Commit graph

603 commits

Author SHA1 Message Date
Gregor Maier
30c4b774aa Somehow I ended up with a lot of crud after merging with master. Fixing it. 2011-06-24 17:15:01 -07:00
Gregor Maier
9f7d4980ea Merge branch 'master' into topic/gregor/smb-nfs
Conflicts:
	policy/bro.init
	policy/nfs.bro
	policy/portmapper.bro
	src/Analyzer.cc
	src/AnalyzerTags.h
	src/Gnutella.cc
	src/NFS.cc
	src/NFS.h
	src/Portmap.cc
	src/Portmap.h
	src/RPC.cc
	src/RPC.h
	src/SSLProxy.h
	src/TCP_Reassembler.cc
	src/XDR.cc
	src/bro.bif
	src/const.bif
	src/event.bif
	src/scan.l
	src/types.bif
2011-06-24 16:01:28 -07:00
Gregor Maier
b8dc8473f2 Merge branch 'topic/gregor/rpc' into topic/gregor/smb-nfs 2011-06-24 15:25:34 -07:00
Gregor Maier
47ff35091c SMB analyzer checkpoint.
Make COM_NT_CREATE_ANDX and COM_CLOSE work nicely
Some other tweaks and fixes.
2011-06-24 15:11:53 -07:00
Gregor Maier
cb9623d3e1 track offset for read_andx and write_andx commands 2011-06-22 13:54:56 -07:00
Gregor Maier
b002160f02 checkpoint 2011-06-20 14:09:15 -07:00
Robin Sommer
ff7b92ffc8 Fixing bug with logging &optional records.
Closes #476.
2011-06-16 17:24:15 -07:00
Robin Sommer
88509e2191 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Fix istate.events-ssl test failing because of expired cert.
2011-06-15 17:52:38 -07:00
Jon Siwek
55c7c42eb7 Fix istate.events-ssl test failing because of expired cert.
Replaced expired certificate w/ one that's valid for ~100 years.
2011-06-15 16:34:33 -05:00
Robin Sommer
e00e29273a Updating submodule(s). 2011-06-14 21:16:01 -07:00
Robin Sommer
244ee664e5 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Change bro doc mode to write out docs immediately after parsing.
2011-06-14 21:15:51 -07:00
Jon Siwek
71c2e79202 Merge branch 'master' into fastpath 2011-06-13 20:21:24 -05:00
Robin Sommer
a73fc15659 Merge remote branch 'origin/fastpath' 2011-06-13 18:03:02 -07:00
Robin Sommer
5bd8caa7a0 Merge remote branch 'origin/topic/gregor/rpc'
Note, I haven't gone through the script-level code as that will change
soon anyway.
2011-06-13 17:56:28 -07:00
Jon Siwek
53dc4ef084 Change bro doc mode to write out docs immediately after parsing.
Originally docs were written right after parsing, but it changed to after
the bro_init event happens when I was experimenting with auto-documenting
logging streams by querying the LogMgr after bro_init.  That experiment
dead-ended, and that location is bad for other reasons: the doc framework
may try to access BroObj's that have already been freed.
2011-06-13 19:50:11 -05:00
Jon Siwek
eb85ae9654 Really, null-terminate full 15-char NetBIOS host names, too. 2011-06-12 08:46:58 -05:00
Jon Siwek
b4d70a22db Fixed core.load-pkg test w/ diff canonifier instead 2011-06-10 15:07:32 -05:00
Jon Siwek
9e747a040d Revert "Fix core.load-pkg unit test."
This reverts commit 80558a994a.
2011-06-10 15:01:35 -05:00
Jon Siwek
cb89440593 Fix language.wrong-delete-field test by running through abs path canonifier 2011-06-10 14:56:49 -05:00
Gregor Maier
3979efad87 Change NFS error handling.
Instead of returning a null pointer to the policy layer in case of an
error we now return an empty record. (See comments in bro.init re
rpc_status)
2011-06-10 12:07:29 -07:00
Jon Siwek
90196b4dc8 Fix bifs.unique_id-rnd test failing because of wc output formatting 2011-06-10 13:27:08 -05:00
Jon Siwek
d358ef1e71 Null-terminate the string created by decode_netbios_name BiF.
(initially observed through failures of bifs.netbios-functions unit test)
2011-06-10 12:59:05 -05:00
Jon Siwek
13c90fc732 Fix core.conn-id test on some platforms.
The output of some versions of `wc` (e.g. MacOS) seems to indent
their output while others don't, causing the baseline diff to fail.
So pipe to sed to get rid of spaces before diffing.
2011-06-10 12:17:10 -05:00
Jon Siwek
80558a994a Fix core.load-pkg unit test.
Removed the test's diff against baseline output that contained absolute
paths so that it will work across systems.  Also don't redirect anything
to stderr so that failure information shows up in btest diagnostic output.
2011-06-10 11:53:51 -05:00
Gregor Maier
e73803f8c4 Merge branch 'topic/gregor/rpc' of ssh://git.bro-ids.org/bro into topic/gregor/rpc 2011-06-09 16:34:35 -07:00
Gregor Maier
6cd6074ab4 clarifying a comment 2011-06-09 16:34:25 -07:00
Gregor Maier
fa50462ba8 No need to resync to RPC stream if the connection is fully established. 2011-06-07 21:01:14 -07:00
Seth Hall
27f692799f Small but crucial fix for the new unique_id function. 2011-06-07 23:47:39 -04:00
Robin Sommer
8266709e20 A new bif unique_id(prefix) that returns a string that's unique across
Bro instaces with high probablity.

