytes per packet to capture from live interfaces.
|
## Number of bytes per packet to capture from live interfaces.
|
||||||
const snaplen = 8192 &redef;
|
const snaplen = 8192 &redef;
|
||||||
|
|
||||||
# Load these frameworks here because it uses fairly deep integration with
|
# Load these frameworks here because they use fairly deep integration with
|
||||||
# BiFs and script-land defined types.
|
# BiFs and script-land defined types.
|
||||||
@load base/frameworks/logging
|
@load base/frameworks/logging
|
||||||
@load base/frameworks/input
|
@load base/frameworks/input
|
||||||
@load base/frameworks/analyzer
|
@load base/frameworks/analyzer
|
||||||
@load base/frameworks/file-analysis
|
@load base/frameworks/file-analysis
|
||||||
|
|
||||||
# Load BiF defined by plugins.
|
# Load BiFs defined by plugins.
|
||||||
@load base/bif/plugins
|
@load base/bif/plugins
|
||||||
|
|
|
@ -175,7 +175,7 @@ event irc_dcc_message(c: connection, is_orig: bool,
|
||||||
c$irc$dcc_file_name = argument;
|
c$irc$dcc_file_name = argument;
|
||||||
c$irc$dcc_file_size = size;
|
c$irc$dcc_file_size = size;
|
||||||
local p = count_to_port(dest_port, tcp);
|
local p = count_to_port(dest_port, tcp);
|
||||||
Analyzer::schedule_analyzer(to_addr("0.0.0.0"), address, p, Analyzer::ANALYZER_IRC_DATA, 5 min);
|
Analyzer::schedule_analyzer(0.0.0.0, address, p, Analyzer::ANALYZER_IRC_DATA, 5 min);
|
||||||
dcc_expected_transfers[address, p] = c$irc;
|
dcc_expected_transfers[address, p] = c$irc;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -82,8 +82,6 @@ int* Base64Converter::InitBase64Table(const string& alphabet)
|
||||||
return base64_table;
|
return base64_table;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Base64Converter::Base64Converter(analyzer::Analyzer* arg_analyzer, const string& arg_alphabet)
|
Base64Converter::Base64Converter(analyzer::Analyzer* arg_analyzer, const string& arg_alphabet)
|
||||||
{
|
{
|
||||||
if ( arg_alphabet.size() > 0 )
|
if ( arg_alphabet.size() > 0 )
|
||||||
|
|
|
@ -375,6 +375,7 @@ install(TARGETS bro DESTINATION bin)
|
||||||
set(BRO_EXE bro
|
set(BRO_EXE bro
|
||||||
CACHE STRING "Bro executable binary" FORCE)
|
CACHE STRING "Bro executable binary" FORCE)
|
||||||
|
|
||||||
|
# Target to create all the autogenerated files.
|
||||||
add_custom_target(generate_outputs DEPENDS ${bro_ALL_GENERATED_OUTPUTS})
|
add_custom_target(generate_outputs DEPENDS ${bro_ALL_GENERATED_OUTPUTS})
|
||||||
|
|
||||||
# Build __load__.bro files for plugins/*.bif.bro.
|
# Build __load__.bro files for plugins/*.bif.bro.
|
||||||
|
|
|
@ -50,8 +50,6 @@ public:
|
||||||
analyzer::Tag ChildAnalyzer() const { return child_analyzer; }
|
analyzer::Tag ChildAnalyzer() const { return child_analyzer; }
|
||||||
|
|
||||||
private:
|
private:
|
||||||
// FIXME: This is in fact an analyzer::ID but we can't include "analyzer/Analyzer.h"
|
|
||||||
// at this point due to circular dependenides. Fix that!
|
|
||||||
analyzer::Tag analyzer;
|
analyzer::Tag analyzer;
|
||||||
analyzer::Tag child_analyzer;
|
analyzer::Tag child_analyzer;
|
||||||
};
|
};
|
||||||
|
|
|
@ -14,7 +14,7 @@ class Manager;
|
||||||
class Component;
|
class Component;
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Class to identify an analyzdr type.
|
* Class to identify an analyzer type.
|
||||||
*
|
*
|
||||||
* Each analyzer type gets a tag consisting of a main type and subtype. The
|
* Each analyzer type gets a tag consisting of a main type and subtype. The
|
||||||
* former is an identifier that's unique all analyzer classes. The latter is
|
* former is an identifier that's unique all analyzer classes. The latter is
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
##! Internal functions and types used by the logging framework.
|
##! Internal functions and types used by the analyzer framework.
|
||||||
|
|
||||||
module Analyzer;
|
module Analyzer;
|
||||||
|
|
||||||
|
|
|
@ -1,6 +1,5 @@
|
||||||
// See the file "COPYING" in the main distribution directory for copyright.
|
// See the file "COPYING" in the main distribution directory for copyright.
|
||||||
|
|
||||||
|
|
||||||
#include "ARP.h"
|
#include "ARP.h"
|
||||||
#include "Event.h"
|
#include "Event.h"
|
||||||
#include "Reporter.h"
|
#include "Reporter.h"
|
||||||
|
|
|
@ -16,8 +16,8 @@
|
||||||
#define BRO_PLUGIN_VERSION_BUILTIN -1
|
#define BRO_PLUGIN_VERSION_BUILTIN -1
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* The current plugin API version. Plugins that won't match this versions
|
* The current plugin API version. Plugins that won't match this version will
|
||||||
* will be rejected.
|
* be rejected.
|
||||||
*/
|
*/
|
||||||
#define BRO_PLUGIN_API_VERSION 1
|
#define BRO_PLUGIN_API_VERSION 1
|
||||||
|
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue