Commit graph

17337 commits

Author SHA1 Message Date
Robin Sommer
33f1e00264 Updating submodule(s). 2011-05-10 20:57:45 -07:00
Robin Sommer
4ed9969f83 Fixing bug with uninitialized counter. 2011-05-10 20:54:24 -07:00
Robin Sommer
4bf6d6092b Sorting was still not consistent. 2011-05-10 19:48:40 -07:00
Robin Sommer
b16bb7fff4 Test updates.
Includes splitting up one test which's output now depends on wether
we've compiled with IPv6 support or not.
2011-05-10 19:33:37 -07:00
Robin Sommer
1b76b76bb0 Removing old istate test-suite. 2011-05-10 18:58:19 -07:00
Robin Sommer
42a1efa77f Updating submodule(s). 2011-05-10 18:30:05 -07:00
Robin Sommer
69391afc42 A hack to report missing GeoIP support only once.
This closes #357, but #455 captures the need for a more general
solution.
2011-05-10 18:29:05 -07:00
Robin Sommer
63f7359e1e Bugfix: vectors in records were not initalized.
Closes #421.
2011-05-10 18:19:27 -07:00
Robin Sommer
0815ea9188 If IPv6 default is not compiled in, the default BPF filters now
excludes IPv6 packets.
2011-05-10 18:10:32 -07:00
Robin Sommer
ee872c12c8 New bif bro_has_ipv6() to check whether IPv6 support is compiled in. 2011-05-10 18:02:10 -07:00
Robin Sommer
e6208c8950 Bringing connection state history back, which was accidentally deleted
from conn.bro.

However, this is primarily for the record, conn.bro will be replaced
with a new version soon.
2011-05-10 17:56:53 -07:00
Robin Sommer
61c929bc16 Updating btests and a Makefile.
"make" now runs all the tests.
2011-05-10 17:56:45 -07:00
Robin Sommer
03cd7a47ac Moving the test-scripts from the old test-suite over to btest. 2011-05-10 17:28:09 -07:00
Robin Sommer
d1db768624 Fix for major bug in POP3 analyzer, which didn't recognize '.'
terminators in multi-line replies if the terminator was bare (no
newline). This caused it to ignore the rest of the session that it's
analyzing.

Patch from #444 by Vern.
2011-05-10 17:11:01 -07:00
Gregor Maier
c24f3391a3 Fix compiler warning with gcc-4.4.4 2011-05-10 12:31:53 -07:00
Seth Hall
ebf75eb373 Found another software string that isn't parsed correctly.
I added it to the parse testing script but left it
commented out.
2011-05-10 15:09:14 -04:00
Seth Hall
2ee78fba12 Fixed a problem with constructing received from header paths.
- If mail between the MUA and mail server is seen, no
  received from headers will be there.  This situations
  is dealt with by setting the two hosts involved in the
  mail transfer as the last two hosts in the path.
2011-05-10 15:08:37 -04:00
Seth Hall
c0ff43fd4a Improved HTTP::build_url function.
- Scripts now deal with host headers containing the port value.
- build_url function copes with missing the request now
  (only seeing the response for some reason).
2011-05-10 13:49:55 -04:00
Jon Siwek
e2c194c990 Fix make doc CMake 2.8.3 incompatibility.
CMake 2.8.4 seems to be able to handle add_custom_target()
interdependencies with the DEPENDS arguments, but 2.8.3 does not.

Using add_dependencies() to create top-level target
dependencies works in both cases.
2011-05-10 11:03:56 -05:00
Jon Siwek
80143e72ba Fixing top-level Makefile target 'doc-clean' (now 'docclean') 2011-05-10 09:38:50 -05:00
Robin Sommer
5cd6394916 Merge remote branch 'remotes/origin/topic/jsiwek/doc-framework'
* remotes/origin/topic/jsiwek/doc-framework:
  Adding example documentation for a script's use of logging features.
  Adding &log attribute to static attr_names array.
  Small typo fix.
  Bro doc mode now tracks record redefs that extend its field list.
  BroBifDoc was unneeded; now dead code, so removed.
  Bro doc mode now only does a "shallow" copy of declared record types
  Bro's doc mode now terminates after processing bro_init but before net_run
  Fixes related to `make doc` handling of script summary text (##! comments)
  Overhaul of "doc" build target for generating policy script documentation.
  Add parser error hint when in doc mode about checking ## comment syntax.
  Move stuff related to policy script documentation from doc/ to doc/scripts/
  Fixing example.bro's auto-reST generation baseline test.
2011-05-09 19:02:39 -07:00
Robin Sommer
bd9855a380 Merge of Gregor's conn-size branch.
If 'use_conn_size_analyzer' is true, the event engine tracks number of
packets and raw IP bytes per connection. If report_conn_size_analyzer
is true, these values are included as four new columns into conn.log

