Promote libz and libmagic to required dependencies.

This commit is contained in:
Jon Siwek 2011-11-11 12:39:00 -06:00
parent 151664bc26
commit d750c3ba74
20 changed files with 26 additions and 114 deletions

View file

@ -53,6 +53,8 @@ FindRequiredPackage(BISON)
FindRequiredPackage(PCAP) FindRequiredPackage(PCAP)
FindRequiredPackage(OpenSSL) FindRequiredPackage(OpenSSL)
FindRequiredPackage(BIND) FindRequiredPackage(BIND)
FindRequiredPackage(LibMagic)
FindRequiredPackage(ZLIB)
if (NOT BinPAC_ROOT_DIR AND if (NOT BinPAC_ROOT_DIR AND
EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/aux/binpac/CMakeLists.txt) EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/aux/binpac/CMakeLists.txt)
@ -72,26 +74,12 @@ include_directories(BEFORE
${OpenSSL_INCLUDE_DIR} ${OpenSSL_INCLUDE_DIR}
${BIND_INCLUDE_DIR} ${BIND_INCLUDE_DIR}
${BinPAC_INCLUDE_DIR} ${BinPAC_INCLUDE_DIR}
${LibMagic_INCLUDE_DIR}
${ZLIB_INCLUDE_DIR}
) )
# Optional Dependencies # Optional Dependencies
set(HAVE_LIBMAGIC false)
find_package(LibMagic)
if (LIBMAGIC_FOUND)
set(HAVE_LIBMAGIC true)
include_directories(BEFORE ${LibMagic_INCLUDE_DIR})
list(APPEND OPTLIBS ${LibMagic_LIBRARY})
endif ()
set(HAVE_LIBZ false)
find_package(ZLIB)
if (ZLIB_FOUND)
set(HAVE_LIBZ true)
include_directories(BEFORE ${ZLIB_INCLUDE_DIR})
list(APPEND OPTLIBS ${ZLIB_LIBRARY})
endif ()
set(USE_GEOIP false) set(USE_GEOIP false)
find_package(LibGeoIP) find_package(LibGeoIP)
if (LIBGEOIP_FOUND) if (LIBGEOIP_FOUND)
@ -110,6 +98,16 @@ if (ENABLE_PERFTOOLS)
endif () endif ()
endif () endif ()
set(brodeps
${BinPAC_LIBRARY}
${PCAP_LIBRARY}
${OpenSSL_LIBRARIES}
${BIND_LIBRARY}
${LibMagic_LIBRARY}
${ZLIB_LIBRARY}
${OPTLIBS}
)
######################################################################## ########################################################################
## System Introspection ## System Introspection
@ -184,8 +182,6 @@ message(
"\nAux. Tools: ${INSTALL_AUX_TOOLS}" "\nAux. Tools: ${INSTALL_AUX_TOOLS}"
"\n" "\n"
"\nGeoIP: ${USE_GEOIP}" "\nGeoIP: ${USE_GEOIP}"
"\nlibz: ${HAVE_LIBZ}"
"\nlibmagic: ${HAVE_LIBMAGIC}"
"\nGoogle perftools: ${USE_PERFTOOLS}" "\nGoogle perftools: ${USE_PERFTOOLS}"
"\n" "\n"
"\n================================================================\n" "\n================================================================\n"

10
INSTALL
View file

@ -14,16 +14,15 @@ before you begin:
* OpenSSL (headers and libraries) http://www.openssl.org * OpenSSL (headers and libraries) http://www.openssl.org
Bro can make uses of some optional libraries if they are found at
installation time:
* Libmagic For identifying file types (e.g., in FTP transfers). * Libmagic For identifying file types (e.g., in FTP transfers).
* LibGeoIP For geo-locating IP addresses.
* Libz For decompressing HTTP bodies by the HTTP analyzer, and for * Libz For decompressing HTTP bodies by the HTTP analyzer, and for
compressed Bro-to-Bro communication. compressed Bro-to-Bro communication.
Bro can make uses of some optional libraries if they are found at
installation time:
* LibGeoIP For geo-locating IP addresses.
Bro also needs the following tools, but on most systems they will Bro also needs the following tools, but on most systems they will
already come preinstalled: already come preinstalled:
@ -33,7 +32,6 @@ already come preinstalled:
* Flex (Fast Lexical Analyzer) * Flex (Fast Lexical Analyzer)
* Perl (Used only during the Bro build process) * Perl (Used only during the Bro build process)
Installation Installation
============ ============

