Commit graph

989 commits

Author SHA1 Message Date
Seth Hall
a97cca4e86 Chaged http/detect to http/detect-sqli.
- It was only detecting SQL injections anyway, so it seems
  to make sense.
2011-05-03 15:34:42 -04:00
Seth Hall
e9089d2016 Merge branch 'topic/policy-scripts-new' of ssh://git.bro-ids.org/bro into topic/policy-scripts-new 2011-05-03 15:17:19 -04:00
Seth Hall
2ba0baafd4 Small updates to deal with comments from Robin and Jon.
- Modifications for changes to vectors too.
2011-05-03 15:16:57 -04:00
Don Appleman
7dfb9e1c7e Move loading of tcp.bro from command line to script body 2011-05-03 13:49:03 -05:00
Seth Hall
ea2b0c3e73 Updates for conn script based on feedback from Robin. 2011-05-03 14:48:16 -04:00
Seth Hall
ed37d8ae36 Updates to DNS scripts from Robin's feedback. 2011-05-03 14:11:05 -04:00
Seth Hall
0a0dbcc44e Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-05-02 22:25:54 -04:00
Robin Sommer
4aa844aa87 Switching vectors from being 1-based to 0-based.
This is obviously a change that break backwards-compatibility. I hope
I caught all cases where vectors are used ...

I've completely removed the VECTOR_MIN constant. Turns out that was
already not working: some code pieces were nevertheless hard-coding
the 1-based indexing ...
2011-05-02 17:10:18 -07:00
Jon Siwek
7490095e42 Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-02 15:50:21 -05:00
Jon Siwek
ceaba8077b Fixes related to make doc handling of script summary text (##! comments)
- Summary comments (##!) can now be placed at the beginning of
BiF files (but still outside C segments).  An issue was fixed where
these comments would mistakenly be transferred into the generated
.func_def file and cause a compile error. I completely removed writing
any opt_ws value into the .func_def file because it was currently not
writing anything besides whitespace.

- The generation of reST for the collecting of "groups" of policy
script documentation now happens at build time of `make doc` through the
use of a helper script rather than doing this at configure time so that
changes to summary text will always be reflected in the documentation.
2011-05-02 15:34:34 -05:00
Robin Sommer
f564023a12 Updating submodule(s). 2011-05-02 11:29:07 -07:00
Robin Sommer
90302a8834 Adding istate tests to default btest configuration. 2011-05-02 11:28:40 -07:00
Jon Siwek
54e9946fc7 Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-02 12:23:56 -05:00
Robin Sommer
eed759b7b5 Increasing serialization format version for the recent 64-bit changes. 2011-05-02 08:43:55 -07:00
Robin Sommer
5478bd5b1d Updating tests.
The istate tests now all pass except for the SSL one. Still need to
figure out why it fails.
2011-05-02 08:43:39 -07:00
Seth Hall
ebf907fa33 More small cleanup. 2011-05-02 11:41:38 -04:00
Seth Hall
7fc195e82e Merge branch 'topic/policy-scripts-new' of ssh://git.bro-ids.org/bro into topic/policy-scripts-new 2011-04-29 21:41:46 -04:00
Seth Hall
12820563a1 Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-29 21:39:23 -04:00
Robin Sommer
9ddc26328d Support for (mixed) MPLS and VLAN traffic, and a new default BPF
filter. (Seth Hall and Robin Sommer)

- Merging in the patch from #264, which provides support for mixed
  VLAN and MPLS traffic.

- Changing Bro's default filter from being built dynamically to being
  a static "ip or not ip". To get the old behaviour back (i.e., the
  dynamically built filter), redef "all_packets" to false.

- print-filter.bro now always prints the filter that Bro is actually
  using, even if overriden from the command line.
2011-04-29 09:10:43 -07:00
Robin Sommer
b01aa66fe6 Fixing some more format strings. 2011-04-27 21:31:23 -07:00
Robin Sommer
714289bd13 Changing the HTTP's analyzers internals to use 64-bit integers.
(Gregor Maier).

