Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
622 commits 388 branches 197 tags 276 MiB
Commit graph

95 commits

Author SHA1 Message Date
Don Appleman
7dfb9e1c7e Move loading of tcp.bro from command line to script body 2011-05-03 13:49:03 -05:00
Seth Hall
0a0dbcc44e Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-05-02 22:25:54 -04:00
Robin Sommer
4aa844aa87 Switching vectors from being 1-based to 0-based. 
This is obviously a change that break backwards-compatibility. I hope
I caught all cases where vectors are used ...

I've completely removed the VECTOR_MIN constant. Turns out that was
already not working: some code pieces were nevertheless hard-coding
the 1-based indexing ...
 2011-05-02 17:10:18 -07:00
Robin Sommer
90302a8834 Adding istate tests to default btest configuration. 2011-05-02 11:28:40 -07:00
Robin Sommer
5478bd5b1d Updating tests. 
The istate tests now all pass except for the SSL one. Still need to
figure out why it fails.
 2011-05-02 08:43:39 -07:00
Seth Hall
12820563a1 Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-29 21:39:23 -04:00
Robin Sommer
9ddc26328d Support for (mixed) MPLS and VLAN traffic, and a new default BPF 
filter. (Seth Hall and Robin Sommer)

- Merging in the patch from #264, which provides support for mixed
  VLAN and MPLS traffic.

- Changing Bro's default filter from being built dynamically to being
  a static "ip or not ip". To get the old behaviour back (i.e., the
  dynamically built filter), redef "all_packets" to false.

- print-filter.bro now always prints the filter that Bro is actually
  using, even if overriden from the command line.
 2011-04-29 09:10:43 -07:00
Don Appleman
d5bfc6f5bd Added "policy" subdirectory to list of TestDirs 2011-04-27 12:53:40 -05:00
Seth Hall
6621a3001a Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-26 11:18:58 -04:00
Seth Hall
f6e67a6a87 More script updates. 2011-04-26 11:08:04 -04:00
Robin Sommer
5662fe7358 Updating baselines. 2011-04-23 10:47:14 -07:00
Robin Sommer
c41da9ca99 Fixing bug with deleting still unset record fields of table type. 2011-04-23 10:40:07 -07:00
Seth Hall
adec99751d More script updates. 2011-04-23 02:58:44 -04:00
Robin Sommer
59d6202104 Merge remote branch 'origin/topic/robin/conn-ids' 
* origin/topic/robin/conn-ids:
  Moving uid from conn_id to connection, and making output determistic if a hash seed is given.
  Extending conn_id with a globally unique identifiers.
 2011-04-22 22:13:44 -07:00
Seth Hall
0a151882ae New software parsing tests and all pass now. 2011-04-22 23:39:19 -04:00
Seth Hall
0d870d203d Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-22 22:22:08 -04:00
Robin Sommer
46b1fd9850 Delete operator for record fields. 
"delete x$y" now resets record field "x" back to its original state if
it is either &optional or has a &default. "delete" may not be used
with non-optional/default fields.
 2011-04-22 18:40:14 -07:00
Robin Sommer
964060c32f Fixing bug with nested record coercions. 2011-04-22 18:07:29 -07:00
Seth Hall
c5a19f7cdc Fixed another do_split bug and included a test for the fix. 2011-04-22 08:00:28 -04:00
Robin Sommer
c80cd26e17 Merge remote branch 'origin/topic/seth/decode-nbns-names' 
* origin/topic/seth/decode-nbns-names:
  Updates and tests for netbios name BiF.
 2011-04-21 19:49:24 -07:00
Robin Sommer
9fe52512eb Merge remote branch 'origin/topic/seth/fix-do_split' 
* origin/topic/seth/fix-do_split:
  Fixed the do_split bug and added a test.
 2011-04-21 19:42:50 -07:00
Robin Sommer
da0ea67453 Fixing btests. 
- When Bro is given a PRNG seed, it now uses its own internal random
  number generator that produces consistent results across sytems.
  Note that this internal generator isn't very good, so it should only
  be used for testing purposes.

- The BTest configuration now sets the environemnt variables TZ=UTC
  and LANG=C to ensure consistent results.

- Fixing doc markup in logging.bro.

