diff --git a/.gitmodules b/.gitmodules index e2dcd2b8a4..326e1fe506 100644 --- a/.gitmodules +++ b/.gitmodules @@ -10,3 +10,6 @@ [submodule "aux/broctl"] path = aux/broctl url = git://git.icir.org/broctl +[submodule "aux/btest"] + path = aux/btest + url = git://git.icir.org/btest diff --git a/CHANGES b/CHANGES index f2f271e141..d12cd02ebb 100644 --- a/CHANGES +++ b/CHANGES @@ -1,6 +1,141 @@ -@(#) $Id: CHANGES 7076 2010-09-13 02:42:27Z vern $ +1.6-dev.45 Tue Feb 8 21:28:01 PST 2011 + +- Fixing a number of compiler warnings. (Seth Hall and Robin Sommer) + +1.6-dev.44 Tue Feb 8 20:11:44 PST 2011 + +- A number of updates to the SSL analyzer, including support for new + ciphers; SSL extensions; and bug fixes. The analyzer does not longer + throw weird for exceeding a predefined cipherspec_size anymore. + (Seth Hall and Rmkml). + +- The various split*() BiFs now handle strings containing null bytes + correctly. (Seth Hall) + +- Adding new aux/btest submodule. This is a framework we will use in + the future for doing unit tests. (Robin Sommer) + +1.6-dev.41 Mon Feb 7 13:43:56 PST 2011 + +- Smarter way to increase the parent/child pipe's socket buffer. + (Craig Leres). + +- Fixing bug with defining bro_int_t and bro_uint_t to be 64 bits wide + on some platforms. (Robin Sommer) + +1.6-dev.39 Mon Jan 31 16:42:23 PST 2011 + +- Login's confused messages now go through weird.bro. (Robin Sommer) + +1.6-dev.36 Mon Jan 31 08:45:35 PST 2011 + +- Adding more configure options for finding dependencies, (Jon Siwek) + + --with-flex=PATH path to flex executable + --with-bison=PATH path to bison executable + --with-perl=PATH path to perl executable + --with-python=PATH path to Python interpreter + --with-python-lib=PATH path to libpython + --with-python-inc=PATH path to Python headers + --with-swig=PATH path to SWIG executable + +- Fixing typo in PCAPTests.cmake (Jon Siwek) + + +1.6-dev.33 Mon Jan 24 15:29:04 PST 2011 + +- Fixing bug in SMB analyzer. (Robin Sommer) + +- Configure wrapper now deletes previous CMake cache (Jon Siwek) + +- Fix for the --with-binpac configure option. (Jon Siwek) + +1.6-dev.30 Thu Jan 20 16:32:43 PST 2011 + +- Changed configure wrapper to create config.status. (Jon Siwek) + +1.6-dev.29 Thu Jan 20 16:29:56 PST 2011 + +- Fixing little problem with initialization of Bro-to-Bro event + communication. (Christian Kreibich) + + +1.6-dev.27 Thu Jan 20 13:52:25 PST 2011 + +- Fine-tuning of the HTTP analyzer in terms of raising protocol + violations and interrupted transfers. (Gregor Maier) + + +1.6-dev.21 Wed Jan 19 17:36:02 PST 2011 + +- Added 4 new BiFs and a new record type for testing the entropy of + strings. (Seth Hall) + + find_entropy(data: string): entropy_test_result + This is a one shot function that accepts a string and + returns the result of the entropy calculations. + + entropy_test_init(index: any): bool + This and the next two functions are for calculating entropy + piece-wise. It only needs an index which can be any type of + variable. It needs to be something that uniquely identifies + the data stream that is currently having it's entropy + calculated. + + entropy_test_add(index: any, data: string): bool + This function is used to add data into the entropy + calculation. It takes the index used in the function above + and the data that you are adding and returns true if + everything seemed to work, false otherwise. + + entropy_test_finish(index: any): entropy_test_result + Calling this function indicates that all of the desired data + has been inserted into the entropy_test_add function and the + entropy should be calculated. This function *must* be called + in order to clean up an internal state tracking variable. + If this is never called on an index, it will result in a + memory leak. + + The entropy_test_result values have several measures of the + entropy, but a good one to work with is the "entropy" attribute. + It's a double and as the value approaches 8.0 it can be considered + more and more random. For example, a value of 7.832 would be + quite random but a value of 4.671 is not very random. + +1.6-dev.20 Wed Jan 19 17:30:11 PST 2011 + +- BRO_DNS_FAKE is now listed in the --help output. (Seth Hall) + + +1.6-dev.18 Wed Jan 19 16:37:13 PST 2011 + +- Removing unnecessary expire timer from http_sessions. (Gregor + Maier) + + +1.6-dev.16 Sat Jan 15 14:14:21 PST 2011 + +- Updates to the build system. (Jonathan Siwek) + + * ``make dist`` is now available to be used with the top-level + Makefile for creating source packages according to #344. + + * ``make-rpm-packages`` and ``make-mac-packages`` scripts can + now generate binary packages according to #295. + + * Additional configure options to change packaging behavior. + + * OS X builds will now prefer to link static libraries of + optional dependencies that don't come with the vanilla + operating system. + + * Fix for OS X 10.5 compile error dealing with the llabs() + function from stdlib. + + * Installing as a different user than the one that + configured/built now works (although, a harmless error message + about not being able to write the install manifest may occur). --+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ 1.6-dev.3 Wed Dec 8 04:09:38 PST 2010 @@ -31,7 +166,7 @@ - The Bro source code is now developed in the new git repositories. See the developer pages at http://www.bro-ids.org for more - information on the new development process. + information on the new development process. - Bro's build and installation setup has been moved from GNU autotools to CMake. As a result of that, layout and specifics of @@ -54,7 +189,7 @@ and can no longer be disabled. - ClamAV support has been removed, which has been non-functional for - a while already. + a while already. 