Commit graph

164 commits

Author SHA1 Message Date
Jon Siwek
637fe69cf9 FileAnalysis: buffer input that can't get unique file handle immediately
A retry happens on every new input and also periodically based on a
timer.  If a file handle is returned at those times, the input is
forwarded for analysis, else it keeps retrying until a timeout
threshold.
2013-03-14 10:57:16 -05:00
Jon Siwek
878dfff2f2 FileAnalysis: decentralize unique file handle generator callbacks.
The framework now cycles through callbacks based on a table indexed
by analyzer tags, or the special case of service strings if a given
analyzer is overloaded for multiple protocols (FTP/IRC data).  This
lets each protocol script bundle implement the callback locally and
reduces the FAF's external dependencies.
2013-03-13 10:48:26 -05:00
Jon Siwek
3dd513e26e FileAnalysis: move unique file handle string generation to script-layer
And add minimal integration with HTTP analyzer.
2013-03-12 13:44:31 -05:00
Jon Siwek
589952f4d9 Merge branch 'master' into topic/jsiwek/file-analysis
Conflicts:
	src/FileAnalyzer.cc
	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
2013-03-07 11:06:00 -06:00
Jon Siwek
00b2d34a8e FileAnalysis: add binary input reader and BIFs for sending in data.
This allows the input framework to feed files in to Bro for analysis.
2013-03-06 12:59:54 -06:00
Jon Siwek
c330b46128 FileAnalysis: add libmagic file type detection. 2013-03-04 16:20:10 -06:00
Jon Siwek
9425c2508f Change semantics of FileAnalysis::stop BIF to internally mean "ignore".
The manager has to remember that the file is being ignored until either
EOF or timeout.
2013-03-01 14:03:37 -06:00
Jon Siwek
6cb58a5228 FileAnalysis: minor code reorg/tweak of BOF buffering stuff. 2013-03-01 09:55:49 -06:00
Jon Siwek
720858fb36 FileAnalysis: refactor add/remove/stop BIFs, add BOF triggers/fields.
The add_action, remove_action, and stop BIFs now go through a queue to
ensure that modifications are made at well-defined times and don't end
up invalidating loop iterators.
2013-02-28 17:19:16 -06:00
Jon Siwek
691622b3aa Refactor how file analysis actions are tracked.
The Info record now uses a "table[ActionArgs] of ActionResults", which
allows for simultaneous actions of a given type as long as other args
(fields in the ActionArgs record) are different.
2013-02-25 16:35:42 -06:00
Jon Siwek
4b30cc2e24 Add file analysis action to send data to script-land in chosen events. 2013-02-22 16:49:53 -06:00
Jon Siwek
85410a7657 Add MD5/SHA1/SHA256 file analysis hashing actions. 2013-02-21 21:05:01 -06:00
Jon Siwek
ceb471fb36 Prettify file analysis IDs to be more like connection uids. 2013-02-20 22:09:39 -06:00
Jon Siwek
f8af42cf9a Reorganizing file analysis source code. 2013-02-14 16:07:42 -06:00