Commit graph

12 commits

Author SHA1 Message Date
Jon Siwek
0141f51801 FileAnalysis: load custom mime magic database just once.
This works around a bug in libmagic since version 5.12 (current at
time of writing is 5.14) -- second call to magic_load() w/ non-default
database segfaults.
2013-04-29 12:49:22 -05:00
Jon Siwek
661677d452 FileAnalysis: separating IRC/FTP data analyzers.
It simplifies the file handle string callbacks.
2013-03-20 11:12:06 -05:00
Jon Siwek
878dfff2f2 FileAnalysis: decentralize unique file handle generator callbacks.
The framework now cycles through callbacks based on a table indexed
by analyzer tags, or the special case of service strings if a given
analyzer is overloaded for multiple protocols (FTP/IRC data).  This
lets each protocol script bundle implement the callback locally and
reduces the FAF's external dependencies.
2013-03-13 10:48:26 -05:00
Jon Siwek
589952f4d9 Merge branch 'master' into topic/jsiwek/file-analysis
Conflicts:
	src/FileAnalyzer.cc
	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
2013-03-07 11:06:00 -06:00
Jon Siwek
2481f9f837 Fix possible null pointer dereference in identify_data BIF.
There was no check/handling for if magic_buffer() returns null.
Also centralized libmagic calls for consistent error handling/output.
2013-02-27 16:04:36 -06:00
Jon Siwek
ceb471fb36 Prettify file analysis IDs to be more like connection uids. 2013-02-20 22:09:39 -06:00
Jon Siwek
f04d189d3f More work on the interface to add/remove file analysis actions.
Added the file extraction action and did other misc. cleanup.  Most of
the minimal core features/support for file analysis should be working at
this point, just have to start fleshing things out.
2013-02-14 12:53:20 -06:00
Jon Siwek
2b7aedc688 Prototype file analyzer/actions, connect TCP analyzer to file analysis.
No way to add analyzers/actions and they don't do anything yet.
2013-01-22 10:48:00 -06:00
Jon Siwek
d750c3ba74 Promote libz and libmagic to required dependencies. 2011-11-11 12:39:00 -06:00
Jon Siwek
495e987938 Remove $Id$ tags 2011-08-04 15:21:18 -05:00
Jon Siwek
b0d78eab40 Removed ClamAV support. 2010-11-17 20:38:34 -06:00
Robin Sommer
61757ac78b Initial import of svn+ssh:://svn.icir.org/bro/trunk/bro as of r7088 2010-09-27 20:42:30 -07:00