"prefix" is a string that will be prepended to the returned ID.
2011-06-07 17:57:22 -07:00
Robin Sommer
4bdb94955d Merge remote branch 'origin/topic/seth/ssl-binpac'
* origin/topic/seth/ssl-binpac:
  Fixed bug due to vectors now initially indexed on 0.
  Finished core support for new SSL analyzer.
  SSL analyzer changes with accompanying BiF.
  A table_s_of_s type to get around bifcl type limitation.
  Regenerated the Mozilla CA bundle without the untrusted server authentication certs.
  Complete rewrite to SSL analyzer.

Conflicts:
	src/AnalyzerTags.h
	src/CMakeLists.txt

Notes:

    - Haven't looked at the script-level, postponed to
      policy-scripts-new.

    - I renamed X509Extension to X509_extension for consistency.
2011-06-07 10:12:25 -07:00
Robin Sommer
6e6af4c541 Merge remote branch 'origin/topic/seth/syslog-analyzer'
Note: I didn't merge anything in policy/*. Seems there was some
unrelated stuff in there, and the ticket says that the policy script
was a dummy for now anyway.

* origin/topic/seth/syslog-analyzer:
  Updates for syslog analyzer to prepare it for merging.
  Added the initial syslog analyzer and policy script.
  Adding some of the initial scripts that are going to be merged from my script repository.
2011-06-05 18:37:48 -07:00
Seth Hall
6322130c37 Updates for syslog analyzer to prepare it for merging.
- Integrated with CMake.
- Analyzer only support syslog over UDP right now.
- Fixed small bug in the analyzer to make it generate events correctly.
2011-06-03 10:28:10 -04:00
Seth Hall
b621b8eccc Merge remote branch 'origin/master' into topic/seth/syslog-analyzer
Conflicts:
	src/Analyzer.cc
	src/Makefile.am
2011-06-03 09:38:23 -04:00
Robin Sommer
a236dd0d3d Fixing typo in test. 2011-06-02 22:07:36 -07:00
Robin Sommer
fac328685b @load now supports loading a directory.
With a directory "foo" somewhere in BROPATH, "@load foo" now checks if
there's a file "foo/__load__.bro". If so, it reads that file in. (If
not, Bro reports the same error as before, complaining that it can't
read a directory).
2011-06-02 21:57:24 -07:00
Robin Sommer
5c0704eec8 ASCII logger now escapes non-printable characters.
Closes #450.
2011-06-01 22:33:44 -07:00
Gregor Maier
1b638eec0c Hacking the SMB analyzer. Checkpoint. 2011-06-01 14:30:02 -07:00
Robin Sommer
09083b8992 Updating submodule(s). 2011-06-01 11:35:37 -07:00
Robin Sommer
a3b527be4b Updating submodule(s). 2011-06-01 11:30:59 -07:00
Robin Sommer
909c5daf6c Revert "Setting the snaplen to 0 to capture the full packet regardless of size."
This reverts commit fe274c3e64.
2011-06-01 11:27:53 -07:00
Seth Hall
fe274c3e64 Setting the snaplen to 0 to capture the full packet regardless of size.
