Commit graph

1066 commits

Author SHA1 Message Date
Gregor Maier
95d84da1b0 Set c$conn (for logging) in new_connection() event.
c$conn was originally set in connection_established(), which is only
used by TCP connections, and in connection_state_remove(). Using
new_connection() allows us to have c$conn available for any connection
and for any script that wants to extend logging to conn.log.
2011-08-11 15:29:54 -07:00
Gregor Maier
fe5624fb06 Add ConnSize_Analyzer's fields to conn.log 2011-08-11 12:21:42 -07:00
Gregor Maier
88f7db927e SSH base scripts: make sure ConnSizeAnalyzer variables are available before using them. 2011-08-11 12:20:38 -07:00
Jon Siwek
351b13d1c8 Fix more bare-mode @load dependency problems 2011-08-11 11:47:12 -05:00
Jon Siwek
59e5fc5633 Merge branch 'master' into topic/jsiwek/reorg-followup
Conflicts:
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/protocols/ssh/main.bro
2011-08-11 10:56:20 -05:00
Jon Siwek
ed281fb634 Fixing some more bare-mode @load dependency issues 2011-08-11 10:49:41 -05:00
Seth Hall
b45c175147 Split out more SMTP analysis functionality. 2011-08-11 08:26:20 -04:00
Seth Hall
9c2273b7a7 Updates for SSH scripts. 2011-08-11 01:35:50 -04:00
Jon Siwek
f517d0e0ad Merge branch 'master' into topic/jsiwek/reorg-followup 2011-08-10 19:59:18 -05:00
Jon Siwek
9e7934dc32 Normalize some intra-package @loads 2011-08-10 16:06:05 -05:00
Jon Siwek
fae54dc8f0 Normalizing base.bro script naming as main.bro 2011-08-10 15:40:28 -05:00
Jon Siwek
47500ceef4 Add a test that checks each individual script can be loaded in bare-mode.
Fixed most @load dependency issues in the process.  The test is still
failing in a "known" way due to hot.conn.bro and scan.bro.

Adressess #545
2011-08-10 15:38:21 -05:00
Seth Hall
8e7a76b548 HTTP now uses the extract_filename_from_content_disposition function. 2011-08-10 13:37:58 -04:00
Seth Hall
adc486c673 Merge remote-tracking branch 'origin/topic/jsiwek/smtp-refactor'
- While updating, I did some further work on the branch.

- New function in the base/utils/files for extracting filenames
  from content-dispositions.

- New script for entity excerpt extraction if you aren't interested
  in full extraction.  The data goes a log field too.

- Some renaming and reorganization of types.

- Updated tests to work with new code.

* origin/topic/jsiwek/smtp-refactor:
  Make the doc.coverage test happy.
  SMTP script refactor. (addresses #509)

Conflicts:
	doc/scripts/DocSourcesList.cmake
	policy/protocols/smtp/__load__.bro
	policy/protocols/smtp/base/__load__.bro
2011-08-10 13:34:31 -04:00
Jon Siwek
4ac6d0ae2e Fixes for script auto-documentation.
- Fixing the parts of the `make restdoc` and `make doc` process that were
  broken by the last Bro script re-organization

- Generated documentation for Bro scripts derived from BiFs now use the
  original BiF source file as the "original source file" link

- Renaming of the internal POLICYDEST definition and other misc places that
  refer to "policy" scripts; that terminology doesn't make total sense now

- Added a documentation blacklist reminder test that will fail if there's
  scripts that are blacklisted from being documentated because they're still
  in progress

- Some minor Bro script changes to fix small @load dependency errors

Addresses #543
2011-08-08 19:50:45 -05:00
Seth Hall
597a4d6704 Hopefully the last major script reorganization.
- policy/ renamed to scripts/

- By default BROPATH now contains:
	- scripts/
	- scripts/policy
	- scripts/site

- *Nearly* all tests pass.

- All of scripts/base/ is loaded by main.cc
	- Can be disabled by setting $BRO_NO_BASE_SCRIPTS
	- Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script).

- The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building.

- The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead.

- All "detection" activity happens through scripts in scripts/policy/.

- Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1)
	- This is so the communications framework can be loaded as part
	  of the base without causing trouble when it's not needed.
	- This will be removed once a resolution to ticket #540 is reached.
2011-08-05 23:09:53 -04:00