Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 07:08:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3
2643 commits 386 branches 195 tags 257 MiB
Commit graph

10 commits

Author SHA1 Message Date
Robin Sommer
fb8e9fc5f0 Merge remote-tracking branch 'origin/topic/seth/tunnels-merge' 
* origin/topic/seth/tunnels-merge:
  Add another SOCKS command.

Conflicts:
	scripts/base/protocols/socks/consts.bro
 2012-06-21 10:12:43 -07:00
Seth Hall
3eb16e5738 Add another SOCKS command. 2012-06-21 02:07:30 -04:00
Robin Sommer
54670817fa Merge remote-tracking branch 'origin/topic/seth/tunnels-merge' 
* origin/topic/seth/tunnels-merge:
  Fixed some problems with the SOCKS analyzer and tests.

Conflicts:
	scripts/base/protocols/socks/main.bro
	src/socks-analyzer.pac
 2012-06-20 21:05:04 -07:00
Seth Hall
6b8b4dab71 Fixed some problems with the SOCKS analyzer and tests. 2012-06-20 22:57:46 -04:00
Robin Sommer
6cda00c75e Merge remote-tracking branch 'origin/topic/seth/tunnels-merge' 
* origin/topic/seth/tunnels-merge:
  SOCKS DPD fixes.
  Fix a bug in the SOCKS analyzer.
  SOCKS and tunnel test updates.
  Updates for the SOCKS analyzer.
  Very small updates to the tunnels framework.
 2012-06-20 14:33:18 -07:00
Seth Hall
f59736cb17 SOCKS DPD fixes. 
- Restricted the SOCKS 5 DPD signatures further.

- Added protocol violations.
 2012-06-20 15:12:52 -04:00
Seth Hall
896f252a31 Updates for the SOCKS analyzer. 
- Now supports SOCKSv5 in the analyzer and the DPD sigs.

- Reworked the core events.

- Tests.

- A SOCKS log!
 2012-06-20 13:58:25 -04:00
Robin Sommer
c7c3ff7af9 Adding a SOCKS test case. 
However, I'm not sure the output is right.
 2012-06-15 16:01:59 -07:00
Jon Siwek
b8e1604ab5 Make tunnels always identifiable by UID, tunnel.log now gets populated. 
conn.log now sets a field indicating all the parent tunnel UIDs over
which a connection operated and cross reference the UIDs found in
the tunnel.log.

Also some renaming of tunnel related types at the scripting layer.
 2012-04-26 12:29:59 -05:00
Seth Hall
e2da969415 Return of Robin's old SOCKS analyzer/decapsulator and tunnel code checkpoint. 
- More discussion is needed to figure out how to integrate the SOCKS analyzer best.

- Tunnels framework now logs for the SOCKS analyzer.
 2012-04-21 23:50:09 -04:00