Seth Hall
cafd35e746
Updates the files event api and brings file reassembly up to master.
2014-09-26 00:40:37 -04:00
Jon Siwek
f2574636b6
Merge branch 'master' into topic/jsiwek/faf-cleanup
...
Conflicts:
scripts/base/protocols/ftp/file-analysis.bro
scripts/base/protocols/http/file-analysis.bro
scripts/base/protocols/irc/file-analysis.bro
scripts/base/protocols/smtp/file-analysis.bro
src/file_analysis/File.cc
src/file_analysis/File.h
src/file_analysis/Manager.cc
src/file_analysis/Manager.h
testing/btest/Baseline/scripts.base.frameworks.file-analysis.logging/file_analysis.log
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-0.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-1.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-2.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-3.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-BTsa70Ua9x7-1.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-BTsa70Ua9x7.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-Rqjkzoroau4-0.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-Rqjkzoroau4.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-VLQvJybrm38-2.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-VLQvJybrm38.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-zrfwSs9K1yk-3.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp-item-zrfwSs9K1yk.dat
testing/btest/Baseline/scripts.base.protocols.ftp.ftp-extract/ftp.log
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item-BFymS6bFgT3-0.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item-BFymS6bFgT3.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http-item.dat
testing/btest/Baseline/scripts.base.protocols.http.http-extract-files/http.log
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item-wqKMAamJVSb-0.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item-wqKMAamJVSb.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc-dcc-item.dat
testing/btest/Baseline/scripts.base.protocols.irc.dcc-extract/irc.log
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-0.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-1.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-Ltd7QO7jEv3-1.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-Ltd7QO7jEv3.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-cwR7l6Zctxb-0.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp-entity-cwR7l6Zctxb.dat
testing/btest/Baseline/scripts.base.protocols.smtp.mime-extract/smtp_entities.log
testing/btest/scripts/base/protocols/ftp/ftp-extract.bro
testing/btest/scripts/base/protocols/http/http-extract-files.bro
testing/btest/scripts/base/protocols/irc/dcc-extract.test
testing/btest/scripts/base/protocols/smtp/mime-extract.test
2013-06-07 15:44:36 -05:00
Jon Siwek
037d582b0e
FileAnalysis: add custom libmagic database.
...
- It's derived from the magic database of libmagic 5.14, but with most
everything not related to mime types removed.
- The custom database is always used by default for mime detection, but
the more verbose file type detection will fall back on the default
libmagic installation's database. The result is: mime type strings
are now guaranteed to be consistent across platforms, but the verbose
file type descriptions are not.
- The custom database gets installed in $prefix/share/bro/magic, and
should even be extensible if files with new patterns are added inside
the directory.
- The search path for the mime magic database can be controlled via
BROMAGIC environment variable.
- Remove mime_desc field from ftp.log.
- Stop using the mime/file type canonifier with unit tests.
- libmagic >= 5.04 is now a requirement.
2013-04-12 11:58:19 -05:00
Jon Siwek
e81f2ae7b0
FileAnalysis: libmagic tweaks.
...
Remove verbose file type detection and automatically strip out charset
from mime type.
2013-04-11 13:11:46 -05:00
Jon Siwek
d9321e2203
FileAnalysis: remove some file events.
...
The file_new event now takes over the function of file_type, file_bof,
and file_bof_buffer.
2013-04-10 14:34:23 -05:00
Jon Siwek
a2d9b47bcd
FileAnalysis: finish switching hooks to events.
2013-04-10 11:13:43 -05:00
Jon Siwek
641154f8e8
FileAnalysis: checkpoint in middle of big reorganization.
...
- FileAnalysis::Info is now just a record used for logging, the fa_file
record type is defined in init-bare.bro as the analogue to a
connection record.
- Starting to transfer policy hook triggers and analyzer results to
events.
2013-04-09 15:49:58 -05:00
Jon Siwek
1ef7465e30
FileAnalysis: add more unit tests.
2013-03-20 12:47:45 -05:00
