Vlad Grigorescu
847b16442b
BIT-1410: Add btest
2015-06-01 20:49:04 -05:00
Robin Sommer
9301ef5a4f
Fixing SMTP state tracking.
...
This fixes the case that an SMTP session has multiple mails sent from
the originator but we miss the server's response (e.g., because we
don't see server side packets at all).
2014-06-10 18:01:38 -07:00
Bernhard Amann
6bc914458b
Add smtp starttls support
2014-05-15 09:59:43 -07:00
Jon Siwek
939619889d
File analysis fixes and test updates.
...
- Several places were just using old variable names or not loading
scripts correctly after they'd been renamed/moved.
- Revert/adjust a change in how HTTP file handles are generated that
broke partial content responses.
- Turn some libmagic builtin checks back on; seems some are actually
useful (e.g. text detection seems to be a builtin). The rule going
forward probably will be only to turn off a builtin if we confirm it
causes issues.
- Removed some tests that are redundant or not necessary anymore because
the generic file analysis tests cover them.
- A couple FTP tests still fail that I think need an actual solution via
script changes.
2013-07-25 16:51:16 -05:00
Seth Hall
f098b17429
A few test updates.
2013-07-23 11:18:49 -04:00
Jon Siwek
f2574636b6
Merge branch 'master' into topic/jsiwek/faf-cleanup
...
Conflicts:
scripts/base/protocols/ftp/file-analysis.bro
scripts/base/protocols/http/file-analysis.bro
scripts/base/protocols/irc/file-analysis.bro
scripts/base/protocols/smtp/file-analysis.bro
src/file_analysis/File.cc
src/file_analysis/File.h
src/file_analysis/Manager.cc
src/file_analysis/Manager.h
testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/file_analysis.log
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-0.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-1.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-2.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-3.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-BTsa70Ua9x7-1.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-BTsa70Ua9x7.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-Rqjkzoroau4-0.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-Rqjkzoroau4.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-VLQvJybrm38-2.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-VLQvJybrm38.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-zrfwSs9K1yk-3.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-zrfwSs9K1yk.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp.log
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item-BFymS6bFgT3-0.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item-BFymS6bFgT3.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http.log
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item-wqKMAamJVSb-0.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item-wqKMAamJVSb.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc.log
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-0.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-1.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-Ltd7QO7jEv3-1.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-Ltd7QO7jEv3.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-cwR7l6Zctxb-0.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-cwR7l6Zctxb.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp_entities.log
testing/btest/scripts/base/protocols/ftp/ftp-extract.bro
testing/btest/scripts/base/protocols/http/http-extract-files.bro
testing/btest/scripts/base/protocols/irc/dcc-extract.test
testing/btest/scripts/base/protocols/smtp/mime-extract.test
2013-06-07 15:44:36 -05:00
Jon Siwek
28f51a9a22
Remove extraction counter in default file extraction scripts.
2013-05-21 11:12:00 -05:00
Robin Sommer
4ccd6d76fd
Fixing tests.
...
Part of this involves making the file-analysis tests independent of
specific hash values. I've done that only partially though.
2013-05-17 18:14:35 -07:00
Jon Siwek
497496ec83
FileAnalysis: replace script-layer SMTP file analysis.
...
Notable differences:
- Removed SMTP::MD5 notice.
- Removed ability to specify mime entity excerpt length per mime-type.
2013-03-26 15:48:52 -05:00
Jon Siwek
d750c3ba74
Promote libz and libmagic to required dependencies.
2011-11-11 12:39:00 -06:00
Seth Hall
11c437faa3
Logging framework update and mass Log::ID renaming.
...
- Log path's are generated in the scripting land
now. The default Log stream ID to path string
mapping works like this:
- Notice::LOG -> "notice"
- Notice::POLICY_LOG -> "notice_policy"
- TestModule::LOG -> "test_module"
- Logging streams updated across all of the shipped
scripts to be more user friendly. Instead of
the logging stream ID HTTP::HTTP, we now have
HTTP::LOG, etc.
- The priorities on some bro_init handlers have
been adjusted to make the process of applying
filters or disabling streams easier for users.
2011-09-03 01:10:17 -04:00
Jon Siwek
c3fb0ea035
Reorganizing btest/policy directory to match new scripts/ organization
...
Addresses #545
2011-08-11 10:43:11 -05:00