1.5.2.7 Sun Sep 12 19:39:49 PDT 2010 @@ -432,7 +567,7 @@ (1) Remote communication now no longer includes location information for serialized objects; that removes quite a bit of redundacy from the network traffic. - + (2) The new option 'remote_check_sync_consistency" disables the cross-check on the receiving side of &synchronized state of whether the current value of a variable has the value expected by the sender. Transmitting the @@ -449,7 +584,7 @@ we maintain *two* caches independently for these types of objects; one with a low turn-over one and another with a high one. This should reduce CPU load on both sender and receiver sides. - + The new scheme is only used if both communicating Bros support it; with older Bros, as well as with Broccoli, we continue using the old scheme. @@ -643,12 +778,12 @@ bro -Y 0.0.0.0:5555 netflow bro -i eth0 -Y 10.0.0.1:1234=src1 brolite netflow - -y|--flowfile [=] + -y|--flowfile [=] Used to read from a file. You can optionally include an identifier for the source. - Examples: + Examples: bro -y myflowfile netflow bro -y myflowfile=src1 otherflowfile=src2 netflow @@ -817,7 +952,7 @@ So, to drop all sources triggering a specific notice, one can now, e.g., write: - + redef notice_action_filters += { [Hot::SSH_Overflow] = drop_source }; Related to this change, notice_info has a new field $dropped, set to @@ -848,8 +983,8 @@ before starting the main packet loop and another one when finished. These snapshots can then be analyzed with pprof. - For more information about the perftools see - + For more information about the perftools see + http://code.google.com/p/google-perftools - Notice tags are now generated in a pseudo-unique fashion that, with high @@ -923,7 +1058,7 @@ detector tables. - When Bro serializes functions, it now does so by default using only - their name, rather than their full value (Robin Sommer). This prevents + their name, rather than their full value (Robin Sommer). This prevents propagation of expiration functions associated with tables and sets. Note, currently there is no mechanism provided to switch from the default behavior, but the internal hooks are in place to do so. @@ -1188,7 +1323,7 @@ - An arbitrary tag can now be past to post-processors for log rotation (Robin Sommer). -- Default inactivity timeouts for interactive services shortened to +- Default inactivity timeouts for interactive services shortened to 1 hour (Robin Sommer). - The scanning variables distinct_{peers,ports,low_ports} are now @@ -1501,7 +1636,7 @@ This fixes a long-standing problem of sometimes $addl fields not showing up in connection summaries. -- The new expressions record(...), table(...), set(...) and vector(...) +- The new expressions record(...), table(...), set(...) and vector(...) are constructors for the corresponding aggregate types (Vern Paxson). For example, @@ -1655,7 +1790,7 @@ - A new notice_action_filter, tally_notice_type_and_ignore, works the same as tally_notice_type but returns IGNORE (Robin Sommer) -- Setting summary_interval == 0 disables the creation of irc-bots.summary.log +- Setting summary_interval == 0 disables the creation of irc-bots.summary.log (Robin Sommer). - If you @load foo and a directory "foo" is in your path, Bro no longer @@ -1772,9 +1907,9 @@ - Fixed using "time" values as table indices. -- Added ssh to default brolite DPD configuration. +- Added ssh to default brolite DPD configuration. -- Fixed catching up to real-time in case of lull. +- Fixed catching up to real-time in case of lull. - Fixed Broccoli "BRO_DATA_FORMAT_VERSION" to match version in Bro. @@ -1784,11 +1919,11 @@ - Added Linux tuning to brolite install script. -- Modified Makefile to include broccoli/contrib. +- Modified Makefile to include broccoli/contrib. -- Adding missing initialization to remote serializer. +- Adding missing initialization to remote serializer. -- Minor documentation updates for reference manual and Broccoli. +- Minor documentation updates for reference manual and Broccoli. 1.2 Tue Oct 17 12:09:49 PDT 2006 @@ -2007,7 +2142,7 @@ - notice_action_filters now reside in the new script notice-action-filter.bro (automatically loaded by notice.bro). - + - The notice actions NOTICE_ALARM_PER_CONN, NOTICE_ALARM_PER_ORIG, and NOTICE_ALARM_ONCE have been removed, as they were never actually implemented. @@ -2027,7 +2162,7 @@ - TRW analysis now skips UDP traffic because it currently treats all UDP connections as failures (Robin Sommer). - + - trw.bro has been split into trw-impl.bro (the algorithm) and trw.bro (which simply activates the analysis), to facilitate writing scripts that have hooks into TRW analysis but don't presume it's @@ -2160,7 +2295,7 @@ (Robin Sommer). This appears to still need some work, as now it generates redundant events. -- Fix for initial exchange of &sync state which could lead to +- Fix for initial exchange of &sync state which could lead to referencing unknown IDs (Robin Sommer). - Fix to scan detection for differing semantics of connection compressor @@ -2469,7 +2604,7 @@ - the new variable dump_backdoor_packets (default F) if set causes the packet that triggered the backdoor detection to be written to - backdoor-packets/: