ignore vim swap-files
basic tar file parser
Merge remote-tracking branch 'origin/master' into bernhard
rtmp connection parser

At the moment, the parser stops after the first client packet
has been exchanged. This packet contains the most interesting
stream information (like flash version, stream location and
origin) :)
ASF header parser (usually used for windows media files).

We seem to get all the typically used headers with this - I skipped
the ones that do not seem to contain data that is interesting for us
for the moment.

Once we have a UTF-16 parser, the string-data will look much nicer :)
really only include the headers in the files.

(I managed to confuse head -n with head -c :/ )
Merge remote-tracking branch 'origin/master' into bernhard

Conflicts:
	hilti2/tests/btest.cfg
Very (very!) basic x509 parser in binpac++.

Parses the basic certificate data structures (and does nothing else).

Due to the fact that cross-module imports do not work correctly yet,
this is intermingled with the asn1-parsing and generally needs quite
a bit of cleanup.

But - it parses out all v1 certificate fields into a manageable data
structures. Adding extensions as we see fit would not be much of a problem.

Next step: forget about certificates and try to implement bacnet. The
data types we support should be sufficient for at least a few of the
messages :)

This probably abuses a few binpac++-features.
Merge remote-tracking branch 'origin/master' into bernhard
parse certificate subjects into a string - this does not fully work yet,
because of a bug in binpac.

Split out x509 in a separate file - they have to be combined together
to run it (modularizing it does not work due to another bug in binpac)
Start of a BACnet analyzer. Should completely cover the lower
two layers of the protocol. The actual application layer is not
yet really parsed though (just one message). This is getting a bit
difficult without having access to the standard, because finding
some of the number mappings on the Internet is not really easy :)
BACnet parser can now parse the first two real requests (I-am, Who-Is).

The others might be a tad easier now. Making sensible Bro events out
of this will be a bit of a challenge :)
Merge remote-tracking branch 'origin/master' into bernhard
modernize x509 pac a bit. Still missing a few binpac problem fixes
to do quite what it should do.
Parse a bit more of BACnet.

To implement arrays, it would be very handy to have if-clauses
for the switch statement.
Merge remote-tracking branch 'origin/master' into bernhard
Now we can parse the probably most often used cases readproperty, writeProperty
as well as the ACKs for them.

This should (probably) cover a huge parts of the requests we will see in practice.

Once binpac can read reals from the wire we also can read the data values in
them :)
snapshot of bacnet
add bacnet vendor id list & parser
Handle segmentation in BACnet.

This is not solved in an elegant way - but I do not really know
how to improve this with the current feature set of binpac.

Basically, for each of the 2 request types that support segmentation,
a map is created which is indexed by the invoke-ID. The bytes of all
packets until the last one are appended to the map. When the last
packet is encountered, the whole byte stream is parsed.

If we do not see the last packet of a specific segmented message, we
never delete the data and leak memory.