Commit graph

1825 commits

Author SHA1 Message Date
Robin Sommer
1555eb65d4 Updating plugin docs.
The remaining components are now supported as well.
2014-10-02 16:39:51 -07:00
Robin Sommer
d9889d489f Fix to use length parameter in DNP3 time conversion correctly now. 2014-09-29 20:07:32 -07:00
Robin Sommer
64102e6f4f Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  new ssl extension type from iana and a few other ssl const changes.
  adding a function in dnp3-analyzer.pac to translate the time stamp format
  Make unexpected pipe errors fatal as precaution.

I added a lenght parameter to the DNP3 time conversion function to not
accidentally run into trouble later if there were ever any other
buffers passed in.
2014-09-29 17:07:51 -07:00
Jon Siwek
c7354c6fa0 Fix possible seg fault in TCP reassembler. 2014-09-29 10:43:05 -05:00
Robin Sommer
cce09b75de Changing prefix for packet sources/dumper from ':' to '%'.
Addresses BIT-1249.
2014-09-25 17:54:36 -07:00
Jon Siwek
3f446b8a81 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Adds a "node" field to Intel::Seen struture and intel.log.
2014-09-24 10:09:51 -05:00
Jon Siwek
dae80fc119 Fix issue w/ duplicate TCP reassembly deliveries.
Due to the change in f1cef9d2a9, it was possible for the TCP reassembler
to deliver the same data twice because Undelivered did not take in to
account that the reassembly stream could now advance past the end of the
gap.

Addresses BIT-1259.
2014-09-22 13:00:58 -05:00
Jon Siwek
17d60ea8ac Fix file analysis events from coming after bro_done().
BIT-1256 #close
2014-09-18 14:33:20 -05:00
Jon Siwek
e5bd113286 Merge branch 'master' of https://github.com/cmavr8/bro 2014-09-17 09:46:06 -05:00
Jon Siwek
687b085d32 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fixed some "make doc" warnings caused by reST formatting
2014-09-17 09:37:40 -05:00
Jon Siwek
a7373a1ca4 Remove unneeded allocations for HTTP messages. 2014-09-15 13:40:45 -05:00
Jon Siwek
a87b22cd0a Fix a compile error on systems without pcap-int.h. 2014-09-15 11:16:39 -05:00
Robin Sommer
160543cbc6 Merge remote-tracking branch 'origin/topic/jsiwek/jj-bugs'
* origin/topic/jsiwek/jj-bugs:
  Fix incorrect data delivery skips after gap in HTTP Content-Range.
  Fix file analysis placement of data after gap in HTTP Content-Range.
  Fix issue w/ TCP reassembler not delivering some segments.
  Raise http_entity_data in line with data arrival.
  Implement file ID caching for MIME_Mail.
  BIT-1240: Fix MIME entity file data/gap ordering.

BIT-1240 #closed
BIT-1246 #closed
BIT-1247 #closed
BIT-1248 #closed
2014-09-12 19:44:54 -07:00
Jon Siwek
eb16c971c0 Merge remote-tracking branch 'origin/topic/robin/pktsrc'
* origin/topic/robin/pktsrc:
  Fixing link-layer handling.
  Bugfixes and test updates.
  Fixing remaining tests.
  Adding test for dynamic packet dumper plugin.
  Test updates.
  Fixing Bro-level BPF filtering.
  A set of smaller API tweaks, and polishing.
  Adding test creating a dynamic pktsrc plugin.
  Interface tweaks for PktSrc, plus docs for PktSrc and PktDumper.
  A set of various fixes and smaller API tweaks, plus tests.
  Moving some of the BPF filtering code into base class.
  Small packet dumper API change.
  Moving Pkt{Src,Dumper} a directory level up.
  Removing FlowSrc.
  Removing netmap, remaining pieces of the 2ndary path, and left-over files of packet sorter.
  Prototype of a netmap packet source.
  A series of updates and tweaks to the new PktSrc interface.
  Fixing rebase relicts.
  IOSource reorg.

BIT-1243 #close
2014-09-09 12:46:45 -05:00
Jon Siwek
3caecadf0a Fix Broxygen's rendering of opaque types.
BIT-1245 #close
2014-09-08 19:05:01 -05:00
Robin Sommer
ff33789f6a Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  fix more http links.
2014-09-07 20:51:22 -07:00
Robin Sommer
daae28c72e Merge remote-tracking branch 'origin/topic/johanna/ticket-1212'
* origin/topic/johanna/ticket-1212:
  Fix ocsp reply validation - there were a few things that definitely were wrong.
  fix null pointer dereference in ocsp verification code in case no certificate is sent as part as the ocsp reply.
2014-09-04 16:17:36 -07:00
Robin Sommer
b66721375a Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Also make links in documentation templates protocol relative.
2014-09-04 16:11:08 -07:00
Robin Sommer
dc468b1e56 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Simplify a conditional with equivalent branches.
  Change EDNS parsing code to use rdlength more cautiously.
  Fix a memory leak when bind() fails due to EADDRINUSE.
  Fix possible buffer over-read in DNS TSIG parsing
2014-09-02 17:23:37 -07:00
Jon Siwek
73cc81f44a Merge branch 'topic/jimmyjones2/string-doc' of https://github.com/jimmyjones2/bro 2014-08-26 09:26:00 -05:00
Robin Sommer
a3b2e3a2b4 Merge remote-tracking branch 'origin/topic/jsiwek/outer_param_binding'
That works. Just renaming "param" to "ID", as locals are affected as
well.