- Updating baselines.
 2011-04-21 19:31:44 -07:00
Seth Hall
8b363e934a More updates to software logging and more tests. 2011-04-21 14:25:52 -04:00
Seth Hall
6275bc555d Merge remote branch 'origin/master' into topic/policy-scripts-new 
Conflicts:
	policy/conn.bro
 2011-04-21 01:16:08 -04:00
Robin Sommer
13a492091f Merge remote branch 'origin/topic/robin/logging-internals' 
Includes some additional cleanup.
 2011-04-20 21:30:41 -07:00
Seth Hall
5a868eefda More extensive base script updating. 
* This is basically another checkpoint, but the difference
  is that in this one all.bro loads just about all of the
  new scripts and functionality.
 2011-04-20 23:14:54 -04:00
Seth Hall
c564f545c0 Updates and tests for netbios name BiF. 
* New BiF named: decode_netbios_name_type
* \x01 and \x02 are now decoded because I saw those
  bytes being actively used in names.
 2011-04-20 15:59:11 -04:00
Seth Hall
5c47f1b155 Many more script updates. 2011-04-20 08:53:22 -04:00
Seth Hall
58f3b3921d Merge remote branch 'origin/topic/robin/logging-internals' into topic/policy-scripts-new 2011-04-19 22:54:32 -04:00
Seth Hall
cba5766bc8 Fixed the do_split bug and added a test. 
* do_split was having a problem if there was another match
  after the end of the number of separators.  It would only
  return the match up to the point of the next match instead
  of the rest of the string.
 2011-04-19 22:24:46 -04:00
Seth Hall
7a1fd6498c Merge remote branch 'origin/topic/robin/logging-internals' into topic/policy-scripts-new 2011-04-19 20:35:00 -04:00
Robin Sommer
5a6311d360 Implementing a VectorCoerceExpr. 
Turns out we didn't have that yet.

I don't remember who implemented vectors originally, but he does owe
us all round at Jupiter ...
 2011-04-19 16:58:18 -07:00
Robin Sommer
b3b5a73113 Fixing problem with optional fields. 2011-04-19 16:22:40 -07:00
Robin Sommer
a4a47c3df1 Merge remote branch 'origin/topic/seth/count_to_addr' 
* origin/topic/seth/count_to_addr:
  Adjusting BiF name to indicate v4 addresses only.
  count_to_addr function
 2011-04-19 15:52:16 -07:00
Seth Hall
61be2f5bd3 Adjusting BiF name to indicate v4 addresses only. 
* Function is now named count_to_v4_addr
 2011-04-19 00:30:56 -04:00
Robin Sommer
e7bde27f2d Merge remote branch 'origin/topic/jsiwek/doc-framework' 2011-04-18 14:54:23 -07:00
Seth Hall
dfd9b40466 count_to_addr function 
* Updates to_count to cope with 64bit ints.
* Adds count_to_addr which will turn a count into an IPv4 address.
* Includes tests.
 2011-04-18 15:22:48 -04:00
Seth Hall
3b4e452e66 Readding the software parse testing script. 2011-04-18 14:22:21 -04:00
Seth Hall
2464cc6e37 Merge remote branch 'origin/topic/robin/logging-internals' into topic/policy-scripts-new 
Conflicts:
	policy.old/dns-anonymizer.bro
	policy.old/ftp-anonymizer.bro
	policy.old/http-anonymizer.bro
	policy.old/http-rewriter.bro
	policy.old/ident-rewriter.bro
	policy.old/smb-anonymizer.bro
	policy.old/smtp-rewriter.bro
	policy/all.bro
	policy/ftp.bro
	policy/smtp.bro
 2011-04-18 11:56:34 -04:00
Robin Sommer
29b0d0d1d9 Files can now be logged; their filename will be written out. 2011-04-17 20:52:18 -07:00
Robin Sommer
65016dc5e8 Updating istate tests. 
Some still don't pass:

    - events-ssl doesn't work; not clear yet why, there may be some
      problem with SSL connections.

    - broccoli needs the changes topic/jsiwek/64bit-val-fix, plus
    adaption of the protocol version.

    - pybroccoli crashes even with the 64bit-val-fix changes. Reason
      unclear.
 2011-04-17 19:53:56 -07:00
Robin Sommer
c132506203 Merge branch 'topic/robin/record-table-default' into topic/robin/logging-internals 
Includes additional fixes for the &default attribute's type checking.
 2011-04-17 12:03:58 -07:00
Robin Sommer
09d37b2026 Fixing logging filter "include" and "exclude" options. 2011-04-17 11:14:07 -07:00
Robin Sommer
58f86ae55d Fixing bug with records sometimes unnecessarily coerced on assignment. 2011-04-17 10:42:51 -07:00
Don Appleman
f99235cfdd Added a pointer to testing/btest/README for information on BTest 2011-04-14 14:04:30 -05:00
Don Appleman
4ca7ff095a Initial drop of testing/btest/README with description of the contents of the testing/btest directory, how to run BTest, and how to add a new test. 2011-04-14 13:57:10 -05:00
Jon Siwek
515b96685a Fix generated docs displaying "func" for events in identifier summary table. 2011-04-11 10:32:07 -05:00
Jon Siwek
0a14cd11f6 Move generated script doc for "private interface" to bottom of page. 2011-04-11 10:29:41 -05:00
Jon Siwek
af54714839 Add tests for auto-generating reST from bro scripts. 2011-04-08 12:02:03 -05:00
Robin Sommer
5629359a87 Test commit. 2011-04-05 16:28:55 -07:00