More smaller cleanup.

This commit is contained in:
Robin Sommer 2013-06-02 17:54:43 -07:00
parent 2fd0b36057
commit c6ad731562
13 changed files with 50 additions and 65 deletions

View file

@ -45,12 +45,6 @@ macro(REST_TARGET srcDir broInput)
set(sumTextSrc ${absSrcPath}) set(sumTextSrc ${absSrcPath})
set(ogSourceFile ${absSrcPath}) set(ogSourceFile ${absSrcPath})
if (${extension} STREQUAL ".bif.bro")
# set(ogSourceFile ${BIF_SRC_DIR}/${basename})
# the summary text is taken at configure time, but .bif.bro files
# may not have been generated yet, so read .bif file instead
set(sumTextSrc ${ogSourceFile})
endif ()
if (NOT relDstDir) if (NOT relDstDir)
set(docName "${basename}") set(docName "${basename}")

View file

@ -58,7 +58,7 @@ global example_ports = {
event bro_init() event bro_init()
{ {
# Registering a well-known port is self-documenting and # Registering a well-known port is self-documenting and
# go into the generated doc's "Port Analysis" section # goes into the generated doc's "Port Analysis" section.
Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, example_ports); Analyzer::register_for_ports(Analyzer::ANALYZER_SSL, example_ports);
} }

View file

@ -2,25 +2,25 @@
##! ##!
##! The analyzer framework allows to dynamically enable or disable analyzers, as ##! The analyzer framework allows to dynamically enable or disable analyzers, as
##! well as to manage the well-known ports which automatically active a particular ##! well as to manage the well-known ports which automatically active a particular
##! analyzer for new connections. ##! analyzer for new connections.
##! ##!
##! Protocol analyzers are identified by unique tags of type ##! Protocol analyzers are identified by unique tags of type
##! :bro:type:`Analyzer::Tag`, such as :bro:enum:`Analyzer::ANALYZER_HTTP` and ##! :bro:type:`Analyzer::Tag`, such as :bro:enum:`Analyzer::ANALYZER_HTTP` and
##! :bro:enum:`Analyzer::ANALYZER_HTTP`. These tags are defined internally by the ##! :bro:enum:`Analyzer::ANALYZER_HTTP`. These tags are defined internally by the
##! analyzers themselves, and documented in their analyzer-specific description along with the ##! analyzers themselves, and documented in their analyzer-specific description
##! events that they generate. ##! along with the events that they generate.
##! ##!
##! .. todo: ``The ANALYZER_*`` are in fact not yet documented, we need to add that ##! .. todo: ``The ANALYZER_*`` are in fact not yet documented, we need to add that
##! to Broxygen. ##! to Broxygen.
module Analyzer; module Analyzer;
export { export {
## If true, all available analyzers are initially disabled at startup. One can ## If true, all available analyzers are initially disabled at startup. One can
## then selectively enable them with :bro:id:`enable_analyzer`. ## then selectively enable them with :bro:id:`enable_analyzer`.
global disable_all = F &redef; global disable_all = F &redef;
## Enables an analyzer. Once enabled, the analyzer may be used for analysis of ## Enables an analyzer. Once enabled, the analyzer may be used for analysis of
## future connections as decided by Bro's dynamic protocol detection. ## future connections as decided by Bro's dynamic protocol detection.
## ##
## tag: The tag of the analyzer to enable. ## tag: The tag of the analyzer to enable.
## ##
@ -28,11 +28,11 @@ export {
global enable_analyzer: function(tag: Analyzer::Tag) : bool; global enable_analyzer: function(tag: Analyzer::Tag) : bool;
## Disables an analyzer. Once disabled, the analyzer will not be used ## Disables an analyzer. Once disabled, the analyzer will not be used
## further for analysis of future connections. ## further for analysis of future connections.
## ##
## tag: The tag of the analyzer to disable. ## tag: The tag of the analyzer to disable.
## ##
## Returns: True if the analyzer was successfully disabled. ## Returns: True if the analyzer was successfully disabled.
global disable_analyzer: function(tag: Analyzer::Tag) : bool; global disable_analyzer: function(tag: Analyzer::Tag) : bool;
## Registers a set of well-known ports for an analyzer. If a future connection ## Registers a set of well-known ports for an analyzer. If a future connection
@ -40,50 +40,50 @@ export {
## to parsing it. The function *adds* to all ports already registered, it doesn't ## to parsing it. The function *adds* to all ports already registered, it doesn't
## replace them . ## replace them .
## ##
## tag: The tag of the analyzer. ## tag: The tag of the analyzer.
## ##
## ports: The set of well-known ports to associate with the analyzer. ## ports: The set of well-known ports to associate with the analyzer.
## ##
## Returns: True if the ports were sucessfully registered. ## Returns: True if the ports were sucessfully registered.
global register_for_ports: function(tag: Analyzer::Tag, ports: set[port]) : bool; global register_for_ports: function(tag: Analyzer::Tag, ports: set[port]) : bool;
## Registers an individual well-known port for an analyzer. If a future connection ## Registers an individual well-known port for an analyzer. If a future connection
## on this ports is seen, the analyzer will be automatically assigned to parsing ## on this ports is seen, the analyzer will be automatically assigned to parsing
## it. The function *adds* to all ports already registered, it doesn't ## it. The function *adds* to all ports already registered, it doesn't replace
## replace them . ## them.
## ##
## tag: The tag of the analyzer. ## tag: The tag of the analyzer.
## ##
## p: The well-known port to associate with the analyzer. ## p: The well-known port to associate with the analyzer.
## ##
## Returns: True if the port was sucessfully registered. ## Returns: True if the port was sucessfully registered.
global register_for_port: function(tag: Analyzer::Tag, p: port) : bool; global register_for_port: function(tag: Analyzer::Tag, p: port) : bool;
## Returns a set of all well-known ports currently registered for a ## Returns a set of all well-known ports currently registered for a
## specific analyzer. ## specific analyzer.
## ##
## tag: The tag of the analyzer. ## tag: The tag of the analyzer.
## ##
## Returns: The set of ports. ## Returns: The set of ports.
global registered_ports: function(tag: Analyzer::Tag) : set[port]; global registered_ports: function(tag: Analyzer::Tag) : set[port];
## Returns a table of all ports-to-analyzer mappings currently registered. ## Returns a table of all ports-to-analyzer mappings currently registered.
## ##
## Returns: A table mapping each analyzer to the set of ports ## Returns: A table mapping each analyzer to the set of ports
## registered for it. ## registered for it.
global all_registered_ports: function() : table[Analyzer::Tag] of set[port]; global all_registered_ports: function() : table[Analyzer::Tag] of set[port];
## Translates an analyzer type to a string with the analyzer's. ## Translates an analyzer type to a string with the analyzer's name.
## ##
## tag: The analyzer tag. ## tag: The analyzer tag.
## ##
## Returns: The analyzer name corresponding to the tag. ## Returns: The analyzer name corresponding to the tag.
global name: function(tag: Analyzer::Tag) : string; global name: function(tag: Analyzer::Tag) : string;
## Schedules an analyzer for a future connection originating from a given IP ## Schedules an analyzer for a future connection originating from a given IP
## address and port. ## address and port.
## ##
## orig: The IP address originating a connection in the future. ## orig: The IP address originating a connection in the future.
## 0.0.0.0 can be used as a wildcard to match any originator address. ## 0.0.0.0 can be used as a wildcard to match any originator address.
## ##
## resp: The IP address responding to a connection from *orig*. ## resp: The IP address responding to a connection from *orig*.
@ -99,8 +99,8 @@ export {
global schedule_analyzer: function(orig: addr, resp: addr, resp_p: port, global schedule_analyzer: function(orig: addr, resp: addr, resp_p: port,
analyzer: Analyzer::Tag, tout: interval) : bool; analyzer: Analyzer::Tag, tout: interval) : bool;
## A set of analyzers to disable by at startup. The default set ## A set of analyzers to disable by default at startup. The default set contains
## contains legacy analyzers that are no longer supported. ## legacy analyzers that are no longer supported.
global disabled_analyzers: set[Analyzer::Tag] = { global disabled_analyzers: set[Analyzer::Tag] = {
ANALYZER_INTERCONN, ANALYZER_INTERCONN,
ANALYZER_STEPPINGSTONE, ANALYZER_STEPPINGSTONE,
@ -115,11 +115,11 @@ export {
global ports: table[Analyzer::Tag] of set[port]; global ports: table[Analyzer::Tag] of set[port];
event bro_init() &priority=-5 event bro_init() &priority=5
{ {
if ( disable_all ) if ( disable_all )
__disable_all_analyzers(); __disable_all_analyzers();
for ( a in disabled_analyzers ) for ( a in disabled_analyzers )
disable_analyzer(a); disable_analyzer(a);
} }
@ -137,8 +137,8 @@ function disable_analyzer(tag: Analyzer::Tag) : bool
function register_for_ports(tag: Analyzer::Tag, ports: set[port]) : bool function register_for_ports(tag: Analyzer::Tag, ports: set[port]) : bool
{ {
local rc = T; local rc = T;
for ( p in ports ) for ( p in ports )
{ {
if ( ! register_for_port(tag, p) ) if ( ! register_for_port(tag, p) )
rc = F; rc = F;
@ -154,7 +154,7 @@ function register_for_port(tag: Analyzer::Tag, p: port) : bool
if ( tag !in ports ) if ( tag !in ports )
ports[tag] = set(); ports[tag] = set();
add ports[tag][p]; add ports[tag][p];
return T; return T;
} }

View file

@ -23,12 +23,12 @@ export {
analyzer: string &log; analyzer: string &log;
## The textual reason for the analysis failure. ## The textual reason for the analysis failure.
failure_reason: string &log; failure_reason: string &log;
## Disabled analyzer IDs. This is only for internal tracking ## Disabled analyzer IDs. This is only for internal tracking
## so as to not attempt to disable analyzers multiple times. ## so as to not attempt to disable analyzers multiple times.
disabled_aids: set[count]; disabled_aids: set[count];
}; };
## Ignore violations which go this many bytes into the connection. ## Ignore violations which go this many bytes into the connection.
## Set to 0 to never ignore protocol violations. ## Set to 0 to never ignore protocol violations.
const ignore_violations_after = 10 * 1024 &redef; const ignore_violations_after = 10 * 1024 &redef;
@ -43,11 +43,6 @@ event bro_init() &priority=5
Log::create_stream(DPD::LOG, [$columns=Info]); Log::create_stream(DPD::LOG, [$columns=Info]);
} }
function foo() : string
{
return "HTTP";
}
event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count) &priority=10 event protocol_confirmation(c: connection, atype: Analyzer::Tag, aid: count) &priority=10
{ {
local analyzer = Analyzer::name(atype); local analyzer = Analyzer::name(atype);
@ -66,10 +61,10 @@ event protocol_violation(c: connection, atype: Analyzer::Tag, aid: count,
# for the protocol violation. # for the protocol violation.
if ( analyzer !in c$service ) if ( analyzer !in c$service )
return; return;
delete c$service[analyzer]; delete c$service[analyzer];
add c$service[fmt("-%s", analyzer)]; add c$service[fmt("-%s", analyzer)];
local info: Info; local info: Info;
info$ts=network_time(); info$ts=network_time();
info$uid=c$uid; info$uid=c$uid;
@ -88,7 +83,7 @@ event protocol_violation(c: connection, atype: Analyzer::Tag, aid: count, reason
local size = c$orig$size + c$resp$size; local size = c$orig$size + c$resp$size;
if ( ignore_violations_after > 0 && size > ignore_violations_after ) if ( ignore_violations_after > 0 && size > ignore_violations_after )
return; return;
# Disable the analyzer that raised the last core-generated event. # Disable the analyzer that raised the last core-generated event.
disable_analyzer(c$id, aid); disable_analyzer(c$id, aid);
add c$dpd$disabled_aids[aid]; add c$dpd$disabled_aids[aid];

View file

@ -2946,7 +2946,7 @@ const dpd_buffer_size = 1024 &redef;
const dpd_match_only_beginning = T &redef; const dpd_match_only_beginning = T &redef;
## If true, don't consider any ports for deciding which protocol analyzer to ## If true, don't consider any ports for deciding which protocol analyzer to
## use. ## use.
## ##
## .. bro:see:: dpd_reassemble_first_packets dpd_buffer_size ## .. bro:see:: dpd_reassemble_first_packets dpd_buffer_size
## dpd_match_only_beginning ## dpd_match_only_beginning
@ -3065,12 +3065,12 @@ module GLOBAL;
## Number of bytes per packet to capture from live interfaces. ## Number of bytes per packet to capture from live interfaces.
const snaplen = 8192 &redef; const snaplen = 8192 &redef;
# Load these frameworks here because it uses fairly deep integration with # Load these frameworks here because they use fairly deep integration with
# BiFs and script-land defined types. # BiFs and script-land defined types.
@load base/frameworks/logging @load base/frameworks/logging
@load base/frameworks/input @load base/frameworks/input
@load base/frameworks/analyzer @load base/frameworks/analyzer
@load base/frameworks/file-analysis @load base/frameworks/file-analysis
# Load BiF defined by plugins. # Load BiFs defined by plugins.
@load base/bif/plugins @load base/bif/plugins

View file

@ -175,7 +175,7 @@ event irc_dcc_message(c: connection, is_orig: bool,
c$irc$dcc_file_name = argument; c$irc$dcc_file_name = argument;
c$irc$dcc_file_size = size; c$irc$dcc_file_size = size;
local p = count_to_port(dest_port, tcp); local p = count_to_port(dest_port, tcp);
Analyzer::schedule_analyzer(to_addr("0.0.0.0"), address, p, Analyzer::ANALYZER_IRC_DATA, 5 min); Analyzer::schedule_analyzer(0.0.0.0, address, p, Analyzer::ANALYZER_IRC_DATA, 5 min);
dcc_expected_transfers[address, p] = c$irc; dcc_expected_transfers[address, p] = c$irc;
} }

View file

@ -82,8 +82,6 @@ int* Base64Converter::InitBase64Table(const string& alphabet)
return base64_table; return base64_table;
} }
Base64Converter::Base64Converter(analyzer::Analyzer* arg_analyzer, const string& arg_alphabet) Base64Converter::Base64Converter(analyzer::Analyzer* arg_analyzer, const string& arg_alphabet)
{ {
if ( arg_alphabet.size() > 0 ) if ( arg_alphabet.size() > 0 )

View file

@ -375,6 +375,7 @@ install(TARGETS bro DESTINATION bin)
set(BRO_EXE bro set(BRO_EXE bro
CACHE STRING "Bro executable binary" FORCE) CACHE STRING "Bro executable binary" FORCE)
# Target to create all the autogenerated files.
add_custom_target(generate_outputs DEPENDS ${bro_ALL_GENERATED_OUTPUTS}) add_custom_target(generate_outputs DEPENDS ${bro_ALL_GENERATED_OUTPUTS})
# Build __load__.bro files for plugins/*.bif.bro. # Build __load__.bro files for plugins/*.bif.bro.

View file

@ -50,8 +50,6 @@ public:
analyzer::Tag ChildAnalyzer() const { return child_analyzer; } analyzer::Tag ChildAnalyzer() const { return child_analyzer; }
private: private:
// FIXME: This is in fact an analyzer::ID but we can't include "analyzer/Analyzer.h"
// at this point due to circular dependenides. Fix that!
analyzer::Tag analyzer; analyzer::Tag analyzer;
analyzer::Tag child_analyzer; analyzer::Tag child_analyzer;
}; };

View file

@ -14,7 +14,7 @@ class Manager;
class Component; class Component;
/** /**
* Class to identify an analyzdr type. * Class to identify an analyzer type.
* *
* Each analyzer type gets a tag consisting of a main type and subtype. The * Each analyzer type gets a tag consisting of a main type and subtype. The
* former is an identifier that's unique all analyzer classes. The latter is * former is an identifier that's unique all analyzer classes. The latter is

View file

@ -1,4 +1,4 @@
##! Internal functions and types used by the logging framework. ##! Internal functions and types used by the analyzer framework.
module Analyzer; module Analyzer;

View file

@ -1,6 +1,5 @@
// See the file "COPYING" in the main distribution directory for copyright. // See the file "COPYING" in the main distribution directory for copyright.
#include "ARP.h" #include "ARP.h"
#include "Event.h" #include "Event.h"
#include "Reporter.h" #include "Reporter.h"

View file

@ -16,8 +16,8 @@
#define BRO_PLUGIN_VERSION_BUILTIN -1 #define BRO_PLUGIN_VERSION_BUILTIN -1
/** /**
* The current plugin API version. Plugins that won't match this versions * The current plugin API version. Plugins that won't match this version will
* will be rejected. * be rejected.
*/ */
#define BRO_PLUGIN_API_VERSION 1 #define BRO_PLUGIN_API_VERSION 1