Commit graph

13 commits

Author SHA1 Message Date
Bernhard Amann
986b346e3f remove the byte_len and length bifs 2013-03-06 13:45:42 -08:00
Jon Siwek
69afc4a882 Add an error for record coercions that would orphan a field.
These cases should be avoidable by fixing scripts where they occur and
they can also help catch typos that would lead to unintentional runtime
behavior.

Adding this already revealed several scripts where a field in an inlined
record was never removed after a code refactor.
2013-01-24 09:56:19 -06:00
Robin Sommer
4fab70ecce Merge remote-tracking branch 'vlad/topic/vladg/dns_txt_queries'
* vlad/topic/vladg/dns_txt_queries:
  Add detection rate threshold for MHR.
  Make sure lookup_hostname_txt isn't checking lookup_hostname's cache for answers.
  A couple of lookup_hostname_txt fixes.

Reverting the earlier function-join during merging.
2012-11-05 13:40:24 -08:00
Vlad Grigorescu
1aeb52ae46 Add detection rate threshold for MHR. 2012-11-03 12:09:11 -04:00
Seth Hall
3be1222532 Documentation updates for HTTP & IRC scripts.
Closes #733
2012-01-08 02:22:52 -05:00
Seth Hall
3391270527 Fixed a really dumb bug that was causing the malware hash registry script to break. 2011-12-08 14:25:52 -05:00
Seth Hall
8661abe9d9 Small script refinements and documentation updates. 2011-10-21 13:58:58 -04:00
Seth Hall
fc5f22cb5d Merge remote-tracking branch 'origin/topic/jsiwek/reorg-followup' 2011-08-25 16:44:31 -04:00
Gregor Maier
7ea0646f30 Make reference to the other script a link 2011-08-11 10:31:36 -07:00
Jon Siwek
59e5fc5633 Merge branch 'master' into topic/jsiwek/reorg-followup
Conflicts:
	scripts/base/frameworks/cluster/setup-connections.bro
	scripts/base/protocols/ssh/main.bro
2011-08-11 10:56:20 -05:00
Seth Hall
423769c61d Updates to local.bro 2011-08-11 08:26:40 -04:00
Jon Siwek
47500ceef4 Add a test that checks each individual script can be loaded in bare-mode.
Fixed most @load dependency issues in the process.  The test is still
failing in a "known" way due to hot.conn.bro and scan.bro.

Adressess #545
2011-08-10 15:38:21 -05:00
Seth Hall
597a4d6704 Hopefully the last major script reorganization.
- policy/ renamed to scripts/

- By default BROPATH now contains:
	- scripts/
	- scripts/policy
	- scripts/site

- *Nearly* all tests pass.

- All of scripts/base/ is loaded by main.cc
	- Can be disabled by setting $BRO_NO_BASE_SCRIPTS
	- Scripts in scripts/base/ don't use relative path loading to ease use of BRO_NO_BASE_SCRIPTS (to copy and paste that script).

- The scripts in scripts/base/protocols/ only (or soon will only) do logging and state building.

- The scripts in scripts/base/frameworks/ add functionality without causing any additional overhead.

- All "detection" activity happens through scripts in scripts/policy/.

- Communications framework modified temporarily to need an environment variable to actually enable (ENABLE_COMMUNICATION=1)
	- This is so the communications framework can be loaded as part
	  of the base without causing trouble when it's not needed.
	- This will be removed once a resolution to ticket #540 is reached.
2011-08-05 23:09:53 -04:00
Renamed from policy/protocols/http/detect-MHR.bro (Browse further)