Commit graph

6667 commits

Author SHA1 Message Date
Jon Siwek
ff61737212 Simplify a conditional with equivalent branches. 2014-09-02 16:29:52 -05:00
Jon Siwek
782b4d0eae Change EDNS parsing code to use rdlength more cautiously.
It shouldn't ever be negative, but if it were, using it to modify the
data pointer/length isn't appropriate.
2014-09-02 16:22:15 -05:00
Jon Siwek
d57b161c40 Fix a memory leak when bind() fails due to EADDRINUSE. 2014-09-02 16:18:55 -05:00
Jon Siwek
dde0ce234f Fix possible buffer over-read in DNS TSIG parsing 2014-09-02 14:22:26 -05:00
Vlad Grigorescu
51373b0592 SSH: Misc. updates to the new analyzer. 2014-09-02 00:15:32 -04:00
Hui Lin
dd830db38a remove redundnt codes; find a way to use the analyzer function, such as Weird; fix a small bug in ProcessData function in DNP3.cc; passed the test 2014-08-28 20:35:28 -05:00
Vlad Grigorescu
0a50688afc Move auth method detection into script-land, to make it easier to change. 2014-08-28 18:23:30 -04:00
Jon Siwek
675fba3fde Remove timeouts from remote communication loop.
The select() now blocks until there's work to do instead of relying on a
small timeout value which can cause unproductive use of cpu cycles.
2014-08-28 13:13:30 -05:00
Robin Sommer
3e669daa05 Interface tweaks for PktSrc, plus docs for PktSrc and PktDumper. 2014-08-28 00:52:36 -04:00
Vlad Grigorescu
214e6b3ea9 Move the SIP analyzer to uint64 sequences, and a number of other small SIP fixes. 2014-08-26 22:26:42 -04:00
Jon Siwek
d5513a0757 Improve multipart HTTP/MIME entity file analysis.
Singular CR or LF characters in multipart body content are no longer
converted to a full CRLF (thus corrupting the file) and it also no
longer considers the CRLF before the multipart boundary as part of the
content.

Addresses BIT-1235.
2014-08-26 17:54:41 -05:00
Vlad Grigorescu
e87b2080d1 Small Kerberos tweaks and fixes. 2014-08-25 11:33:32 -04:00
Hui Lin
81606e7ff4 Renameing the DNP3 TCP analyzer 2014-08-25 10:33:28 -05:00
Robin Sommer
5f817513d0 A set of various fixes and smaller API tweaks, plus tests.
Also moving PCAP-related bifs to iosource/pcap.bif.
2014-08-24 19:55:26 -07:00
Jimmy Jones
9232f05f52 Better documentation for sub_bytes 2014-08-23 15:05:20 +01:00
Jon Siwek
121fcdbb5b Fix build on systems that already have ntohll/htonll
BIT-1234 #close
2014-08-22 19:56:27 -05:00
Robin Sommer
ce9f16490c Moving some of the BPF filtering code into base class.
This will allow packet sources that don't support BPF natively to
emulate the filtering via libpcap.
2014-08-22 17:50:03 -07:00
Robin Sommer
0186061aa8 Small packet dumper API change. 2014-08-22 16:49:32 -07:00
Robin Sommer
caa55ad352 Moving Pkt{Src,Dumper} a directory level up.
Also renaming PktSourceComponent to PktSrcComponent.
2014-08-22 16:46:15 -07:00
Robin Sommer
ecf1e32f60 Removing FlowSrc.
We could bring this back, now derived from PktSrc (though strickly
speaking it's of course not *packets). But not sure if we want that,
as the input framework seems the better place to host it. Then it
would turns into a reader.
2014-08-22 16:33:55 -07:00
Vlad Grigorescu
f93f2af748 Merge tag 'v2.3' into topic/vladg/sip
Version tag

Conflicts:
	scripts/base/init-default.bro
2014-08-22 19:25:43 -04:00
Robin Sommer
93e6a4a9db Removing netmap, remaining pieces of the 2ndary path, and left-over
files of packet sorter.

Netmap will move to a plugin.
2014-08-22 16:24:39 -07:00
Robin Sommer
bf6dd2e9ca Merge remote-tracking branch 'origin/master' into topic/robin/pktsrc
Conflicts:
	configure
	src/CMakeLists.txt
	src/Net.cc
	src/PacketSort.cc
	src/PacketSort.h
	src/RemoteSerializer.cc
	src/Sessions.cc
	src/Sessions.h
2014-08-22 15:41:42 -07:00
Robin Sommer
a3b2e3a2b4 Merge remote-tracking branch 'origin/topic/jsiwek/outer_param_binding'
That works. Just renaming "param" to "ID", as locals are affected as
well.

BIT-1233 #merged

* origin/topic/jsiwek/outer_param_binding:
  Detect functions that try to bind variables from an outer scope.
2014-08-22 15:23:18 -07:00
Jon Siwek
3521a92a00 Detect functions that try to bind variables from an outer scope.
And raise an error saying that's not supported.
Addresses BIT-1233.
2014-08-22 16:49:10 -05:00
Jon Siwek
e7f10755c8 Merge remote-tracking branch 'origin/topic/robin/reader-writer-plugins'
* origin/topic/robin/reader-writer-plugins:
  Adding plugin testing to Makefile's test-all.
  Fixing tests.
  Removing DataSeries and ElasticSearch from configure script.
  Updating submodule.
  Move DataSeries and ElasticSearch into plugins.
  More polishing of some of the branche's changes.
  More polishing.
  Test case for a dynamic input reader.
  Test case for a dynamic log writer.
  Final fixes, preparing for merge.
  Converting log writers and input readers to plugins.

