Commit graph

552 commits

Author SHA1 Message Date
Robin Sommer
ed91732e09 Merge remote-tracking branch 'origin/topic/seth/more-file-type-ident-fixes'
* origin/topic/seth/more-file-type-ident-fixes:
  File API updates complete.
  Fixes for file type identification.
  API changes to file analysis mime type detection.
  Make HTTP 206 reassembly require ETags by default.
  More file type identification improvements
  Fix an issue with files having gaps before the bof_buffer is filled.
  Fix an issue with packet loss in http file reporting.
  Adding WOFF fonts to file type identification.
  Extended JSON matching and added OCSP responses.
  Another large signature update.
  More signature updates.
  Even more file type ident clean up.
  Lots of fixes for file type identification.

BIT-1368 #merged
2015-04-20 13:31:00 -07:00
Seth Hall
ed375167c8 File API updates complete.
Addresses BIT-1368.
2015-04-20 10:46:48 -04:00
Robin Sommer
8bd38c2788 Add paragraph to plugin documentation. 2015-04-12 20:50:18 -04:00
Jon Siwek
a55ce01ef3 API changes to file analysis mime type detection.
Removed "file_mime_type" and "file_mime_types" event, replacing them
with a new event called "file_metadata_inferred".  It has a record
argument of type "inferred_file_metadata", which contains the mime type
information that the earlier events used to supply.  The idea here is
that future extensions to the record with new metadata will be less
likely to break user code than the alternatives (adding new events or
new event parameters).

Addresses BIT-1368.
2015-04-10 16:31:29 -05:00
Jon Siwek
dcbd0819a6 Updates related to SSH analysis.
- Some scripts used wrong SSH module/namespace scoping on events.
- Fix outdated notice documentation related to SSH password guessing.
- Add a unit test for SSH pasword guessing notice.
2015-03-30 11:30:48 -05:00
Robin Sommer
d2998b6f64 Merge branch 'master' of git.bro.org:bro
Conflicts:
	CHANGES
	VERSION
2015-03-23 12:50:30 -07:00
Jon Siwek
dbf58be0e5 Fix an example in quickstart docs.
BIT-1226 #close
2015-03-23 13:05:58 -05:00
Robin Sommer
1d49ec63f8 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1324'
I added the $path to the create_stream() calls inside doc/ as well.

* origin/topic/jsiwek/bit-1324:
  Allow logging filters to inherit default path from stream.

BIT-1324: #merged
2015-03-23 10:35:30 -07:00
Jon Siwek
739b295611 Improve documentation of 'for' loop iterator invalidation.
BIT-978 #close
2015-03-20 16:29:10 -05:00
Jon Siwek
778b37b5d0 Deprecate &rotate_interval, &rotate_size, &encrypt, &mergeable.
Addresses BIT-1305.
2015-03-13 14:54:46 -05:00
Jon Siwek
2f626fa602 Fix build warnings, clarify broker requirements, update submodule. 2015-03-06 11:07:58 -06:00
Jon Siwek
9e53722b57 Rename comm/ directories to broker/ 2015-03-05 17:02:25 -06:00
Jon Siwek
fa08083a92 Rename broker-related namespaces.
c++ namespace "comm" -> bro_broker
script module "Comm" -> BrokerComm
script module "Store" -> BrokerStore
2015-03-05 16:20:51 -06:00
Robin Sommer
d8d13df406 Updating docs for recent addition of local_resp. 2015-03-02 17:11:51 -08:00
Robin Sommer
dfc88094ab Merge remote-tracking branch 'origin/topic/jsiwek/broker'
* origin/topic/jsiwek/broker: (34 commits)
  Update broker submodule.
  Update broker submodule.
  broker integration: add missing baselines for doc tests
  broker integration: add prof.log statistics
  broker integration: add high-level usage documentation
  broker integration: add API documentation (broxygen/doxygen)
  broker integration: fix memory leak, add leak tests
  Update broker submodule.
  Improve comm tests.
  Fix gcc compile warnings.
  broker integration: fix unit tests to work when broker is not enabled.
  Add --enable-c++11 configure flag.
  broker integration: add (un)publish/(un)advertise functions
  broker integration: add knobs to set auto publish/advertise behavior
  broker integration: move listen port for unit tests to a btest variable
  broker integration: add events for incoming connection status updates
  broker integration: adapt to change in expiration_time
  Update coverage unit test baselines.
  broker integration: add Comm::enable function
  broker integration: process debug/diagnostic reports from broker
  ...

