Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 09:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/fastpath'

Browse source 
* origin/fastpath:
  Remove remaining references to BROMAGIC
  Fix typos and formatting in event and BiF documentation
This commit is contained in:
Jon Siwek 2014-05-20 10:16:50 -05:00
commit fb7c3677dc
15 changed files with 93 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

6
CHANGES
View file

@ -1,4 +1,10 @@
2.3-beta-3 | 2014-05-20 10:16:50 -0500
* Remove remaining references to BROMAGIC (Daniel Thayer)
* Fix typos and formatting in event and BiF documentation (Daniel Thayer)
2.3-beta | 2014-05-19 16:36:50 -0500 2.3-beta | 2014-05-19 16:36:50 -0500
* Release 2.3-beta * Release 2.3-beta

2
VERSION
View file

@ -1 +1 @@
2.3-beta 2.3-beta-3

1
doc/conf.py.in
View file

@ -38,7 +38,6 @@ extensions += ["broxygen"]
bro_binary = os.path.abspath("@CMAKE_SOURCE_DIR@/build/src/bro") bro_binary = os.path.abspath("@CMAKE_SOURCE_DIR@/build/src/bro")
broxygen_cache="@BROXYGEN_CACHE_DIR@" broxygen_cache="@BROXYGEN_CACHE_DIR@"
os.environ["BROPATH"] = "@BROPATH@" os.environ["BROPATH"] = "@BROPATH@"
os.environ["BROMAGIC"] = "@BROMAGIC@"
# ----- End of Broxygen configuration. ----- # ----- End of Broxygen configuration. -----
# -- General configuration ----------------------------------------------------- # -- General configuration -----------------------------------------------------

2
doc/quickstart/index.rst
View file

@ -426,7 +426,7 @@ Running Bro Without Installing
For developers that wish to run Bro directly from the ``build/`` For developers that wish to run Bro directly from the ``build/``
directory (i.e., without performing ``make install``), they will have directory (i.e., without performing ``make install``), they will have
to first adjust ``BROPATH`` and ``BROMAGIC`` to look for scripts and to first adjust ``BROPATH`` to look for scripts and
additional files inside the build directory. Sourcing either additional files inside the build directory. Sourcing either
``build/bro-path-dev.sh`` or ``build/bro-path-dev.csh`` as appropriate ``build/bro-path-dev.sh`` or ``build/bro-path-dev.csh`` as appropriate
for the current shell accomplishes this and also augments your for the current shell accomplishes this and also augments your

17
src/analyzer/protocol/dns/events.bif
View file

@ -367,7 +367,7 @@ event dns_MX_reply%(c: connection, msg: dns_msg, ans: dns_answer, name: string,
## ##
## ans: The type-independent part of the parsed answer record. ## ans: The type-independent part of the parsed answer record.
## ##
## str: The textual information returned by the reply. ## strs: The textual information returned by the reply.
## ##
## .. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl ## .. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
## dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply ## dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
@ -392,11 +392,17 @@ event dns_TXT_reply%(c: connection, msg: dns_msg, ans: dns_answer, strs: string_
## ##
## ans: The type-independent part of the parsed answer record. ## ans: The type-independent part of the parsed answer record.
## ##
## priority: Priority of the SRV response. ## target: Target of the SRV response -- the canonical hostname of the
## machine providing the service, ending in a dot.
## ##
## weight: Weight of the SRV response. ## priority: Priority of the SRV response -- the priority of the target
## host, lower value means more preferred.
## ##
## p: Port of the SRV response. ## weight: Weight of the SRV response -- a relative weight for records
## with the same priority, higher value means more preferred.
##
## p: Port of the SRV response -- the TCP or UDP port on which the
## service is to be found.
## ##
## .. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl ## .. bro:see:: dns_AAAA_reply dns_A_reply dns_CNAME_reply dns_EDNS_addl
## dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply ## dns_HINFO_reply dns_MX_reply dns_NS_reply dns_PTR_reply dns_SOA_reply
@ -408,8 +414,7 @@ event dns_TXT_reply%(c: connection, msg: dns_msg, ans: dns_answer, strs: string_
event dns_SRV_reply%(c: connection, msg: dns_msg, ans: dns_answer, target: string, priority: count, weight: count, p: count%); event dns_SRV_reply%(c: connection, msg: dns_msg, ans: dns_answer, target: string, priority: count, weight: count, p: count%);
## Generated on DNS reply resource records when the type of record is not one ## Generated on DNS reply resource records when the type of record is not one
## that Bro knows how to parse and generate another more specific specific ## that Bro knows how to parse and generate another more specific event.
## event.
## ##
## c: The connection, which may be UDP or TCP depending on the type of the ## c: The connection, which may be UDP or TCP depending on the type of the
## transport-layer session being analyzed. ## transport-layer session being analyzed.

