Commit graph

10798 commits

Author SHA1 Message Date
Jon Siwek
70e14cb7d5 Fix CommentedTypeDecl to track whether it's in a record like TypeDecl does. 2011-05-12 19:55:26 -05:00
Jon Siwek
f70b5ece8c Add note to stub files used for grouping script docs. 2011-05-12 15:13:51 -05:00
Jon Siwek
3fe92fc1ff Remove duplicate 'addr_set' type declaration. 2011-05-12 13:01:58 -05:00
Jon Siwek
6b7e300e0b Remove unused events 'bro_signal' and 'no_handler' 2011-05-12 13:00:22 -05:00
Jon Siwek
c14afc7079 Adding conn.bro documentation for 'conn_state' and 'history' fields. 2011-05-12 12:47:43 -05:00
Jon Siwek
650177cde0 DNS policy scripts documentation cleanup/tweaks. 2011-05-12 12:19:43 -05:00
Jon Siwek
68784634ff Fixing doc tests in the btest suite.
- reduce number of docs generated by `make doc`; will add as they're reviewed

- Conforming to new Notice::Type enum for notices
2011-05-12 11:21:20 -05:00
Seth Hall
7399b79dd2 Updating DNS scripts based on comments from Jon. 2011-05-11 14:17:35 -04:00
Seth Hall
01499922ac Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-05-11 10:53:56 -04:00
Robin Sommer
da5618b9ba Portability fixes for tests on MacOS. 2011-05-10 21:27:44 -07:00
Robin Sommer
a8f15616f2 Merge branch 'master' of ssh://git.bro-ids.org/bro 2011-05-10 20:58:02 -07:00
Robin Sommer
33f1e00264 Updating submodule(s). 2011-05-10 20:57:45 -07:00
Robin Sommer
4ed9969f83 Fixing bug with uninitialized counter. 2011-05-10 20:54:24 -07:00
Robin Sommer
4bf6d6092b Sorting was still not consistent. 2011-05-10 19:48:40 -07:00
Robin Sommer
b16bb7fff4 Test updates.
Includes splitting up one test which's output now depends on wether
we've compiled with IPv6 support or not.
2011-05-10 19:33:37 -07:00
Robin Sommer
1b76b76bb0 Removing old istate test-suite. 2011-05-10 18:58:19 -07:00
Robin Sommer
42a1efa77f Updating submodule(s). 2011-05-10 18:30:05 -07:00
Robin Sommer
69391afc42 A hack to report missing GeoIP support only once.
This closes #357, but #455 captures the need for a more general
solution.
2011-05-10 18:29:05 -07:00
Robin Sommer
63f7359e1e Bugfix: vectors in records were not initalized.
Closes #421.
2011-05-10 18:19:27 -07:00
Robin Sommer
0815ea9188 If IPv6 default is not compiled in, the default BPF filters now
excludes IPv6 packets.
2011-05-10 18:10:32 -07:00
Robin Sommer
ee872c12c8 New bif bro_has_ipv6() to check whether IPv6 support is compiled in. 2011-05-10 18:02:10 -07:00
Robin Sommer
e6208c8950 Bringing connection state history back, which was accidentally deleted
from conn.bro.

However, this is primarily for the record, conn.bro will be replaced
with a new version soon.
2011-05-10 17:56:53 -07:00
Robin Sommer
61c929bc16 Updating btests and a Makefile.
"make" now runs all the tests.
2011-05-10 17:56:45 -07:00
Robin Sommer
03cd7a47ac Moving the test-scripts from the old test-suite over to btest. 2011-05-10 17:28:09 -07:00
Robin Sommer
d1db768624 Fix for major bug in POP3 analyzer, which didn't recognize '.'
terminators in multi-line replies if the terminator was bare (no
newline). This caused it to ignore the rest of the session that it's
analyzing.

Patch from #444 by Vern.
2011-05-10 17:11:01 -07:00
Gregor Maier
c24f3391a3 Fix compiler warning with gcc-4.4.4 2011-05-10 12:31:53 -07:00
Seth Hall
ebf75eb373 Found another software string that isn't parsed correctly.
I added it to the parse testing script but left it
commented out.
2011-05-10 15:09:14 -04:00
Seth Hall
2ee78fba12 Fixed a problem with constructing received from header paths.
- If mail between the MUA and mail server is seen, no
  received from headers will be there.  This situations
  is dealt with by setting the two hosts involved in the
  mail transfer as the last two hosts in the path.
2011-05-10 15:08:37 -04:00
Seth Hall
c0ff43fd4a Improved HTTP::build_url function.
- Scripts now deal with host headers containing the port value.
- build_url function copes with missing the request now
  (only seeing the response for some reason).
2011-05-10 13:49:55 -04:00
Jon Siwek
e2c194c990 Fix make doc CMake 2.8.3 incompatibility.
CMake 2.8.4 seems to be able to handle add_custom_target()
interdependencies with the DEPENDS arguments, but 2.8.3 does not.