BIT-1233 #merged

* origin/topic/jsiwek/outer_param_binding:
  Detect functions that try to bind variables from an outer scope.
2014-08-22 15:23:18 -07:00
Jon Siwek
8b0678b8a8 Updating CHANGES and VERSION. 2014-08-21 16:10:58 -05:00
Jon Siwek
6f27d3dd40 Silence some doc-related warnings when using bro -e.
BIT-1232 #close
2014-08-19 11:06:21 -05:00
Robin Sommer
ccfd081437 Fixing PATH to bro-cut in BTest configuration. 2014-08-01 14:35:26 -07:00
Robin Sommer
8d936e593f Updating submodule(s).
[nomail]
2014-08-01 14:19:46 -07:00
Robin Sommer
2e3b217667 Fix for redefining built-in constants.
Turns out redefs weren't visibile to core-land due to initialization
order.
2014-07-31 14:38:24 -07:00
Jon Siwek
69b1ba653d Minor adjustments to plugin code/docs.
Mostly whitespace/typos.
Moved some Plugin methods out from public access.
2014-07-30 16:48:23 -05:00
Robin Sommer
a6901a6b86 Updating submodule(s).
[nomail]
2014-07-22 17:41:21 -07:00
Robin Sommer
3e6193921a Merge remote-tracking branch 'origin/topic/robin/modbus-events-merge'
* origin/topic/robin/modbus-events-merge:
  adding another trace file to test read and write coil function codes
  add/update test file and baseline result
  add implementation of bytestring_to_coils for modbusy analyzer
  adding a missing field in record ModbusHeaders
  add event handlers for modbus
2014-07-22 17:34:11 -07:00
Jon Siwek
3cea6ab1eb Include yield of vectors in Broxygen's type descriptions.
BIT-1217 #close
2014-07-10 19:23:49 -05:00
Robin Sommer
a7746afa0a Fixing DataSeries, which was using a now illegal value as default
compression level.
2014-07-10 14:50:15 -07:00
Robin Sommer
c686d5bc84 Extending "make test-all" to include aux/bro-aux.
Also updating bro-aux submodule.
2014-06-26 17:36:18 -07:00
mlaterman
413871af79 DataSeries compilation issue fixed.
BIT-1121 #merged
2014-06-26 17:25:07 -07:00
Jon Siwek
45e714844c Support tilde expansion when Bro tries to find its own path. 2014-06-26 15:44:45 -05:00
Jon Siwek
f7c2c00045 Merge remote-tracking branch 'origin/topic/dnthayer/ticket1206'
* origin/topic/dnthayer/ticket1206:
  Remove references to line numbers in tutorial text

BIT-1206 #merged
2014-06-23 16:56:46 -05:00
Jon Siwek
5d7b3f850b Updating CHANGES and VERSION. 2014-06-16 09:49:19 -05:00
Jon Siwek
86139fb8d2 Merge remote-tracking branch 'origin/topic/dnthayer/doc-fixes-for-2.3'
* origin/topic/dnthayer/doc-fixes-for-2.3:
  Fix minor formatting issues in script docs
  Fix a broken link in the docs
  Update some info in the docs
  Removed a table from the scripting tutorial
  Update line numbers mentioned in scripting tutorial
  Update line numbers for a doc example
  Move scripting tutorial out of reference section

BIT-1205 #merged
2014-06-12 12:22:08 -05:00
Jon Siwek
b4b64c1239 Merge remote-tracking branch 'origin/topic/robin/smtp-fix'
* origin/topic/robin/smtp-fix:
  Fixing SMTP state tracking.

BIT-1203 #merged
2014-06-11 15:38:29 -05:00
Jon Siwek
5ebda7cc09 Fix doc/test that broke due to a Bro script change. 2014-06-11 12:34:29 -05:00
Robin Sommer
ba229f798d Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix use-after-free in some cases of reassigning a table index.
2014-06-10 18:17:04 -07:00
Robin Sommer
c289a2743b Merge remote-tracking branch 'origin/topic/bernhard/ssl-new-events'
* origin/topic/bernhard/ssl-new-events:
  Add two more ssl events - one triggered for each handshake message and one triggered for the tls change cipherspec message.

BIT-1201 #merged
2014-06-06 13:24:17 -07:00
Robin Sommer
23c1f07bb6 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  re-add notice suppression for expiring certificates
2014-06-06 13:05:57 -07:00
Robin Sommer
cfda4113f4 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  add new TLS extension type numbers from IANA
2014-06-05 14:45:50 -07:00
Jon Siwek
8ec8dfa705 Fix misc/load-balancing.bro's reference to PacketFilter::sampling_filter
BIT-1197 #close
2014-05-29 15:40:41 -05:00
Jon Siwek
8383828b02 Fix potential mem leak in remote function/event unserialization.
I say potential because a code path to get in the required state is
not obvious (if one even exists).
2014-05-28 15:12:38 -05:00
Jon Siwek
3874286ff7 Update CHANGES, VERSION, submodules. 2014-05-20 12:47:38 -05:00
Jon Siwek
943495cfd3 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  intel framework plugin for ssl server_name extension was not updated after api changes :(
2014-05-20 10:58:47 -05:00
Jon Siwek
fb7c3677dc Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Remove remaining references to BROMAGIC
  Fix typos and formatting in event and BiF documentation
2014-05-20 10:29:45 -05:00
Jon Siwek
daab3145fa Update submodules, CHANGES, VERSION. 2014-05-19 16:38:21 -05:00
Jon Siwek
aee708c703 Change record ctors to only allow record-field-assignment expressions.
Previously, any expression that evaluates to a record may have been used
in a record ctor's expression list.  This didn't work in all cases,
doesn't provide any unique functionality that can't be done otherwise,
and is possibly a path to introducing subtle scripting errors.

BIT-1192 #closed
2014-05-19 15:50:00 -05:00