Commit graph

4 commits

Author SHA1 Message Date
Daniel Thayer
3f9e7138bd More bro-to-zeek renaming in the unit tests 2019-05-16 02:27:54 -05:00
Robin Sommer
789cb376fd GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
This also installs symlinks from "zeek" and "bro-config" to a wrapper
script that prints a deprecation warning.

The btests pass, but this is still WIP. broctl renaming is still
missing.

#239
2019-05-01 21:43:45 +00:00
Jon Siwek
995368e68c Remove variable content from weird names
This changes many weird names to move non-static content from the
weird name into the "addl" field to help ensure the total number of
weird names is reasonably bounded.  Note the net_weird and flow_weird
events do not have an "addl" parameter, so information may no longer
be available in those cases -- to make it available again we'd need
to either (1) define new events that contain such a parameter, or
(2) change net_weird/flow_weird event signature (which is a breaking
change for user-code at the moment).

Also, the generic handling of binpac exceptions for analyzers which
to not otherwise catch and handle them has been changed from a Weird
to a ProtocolViolation.

Finally, a new "file_weird" event has been added for reporting
weirdness found during file analysis.
2019-04-01 18:30:11 -07:00
Jon Siwek
defed7b6f3 Adjustments to modbus test cases.
- Added a test for binpac exception handling -- the generated code
  should use "binpac::Exception" and not "Exception" for exception
  handling logic to avoid accidental overshadowing by
  the analyzer-specific type "binpac::ModbusTCP::Exception", which
  could lead to interesting asserts being triggered in binpac.

- Update baseline for the event coverage test -- seems that more
  events get generated with working exception handling in the generated
  binpac parser code.

- Coverage baseline was giving wrong number of events covered.
2012-11-12 11:51:42 -06:00