Merge pull request elastic#455 from alex-weltman/2.8.1_removeFileMeta…

…dataFromBlacklist remove attachment metadata from blacklist
harper-carroll · Nov 24, 2015 · b51e7d8 · b51e7d8
2 parents 543dacd + 21609d2
commit b51e7d8
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 7 deletions.
diff --git a/protofiles/DpiMsgLRproto.proto b/protofiles/DpiMsgLRproto.proto
@@ -3251,13 +3251,13 @@ optional bool receivedQ_PROTO_POP3 = 3488; // QOSMOS:Q_PROTO_POP3,Q_MPA_RECEIVED
 //repeated bytes file_idQ_PROTO_SMB = 3544; // QOSMOS:Q_PROTO_SMB,Q_SMB_FILE_ID
 //optional bool fileQ_PROTO_SMB = 3545; // QOSMOS:Q_PROTO_SMB,Q_MPA_FILE
 //optional bool messageQ_PROTO_SMPP = 3546; // QOSMOS:Q_PROTO_SMPP,Q_MPA_MESSAGE
-//optional bool emailQ_PROTO_SMTP = 3547; // QOSMOS:Q_PROTO_SMTP,Q_MPA_EMAIL
+optional bool emailQ_PROTO_SMTP = 3547; // QOSMOS:Q_PROTO_SMTP,Q_MPA_EMAIL
 optional bool sender_entryQ_PROTO_SMTP = 3548; // QOSMOS:Q_PROTO_SMTP,Q_MPA_SENDER_ENTRY
 optional bool mailfromQ_PROTO_SMTP = 3549; // QOSMOS:Q_PROTO_SMTP,Q_SMTP_MAILFROM
 optional bool rcpttoQ_PROTO_SMTP = 3550; // QOSMOS:Q_PROTO_SMTP,Q_SMTP_RCPTTO
 optional bool receiver_entryQ_PROTO_SMTP = 3551; // QOSMOS:Q_PROTO_SMTP,Q_MPA_RECEIVER_ENTRY
 optional bool requestQ_PROTO_SMTP = 3552; // QOSMOS:Q_PROTO_SMTP,Q_MPA_REQUEST
-//optional bool attachQ_PROTO_SMTP = 3553; // QOSMOS:Q_PROTO_SMTP,Q_MPA_ATTACH
+optional bool attachQ_PROTO_SMTP = 3553; // QOSMOS:Q_PROTO_SMTP,Q_MPA_ATTACH
 //optional bool content_entryQ_PROTO_SMTP = 3554; // QOSMOS:Q_PROTO_SMTP,Q_MPA_CONTENT_ENTRY
 //repeated bytes contentQ_PROTO_SMTP = 3555; // QOSMOS:Q_PROTO_SMTP,Q_MPA_CONTENT
 //repeated bytes content_headerQ_PROTO_SMTP = 3556; // QOSMOS:Q_PROTO_SMTP,Q_MPA_CONTENT_HEADER
@@ -3555,7 +3555,7 @@ optional uint32 seg_buffered_sizeQ_PROTO_TCP = 3594; // QOSMOS:Q_PROTO_TCP,Q_TCP
 //optional Void endQ_PROTO_SLSK = 3848; // QOSMOS:Q_PROTO_SLSK,Q_MPA_END
 //optional Void endQ_PROTO_SMB = 3849; // QOSMOS:Q_PROTO_SMB,Q_MPA_END
 //optional Void endQ_PROTO_SMPP = 3850; // QOSMOS:Q_PROTO_SMPP,Q_MPA_END
-//optional Void endQ_PROTO_SMTP = 3851; // QOSMOS:Q_PROTO_SMTP,Q_MPA_END
+optional Void endQ_PROTO_SMTP = 3851; // QOSMOS:Q_PROTO_SMTP,Q_MPA_END
 //optional Void endQ_PROTO_SNMP = 3852; // QOSMOS:Q_PROTO_SNMP,Q_MPA_END
 //optional Void endQ_PROTO_SPDY = 3853; // QOSMOS:Q_PROTO_SPDY,Q_MPA_END
 //optional Void endQ_PROTO_SPID = 3854; // QOSMOS:Q_PROTO_SPID,Q_MPA_END

diff --git a/resources/LuaProtoFieldsDesc.csv b/resources/LuaProtoFieldsDesc.csv
@@ -50,6 +50,7 @@ Internal, Internal, fieldcountindexed, FieldCountIndexed, uint32, "Field count i
 Internal, Internal, emailAttachments, EmailAttachments, EmailAttach, "Email attachment structure."
 Internal, Internal, customfields, CustomFields, CustomField, "Custom Fields."
 Internal, Internal, repeatedfieldcount, RepeatedFieldCount, uint64, "Total repeated fields in DPI message."
+Internal, Internal, flowclassified, FlowClassified, bool, "Flow Classified"
 0zz0, 0zz0.com, login, loginq_proto_0zz0, bytes, "User's login string."
 0zz0, 0zz0.com, password, passwordq_proto_0zz0, bytes, "User's password string."
 0zz0, 0zz0.com, action, actionq_proto_0zz0, bytes, "Indicates the action executed by the user."

diff --git a/resources/ProtocolFilters b/resources/ProtocolFilters
@@ -906,7 +906,6 @@
 ![,:]Q_PROTO_SMPP.*,Q_MPA_MESSAGE[,\n]|
 ![,:]Q_PROTO_SMPP.*,Q_MPA_RECEIVER[,\n]|
 ![,:]Q_PROTO_SMPP.*,Q_MPA_SENDER[,\n]|
-![,:]Q_PROTO_SMTP.*,Q_MPA_ATTACH[,\n]|
 ![,:]Q_PROTO_SMTP.*,Q_MPA_ATTACH_CONTENT[,\n]|
 ![,:]Q_PROTO_SMTP.*,Q_MPA_ATTACH_CONTENT_DECODED[,\n]|
 ![,:]Q_PROTO_SMTP.*,Q_MPA_CONTENT[,\n]|
@@ -915,8 +914,6 @@
 ![,:]Q_PROTO_SMTP.*,Q_MPA_CONTENT_ENTRY[,\n]|
 ![,:]Q_PROTO_SMTP.*,Q_MPA_CONTENT_HEADER[,\n]|
 ![,:]Q_PROTO_SMTP.*,Q_MPA_CONTENT_TRANSFER_ENCODING[,\n]|
-![,:]Q_PROTO_SMTP.*,Q_MPA_EMAIL[,\n]|
-![,:]Q_PROTO_SMTP.*,Q_MPA_END[,\n]|
 ![,:]Q_PROTO_SMTP.*,Q_MPA_HEADER_RAW[,\n]|
 ![,:]Q_PROTO_SMTP.*,Q_MPA_RECEIVER[,\n]|
 ![,:]Q_PROTO_SMTP.*,Q_MPA_SENDER[,\n]|

diff --git a/scripts/buildDpiMsgLRProto.pl b/scripts/buildDpiMsgLRProto.pl
@@ -287,7 +287,7 @@ sub CreateRemappingFile {
 while ( my $line = <staticFieldsCsv> ) {
    print luaProtoFieldsCsv $line;
 }
-
+print luaProtoFieldsCsv "\n";
 seek qosmosWorkbook, 0, 0;
 while (<qosmosWorkbook>) {
    # Include all attributes matching the includeFilter, but exclude the 19 attributes at the beginning