Netcontrol log now includes more information; before that, it had not
quite caught up to the new capabilities (like flow modifying and
redirection, as well as mac addresses).
Furthermore, this fixes a number of bugs with cluster mode (like
duplicate events), test failures due to updates in Bro, etc.
Events now generally carry the unique ID of the backend that is given
during initialization; there are a few more functions and other
bugfixes.
A few netcontrol tests are still broken (mostly due to a pcap update in
msater).
* 'master' of https://github.com/marktayl/bro:
Removed duplicate parameter for IRC "QUIT" event handler.
Also add a test-case that checks the output of the quit
event handler.
Radiotap support should be fully functional now with Radiotap
packets that include IPv4 and IPv6. Other radiotap packets are
silently ignored. This includes a test which has 802.11 headers
both with and without QoS data.
The change from #49 made it an error to not have a URI. That however
then led requests with an URI yet no version to abort as well.
Instead, we now check if the token following the method is an "HTTP/"
version identifier. If, so accept that the URI is empty (and trigger
a weird) but otherwise keep processing.
Adding test cases for both HTTP requests without URI and without
version.
- Daniel Guerra pointed out a type issue for SIP
request and response code length fields which is now
corrected.
- Some redundant code was removed.
- if/else tree modified to use switch instead.
Cleaned up the surrounding code a bit and also added '[' as another
case (not sure that can happen, but doesn't hurt eihter).
* 'master' of https://github.com/aeppert/bro:
Whitespace
Remove
Remove.
Fix for JSON formatter
A fatal error, especially in DEBUG, should result in a core.
Seems to fix a case where an entry in the table may be null on insert.
The alert in this case is caused by the server name in the SNI not being
recognized by the server, which triggers an alert. Since the server is
an apache, and this might happen reasonably often, the new signature
allows one TLS alert before the server hello is expected.
Without this patch, this scenario results in a segmentation fault.
I opted to keep the separator present for non-existing elements. Hence,
a vector a, [empty], b with separator "|" will result in
a||b
* origin/topic/yunzheng/x509-generalizedtime:
Make x509 end-of-string-check nicer.
Refactor X509 generalizedtime support and test.
Fixed parsing of V_ASN1_GENERALIZEDTIME timestamps in x509 certificates
BIT-1481 #merged
* origin/topic/dnthayer/ticket1481:
Improve a few test canonifiers
Remove unnecessary use of TEST_DIFF_CANONIFIER
Fixed some test canonifiers to read only from stdin