View file

@ -14,12 +14,6 @@
/* Define if you have the `getopt_long' function. */ /* Define if you have the `getopt_long' function. */
#cmakedefine HAVE_GETOPT_LONG #cmakedefine HAVE_GETOPT_LONG
/* Define if you have the `magic' library (-lmagic). */
#cmakedefine HAVE_LIBMAGIC
/* Define if you have the `z' library (-lz). */
#cmakedefine HAVE_LIBZ
/* We are on a Linux system */ /* We are on a Linux system */
#cmakedefine HAVE_LINUX #cmakedefine HAVE_LINUX

View file

@ -60,13 +60,13 @@ Required Dependencies
.. console:: .. console::
> sudo yum install cmake make gcc gcc-c++ flex bison libpcap-devel openssl-devel python-devel swig > sudo yum install cmake make gcc gcc-c++ flex bison libpcap-devel openssl-devel python-devel swig zlib-devel file-devel
* DEB/Debian-based Linux: * DEB/Debian-based Linux:
.. console:: .. console::
> sudo apt-get install cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig > sudo apt-get install cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig zlib1g-dev libmagic-dev
* FreeBSD * FreeBSD
@ -94,21 +94,20 @@ Required Dependencies
Optional Dependencies Optional Dependencies
~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~
Bro can use libmagic for identifying file types, libGeoIP for geo-locating Bro can use libGeoIP for geo-locating IP addresses and sendmail for
IP addresses, libz for (de)compression during analysis and communication, sending emails.
and sendmail for sending emails.
* RPM/RedHat-based Linux: * RPM/RedHat-based Linux:
.. console:: .. console::
> sudo yum install zlib-devel file-devel GeoIP-devel sendmail > sudo yum install GeoIP-devel sendmail
* DEB/Debian-based Linux: * DEB/Debian-based Linux:
.. console:: .. console::
> sudo apt-get install zlib1g-dev libmagic-dev libgeoip-dev sendmail > sudo apt-get install libgeoip-dev sendmail
* Ports-based FreeBSD * Ports-based FreeBSD
@ -116,7 +115,7 @@ and sendmail for sending emails.
> sudo pkg_add -r GeoIP > sudo pkg_add -r GeoIP
libz, libmagic, and sendmail are typically already available. sendmail is typically already available.
* Mac OS X * Mac OS X

View file

@ -419,15 +419,7 @@ add_definitions(-DBRO_BUILD_PATH="${CMAKE_CURRENT_BINARY_DIR}")
add_executable(bro ${bro_SRCS} ${bro_HEADERS}) add_executable(bro ${bro_SRCS} ${bro_HEADERS})
set(brolibs target_link_libraries(bro ${brodeps})
${BinPAC_LIBRARY}
${PCAP_LIBRARY}
${OpenSSL_LIBRARIES}
${BIND_LIBRARY}
${OPTLIBS}
)
target_link_libraries(bro ${brolibs})
install(TARGETS bro DESTINATION bin) install(TARGETS bro DESTINATION bin)
install(FILES ${INSTALL_BIF_OUTPUTS} DESTINATION ${BRO_SCRIPT_INSTALL_PATH}/base) install(FILES ${INSTALL_BIF_OUTPUTS} DESTINATION ${BRO_SCRIPT_INSTALL_PATH}/base)

View file

@ -1170,8 +1170,6 @@ void ChunkedIOSSL::Stats(char* buffer, int length)
ChunkedIO::Stats(buffer + i, length - i); ChunkedIO::Stats(buffer + i, length - i);
} }
#ifdef HAVE_LIBZ
bool CompressedChunkedIO::Init() bool CompressedChunkedIO::Init()
{ {
zin.zalloc = 0; zin.zalloc = 0;
@ -1348,5 +1346,3 @@ void CompressedChunkedIO::Stats(char* buffer, int length)
io->Stats(buffer + i, length - i); io->Stats(buffer + i, length - i);
buffer[length-1] = '\0'; buffer[length-1] = '\0';
} }
#endif /* HAVE_LIBZ */

