Commit graph

15 commits

Author SHA1 Message Date
Jon Siwek
a994be9eeb Merge remote-tracking branch 'origin/topic/seth/zeek_init'
* origin/topic/seth/zeek_init:
  Some more testing fixes.
  Update docs and tests for bro_(init|done) -> zeek_(init|done)
  Implement the zeek_init handler.
2019-04-19 11:24:29 -07:00
Seth Hall
8cefb9be42 Implement the zeek_init handler.
Implements the change and a test.
2019-04-14 08:37:35 -04:00
Daniel Thayer
18bd74454b Rename all scripts to have ".zeek" file extension 2019-04-11 21:12:40 -05:00
Jon Siwek
9a295a7009 Merge branch 'master' of https://github.com/spitfire55/bro
* 'master' of https://github.com/spitfire55/bro:
  Revert DNS query 255 from ANY to *
  Missing commas...
  Fix typo in dce-rpc consts
  Refactor to use consistent numeric type in dce_rpc. Add missing DNS query type codes

I added back in DNS constants for PTR, EDNS, and ANY to avoid breaking
code for any people that use them.

Also omitted the DNP3 function code 0x83 name change from
"AUTHENTICATE_RESP" to "AUTHENTICATE_RESPONSE", again to avoid
potentially breaking code unnecessarily: "RESP" vs. "RESPONSE" is not
wrong in any sense, just maybe a matter of clarify.
2018-10-16 15:56:37 -05:00
Dale Lakes
3c765731b3 Refactor to use consistent numeric type in dce_rpc. Add missing DNS query type codes 2018-10-15 19:17:53 -04:00
Jon Siwek
186e67ec1d Allow logging filters to inherit default path from stream.
This allows the path for the default filter to be specified explicitly
when creating a stream and reduces the need to rely on the default path
function to magically supply the path.

The default path function is now only used if, when a filter is added to
a stream, it has neither a path nor a path function already.

Adapted the existing Log::create_stream calls to explicitly specify a
path value.

Addresses BIT-1324
2015-03-19 14:49:55 -05:00
Hui Lin
794273913f add test trace in which DNP3 packets are over UDP; update test scripts and baseline results 2015-01-07 15:04:22 -06:00
Hui Lin
81606e7ff4 Renameing the DNP3 TCP analyzer 2014-08-25 10:33:28 -05:00
Hui Lin
fb21236661 quickly fix another bug; adding missing field of the declaration of dnp3_request_application_header and dnp3_response_application_header 2014-08-16 11:01:30 -05:00
Jon Siwek
b83d4a9c84 Fix some things in DNP3 UDP analyzer.
- DeliverPacket override had a wrong parameter.
- Change the DNP3 plugin to provide both UDP and TCP analyzer versions.
- Add a DPD signature.
2014-08-06 15:41:53 -05:00
Daniel Thayer
8f2336f531 Add README files for base/protocols
The text from these README files appears on the "Bro Script Packages"
page after building the documentation.
2013-10-17 12:47:32 -05:00
Daniel Thayer
c224fbe7f8 Fix typos and formatting in the other protocol docs 2013-10-16 18:07:34 -05:00
Robin Sommer
45f1b89f60 Merge branch 'topic/robin/dnp3-merge-v3'
Includes a bit more docs/comments cleanup. We should eventually
document the events further but it should suffice for now.

* topic/robin/dnp3-merge-v3:
  Tiny bit of cleanup and adapting the new test.
  added a test case for dnp3 packets with only link layer
  added condition to check DNP3 packet without app layer data
  Fixing well-known port.
  Pluginizing the DNP3 analyzer, plus a basic script logging requests and replies.
2013-08-12 11:39:03 -07:00
Robin Sommer
36c2433075 Fixing well-known port.
This fixes the remaining test.
2013-08-11 15:59:32 -07:00
Robin Sommer
306d4fa6f9 Pluginizing the DNP3 analyzer, plus a basic script logging requests
and replies.

Almost ready, but now 1 test fails again ...

[Note I broke git history by copying over the files into a new branch.]
2013-08-01 17:36:11 -07:00