4
src/analyzer/protocol/pop3/events.bif
View file

@ -105,8 +105,8 @@ event pop3_unexpected%(c: connection, is_orig: bool,
## ##
## c: The connection. ## c: The connection.
## ##
## .. bro:see:: pop3_data pop3_login_failure pop3_login_success pop3_reply pop3_request ## .. bro:see:: pop3_data pop3_login_failure pop3_login_success pop3_reply
## pop3_unexpected ## pop3_request pop3_unexpected
## ##
## .. todo:: Bro's current default configuration does not activate the protocol ## .. todo:: Bro's current default configuration does not activate the protocol
## analyzer that generates this event; the corresponding script has not yet ## analyzer that generates this event; the corresponding script has not yet

15
src/analyzer/protocol/radius/events.bif
View file

@ -3,10 +3,9 @@
## See `Wikipedia <http://en.wikipedia.org/wiki/RADIUS>`__ for more ## See `Wikipedia <http://en.wikipedia.org/wiki/RADIUS>`__ for more
## information about RADIUS. ## information about RADIUS.
## ##
## c: The connection ## c: The connection.
## msg_type: The value of the code field (1 == Access-Request, 2 == Access-Accept, etc.) ##
## trans_id: The RADIUS transaction identifier ## result: A record containing fields parsed from a RADIUS packet.
## authenticator: The value of the authenticator field
## ##
event radius_message%(c: connection, result: RADIUS::Message%); event radius_message%(c: connection, result: RADIUS::Message%);
@ -15,9 +14,11 @@ event radius_message%(c: connection, result: RADIUS::Message%);
## See `Wikipedia <http://en.wikipedia.org/wiki/RADIUS>`__ for more ## See `Wikipedia <http://en.wikipedia.org/wiki/RADIUS>`__ for more
## information about RADIUS. ## information about RADIUS.
## ##
## c: The connection ## c: The connection.
## attr_type: The value of the code field (1 == User-Name, 2 == User-Password, etc.) ##
## authenticator: The value of the authenticator field ## attr_type: The value of the code field (1 == User-Name, 2 == User-Password, etc.).
##
## value: The data/value bound to the attribute.
## ##
event radius_attribute%(c: connection, attr_type: count, value: string%); event radius_attribute%(c: connection, attr_type: count, value: string%);

8
src/analyzer/protocol/smtp/events.bif
View file

@ -99,10 +99,10 @@ event smtp_data%(c: connection, is_orig: bool, data: string%);
## .. bro:see:: smtp_data smtp_request smtp_reply ## .. bro:see:: smtp_data smtp_request smtp_reply
event smtp_unexpected%(c: connection, is_orig: bool, msg: string, detail: string%); event smtp_unexpected%(c: connection, is_orig: bool, msg: string, detail: string%);
## Generated if a connection switched to using TLS using STARTTLS. After this event ## Generated if a connection switched to using TLS using STARTTLS. After this
## no more SMTP events will be raised for the connection. See the SSL analyzer for ## event no more SMTP events will be raised for the connection. See the SSL
## related SSL events, which will now be generated. ## analyzer for related SSL events, which will now be generated.
## ##
## c: The connection ## c: The connection.
## ##
event smtp_starttls%(c: connection%); event smtp_starttls%(c: connection%);