This is the patch from #326, plus some cleanup.
2011-04-27 21:25:51 -07:00
Seth Hall
8e8e460ede Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-27 16:07:26 -04:00
Seth Hall
ee65231968 Merge branch 'topic/policy-scripts-new' of ssh://git.bro-ids.org/bro into topic/policy-scripts-new 2011-04-27 16:03:10 -04:00
Seth Hall
651bfc2e19 Bugfixes and improvements the dns script. 2011-04-27 16:02:59 -04:00
Don Appleman
d5bfc6f5bd Added "policy" subdirectory to list of TestDirs 2011-04-27 12:53:40 -05:00
Seth Hall
5d2a9f6bcc HTTP script rework and bug fixing. 2011-04-27 10:15:15 -04:00
Robin Sommer
80376653c2 Updating submodule(s). 2011-04-26 21:30:37 -07:00
Jon Siwek
f10d2e10ea Overhaul of "doc" build target for generating policy script documentation.
It's now all implemented in CMake scripting.

The generation of reST docs is now a distinct target, "restdoc", while
the target to generate HTML docs, "doc", depends on "restdoc".  reST doc
generation supports incremental builds (documentation for a given policy
script is only regenerated when it is out of date), but HTML doc generation
via ``make doc`` is not incremental (Sphinx always starts with fresh input).

Building the "restdoc" target is now covered by a btest to ensure all
policy scripts are parse-able when Bro is in "doc mode".

Generated reST docs should now support "@load"ing from subdirectories.  e.g.
"@load foo/baz" and "@load bar/baz" will now generate the right xref links.
2011-04-26 22:13:04 -05:00
Seth Hall
58370e7aab Added software detection for unspecified WebKit based browsers. 2011-04-26 15:24:25 -04:00
Seth Hall
e6fd1d9178 Fixed bug with pending requests in HTTP script. 2011-04-26 15:24:02 -04:00
Seth Hall
64e7fd967a Fixed a bug with browser version parsing.
* The full user-agent string wasn't being sent along
  to the log file in some cases when parsing user-agents.
2011-04-26 14:24:50 -04:00
Jon Siwek
9875c2ba9c Merge branch 'master' into topic/jsiwek/doc-framework 2011-04-26 10:27:06 -05:00
Seth Hall
cc1501d6e3 Fixed a couple of bugs in the IRC analysis script.
* Also removed a debug print from the software/vulnerable script.
2011-04-26 11:24:38 -04:00
Seth Hall
6621a3001a Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-26 11:18:58 -04:00
Seth Hall
f6e67a6a87 More script updates. 2011-04-26 11:08:04 -04:00
Robin Sommer
5662fe7358 Updating baselines. 2011-04-23 10:47:14 -07:00
Robin Sommer
c41da9ca99 Fixing bug with deleting still unset record fields of table type. 2011-04-23 10:40:07 -07:00
Seth Hall
adec99751d More script updates. 2011-04-23 02:58:44 -04:00
Robin Sommer
59d6202104 Merge remote branch 'origin/topic/robin/conn-ids'
* origin/topic/robin/conn-ids:
  Moving uid from conn_id to connection, and making output determistic if a hash seed is given.
  Extending conn_id with a globally unique identifiers.
2011-04-22 22:13:44 -07:00
Seth Hall
0a151882ae New software parsing tests and all pass now. 2011-04-22 23:39:19 -04:00
Seth Hall
0d870d203d Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-22 22:22:08 -04:00
Robin Sommer
46b1fd9850 Delete operator for record fields.
"delete x$y" now resets record field "x" back to its original state if
it is either &optional or has a &default. "delete" may not be used
with non-optional/default fields.
2011-04-22 18:40:14 -07:00
Robin Sommer
964060c32f Fixing bug with nested record coercions. 2011-04-22 18:07:29 -07:00
Robin Sommer
386f9db140 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Fixed another do_split bug and included a test for the fix.
2011-04-22 08:43:36 -07:00
Seth Hall
6826b58fb4 Merge remote branch 'origin/master' into topic/seth/ssl-binpac 2011-04-22 09:53:25 -04:00
Seth Hall
c5a19f7cdc Fixed another do_split bug and included a test for the fix. 2011-04-22 08:00:28 -04:00
Robin Sommer
dbecbccdbc Updating submodule(s). 2011-04-21 19:59:49 -07:00
Robin Sommer
5eb74bea67 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Fix CheckTypes.cmake from generating different config.h's between CMake runs.
2011-04-21 19:54:56 -07:00
Robin Sommer
c80cd26e17 Merge remote branch 'origin/topic/seth/decode-nbns-names'
* origin/topic/seth/decode-nbns-names:
  Updates and tests for netbios name BiF.
2011-04-21 19:49:24 -07:00
Robin Sommer
9fe52512eb Merge remote branch 'origin/topic/seth/fix-do_split'
* origin/topic/seth/fix-do_split:
  Fixed the do_split bug and added a test.
2011-04-21 19:42:50 -07:00