Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 15:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
3304 commits 386 branches 195 tags 257 MiB
Commit graph

13 commits

Author SHA1 Message Date
Jon Siwek
69afc4a882 Add an error for record coercions that would orphan a field. 
These cases should be avoidable by fixing scripts where they occur and
they can also help catch typos that would lead to unintentional runtime
behavior.

Adding this already revealed several scripts where a field in an inlined
record was never removed after a code refactor.
 2013-01-24 09:56:19 -06:00
Vlad Grigorescu
f43576cff3 Fix some Info:Record field documentation. 2012-07-13 14:04:24 -04:00
Seth Hall
a44612788e Some small fixes to further reduce SOCKS false positive logs. 2012-07-11 16:53:46 -04:00
Robin Sommer
fb8e9fc5f0 Merge remote-tracking branch 'origin/topic/seth/tunnels-merge' 
* origin/topic/seth/tunnels-merge:
  Add another SOCKS command.

Conflicts:
	scripts/base/protocols/socks/consts.bro
 2012-06-21 10:12:43 -07:00
Seth Hall
3eb16e5738 Add another SOCKS command. 2012-06-21 02:07:30 -04:00
Robin Sommer
54670817fa Merge remote-tracking branch 'origin/topic/seth/tunnels-merge' 
* origin/topic/seth/tunnels-merge:
  Fixed some problems with the SOCKS analyzer and tests.

Conflicts:
	scripts/base/protocols/socks/main.bro
	src/socks-analyzer.pac
 2012-06-20 21:05:04 -07:00
Seth Hall
6b8b4dab71 Fixed some problems with the SOCKS analyzer and tests. 2012-06-20 22:57:46 -04:00
Robin Sommer
6cda00c75e Merge remote-tracking branch 'origin/topic/seth/tunnels-merge' 
* origin/topic/seth/tunnels-merge:
  SOCKS DPD fixes.
  Fix a bug in the SOCKS analyzer.
  SOCKS and tunnel test updates.
  Updates for the SOCKS analyzer.
  Very small updates to the tunnels framework.
 2012-06-20 14:33:18 -07:00
Seth Hall
f59736cb17 SOCKS DPD fixes. 
- Restricted the SOCKS 5 DPD signatures further.

- Added protocol violations.
 2012-06-20 15:12:52 -04:00
Seth Hall
896f252a31 Updates for the SOCKS analyzer. 
- Now supports SOCKSv5 in the analyzer and the DPD sigs.

- Reworked the core events.

- Tests.

- A SOCKS log!
 2012-06-20 13:58:25 -04:00
Robin Sommer
c7c3ff7af9 Adding a SOCKS test case. 
However, I'm not sure the output is right.
 2012-06-15 16:01:59 -07:00
Jon Siwek
b8e1604ab5 Make tunnels always identifiable by UID, tunnel.log now gets populated. 
conn.log now sets a field indicating all the parent tunnel UIDs over
which a connection operated and cross reference the UIDs found in
the tunnel.log.

Also some renaming of tunnel related types at the scripting layer.
 2012-04-26 12:29:59 -05:00
Seth Hall
e2da969415 Return of Robin's old SOCKS analyzer/decapsulator and tunnel code checkpoint. 
- More discussion is needed to figure out how to integrate the SOCKS analyzer best.

- Tunnels framework now logs for the SOCKS analyzer.
 2012-04-21 23:50:09 -04:00