45
src/analyzer/protocol/ssl/events.bif
View file

@ -86,8 +86,8 @@ event ssl_server_hello%(c: connection, version: count, possible_ts: time, server
event ssl_extension%(c: connection, is_orig: bool, code: count, val: string%); event ssl_extension%(c: connection, is_orig: bool, code: count, val: string%);
## Generated for an SSL/TLS Elliptic Curves extension. This TLS extension is ## Generated for an SSL/TLS Elliptic Curves extension. This TLS extension is
## defined in :rfc:`4492` and sent by the client in the initial handshake. It gives ## defined in :rfc:`4492` and sent by the client in the initial handshake. It
## the list of elliptic curves supported by the client. ## gives the list of elliptic curves supported by the client.
## ##
## c: The connection. ## c: The connection.
## ##
@ -118,13 +118,13 @@ event ssl_extension_elliptic_curves%(c: connection, is_orig: bool, curves: index
## ssl_extension_server_name ssl_server_curve ## ssl_extension_server_name ssl_server_curve
event ssl_extension_ec_point_formats%(c: connection, is_orig: bool, point_formats: index_vec%); event ssl_extension_ec_point_formats%(c: connection, is_orig: bool, point_formats: index_vec%);
## Generated if a named curve is chosen by the server for an SSL/TLS connection. The ## Generated if a named curve is chosen by the server for an SSL/TLS connection.
## curve is sent by the server in the ServerKeyExchange message as defined in ## The curve is sent by the server in the ServerKeyExchange message as defined
## :rfc:`4492`, in case an ECDH or ECDHE cipher suite is chosen. ## in :rfc:`4492`, in case an ECDH or ECDHE cipher suite is chosen.
## ##
## c: The connection. ## c: The connection.
## ##
## point_formats: List of supported point formats. ## curve: The curve.
## ##
## .. bro:see:: ssl_alert ssl_client_hello ssl_established ssl_server_hello ## .. bro:see:: ssl_alert ssl_client_hello ssl_established ssl_server_hello
## ssl_session_ticket_handshake ssl_extension ## ssl_session_ticket_handshake ssl_extension
@ -151,7 +151,7 @@ event ssl_dh_server_params%(c: connection, p: string, q: string, Ys: string%);
## Generated for an SSL/TLS Application-Layer Protocol Negotiation extension. ## Generated for an SSL/TLS Application-Layer Protocol Negotiation extension.
## This TLS extension is defined in draft-ietf-tls-applayerprotoneg and sent in ## This TLS extension is defined in draft-ietf-tls-applayerprotoneg and sent in
## the initial handshake. It contains the list of client supported application ## the initial handshake. It contains the list of client supported application
## protocols by the client or the server, respectovely. ## protocols by the client or the server, respectively.
## ##
## At the moment it is mostly used to negotiate the use of SPDY / HTTP2-drafts. ## At the moment it is mostly used to negotiate the use of SPDY / HTTP2-drafts.
## ##
@ -169,15 +169,15 @@ event ssl_extension_application_layer_protocol_negotiation%(c: connection, is_or
## Generated for an SSL/TLS Server Name extension. This SSL/TLS extension is ## Generated for an SSL/TLS Server Name extension. This SSL/TLS extension is
## defined in :rfc:`3546` and sent by the client in the initial handshake. It ## defined in :rfc:`3546` and sent by the client in the initial handshake. It
## contains the name of the server it is contacting. This information can be used ## contains the name of the server it is contacting. This information can be
## by the server to choose the correct certificate for the host the client wants to ## used by the server to choose the correct certificate for the host the client
## contact. ## wants to contact.
## ##
## c: The connection. ## c: The connection.
## ##
## is_orig: True if event is raised for originator side of the connection. ## is_orig: True if event is raised for originator side of the connection.
## ##
## protocols: List of supported application layer protocols. ## names: A list of server names (DNS hostnames).
## ##
## .. bro:see:: ssl_alert ssl_client_hello ssl_established ssl_server_hello ## .. bro:see:: ssl_alert ssl_client_hello ssl_established ssl_server_hello
## ssl_session_ticket_handshake ssl_extension ## ssl_session_ticket_handshake ssl_extension
@ -244,9 +244,9 @@ event ssl_alert%(c: connection, is_orig: bool, level: count, desc: count%);
## ssl_alert ## ssl_alert
event ssl_session_ticket_handshake%(c: connection, ticket_lifetime_hint: count, ticket: string%); event ssl_session_ticket_handshake%(c: connection, ticket_lifetime_hint: count, ticket: string%);
## Generated for SSL/TLS heartbeat messages that are sent before session encryption ## Generated for SSL/TLS heartbeat messages that are sent before session
## starts. Generally heartbeat messages should rarely be seen in normal TLS traffic. ## encryption starts. Generally heartbeat messages should rarely be seen in
## Heartbeats are described in :rfc:`6520`. ## normal TLS traffic. Heartbeats are described in :rfc:`6520`.
## ##
## c: The connection. ## c: The connection.
## ##
@ -254,12 +254,13 @@ event ssl_session_ticket_handshake%(c: connection, ticket_lifetime_hint: count,
## ##
## length: length of the entire heartbeat message. ## length: length of the entire heartbeat message.
## ##
## heartbeat_type: type of the heartbeat message. Per RFC, 1 = request, 2 = response ## heartbeat_type: type of the heartbeat message. Per RFC, 1 = request, 2 = response.
## ##
## payload_length: length of the payload of the heartbeat message, according to packet field ## payload_length: length of the payload of the heartbeat message, according to
## packet field.
## ##
## payload: payload contained in the heartbeat message. Size can differ from payload_length, ## payload: payload contained in the heartbeat message. Size can differ from
## if payload_length and actual packet length disagree. ## payload_length, if payload_length and actual packet length disagree.
## ##
## .. bro:see:: ssl_client_hello ssl_established ssl_extension ssl_server_hello ## .. bro:see:: ssl_client_hello ssl_established ssl_extension ssl_server_hello
## ssl_alert ssl_encrypted_data ## ssl_alert ssl_encrypted_data
@ -269,13 +270,13 @@ event ssl_heartbeat%(c: connection, is_orig: bool, length: count, heartbeat_type
## started. ## started.
## ##
## Note that :bro:id:`SSL::disable_analyzer_after_detection` has to be changed ## Note that :bro:id:`SSL::disable_analyzer_after_detection` has to be changed
## from its default to false for this this event to be generated. ## from its default to false for this event to be generated.
## ##
## c: The connection. ## c: The connection.
## ##
## is_orig: True if event is raised for originator side of the connection. ## is_orig: True if event is raised for originator side of the connection.
## ##
## content type: message type as reported by TLS session layer ## content_type: message type as reported by TLS session layer.
## ##
## length: length of the entire heartbeat message. ## length: length of the entire heartbeat message.
## ##
@ -284,8 +285,8 @@ event ssl_heartbeat%(c: connection, is_orig: bool, length: count, heartbeat_type
event ssl_encrypted_data%(c: connection, is_orig: bool, content_type: count, length: count%); event ssl_encrypted_data%(c: connection, is_orig: bool, content_type: count, length: count%);
## This event contains the OCSP response contained in a Certificate Status Request ## This event contains the OCSP response contained in a Certificate Status Request
## message, when the client requested OCSP stapling and the server supports it. See ## message, when the client requested OCSP stapling and the server supports it.
## description in :rfc:`6066` ## See description in :rfc:`6066`.
## ##
## c: The connection. ## c: The connection.
## ##