View file

@ -287,8 +287,6 @@ private:
static SSL_CTX* ctx; static SSL_CTX* ctx;
}; };
#ifdef HAVE_LIBZ
#include <zlib.h> #include <zlib.h>
// Wrapper class around a another ChunkedIO which the (un-)compresses data. // Wrapper class around a another ChunkedIO which the (un-)compresses data.
@ -335,6 +333,4 @@ protected:
unsigned long uncompressed_bytes_written; unsigned long uncompressed_bytes_written;
}; };
#endif /* HAVE_LIBZ */
#endif #endif

View file

@ -3,23 +3,19 @@
#include "FileAnalyzer.h" #include "FileAnalyzer.h"
#include "Reporter.h" #include "Reporter.h"
#ifdef HAVE_LIBMAGIC
magic_t File_Analyzer::magic = 0; magic_t File_Analyzer::magic = 0;
magic_t File_Analyzer::magic_mime = 0; magic_t File_Analyzer::magic_mime = 0;
#endif
File_Analyzer::File_Analyzer(Connection* conn) File_Analyzer::File_Analyzer(Connection* conn)
: TCP_ApplicationAnalyzer(AnalyzerTag::File, conn) : TCP_ApplicationAnalyzer(AnalyzerTag::File, conn)
{ {
buffer_len = 0; buffer_len = 0;
#ifdef HAVE_LIBMAGIC
if ( ! magic ) if ( ! magic )
{ {
InitMagic(&magic, MAGIC_NONE); InitMagic(&magic, MAGIC_NONE);
InitMagic(&magic_mime, MAGIC_MIME); InitMagic(&magic_mime, MAGIC_MIME);
} }
#endif
} }
void File_Analyzer::DeliverStream(int len, const u_char* data, bool orig) void File_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
@ -52,13 +48,11 @@ void File_Analyzer::Identify()
const char* descr = 0; const char* descr = 0;
const char* mime = 0; const char* mime = 0;
#ifdef HAVE_LIBMAGIC
if ( magic ) if ( magic )
descr = magic_buffer(magic, buffer, buffer_len); descr = magic_buffer(magic, buffer, buffer_len);
if ( magic_mime ) if ( magic_mime )
mime = magic_buffer(magic_mime, buffer, buffer_len); mime = magic_buffer(magic_mime, buffer, buffer_len);
#endif
val_list* vl = new val_list; val_list* vl = new val_list;
vl->append(BuildConnVal()); vl->append(BuildConnVal());
@ -68,7 +62,6 @@ void File_Analyzer::Identify()
ConnectionEvent(file_transferred, vl); ConnectionEvent(file_transferred, vl);
} }
#ifdef HAVE_LIBMAGIC
void File_Analyzer::InitMagic(magic_t* magic, int flags) void File_Analyzer::InitMagic(magic_t* magic, int flags)
{ {
*magic = magic_open(flags); *magic = magic_open(flags);
@ -83,4 +76,3 @@ void File_Analyzer::InitMagic(magic_t* magic, int flags)
*magic = 0; *magic = 0;
} }
} }
#endif

View file

@ -5,9 +5,7 @@
#include "TCP.h" #include "TCP.h"
#ifdef HAVE_LIBMAGIC
#include <magic.h> #include <magic.h>
#endif
class File_Analyzer : public TCP_ApplicationAnalyzer { class File_Analyzer : public TCP_ApplicationAnalyzer {
public: public:
@ -31,12 +29,10 @@ protected:
char buffer[BUFFER_SIZE]; char buffer[BUFFER_SIZE];
int buffer_len; int buffer_len;
#ifdef HAVE_LIBMAGIC
static void InitMagic(magic_t* magic, int flags); static void InitMagic(magic_t* magic, int flags);
static magic_t magic; static magic_t magic;
static magic_t magic_mime; static magic_t magic_mime;
#endif
}; };
#endif #endif

View file

@ -43,9 +43,7 @@ HTTP_Entity::HTTP_Entity(HTTP_Message *arg_message, MIME_Entity* parent_entity,
header_length = 0; header_length = 0;
deliver_body = (http_entity_data != 0); deliver_body = (http_entity_data != 0);
encoding = IDENTITY; encoding = IDENTITY;
#ifdef HAVE_LIBZ
zip = 0; zip = 0;
#endif
} }
void HTTP_Entity::EndOfData() void HTTP_Entity::EndOfData()
@ -53,7 +51,6 @@ void HTTP_Entity::EndOfData()
if ( DEBUG_http ) if ( DEBUG_http )
DEBUG_MSG("%.6f: end of data\n", network_time); DEBUG_MSG("%.6f: end of data\n", network_time);
#ifdef HAVE_LIBZ
if ( zip ) if ( zip )
{ {
zip->Done(); zip->Done();
@ -61,7 +58,6 @@ void HTTP_Entity::EndOfData()
zip = 0; zip = 0;
encoding = IDENTITY; encoding = IDENTITY;
} }
#endif
if ( body_length ) if ( body_length )
http_message->MyHTTP_Analyzer()-> http_message->MyHTTP_Analyzer()->
@ -179,7 +175,6 @@ private:
void HTTP_Entity::DeliverBody(int len, const char* data, int trailing_CRLF) void HTTP_Entity::DeliverBody(int len, const char* data, int trailing_CRLF)
{ {
#ifdef HAVE_LIBZ
if ( encoding == GZIP || encoding == DEFLATE ) if ( encoding == GZIP || encoding == DEFLATE )
{ {
ZIP_Analyzer::Method method = ZIP_Analyzer::Method method =
@ -198,7 +193,6 @@ void HTTP_Entity::DeliverBody(int len, const char* data, int trailing_CRLF)
zip->NextStream(len, (const u_char*) data, false); zip->NextStream(len, (const u_char*) data, false);
} }
else else
#endif
DeliverBodyClear(len, data, trailing_CRLF); DeliverBodyClear(len, data, trailing_CRLF);
} }
@ -450,9 +444,7 @@ void HTTP_Entity::SubmitAllHeaders()
// content-length headers or if connection is to be closed afterwards // content-length headers or if connection is to be closed afterwards
// anyway. // anyway.
else if ( http_message->MyHTTP_Analyzer()->IsConnectionClose () else if ( http_message->MyHTTP_Analyzer()->IsConnectionClose ()
#ifdef HAVE_LIBZ
|| encoding == GZIP || encoding == DEFLATE || encoding == GZIP || encoding == DEFLATE
#endif
) )
{ {
// FIXME: Using INT_MAX is kind of a hack here. Better // FIXME: Using INT_MAX is kind of a hack here. Better

View file

@ -29,10 +29,8 @@ public:
int expect_body); int expect_body);
~HTTP_Entity() ~HTTP_Entity()
{ {
#ifdef HAVE_LIBZ
if ( zip ) if ( zip )
{ zip->Done(); delete zip; } { zip->Done(); delete zip; }
#endif
} }
void EndOfData(); void EndOfData();
@ -55,9 +53,7 @@ protected:
int64_t header_length; int64_t header_length;
int deliver_body; int deliver_body;
enum { IDENTITY, GZIP, COMPRESS, DEFLATE } encoding; enum { IDENTITY, GZIP, COMPRESS, DEFLATE } encoding;
#ifdef HAVE_LIBZ
ZIP_Analyzer* zip; ZIP_Analyzer* zip;
#endif
MIME_Entity* NewChildEntity() { return new HTTP_Entity(http_message, this, 1); } MIME_Entity* NewChildEntity() { return new HTTP_Entity(http_message, this, 1); }

