Jon Siwek
939619889d
File analysis fixes and test updates.
...
- Several places were just using old variable names or not loading
scripts correctly after they'd been renamed/moved.
- Revert/adjust a change in how HTTP file handles are generated that
broke partial content responses.
- Turn some libmagic builtin checks back on; seems some are actually
useful (e.g. text detection seems to be a builtin). The rule going
forward probably will be only to turn off a builtin if we confirm it
causes issues.
- Removed some tests that are redundant or not necessary anymore because
the generic file analysis tests cover them.
- A couple FTP tests still fail that I think need an actual solution via
script changes.
2013-07-25 16:51:16 -05:00
Jon Siwek
f2574636b6
Merge branch 'master' into topic/jsiwek/faf-cleanup
...
Conflicts:
scripts/base/protocols/ftp/file-analysis.bro
scripts/base/protocols/http/file-analysis.bro
scripts/base/protocols/irc/file-analysis.bro
scripts/base/protocols/smtp/file-analysis.bro
src/file_analysis/File.cc
src/file_analysis/File.h
src/file_analysis/Manager.cc
src/file_analysis/Manager.h
testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/file_analysis.log
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-0.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-1.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-2.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-3.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-BTsa70Ua9x7-1.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-BTsa70Ua9x7.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-Rqjkzoroau4-0.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-Rqjkzoroau4.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-VLQvJybrm38-2.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-VLQvJybrm38.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-zrfwSs9K1yk-3.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-zrfwSs9K1yk.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp.log
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item-BFymS6bFgT3-0.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item-BFymS6bFgT3.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http.log
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item-wqKMAamJVSb-0.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item-wqKMAamJVSb.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc.log
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-0.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-1.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-Ltd7QO7jEv3-1.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-Ltd7QO7jEv3.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-cwR7l6Zctxb-0.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-cwR7l6Zctxb.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp_entities.log
testing/btest/scripts/base/protocols/ftp/ftp-extract.bro
testing/btest/scripts/base/protocols/http/http-extract-files.bro
testing/btest/scripts/base/protocols/irc/dcc-extract.test
testing/btest/scripts/base/protocols/smtp/mime-extract.test
2013-06-07 15:44:36 -05:00
Jon Siwek
705a84d688
Improve tracking of HTTP file extraction (addresses #988 ).
...
http.log now has files taken from request and response bodies in
different fields for each, and can now track multiple files per body.
That is, the "extraction_file" field is now "extracted_request_files"
and "extracted_response_files".
2013-05-21 16:42:35 -05:00