Conflicts:
	cmake
	testing/btest/Baseline/plugins.hooks/output
2015-03-02 17:10:15 -08:00
Jon Siwek
8a758d2eb7 Merge remote-tracking branch 'origin/topic/robin/plugin-updates'
* origin/topic/robin/plugin-updates:
  Doc tweak.
  Submodule update.
  Updating plugin docs to recent changes.
  Update submodules.
  Updating submodule.
  Updating submodules.
  Updating plugin tests.
  Making plugin names case-insensitive for some internal comparisions.
  Updating submodules.
  Explicitly removing some old scripts on install.
  Removing setting installation plugin path from  bro-path-dev.sh .
  Creating the installation directory for plugins at install time.

BIT-1318 #merged
BIT-1302 #closed
BIT-1312 #closed
2015-02-23 12:20:39 -06:00
Robin Sommer
abcb8e7c95 Merge remote-tracking branch 'origin/topic/jsiwek/while'
Added documentation to statement reference.

* origin/topic/jsiwek/while:
  Add 'while' statement to Bro language.

BIT-1315 #merged
2015-02-20 12:59:39 -08:00
Jon Siwek
8d19bf6381 broker integration: add high-level usage documentation
i.e. documentation of the new "comm framework" w/ examples.
2015-02-18 12:16:46 -06:00
Robin Sommer
751b6590b5 Doc tweak. 2015-02-17 15:35:28 -08:00
Robin Sommer
093d406920 Updating plugin docs to recent changes. 2015-02-17 14:03:05 -08:00
Robin Sommer
f82adb724c Merge remote-tracking branch 'origin/topic/jsiwek/deprecation'
Fixing one missing index adjustment (I believe ...)

BIT-757 #merged

* origin/topic/jsiwek/deprecation:
  Fix typo.
  Update documentation (broken links, outdated tests).
  Update NEWS for deprecated/changed functions.
  Deprecate split* family of BIFs.
  Improve use of &deprecated on functions.
  Add a new attribute: &deprecated.
2015-01-30 14:37:05 -08:00
Jon Siwek
36bc7ba5b5 Handle guess_lexer exceptions in pygments reST directive 2015-01-27 10:15:22 -06:00
Jon Siwek
7b2316262d Update documentation (broken links, outdated tests). 2015-01-21 16:38:31 -06:00
Jon Siwek
d8890ea009 Increase minimum required CMake version to 2.8. 2015-01-08 13:11:17 -06:00
Daniel Thayer
b5e9433b04 Improve documentation of the Intelligence Framework
Added some missing information and rearranged a few sentences so the order
makes more sense.
2015-01-07 00:01:35 -06:00
Jon Siwek
138438b88e Merge branch 'master' into topic/jsiwek/file-reassembly-merge
Conflicts:
	testing/btest/Baseline/plugins.hooks/output
2015-01-05 15:50:36 -06:00
Daniel Thayer
15ec117da6 Correct a typo in the Notice framework doc 2014-12-18 11:57:32 -06:00
Jon Siwek
edaf7edc11 Merge remote-tracking branch 'origin/topic/seth/files-reassembly-and-mime-updates' into topic/jsiwek/file-reassembly-merge
Conflicts:
	testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
2014-12-15 10:33:09 -06:00
Robin Sommer
19d9a8bfa2 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix some "make doc" warnings and update some doc tests
2014-12-03 14:10:49 -08:00
Daniel Thayer
cc7286b628 Fix some "make doc" warnings and update some doc tests 2014-12-01 22:43:17 -06:00
Jon Siwek
b0383c22d6 Delete prebuilt python bytecode files from git.
BIT-1291 #close
2014-12-01 10:21:41 -06:00
Seth Hall
842dfd8b4a Merge remote-tracking branch 'origin/topic/seth/files-tracking' into topic/seth/files-reassembly-and-mime-updates
Conflicts:
	testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.multipart/out
	testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
2014-11-05 11:40:26 -05:00
Vicente Jimenez Aguilar
65ab987eb6 Wrong port in scripting documentation
HTTP is port 80 not 53
2014-10-25 11:52:17 +02:00
Jon Siwek
191e5da74d Documentation fixes.
BIT-1272 #close
2014-10-14 14:43:08 -05:00
Robin Sommer
446578ea97 Updating plugin documentation.
Extending debugging section a bit, and claryyhing why some content is
missing. Also linking into new development section at top-level.
2014-10-07 15:14:39 -07:00
Robin Sommer
21a0e12d82 Merge remote-tracking branch 'origin/topic/jdopheid/BIT-1242'
* origin/topic/jdopheid/BIT-1242:
  Improved the log file reference documentation
  Added missing log files prof, stderr, stdout
  Add a test that detects changes in the list of all Bro log files
  Broke down logs into grouped sections based on use & origin
  Adding deatils for modbus_register_change.log
  More updates to log files page: descriptions
  Changing name of file
  New page for List of Log files, linked to script-reference