BIT-1222 #merged
2014-08-21 16:04:13 -05:00
Jon Siwek
6f27d3dd40 Silence some doc-related warnings when using bro -e.
BIT-1232 #close
2014-08-19 11:06:21 -05:00
Hui Lin
fb21236661 quickly fix another bug; adding missing field of the declaration of dnp3_request_application_header and dnp3_response_application_header 2014-08-16 11:01:30 -05:00
Hui Lin
ff60706742 Removing the debug printf in DNP3.cc 2014-08-15 14:26:47 -05:00
Hui Lin
11f7e2d74b fixed the bug of deciding the size of object 1 varition 1 in DNP3 2014-08-11 15:41:25 -05:00
Robin Sommer
355314718b Merge remote-tracking branch 'origin/master' into topic/robin/reader-writer-plugins 2014-08-08 18:32:45 -07:00
Robin Sommer
8737eae906 Move DataSeries and ElasticSearch into plugins. 2014-08-08 18:32:21 -07:00
Robin Sommer
8031da4ee7 More polishing of some of the branche's changes. 2014-08-08 18:32:05 -07:00
Vlad Grigorescu
1ceeafcb32 Redo the response handling.. 2014-08-08 13:46:12 -05:00
Jon Siwek
b83d4a9c84 Fix some things in DNP3 UDP analyzer.
- DeliverPacket override had a wrong parameter.
- Change the DNP3 plugin to provide both UDP and TCP analyzer versions.
- Add a DPD signature.
2014-08-06 15:41:53 -05:00
Hui Lin
51e936ec59 changed a bug, but still not working 2014-08-06 15:07:11 -05:00
Vlad Grigorescu
023661fb19 Whitespace/readability fixes. 2014-08-06 11:02:18 -05:00
Vlad Grigorescu
5929b635ab Get MySQL to compile and add basic v9 support. 2014-08-05 21:31:12 -05:00
Hui Lin
cd81eaedca modify DNP3.cc and DNP3.h to add DNP3_UDP_Analyzer; binpac unchanged 2014-08-05 15:43:33 -05:00
Jon Siwek
f8bb17bcb8 Fix possible null ptr derefs reported by Coverity. 2014-08-04 10:53:36 -05:00
Robin Sommer
c68e281832 Merge remote-tracking branch 'origin/topic/johanna/dhcp-log'
BIT-1223 #merged

* origin/topic/johanna/dhcp-log:
  small change to documentation. In server->client messages the host name may differ from the one requested by the client.
  Split dhcp log writing from record creation.
2014-08-01 14:07:53 -07:00
Johanna Amann
605a49f9bd small change to documentation. In server->client messages the host name may differ from the one requested by the client. 2014-08-01 11:19:05 -07:00
Robin Sommer
0ba4b768cd Merge remote-tracking branch 'origin/master' into topic/robin/reader-writer-plugins 2014-07-31 14:45:38 -07:00
Robin Sommer
2e3b217667 Fix for redefining built-in constants.
Turns out redefs weren't visibile to core-land due to initialization
order.
2014-07-31 14:38:24 -07:00
Jon Siwek
597edcd3b6 Fix reference counting bug in Tag::operator= 2014-07-31 14:32:10 -05:00
Robin Sommer
aa731eeaec Final fixes, preparing for merge. 2014-07-31 10:49:50 -07:00
Robin Sommer
2b505b07c1 Merge remote-tracking branch 'origin/master' into topic/robin/reader-writer-plugins 2014-07-31 10:10:39 -07:00
Robin Sommer
382b946098 Adding missing check that a plugin's API version matches what Bro defines. 2014-07-31 10:09:03 -07:00
Jon Siwek
69b1ba653d Minor adjustments to plugin code/docs.
Mostly whitespace/typos.
Moved some Plugin methods out from public access.
2014-07-30 16:48:23 -05:00
Jon Siwek
3ee64ff2ce Merge remote-tracking branch 'origin/topic/robin/dynamic-plugins-2.3'
* origin/topic/robin/dynamic-plugins-2.3: (51 commits)
  Moving Broccoli to master.
  Moving binpac module to master.
  Re-adding missing baseline.
  Adding a plugin test that checks that "make install" works.
  The HOOK_CALL_FUNCTION plugin hook is now also triggered for builtin functions.
  Adding note to plugin docs on how init-plugin treats existing files.
  Adapting plugin tests to use the new split Plugin.{h,cc} structure that init-plugin now generates.
  Updating submodule.
  Allow to activate plugins from the command line by specifying their fully-qualified name.
  Adding Files::register_for_mime_type() to associate a file analyzer with a MIME type.
  Updating cmake module.
  Moving component's CanonicalName() method into base class.
  Further polishing and cleanup in preparation for merge.
  Updating submodule.
  Plugin fixes for FreeBSD.
  Doc tweak.
  Adding missing method implementation.
  Updating plugin hook test.
  Adding a test building a file analyzer plugin.
  Enabling to specific a set of plugins with the -N option.
  ...
2014-07-30 16:24:01 -05:00