From 38ff76a176d839ab354d0ff79dbf7b9a0bc44590 Mon Sep 17 00:00:00 2001 From: Daniel Thayer Date: Wed, 19 Sep 2018 15:41:00 -0500 Subject: [PATCH 1/7] Fix buffer sizes in the rotate_file function The "tmpname" contains a longer string than "newname", so adjust sizes accordingly. --- src/util.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util.cc b/src/util.cc index 35db6f131c..a1cd138b1e 100644 --- a/src/util.cc +++ b/src/util.cc @@ -1272,7 +1272,7 @@ FILE* rotate_file(const char* name, RecordVal* rotate_info) // Build file names. const int buflen = strlen(name) + 128; - char tmpname[buflen], newname[buflen+4]; + char newname[buflen], tmpname[buflen+4]; safe_snprintf(newname, buflen, "%s.%d.%.06f.tmp", name, getpid(), network_time); From 096a7f4f5e40654fe94137f786ce86a593667bda Mon Sep 17 00:00:00 2001 From: Daniel Thayer Date: Wed, 19 Sep 2018 15:47:27 -0500 Subject: [PATCH 2/7] Add a missing "break" in OSFinger.cc This appears to be an error introduced when the original C code was converted to C++. --- src/OSFinger.cc | 1 + 1 file changed, 1 insertion(+) diff --git a/src/OSFinger.cc b/src/OSFinger.cc index bcb00e324b..df5f30b0cc 100644 --- a/src/OSFinger.cc +++ b/src/OSFinger.cc @@ -469,6 +469,7 @@ reparse_ptr: { case 'E': Error("OS fingerprinting: Quirk 'E' is obsolete. Remove it, append E to the options. Line",(uint32)ln); + break; case 'K': if ( mode != RST_FINGERPRINT_MODE ) From d7097635f4b1ec9adca548b81ee42968629987a5 Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Fri, 21 Sep 2018 10:18:55 -0500 Subject: [PATCH 3/7] Fix compile error in MMDB GeoIP code Seems to be from the ambiguity addressed via [1]. In C++11, the compiler could treat it as an initializer list ctor instead of a copy constructor for a single-element list. [1] http://open-std.org/JTC1/SC22/WG21/docs/cwg_defects.html#1467 --- CHANGES | 4 ++++ VERSION | 2 +- src/bro.bif | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGES b/CHANGES index fd4b2c95e3..e167d1bb20 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.6-beta2-7 | 2018-09-21 10:18:55 -0500 + + * Fix compile error in MMDB GeoIP code (Jon Siwek, Corelight) + 2.6-beta2-6 | 2018-09-20 13:15:15 -0500 * Add a missing "break" in OSFinger.cc (Daniel Thayer) diff --git a/VERSION b/VERSION index fce9eeca80..b7a913bf71 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.6-beta2-6 +2.6-beta2-7 diff --git a/src/bro.bif b/src/bro.bif index b2dd814317..938a7b56ad 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -3626,7 +3626,7 @@ private: }; MMDB::MMDB(const char* filename, struct stat info) - : file_info{info}, lookup_error{false}, + : file_info(info), lookup_error{false}, last_check{std::chrono::steady_clock::now()} { int status = MMDB_open(filename, MMDB_MODE_MMAP, &mmdb); From 5161165c8afc6280fce4764c6032dbc75417bd98 Mon Sep 17 00:00:00 2001 From: Daniel Thayer Date: Fri, 21 Sep 2018 12:35:13 -0500 Subject: [PATCH 4/7] Fix some broken @TEST-REQUIRES Some tests were always being skipped because config.h was renamed to bro-config.h a long time ago. --- testing/btest/core/disable-mobile-ipv6.test | 2 +- testing/btest/core/mobile-ipv6-home-addr.test | 2 +- testing/btest/core/mobile-ipv6-routing.test | 2 +- testing/btest/core/mobility-checksums.test | 2 +- testing/btest/core/mobility_msg.test | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/testing/btest/core/disable-mobile-ipv6.test b/testing/btest/core/disable-mobile-ipv6.test index 5151a12b38..88eb2b853f 100644 --- a/testing/btest/core/disable-mobile-ipv6.test +++ b/testing/btest/core/disable-mobile-ipv6.test @@ -1,4 +1,4 @@ -# @TEST-REQUIRES: grep -q "#undef ENABLE_MOBILE_IPV6" $BUILD/config.h +# @TEST-REQUIRES: grep -q "#undef ENABLE_MOBILE_IPV6" $BUILD/bro-config.h # @TEST-EXEC: bro -r $TRACES/mobile-ipv6/mip6_back.trace %INPUT # @TEST-EXEC: btest-diff weird.log diff --git a/testing/btest/core/mobile-ipv6-home-addr.test b/testing/btest/core/mobile-ipv6-home-addr.test index 536d381f9b..e171a07afb 100644 --- a/testing/btest/core/mobile-ipv6-home-addr.test +++ b/testing/btest/core/mobile-ipv6-home-addr.test @@ -1,4 +1,4 @@ -# @TEST-REQUIRES: grep -q "#define ENABLE_MOBILE_IPV6" $BUILD/config.h +# @TEST-REQUIRES: grep -q "#define ENABLE_MOBILE_IPV6" $BUILD/bro-config.h # @TEST-EXEC: bro -b -r $TRACES/mobile-ipv6/ipv6-mobile-hoa.trace %INPUT >output # @TEST-EXEC: btest-diff output diff --git a/testing/btest/core/mobile-ipv6-routing.test b/testing/btest/core/mobile-ipv6-routing.test index 6ad5be002d..ea99a70706 100644 --- a/testing/btest/core/mobile-ipv6-routing.test +++ b/testing/btest/core/mobile-ipv6-routing.test @@ -1,4 +1,4 @@ -# @TEST-REQUIRES: grep -q "#define ENABLE_MOBILE_IPV6" $BUILD/config.h +# @TEST-REQUIRES: grep -q "#define ENABLE_MOBILE_IPV6" $BUILD/bro-config.h # @TEST-EXEC: bro -b -r $TRACES/mobile-ipv6/ipv6-mobile-routing.trace %INPUT >output # @TEST-EXEC: btest-diff output diff --git a/testing/btest/core/mobility-checksums.test b/testing/btest/core/mobility-checksums.test index 8a88eb8194..42877b63d4 100644 --- a/testing/btest/core/mobility-checksums.test +++ b/testing/btest/core/mobility-checksums.test @@ -1,4 +1,4 @@ -# @TEST-REQUIRES: grep -q "#define ENABLE_MOBILE_IPV6" $BUILD/config.h +# @TEST-REQUIRES: grep -q "#define ENABLE_MOBILE_IPV6" $BUILD/bro-config.h # @TEST-EXEC: bro -r $TRACES/chksums/mip6-bad-mh-chksum.pcap # @TEST-EXEC: mv weird.log bad.out # @TEST-EXEC: bro -r $TRACES/chksums/ip6-hoa-tcp-bad-chksum.pcap diff --git a/testing/btest/core/mobility_msg.test b/testing/btest/core/mobility_msg.test index 73461e7944..1fde084dc2 100644 --- a/testing/btest/core/mobility_msg.test +++ b/testing/btest/core/mobility_msg.test @@ -1,4 +1,4 @@ -# @TEST-REQUIRES: grep -q "#define ENABLE_MOBILE_IPV6" $BUILD/config.h +# @TEST-REQUIRES: grep -q "#define ENABLE_MOBILE_IPV6" $BUILD/bro-config.h # @TEST-EXEC: bro -b -r $TRACES/mobile-ipv6/mip6_back.trace %INPUT >output # @TEST-EXEC: bro -b -r $TRACES/mobile-ipv6/mip6_be.trace %INPUT >>output # @TEST-EXEC: bro -b -r $TRACES/mobile-ipv6/mip6_brr.trace %INPUT >>output From 2ede95422bab0c4853b8db7cc15fe5c6e77aa75a Mon Sep 17 00:00:00 2001 From: Jon Siwek Date: Fri, 21 Sep 2018 13:25:50 -0500 Subject: [PATCH 5/7] Emit missing GeoIP database errors only once at startup Instead of one error per lookup. --- CHANGES | 4 ++++ VERSION | 2 +- src/bro.bif | 23 +++++++++++++++++++++-- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/CHANGES b/CHANGES index e167d1bb20..d3f2831c4e 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.6-beta2-8 | 2018-09-21 13:25:50 -0500 + + * Emit missing GeoIP database errors only once at startup (Jon Siwek, Corelight) + 2.6-beta2-7 | 2018-09-21 10:18:55 -0500 * Fix compile error in MMDB GeoIP code (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index b7a913bf71..bd5c1cc7e6 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.6-beta2-7 +2.6-beta2-8 diff --git a/src/bro.bif b/src/bro.bif index 938a7b56ad..88aaa487d0 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -3695,6 +3695,8 @@ const char* MMDB::Filename() std::unique_ptr mmdb_loc; std::unique_ptr mmdb_asn; +static bool did_mmdb_loc_db_error = false; +static bool did_mmdb_asn_db_error = false; static bool mmdb_open(const char* filename, bool asn) { @@ -3719,6 +3721,11 @@ static bool mmdb_open(const char* filename, bool asn) catch ( const std::exception& e ) { + if ( asn ) + did_mmdb_asn_db_error = false; + else + did_mmdb_loc_db_error = false; + reporter->Info("Failed to open MaxMind DB: %s [%s]", filename, e.what()); return false; @@ -3742,6 +3749,7 @@ static void mmdb_check_loc() if ( mmdb_loc && mmdb_loc->StaleDB() ) { reporter->Info("Closing stale MaxMind DB [%s]", mmdb_loc->Filename()); + did_mmdb_loc_db_error = false; mmdb_loc.release(); } } @@ -3751,6 +3759,7 @@ static void mmdb_check_asn() if ( mmdb_asn && mmdb_asn->StaleDB() ) { reporter->Info("Closing stale MaxMind DB [%s]", mmdb_asn->Filename()); + did_mmdb_asn_db_error = false; mmdb_asn.release(); } } @@ -3943,7 +3952,12 @@ function lookup_location%(a: addr%) : geo_location { if ( ! mmdb_try_open_loc() ) { - builtin_error("Failed to open GeoIP location database"); + if ( ! did_mmdb_loc_db_error ) + { + did_mmdb_loc_db_error = true; + builtin_error("Failed to open GeoIP location database"); + } + return location; } } @@ -4021,7 +4035,12 @@ function lookup_asn%(a: addr%) : count { if ( ! mmdb_try_open_asn() ) { - builtin_error("No open GeoIP ASN database"); + if ( ! did_mmdb_asn_db_error ) + { + did_mmdb_asn_db_error = true; + builtin_error("Failed to open GeoIP ASN database"); + } + return new Val(0, TYPE_COUNT); } } From 5e33942864a842b8a4a19f12212a554c6d8028f1 Mon Sep 17 00:00:00 2001 From: Dominik Charousset Date: Sat, 22 Sep 2018 08:09:27 +0200 Subject: [PATCH 6/7] Fix BasicThread::SetOSName on FreeBSD --- src/threading/BasicThread.cc | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/threading/BasicThread.cc b/src/threading/BasicThread.cc index 3b6f5d6532..f111028475 100644 --- a/src/threading/BasicThread.cc +++ b/src/threading/BasicThread.cc @@ -11,6 +11,10 @@ #include #endif +#ifdef __FreeBSD__ +#include +#endif + using namespace threading; static const int STD_FMT_BUF_LEN = 2048; @@ -60,8 +64,8 @@ void BasicThread::SetOSName(const char* arg_name) pthread_setname_np(arg_name); #endif -#ifdef FREEBSD - pthread_set_name_np(thread.native_handle(), arg_name, arg_name); +#ifdef __FreeBSD__ + pthread_set_name_np(thread.native_handle(), arg_name); #endif } From 5ebed9158fab3137808b042bb2fb36e55c54ea81 Mon Sep 17 00:00:00 2001 From: Daniel Thayer Date: Tue, 25 Sep 2018 15:52:19 -0500 Subject: [PATCH 7/7] Add some missing @TEST-REQUIRES to a few tests --- testing/btest/bifs/dump_current_packet.bro | 1 + testing/btest/core/pcap/dumper.bro | 1 + testing/btest/coverage/find-bro-logs.test | 1 + 3 files changed, 3 insertions(+) diff --git a/testing/btest/bifs/dump_current_packet.bro b/testing/btest/bifs/dump_current_packet.bro index 0a852037a4..e61c9585cd 100644 --- a/testing/btest/bifs/dump_current_packet.bro +++ b/testing/btest/bifs/dump_current_packet.bro @@ -1,3 +1,4 @@ +# @TEST-REQUIRES: which hexdump # @TEST-EXEC: bro -b -r $TRACES/wikipedia.trace %INPUT # @TEST-EXEC: hexdump -C 1.pcap >1.hex # @TEST-EXEC: hexdump -C 2.pcap >2.hex diff --git a/testing/btest/core/pcap/dumper.bro b/testing/btest/core/pcap/dumper.bro index 8f89987b37..0f2bdb072e 100644 --- a/testing/btest/core/pcap/dumper.bro +++ b/testing/btest/core/pcap/dumper.bro @@ -1,3 +1,4 @@ +# @TEST-REQUIRES: which hexdump # @TEST-EXEC: bro -r $TRACES/workshop_2011_browse.trace -w dump # @TEST-EXEC: hexdump -C $TRACES/workshop_2011_browse.trace >1 # @TEST-EXEC: hexdump -C dump >2 diff --git a/testing/btest/coverage/find-bro-logs.test b/testing/btest/coverage/find-bro-logs.test index 4e54b1071a..e7bcf0578f 100644 --- a/testing/btest/coverage/find-bro-logs.test +++ b/testing/btest/coverage/find-bro-logs.test @@ -4,6 +4,7 @@ # # If this test fails, then the "Log Files" documentation page should be updated. +# @TEST-REQUIRES: which python # @TEST-EXEC: bash %INPUT # @TEST-EXEC: btest-diff out