View file

@ -1188,15 +1188,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
if ( orig_status == REGISTERED && resp_status == REGISTERED && if ( orig_status == REGISTERED && resp_status == REGISTERED &&
orig_zip_status == ACCEPT_ZIP && resp_zip_status == ACCEPT_ZIP ) orig_zip_status == ACCEPT_ZIP && resp_zip_status == ACCEPT_ZIP )
{ {
#ifdef HAVE_LIBZ
orig_zip_status = ZIP_LOADED; orig_zip_status = ZIP_LOADED;
resp_zip_status = ZIP_LOADED; resp_zip_status = ZIP_LOADED;
AddSupportAnalyzer(new ZIP_Analyzer(Conn(), true)); AddSupportAnalyzer(new ZIP_Analyzer(Conn(), true));
AddSupportAnalyzer(new ZIP_Analyzer(Conn(), false)); AddSupportAnalyzer(new ZIP_Analyzer(Conn(), false));
#else
reporter->Error("IRC analyzer lacking libz support");
Remove();
#endif
} }
return; return;

View file

@ -1222,10 +1222,7 @@ bool RemoteSerializer::SendCapabilities(Peer* peer)
uint32 caps = 0; uint32 caps = 0;
#ifdef HAVE_LIBZ
caps |= Peer::COMPRESSION; caps |= Peer::COMPRESSION;
#endif
caps |= Peer::PID_64BIT; caps |= Peer::PID_64BIT;
caps |= Peer::NEW_CACHE_STRATEGY; caps |= Peer::NEW_CACHE_STRATEGY;
@ -2106,11 +2103,9 @@ bool RemoteSerializer::ProcessPhaseDone()
bool RemoteSerializer::HandshakeDone(Peer* peer) bool RemoteSerializer::HandshakeDone(Peer* peer)
{ {
#ifdef HAVE_LIBZ
if ( peer->caps & Peer::COMPRESSION && peer->comp_level > 0 ) if ( peer->caps & Peer::COMPRESSION && peer->comp_level > 0 )
if ( ! SendToChild(MSG_COMPRESS, peer, 1, peer->comp_level) ) if ( ! SendToChild(MSG_COMPRESS, peer, 1, peer->comp_level) )
return false; return false;
#endif
if ( ! (peer->caps & Peer::PID_64BIT) ) if ( ! (peer->caps & Peer::PID_64BIT) )
Log(LogInfo, "peer does not support 64bit PIDs; using compatibility mode", peer); Log(LogInfo, "peer does not support 64bit PIDs; using compatibility mode", peer);
@ -3699,11 +3694,6 @@ bool SocketComm::ProcessListen()
bool SocketComm::ProcessParentCompress() bool SocketComm::ProcessParentCompress()
{ {
#ifndef HAVE_LIBZ
InternalError("supposed to enable compression but don't have zlib");
return false;
#else
assert(parent_args); assert(parent_args);
uint32* args = (uint32*) parent_args->data; uint32* args = (uint32*) parent_args->data;
@ -3727,7 +3717,6 @@ bool SocketComm::ProcessParentCompress()
Log(fmt("enabling compression (level %d)", level), parent_peer); Log(fmt("enabling compression (level %d)", level), parent_peer);
return true; return true;
#endif
} }
bool SocketComm::ProcessRemoteMessage(SocketComm::Peer* peer) bool SocketComm::ProcessRemoteMessage(SocketComm::Peer* peer)
@ -3847,10 +3836,6 @@ bool SocketComm::ProcessPeerCompress(Peer* peer)
{ {
peer->state = MSG_NONE; peer->state = MSG_NONE;
#ifndef HAVE_LIBZ
Error("peer compresses although we do not support it", peer);
return false;
#else
if ( ! parent_peer->compressor ) if ( ! parent_peer->compressor )
{ {
parent_peer->io = new CompressedChunkedIO(parent_peer->io); parent_peer->io = new CompressedChunkedIO(parent_peer->io);
@ -3862,7 +3847,6 @@ bool SocketComm::ProcessPeerCompress(Peer* peer)
((CompressedChunkedIO*) peer->io)->EnableDecompression(); ((CompressedChunkedIO*) peer->io)->EnableDecompression();
Log("enabling decompression", peer); Log("enabling decompression", peer);
return true; return true;
#endif
} }
bool SocketComm::Connect(Peer* peer) bool SocketComm::Connect(Peer* peer)