10
src/event.bif
View file

@ -360,9 +360,9 @@ event content_gap%(c: connection, is_orig: bool, seq: count, length: count%);
## ##
## .. note:: ## .. note::
## ##
## Bro comes with a script :doc:`/scripts/policy/misc/capture-loss.bro` that uses ## Bro comes with a script :doc:`/scripts/policy/misc/capture-loss.bro` that
## this event to estimate packet loss and report when a predefined threshold ## uses this event to estimate packet loss and report when a predefined
## is exceeded. ## threshold is exceeded.
event gap_report%(dt: interval, info: gap_info%); event gap_report%(dt: interval, info: gap_info%);
## Generated when a protocol analyzer confirms that a connection is indeed ## Generated when a protocol analyzer confirms that a connection is indeed
@ -1011,8 +1011,8 @@ event dns_mapping_lost_name%(dm: dns_mapping%);
## dns_mapping_valid ## dns_mapping_valid
event dns_mapping_altered%(dm: dns_mapping, old_addrs: addr_set, new_addrs: addr_set%); event dns_mapping_altered%(dm: dns_mapping, old_addrs: addr_set, new_addrs: addr_set%);
## A meta event generated for events that Bro raises. This will report all events ## A meta event generated for events that Bro raises. This will report all
## for which at least one handler is defined. ## events for which at least one handler is defined.
## ##
## Note that handling this meta event is expensive and should be limited to ## Note that handling this meta event is expensive and should be limited to
## debugging purposes. ## debugging purposes.

6
src/file_analysis/analyzer/x509/events.bif
View file

@ -43,9 +43,9 @@ event x509_extension%(f: fa_file, ext: X509::Extension%);
event x509_ext_basic_constraints%(f: fa_file, ext: X509::BasicConstraints%); event x509_ext_basic_constraints%(f: fa_file, ext: X509::BasicConstraints%);
## Generated for the X509 subject alternative name extension seen in a certificate. ## Generated for the X509 subject alternative name extension seen in a certificate.
## This extension can be used to allow additional entities to be bound to the subject ## This extension can be used to allow additional entities to be bound to the
## of the certificate. Usually it is used to specify one or multiple DNS names for ## subject of the certificate. Usually it is used to specify one or multiple DNS
## which a certificate is valid. ## names for which a certificate is valid.
## ##
## f: The file. ## f: The file.
## ##