In my limited testing this seemed to work fine but we should
make an actual test for this eventually.
2011-05-25 13:37:21 -04:00
Seth Hall
19c9aaebb9 Fixed bug due to vectors now initially indexed on 0. 2011-05-24 10:08:17 -04:00
Seth Hall
15bfa23ce1 Merge remote branch 'origin/master' into topic/seth/ssl-binpac
Conflicts:
	src/bro.bif
2011-05-23 17:09:41 -04:00
Seth Hall
6918c225db Finished core support for new SSL analyzer.
- Certificate and certificate chain validation is now done
  fully in policy script land.  The script to do this will
  be written in the new policy scripts branch once this is
  merged.

- Removed hand written SSL analyzer.

- Rewrote and reworked much of the BinPAC SSL analyzer.
2011-05-23 17:04:27 -04:00
Seth Hall
a57e50da35 SSL analyzer changes with accompanying BiF.
- Full DER certificates are extracted as strings to be used with
  corresponding BiFs.
- x509_verify function to verify single certs and/or full certificate chains.
2011-05-23 14:54:52 -04:00
Seth Hall
297a2cb9c5 A table_s_of_s type to get around bifcl type limitation. 2011-05-23 14:52:18 -04:00
Jon Siwek
bf84801249 Packaging tweaks and rewrite of 'dist' target.
- Move binary packaging scripts out of source root into pkg/ subdir
- A consistent CMake version (2.8.4) is now enforced for binary packaging
- Added a 'bindist' target to top Makefile as a convenience
- The 'dist' target has been rewritten to depend on standard system
  command/utils rather than CMake and the full dependency chain of Bro,
  addressing #398 (but the CMake 'package_source' target is still available
  in the generated build/Makefile and can be used if desired)
2011-05-20 17:08:59 -05:00
Robin Sommer
e0c05868e3 Updating submodule(s). 2011-05-18 09:08:59 -07:00
Robin Sommer
0913ef3abe Merge remote branch 'origin/topic/jsiwek/deb-packaging'
* origin/topic/jsiwek/deb-packaging:
  Changes to allow DEB packaging via CPack, addresses #458
2011-05-18 09:08:18 -07:00
Robin Sommer
b829c269ff Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Fix reST markup generated for record redefs.
  Fixes for more doc mode corner cases caused by type cloning.

Jon, I added the line below, please double-check.

diff --git a/src/Var.cc b/src/Var.cc
index 7880325..00ac734 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -260,6 +260,7 @@ void add_type(ID* id, BroType* t, attr_list* attr, int /* is_event */)
 			tnew = new FuncType(t->AsFuncType()->Args(),
 			                    t->AsFuncType()->YieldType(),
 			                    t->AsFuncType()->IsEvent());
+			break;
 		default:
 			SerializationFormat* form = new BinarySerializationFormat();
 			form->StartWrite();
2011-05-18 09:06:41 -07:00