View file

@ -2,8 +2,6 @@
#include "ZIP.h" #include "ZIP.h"
#ifdef HAVE_LIBZ
ZIP_Analyzer::ZIP_Analyzer(Connection* conn, bool orig, Method arg_method) ZIP_Analyzer::ZIP_Analyzer(Connection* conn, bool orig, Method arg_method)
: TCP_SupportAnalyzer(AnalyzerTag::Zip, conn, orig) : TCP_SupportAnalyzer(AnalyzerTag::Zip, conn, orig)
{ {
@ -89,4 +87,3 @@ void ZIP_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
} }
while ( zip->avail_out == 0 ); while ( zip->avail_out == 0 );
} }
#endif

View file

@ -5,8 +5,6 @@
#include "config.h" #include "config.h"
#ifdef HAVE_LIBZ
#include "zlib.h" #include "zlib.h"
#include "TCP.h" #include "TCP.h"
@ -29,4 +27,3 @@ protected:
}; };
#endif #endif
#endif

View file

@ -3272,18 +3272,15 @@ function enable_raw_output%(f: file%): any
%} %}
%%{ %%{
#ifdef HAVE_LIBMAGIC
extern "C" { extern "C" {
#include <magic.h> #include <magic.h>
} }
#endif
%%} %%}
function identify_data%(data: string, return_mime: bool%): string function identify_data%(data: string, return_mime: bool%): string
%{ %{
const char* descr = ""; const char* descr = "";
#ifdef HAVE_LIBMAGIC
static magic_t magic_mime = 0; static magic_t magic_mime = 0;
static magic_t magic_descr = 0; static magic_t magic_descr = 0;
@ -3309,7 +3306,6 @@ function identify_data%(data: string, return_mime: bool%): string
} }
descr = magic_buffer(*magic, data->Bytes(), data->Len()); descr = magic_buffer(*magic, data->Bytes(), data->Len());
#endif
return new StringVal(descr); return new StringVal(descr);
%} %}

View file

@ -2,7 +2,6 @@
# will normalize mime types other than the target type to prevent sensitivity # will normalize mime types other than the target type to prevent sensitivity
# to varying versions of libmagic. # to varying versions of libmagic.
# @TEST-REQUIRES: grep -q '#define HAVE_LIBMAGIC' $BUILD/config.h
# @TEST-EXEC: bro -r $TRACES/http-pipelined-requests.trace %INPUT > output # @TEST-EXEC: bro -r $TRACES/http-pipelined-requests.trace %INPUT > output
# @TEST-EXEC: btest-diff http.log # @TEST-EXEC: btest-diff http.log

View file

@ -2,7 +2,6 @@
# correctly extracted. The mime type of the file transferred is normalized # correctly extracted. The mime type of the file transferred is normalized
# to prevent sensitivity to libmagic version being used. # to prevent sensitivity to libmagic version being used.
# @TEST-REQUIRES: grep -q '#define HAVE_LIBMAGIC' $BUILD/config.h
# @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT # @TEST-EXEC: bro -r $TRACES/irc-dcc-send.trace %INPUT
# @TEST-EXEC: btest-diff irc.log # @TEST-EXEC: btest-diff irc.log
# @TEST-EXEC: btest-diff irc-dcc-item_192.168.1.77:57655-209.197.168.151:1024_1.dat # @TEST-EXEC: btest-diff irc-dcc-item_192.168.1.77:57655-209.197.168.151:1024_1.dat

View file

@ -1,4 +1,3 @@
# @TEST-REQUIRES: grep -q '#define HAVE_LIBMAGIC' $BUILD/config.h
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT # @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff smtp_entities.log # @TEST-EXEC: btest-diff smtp_entities.log
# @TEST-EXEC: btest-diff smtp-entity_10.10.1.4:1470-74.53.140.153:25_1.dat # @TEST-EXEC: btest-diff smtp-entity_10.10.1.4:1470-74.53.140.153:25_1.dat

View file

@ -1,7 +1,6 @@
# Checks logging of mime types and md5 calculation. Mime type in the log # Checks logging of mime types and md5 calculation. Mime type in the log
# is normalized to prevent sensitivity to libmagic version. # is normalized to prevent sensitivity to libmagic version.
# @TEST-REQUIRES: grep -q '#define HAVE_LIBMAGIC' $BUILD/config.h
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT # @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff smtp_entities.log # @TEST-EXEC: btest-diff smtp_entities.log