I changed conn.bro so that the value of report_conn_size_analyzer
follows that of use_conn_size_analyzer. For the new conn.log, we
probably want to get rid of report_conn_size_analyzer anyway.
2011-05-09 17:14:31 -07:00
Robin Sommer
7524cce186 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Fix compile errors possible on some platforms.
2011-05-08 21:05:35 -07:00
Jon Siwek
35b7caf44f Fix compile errors possible on some platforms.
Include <algorithm> in some sources that require it; addresses #430

Places where STL's min() template function could get used with
arguments of differing types can fail to deduce the right template type.
These are fixed with some type tweaking of local variables and also
giving an explicit template argument for good measure.
2011-05-08 19:53:41 -05:00
Seth Hall
a1f9ba8b1b Added metrics framework to all.bro 2011-05-08 03:58:49 -04:00
Seth Hall
474139f220 Start of the metrics framework. 2011-05-08 03:57:55 -04:00
Seth Hall
28bda4b077 Loading the webmail-ident script in the smtp.bro script. 2011-05-08 03:17:27 -04:00
Seth Hall
0f583f3e00 Removed some unnessary types from the base software script. 2011-05-08 03:17:03 -04:00
Seth Hall
13189cc08a Added the initial version of the web application detection script.
- Logging is done through the software framework.
- Versions are not detected yet.
2011-05-08 03:16:35 -04:00
Seth Hall
5aa85cc47a Created the webmail identification script. 2011-05-08 03:00:05 -04:00
Seth Hall
789908d182 More script updates from Robin's feedback. 2011-05-08 02:27:19 -04:00
Jon Siwek
af798620de Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-06 19:25:53 -05:00
Jon Siwek
80abad01a9 Adding example documentation for a script's use of logging features. 2011-05-06 19:23:15 -05:00
Jon Siwek
2a21ebba2e Adding &log attribute to static attr_names array. 2011-05-06 18:52:23 -05:00
Jon Siwek
34c475d4db Small typo fix. 2011-05-06 18:24:38 -05:00
Robin Sommer
cde6076857 Updating submodule(s). 2011-05-05 21:06:29 -07:00
Jon Siwek
cf0a542f7c Bro doc mode now tracks record redefs that extend its field list. 2011-05-05 10:43:15 -05:00
Jon Siwek
aec63df90f BroBifDoc was unneeded; now dead code, so removed. 2011-05-04 22:01:01 -05:00
Jon Siwek
6d867cf999 Bro doc mode now only does a "shallow" copy of declared record types
This is necessary so that the cloned type will be able to see additions
to the original type's list of fields
2011-05-04 21:53:51 -05:00
Jon Siwek
d919ebed58 Bro's doc mode now terminates after processing bro_init but before net_run
Generated script reST documentation is also written out at this time
instead of at the end of lexical scanning.

The persistence serializer will no longer write out Bro's state to the
.state directory when in doc mode.
2011-05-04 21:33:21 -05:00
Jon Siwek
481a1d097b Merge branch 'master' into topic/jsiwek/doc-framework 2011-05-04 19:38:03 -05:00
Seth Hall
61fa9c6857 Clean up on software detection scripts. 2011-05-04 11:03:44 -04:00
Seth Hall
fa914cafd9 Added $uid to more base scripts. 2011-05-04 11:03:16 -04:00
Seth Hall
05299e2990 Weird updated to logging framework. 2011-05-04 11:02:26 -04:00
Seth Hall
b03726b3dc Updating comment on the timestamp for conn logs. 2011-05-03 23:51:44 -04:00
Seth Hall
bbf4c0718f The global http script now loads correctly loads detect-sqli 2011-05-03 23:51:18 -04:00
Seth Hall
a97cca4e86 Chaged http/detect to http/detect-sqli.
- It was only detecting SQL injections anyway, so it seems
  to make sense.
2011-05-03 15:34:42 -04:00
Seth Hall
e9089d2016 Merge branch 'topic/policy-scripts-new' of ssh://git.bro-ids.org/bro into topic/policy-scripts-new 2011-05-03 15:17:19 -04:00
Seth Hall
2ba0baafd4 Small updates to deal with comments from Robin and Jon.
- Modifications for changes to vectors too.
2011-05-03 15:16:57 -04:00
Don Appleman
7dfb9e1c7e Move loading of tcp.bro from command line to script body 2011-05-03 13:49:03 -05:00