23
src/file_analysis/analyzer/x509/functions.bif
View file

@ -106,9 +106,9 @@ STACK_OF(X509)* x509_get_untrusted_stack(VectorVal* certs_vec)
## Parses a certificate into an X509::Certificate structure. ## Parses a certificate into an X509::Certificate structure.
## ##
## cert: The X509 certificicate opaque handle ## cert: The X509 certificate opaque handle.
## ##
## Returns: A X509::Certificate structure ## Returns: A X509::Certificate structure.
## ##
## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints ## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints
## x509_ext_subject_alternative_name x509_verify ## x509_ext_subject_alternative_name x509_verify
@ -123,13 +123,13 @@ function x509_parse%(cert: opaque of x509%): X509::Certificate
## Returns the string form of a certificate. ## Returns the string form of a certificate.
## ##
## cert: The X509 certificate opaque handle ## cert: The X509 certificate opaque handle.
## ##
## pem: A boolean that specifies if the certificate is returned ## pem: A boolean that specifies if the certificate is returned
## in pem-form (true), or as the raw ASN1 encoded binary ## in pem-form (true), or as the raw ASN1 encoded binary
## (false). ## (false).
## ##
## Returns: X509 certificate as a string ## Returns: X509 certificate as a string.
## ##
## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints ## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints
## x509_ext_subject_alternative_name x509_parse x509_verify ## x509_ext_subject_alternative_name x509_parse x509_verify
@ -158,14 +158,14 @@ function x509_get_certificate_string%(cert: opaque of x509, pem: bool &default=F
## ##
## certs: Specifies the certificate chain to use. Server certificate first. ## certs: Specifies the certificate chain to use. Server certificate first.
## ##
## ocsp_reply: the ocsp reply to validate ## ocsp_reply: the ocsp reply to validate.
## ##
## root_certs: A list of root certificates to validate the certificate chain ## root_certs: A list of root certificates to validate the certificate chain.
## ##
## verify_time: Time for the validity check of the certificates. ## verify_time: Time for the validity check of the certificates.
## ##
## Returns: A record of type X509::Result containing the result code of the verify ## Returns: A record of type X509::Result containing the result code of the
## operation. ## verify operation.
## ##
## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints ## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints
## x509_ext_subject_alternative_name x509_parse ## x509_ext_subject_alternative_name x509_parse
@ -377,12 +377,13 @@ x509_ocsp_cleanup:
## the given certificate against the root store given in *root_certs*. ## the given certificate against the root store given in *root_certs*.
## The host certificate has to be at index 0. ## The host certificate has to be at index 0.
## ##
## root_certs: A list of root certificates to validate the certificate chain ## root_certs: A list of root certificates to validate the certificate chain.
## ##
## verify_time: Time for the validity check of the certificates. ## verify_time: Time for the validity check of the certificates.
## ##
## Returns: A record of type X509::Result containing the result code of the verify ## Returns: A record of type X509::Result containing the result code of the
## operation. In case of success also returns the full certificate chain. ## verify operation. In case of success also returns the full
## certificate chain.
## ##
## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints ## .. bro:see:: x509_certificate x509_extension x509_ext_basic_constraints
## x509_ext_subject_alternative_name x509_parse ## x509_ext_subject_alternative_name x509_parse

1
testing/btest/btest.cfg
View file

@ -8,7 +8,6 @@ PartFinalizer = btest-diff-rst
[environment] [environment]
BROPATH=`bash -c %(testbase)s/../../build/bro-path-dev` BROPATH=`bash -c %(testbase)s/../../build/bro-path-dev`
BROMAGIC=%(testbase)s/../../magic/database
BRO_SEED_FILE=%(testbase)s/random.seed BRO_SEED_FILE=%(testbase)s/random.seed
TZ=UTC TZ=UTC
LC_ALL=C LC_ALL=C

1
testing/external/subdir-btest.cfg vendored
View file

@ -7,7 +7,6 @@ IgnoreFiles = *.tmp *.swp #* *.trace .gitignore *.skeleton
[environment] [environment]
BROPATH=`bash -c %(testbase)s/../../../build/bro-path-dev`:%(testbase)s/../scripts BROPATH=`bash -c %(testbase)s/../../../build/bro-path-dev`:%(testbase)s/../scripts
BROMAGIC=%(testbase)s/../../../magic/database
BRO_SEED_FILE=%(testbase)s/../random.seed BRO_SEED_FILE=%(testbase)s/../random.seed
TZ=UTC TZ=UTC
LC_ALL=C LC_ALL=C