Commit graph

312 commits

Author SHA1 Message Date
Seth Hall
f7c6dd7f7e Finished work on unified2 analyzer. 2013-08-13 03:21:43 -04:00
Seth Hall
091c8f3ebc Working unified2 analyzer.
- No output by default yet.  Most of the activity is centered
   around generating the Unified2::alert event which ties together
   an IDSEvent and a packet.
2013-08-12 14:57:12 -04:00
Seth Hall
04de4ce24b Unified2 file analyzer updated to new plugin style. 2013-08-10 22:26:32 -04:00
Seth Hall
b7877792c9 First commit of file entropy analyzer.
- Code comments need cleaned up still.
2013-08-05 00:02:48 -04:00
Jon Siwek
ee7dba806d Fix some build errors.
On GCC, some namespace sensitivity and file analyzer plugins now need
to link in Analyzer since it's not just a header anymore.
2013-08-01 12:17:51 -05:00
Jon Siwek
99c89b42d7 Internal refactoring of how plugin components are tagged/managed.
Made some class templates for code that seemed duplicated between
file/protocol tags and managers.  Seems like it helps a bit and
hopefully can be also be used to transition other things that have
enum value "tags" (e.g. logging writers, input readers) to the
plugin system.
2013-08-01 10:35:47 -05:00
Jon Siwek
5fa9c5865b Factor out the need for a tag field in Files::AnalyzerArgs record.
This cleans up internals of how analyzer instances get identified by the
tag plus any args given to it and doesn't change script code a user
would write.
2013-07-31 09:48:19 -05:00
Seth Hall
7ba51786e5 In progress checkpoint. Things are starting to work. 2013-07-27 08:10:08 -04:00
Seth Hall
1e098bae8d Moving the PE analyzer to the new plugin structure. 2013-07-27 00:07:47 -04:00
Seth Hall
cdf6b7864e More file analysis updates.
- Recorrected the module name to Files.

  - Added Files::analyzer_name to get a more readable name for a
    file analyzer.

  - Improved and just overall better handled multipart mime
    transfers in HTTP and SMTP.  HTTP now has orig_fuids and resp_fuids
    log fields since multiple "files" can be transferred with
    multipart mime in a single request/response pair.  SMTP has
    an fuids field which has file unique IDs for all parts
    transferred. FTP and IRC have a log field named fuid added
    because only a single file can be transferred per irc and ftp
    log line.
2013-07-09 11:50:54 -04:00
Seth Hall
58d133e764 Merge remote-tracking branch 'origin/master' into topic/seth/faf-updates
Conflicts:
	scripts/base/frameworks/files/main.bro
	scripts/base/init-bare.bro
	scripts/base/protocols/ftp/file-analysis.bro
	scripts/base/protocols/http/file-analysis.bro
	scripts/base/protocols/irc/file-analysis.bro
	scripts/base/protocols/smtp/file-analysis.bro
	src/const.bif
	src/event.bif
	src/file_analysis/Analyzer.h
	src/file_analysis/file_analysis.bif
2013-07-05 02:13:27 -04:00
Jon Siwek
7c7b6214a6 Move file analyzers to new plugin infrastructure. 2013-06-10 15:50:18 -05:00