[Bro-Dev] Compatibilty script for policy/protocols/smb?

Azoff, Justin S jazoff at illinois.edu
Thu Aug 30 13:01:20 PDT 2018


> On Aug 30, 2018, at 2:26 PM, Jon Siwek <jsiwek at corelight.com> wrote:
> 
> On Thu, Aug 30, 2018 at 9:50 AM Azoff, Justin S <jazoff at illinois.edu> wrote:
> 
>> fatal error in /bro/share/bro/site/local.bro, line 88: can't open /bro/share/bro/policy/protocols/smb/__load__.bro
>> 
>> I see in NEWS we have
>> 
>> - The SMB scripts in policy/protocols/smb are now moved into base/protocols/smb
>>  and loaded/enabled by default.
>> 
>> But should there be an empty script in there or something that does a reporter warning telling people to update local.bro?
> 
> Thanks for pointing that out.
> 
> I'll put a placeholder at the old policy/ location, but also call out
> in NEWS that such @loads can be removed from local.bro or other custom
> scripts.
> 
> Or let me know if there's other ideas.

Sounds good to me.

I was curious why this test didn't catch this:

testing/btest/scripts/site/local-compat.test

but the file as shipped was

# Uncomment the following line to enable the SMB analyzer.  The analyzer
# is currently considered a preview and therefore not loaded by default.
# @load policy/protocols/smb

so while 2.6 would have been compatible with the 2.5 config as it was distributed, it would have broken anyone that uncommented the line.



— 
Justin Azoff




More information about the bro-dev mailing list