Commit graph

13262 commits

Author SHA1 Message Date
Seth Hall
474139f220 Start of the metrics framework. 2011-05-08 03:57:55 -04:00
Seth Hall
28bda4b077 Loading the webmail-ident script in the smtp.bro script. 2011-05-08 03:17:27 -04:00
Seth Hall
0f583f3e00 Removed some unnessary types from the base software script. 2011-05-08 03:17:03 -04:00
Seth Hall
13189cc08a Added the initial version of the web application detection script.
- Logging is done through the software framework.
- Versions are not detected yet.
2011-05-08 03:16:35 -04:00
Seth Hall
5aa85cc47a Created the webmail identification script. 2011-05-08 03:00:05 -04:00
Seth Hall
789908d182 More script updates from Robin's feedback. 2011-05-08 02:27:19 -04:00
Jon Siwek
af798620de Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-06 19:25:53 -05:00
Jon Siwek
80abad01a9 Adding example documentation for a script's use of logging features. 2011-05-06 19:23:15 -05:00
Jon Siwek
2a21ebba2e Adding &log attribute to static attr_names array. 2011-05-06 18:52:23 -05:00
Jon Siwek
34c475d4db Small typo fix. 2011-05-06 18:24:38 -05:00
Robin Sommer
cde6076857 Updating submodule(s). 2011-05-05 21:06:29 -07:00
Jon Siwek
cf0a542f7c Bro doc mode now tracks record redefs that extend its field list. 2011-05-05 10:43:15 -05:00
Jon Siwek
aec63df90f BroBifDoc was unneeded; now dead code, so removed. 2011-05-04 22:01:01 -05:00
Jon Siwek
6d867cf999 Bro doc mode now only does a "shallow" copy of declared record types
This is necessary so that the cloned type will be able to see additions
to the original type's list of fields
2011-05-04 21:53:51 -05:00
Jon Siwek
d919ebed58 Bro's doc mode now terminates after processing bro_init but before net_run
Generated script reST documentation is also written out at this time
instead of at the end of lexical scanning.

The persistence serializer will no longer write out Bro's state to the
.state directory when in doc mode.
2011-05-04 21:33:21 -05:00
Jon Siwek
481a1d097b Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-04 19:38:03 -05:00
Seth Hall
61fa9c6857 Clean up on software detection scripts. 2011-05-04 11:03:44 -04:00
Seth Hall
fa914cafd9 Added $uid to more base scripts. 2011-05-04 11:03:16 -04:00
Seth Hall
05299e2990 Weird updated to logging framework. 2011-05-04 11:02:26 -04:00
Seth Hall
b03726b3dc Updating comment on the timestamp for conn logs. 2011-05-03 23:51:44 -04:00
Seth Hall
bbf4c0718f The global http script now loads correctly loads detect-sqli 2011-05-03 23:51:18 -04:00
Seth Hall
a97cca4e86 Chaged http/detect to http/detect-sqli.
- It was only detecting SQL injections anyway, so it seems
  to make sense.
2011-05-03 15:34:42 -04:00
Seth Hall
e9089d2016 Merge branch 'topic/policy-scripts-new' of ssh://git.bro-ids.org/bro into topic/policy-scripts-new 2011-05-03 15:17:19 -04:00
Seth Hall
2ba0baafd4 Small updates to deal with comments from Robin and Jon.
- Modifications for changes to vectors too.
2011-05-03 15:16:57 -04:00
Don Appleman
7dfb9e1c7e Move loading of tcp.bro from command line to script body 2011-05-03 13:49:03 -05:00
Seth Hall
ea2b0c3e73 Updates for conn script based on feedback from Robin. 2011-05-03 14:48:16 -04:00
Seth Hall
ed37d8ae36 Updates to DNS scripts from Robin's feedback. 2011-05-03 14:11:05 -04:00
Seth Hall
0a0dbcc44e Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-05-02 22:25:54 -04:00
Robin Sommer
4aa844aa87 Switching vectors from being 1-based to 0-based.
This is obviously a change that break backwards-compatibility. I hope
I caught all cases where vectors are used ...

