As opposed to delaying until a certain-sized-buffer fills, which is
problematic because then the event becomes out of sync with the "rest of
the world". E.g. content_gap handlers being called sooner than
expected.
Addresses BIT-1240.
MIME entities buffered data and passed it along to protocol analyzers in
discrete amounts, but a gap is always passed along right away, so the
ordering of these "events" can cause incorrect file analysis. The
change here is to never leave any MIME data buffered -- it should now be
passed along line by line as it is seen, but may still temporarily make
use of a buffer allocated by the analyzer as it works on decoding
content.
* origin/topic/hui/dnp3-udp:
remove redundnt codes; find a way to use the analyzer function, such as Weird; fix a small bug in ProcessData function in DNP3.cc; passed the test
Renameing the DNP3 TCP analyzer
quickly fix another bug; adding missing field of the declaration of dnp3_request_application_header and dnp3_response_application_header
Removing the debug printf in DNP3.cc
fixed the bug of deciding the size of object 1 varition 1 in DNP3
Fix some things in DNP3 UDP analyzer.
changed a bug, but still not working
modify DNP3.cc and DNP3.h to add DNP3_UDP_Analyzer; binpac unchanged
Now the right signer certificate for the reply is looked up (and no longer assumed that it is the first one) and a few compares are fixed. Plus - there are more test cases that partially send certificates in the ocsp message and partially do not - and it seems to work fine in all cases.
Addresses BIT-1212
Singular CR or LF characters in multipart body content are no longer
converted to a full CRLF (thus corrupting the file) and it also no
longer considers the CRLF before the multipart boundary as part of the
content.
Addresses BIT-1235.
That works. Just renaming "param" to "ID", as locals are affected as
well.
BIT-1233 #merged
* origin/topic/jsiwek/outer_param_binding:
Detect functions that try to bind variables from an outer scope.
* origin/topic/robin/reader-writer-plugins:
Adding plugin testing to Makefile's test-all.
Fixing tests.
Removing DataSeries and ElasticSearch from configure script.
Updating submodule.
Move DataSeries and ElasticSearch into plugins.
More polishing of some of the branche's changes.
More polishing.
Test case for a dynamic input reader.
Test case for a dynamic log writer.
Final fixes, preparing for merge.
Converting log writers and input readers to plugins.
BIT-1222 #merged
* origin/topic/robin/modbus-events-merge:
adding another trace file to test read and write coil function codes
add/update test file and baseline result
add implementation of bytestring_to_coils for modbusy analyzer
adding a missing field in record ModbusHeaders
add event handlers for modbus
* origin/topic/hui/modbus-events:
adding another trace file to test read and write coil function codes
add/update test file and baseline result
add implementation of bytestring_to_coils for modbusy analyzer
adding a missing field in record ModbusHeaders
add event handlers for modbus
that init-plugin now generates.
Also adding new test that makes sure the the skeleton created by
init-plugin compiles on its own withoyt any further changes.
with a MIME type.
Whenever that MIME is detected, Bro will now automatically activate
the analyzer. The interface mimics how well-known ports are defined
for protocol analyzers.
This isn't actually used by any existing file analyzer (because we
don't have any yet that target a specific file format), but there's a
test making sure it works.