Very nice. I've reorganized slightly more, mostly to shrink down the
"other" category: moved some of that into "Detection" and "Files" (the
latter is small, but will hopefully grow).

BIT-1242 #merged
2014-10-07 14:35:19 -07:00
Robin Sommer
175ff9cf2d Merge remote-tracking branch 'origin/topic/dnthayer/langref'
* origin/topic/dnthayer/langref:
  Minor improvements to script language reference docs
  Add more script language reference documentation
  Split the types and attributes reference doc into two docs

Wow, this is great!

BIT-1269 #merged
2014-10-07 14:18:08 -07:00
Daniel Thayer
0ab36bca26 Merge remote-tracking branch 'origin/master' into topic/dnthayer/langref 2014-10-06 13:34:22 -05:00
Daniel Thayer
f24adc1a95 Minor improvements to script language reference docs 2014-10-06 13:27:21 -05:00
Robin Sommer
1555eb65d4 Updating plugin docs.
The remaining components are now supported as well.
2014-10-02 16:39:51 -07:00
Daniel Thayer
c16384b914 Improved the log file reference documentation
Reorganized the log file reference documentation, improved some of the
descriptions, and corrected a typo in a log filename.  Also removed
non-ascii characters that somehow got in the text.
2014-09-30 00:45:28 -05:00
Jeannette Dopheide
999f846abe Added missing log files prof, stderr, stdout 2014-09-29 10:50:46 -05:00
Seth Hall
cafd35e746 Updates the files event api and brings file reassembly up to master. 2014-09-26 00:40:37 -04:00
Jeannette Dopheide
16c70a5179 Broke down logs into grouped sections based on use & origin 2014-09-25 10:22:46 -05:00
Jon Siwek
623896dd20 Fixes to plugin quick start doc.
BIT-1261 #close
2014-09-24 10:07:12 -05:00
Jeannette Dopheide
e402a224d8 Adding deatils for modbus_register_change.log 2014-09-23 08:53:54 -05:00
Jeannette Dopheide
14940c2d89 More updates to log files page: descriptions 2014-09-22 10:59:05 -05:00
Jon Siwek
e5bd113286 Merge branch 'master' of https://github.com/cmavr8/bro 2014-09-17 09:46:06 -05:00
Daniel Thayer
d226fef723 Fixed some "make doc" warnings caused by reST formatting 2014-09-16 12:44:51 -05:00
Jeannette Dopheide
401ec39ce2 Changing name of file 2014-09-16 09:49:48 -05:00