Commit graph

12 commits

Author SHA1 Message Date
Jon Siwek
45526e6063 Merge remote-tracking branch 'origin/master' into dev/2.7
* origin/master:
  Fix typo in Sessions.h
  Update baselines for SSH capabilities fix
  Fix SSH analyzer bug where is_server in capabilities is wrong.
  Revert DNS query 255 from ANY to *
  Missing commas...
  Fix typo in dce-rpc consts
  Refactor to use consistent numeric type in dce_rpc. Add missing DNS query type codes
  Add DCE_RPC exchange_mapi operations to relevant consts.bro file
  GH-186: fix JSON formatting of timestamps before Unix epoch
  Fix test baseline for plugin skeleton update
  Fix crash when modifying a table from within its &expire_func
  Convert site::local_nets, etc. into options.
  GH-184: add `bro-config --build_type`, outputs CMake build type
  Updating submodule(s).
  Add return value checks for some RPC parsing functions
  Add 'fallthrough' comment to a switch/case block
  Improve broker.remote_id unit test
  Increase broker unit test timeout intervals
2018-10-16 16:50:27 -05:00
Jon Siwek
9a295a7009 Merge branch 'master' of https://github.com/spitfire55/bro
* 'master' of https://github.com/spitfire55/bro:
  Revert DNS query 255 from ANY to *
  Missing commas...
  Fix typo in dce-rpc consts
  Refactor to use consistent numeric type in dce_rpc. Add missing DNS query type codes

I added back in DNS constants for PTR, EDNS, and ANY to avoid breaking
code for any people that use them.

Also omitted the DNP3 function code 0x83 name change from
"AUTHENTICATE_RESP" to "AUTHENTICATE_RESPONSE", again to avoid
potentially breaking code unnecessarily: "RESP" vs. "RESPONSE" is not
wrong in any sense, just maybe a matter of clarify.
2018-10-16 15:56:37 -05:00
Dale Lakes
cf99ecf8b2 Revert DNS query 255 from ANY to * 2018-10-15 21:15:31 -04:00
Dale Lakes
c335988b0c Missing commas... 2018-10-15 20:35:17 -04:00
Dale Lakes
3c765731b3 Refactor to use consistent numeric type in dce_rpc. Add missing DNS query type codes 2018-10-15 19:17:53 -04:00
Jon Siwek
71ef5c8428 Merge branch 'fatemabw/bro' of https://github.com/fatemabw/bro into dev/2.7
* 'fatemabw/bro' of https://github.com/fatemabw/bro:
  DNSSEC support in Bro

I made several changes:

  - renamed event/record types
  - reformatted the info added to dns.log
  - removed the "addl" scripts that added extended dnssec info to dns.log
  - simplifications/improvements to the internal parsing logic
2018-09-21 16:40:41 -05:00
fatema
ff5c11975d DNSSEC support in Bro 2018-09-05 14:12:07 -04:00
Jon Siwek
81a8961f16 BIT-1858: fix logged-names for DNS RR types 44 and 45 2018-08-16 14:13:31 -05:00
Mark Taylor
a14de582a2 Add DNS "CAA" RR type and event. 2016-04-22 15:26:34 -04:00
Daniel Thayer
bc337f3d5a Fix typos and formatting in the dns protocol docs 2013-10-15 16:44:28 -05:00
Jon Siwek
62d012e04a Add Conn and DNS protocol script documentation. (fixes #731) 2012-01-09 14:23:24 -06:00
Seth Hall
597a4d6704 Hopefully the last major script reorganization.
- policy/ renamed to scripts/

- By default BROPATH now contains:
	- scripts/
	- scripts/policy
	- scripts/site

- *Nearly* all tests pass.

- All of scripts/base/ is loaded by main.cc
	- Can be disabled by setting $BRO_NO_BASE_SCRIPTS
	- Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script).

- The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building.

- The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead.

- All "detection" activity happens through scripts in scripts/policy/.

- Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1)
	- This is so the communications framework can be loaded as part
	  of the base without causing trouble when it's not needed.
	- This will be removed once a resolution to ticket #540 is reached.
2011-08-05 23:09:53 -04:00
Renamed from policy/protocols/dns/base/consts.bro (Browse further)