Using add_dependencies() to create top-level target
dependencies works in both cases.
2011-05-10 11:03:56 -05:00
Jon Siwek
80143e72ba Fixing top-level Makefile target 'doc-clean' (now 'docclean') 2011-05-10 09:38:50 -05:00
Robin Sommer
5cd6394916 Merge remote branch 'remotes/origin/topic/jsiwek/doc-framework'
* remotes/origin/topic/jsiwek/doc-framework:
  Adding example documentation for a script's use of logging features.
  Adding &log attribute to static attr_names array.
  Small typo fix.
  Bro doc mode now tracks record redefs that extend its field list.
  BroBifDoc was unneeded; now dead code, so removed.
  Bro doc mode now only does a "shallow" copy of declared record types
  Bro's doc mode now terminates after processing bro_init but before net_run
  Fixes related to `make doc` handling of script summary text (##! comments)
  Overhaul of "doc" build target for generating policy script documentation.
  Add parser error hint when in doc mode about checking ## comment syntax.
  Move stuff related to policy script documentation from doc/ to doc/scripts/
  Fixing example.bro's auto-reST generation baseline test.
2011-05-09 19:02:39 -07:00
Robin Sommer
bd9855a380 Merge of Gregor's conn-size branch.
If 'use_conn_size_analyzer' is true, the event engine tracks number of
packets and raw IP bytes per connection. If report_conn_size_analyzer
is true, these values are included as four new columns into conn.log

I changed conn.bro so that the value of report_conn_size_analyzer
follows that of use_conn_size_analyzer. For the new conn.log, we
probably want to get rid of report_conn_size_analyzer anyway.
2011-05-09 17:14:31 -07:00
Robin Sommer
7524cce186 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Fix compile errors possible on some platforms.
2011-05-08 21:05:35 -07:00
Jon Siwek
35b7caf44f Fix compile errors possible on some platforms.
Include <algorithm> in some sources that require it; addresses #430

Places where STL's min() template function could get used with
arguments of differing types can fail to deduce the right template type.
These are fixed with some type tweaking of local variables and also
giving an explicit template argument for good measure.
2011-05-08 19:53:41 -05:00
Seth Hall
a1f9ba8b1b Added metrics framework to all.bro 2011-05-08 03:58:49 -04:00
Seth Hall
474139f220 Start of the metrics framework. 2011-05-08 03:57:55 -04:00
Seth Hall
28bda4b077 Loading the webmail-ident script in the smtp.bro script. 2011-05-08 03:17:27 -04:00
Seth Hall
0f583f3e00 Removed some unnessary types from the base software script. 2011-05-08 03:17:03 -04:00
Seth Hall
13189cc08a Added the initial version of the web application detection script.
- Logging is done through the software framework.
- Versions are not detected yet.
2011-05-08 03:16:35 -04:00
Seth Hall
5aa85cc47a Created the webmail identification script. 2011-05-08 03:00:05 -04:00
Seth Hall
789908d182 More script updates from Robin's feedback. 2011-05-08 02:27:19 -04:00
Jon Siwek
af798620de Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-06 19:25:53 -05:00
Jon Siwek
80abad01a9 Adding example documentation for a script's use of logging features. 2011-05-06 19:23:15 -05:00
Jon Siwek
2a21ebba2e Adding &log attribute to static attr_names array. 2011-05-06 18:52:23 -05:00
Jon Siwek
34c475d4db Small typo fix. 2011-05-06 18:24:38 -05:00
Robin Sommer
cde6076857 Updating submodule(s). 2011-05-05 21:06:29 -07:00
Jon Siwek
cf0a542f7c Bro doc mode now tracks record redefs that extend its field list. 2011-05-05 10:43:15 -05:00
Jon Siwek
aec63df90f BroBifDoc was unneeded; now dead code, so removed. 2011-05-04 22:01:01 -05:00
Jon Siwek
6d867cf999 Bro doc mode now only does a "shallow" copy of declared record types
This is necessary so that the cloned type will be able to see additions
to the original type's list of fields
2011-05-04 21:53:51 -05:00