I've completely removed the VECTOR_MIN constant. Turns out that was
already not working: some code pieces were nevertheless hard-coding
the 1-based indexing ...
2011-05-02 17:10:18 -07:00
Jon Siwek
7490095e42 Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-02 15:50:21 -05:00
Jon Siwek
ceaba8077b Fixes related to make doc handling of script summary text (##! comments)
- Summary comments (##!) can now be placed at the beginning of
BiF files (but still outside C segments).  An issue was fixed where
these comments would mistakenly be transferred into the generated
.func_def file and cause a compile error. I completely removed writing
any opt_ws value into the .func_def file because it was currently not
writing anything besides whitespace.

- The generation of reST for the collecting of "groups" of policy
script documentation now happens at build time of `make doc` through the
use of a helper script rather than doing this at configure time so that
changes to summary text will always be reflected in the documentation.
2011-05-02 15:34:34 -05:00
Robin Sommer
f564023a12 Updating submodule(s). 2011-05-02 11:29:07 -07:00
Robin Sommer
90302a8834 Adding istate tests to default btest configuration. 2011-05-02 11:28:40 -07:00
Jon Siwek
54e9946fc7 Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-02 12:23:56 -05:00
Robin Sommer
eed759b7b5 Increasing serialization format version for the recent 64-bit changes. 2011-05-02 08:43:55 -07:00
Robin Sommer
5478bd5b1d Updating tests.
The istate tests now all pass except for the SSL one. Still need to
figure out why it fails.
2011-05-02 08:43:39 -07:00
Seth Hall
ebf907fa33 More small cleanup. 2011-05-02 11:41:38 -04:00
Seth Hall
7fc195e82e Merge branch 'topic/policy-scripts-new' of ssh://git.bro-ids.org/bro into topic/policy-scripts-new 2011-04-29 21:41:46 -04:00
Seth Hall
12820563a1 Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-29 21:39:23 -04:00
Robin Sommer
9ddc26328d Support for (mixed) MPLS and VLAN traffic, and a new default BPF
filter. (Seth Hall and Robin Sommer)

- Merging in the patch from #264, which provides support for mixed
  VLAN and MPLS traffic.

- Changing Bro's default filter from being built dynamically to being
  a static "ip or not ip". To get the old behaviour back (i.e., the
  dynamically built filter), redef "all_packets" to false.

- print-filter.bro now always prints the filter that Bro is actually
  using, even if overriden from the command line.
2011-04-29 09:10:43 -07:00
Robin Sommer
b01aa66fe6 Fixing some more format strings. 2011-04-27 21:31:23 -07:00
Robin Sommer
714289bd13 Changing the HTTP's analyzers internals to use 64-bit integers.
(Gregor Maier).

This is the patch from #326, plus some cleanup.
2011-04-27 21:25:51 -07:00
Seth Hall
8e8e460ede Merge remote branch 'origin/master' into topic/policy-scripts-new 2011-04-27 16:07:26 -04:00
Seth Hall
ee65231968 Merge branch 'topic/policy-scripts-new' of ssh://git.bro-ids.org/bro into topic/policy-scripts-new 2011-04-27 16:03:10 -04:00
Seth Hall
651bfc2e19 Bugfixes and improvements the dns script. 2011-04-27 16:02:59 -04:00
Don Appleman
d5bfc6f5bd Added "policy" subdirectory to list of TestDirs 2011-04-27 12:53:40 -05:00
Seth Hall
5d2a9f6bcc HTTP script rework and bug fixing. 2011-04-27 10:15:15 -04:00
Robin Sommer
80376653c2 Updating submodule(s). 2011-04-26 21:30:37 -07:00
Jon Siwek
f10d2e10ea Overhaul of "doc" build target for generating policy script documentation.
It's now all implemented in CMake scripting.

The generation of reST docs is now a distinct target, "restdoc", while
the target to generate HTML docs, "doc", depends on "restdoc".  reST doc
generation supports incremental builds (documentation for a given policy
script is only regenerated when it is out of date), but HTML doc generation
via ``make doc`` is not incremental (Sphinx always starts with fresh input).

Building the "restdoc" target is now covered by a btest to ensure all
policy scripts are parse-able when Bro is in "doc mode".

Generated reST docs should now support "@load"ing from subdirectories.  e.g.
"@load foo/baz" and "@load bar/baz" will now generate the right xref links.
2011-04-26 22:13:04 -05:00
Seth Hall
58370e7aab Added software detection for unspecified WebKit based browsers. 2011-04-26 15:24:25 -04:00