Commit graph

3049 commits

Author SHA1 Message Date
Daniel Thayer
e2c5a5c4a5 Fix typos and formatting in the communication framework doc
Fixed a link that was pointing to the wrong "connect".
2013-10-10 14:42:01 -05:00
Daniel Thayer
f21f45ac1a Fix typos and formatting in the cluster framework docs
Changed a Time Machine link to point to something useful.
2013-10-10 14:39:44 -05:00
Daniel Thayer
7ddc670a02 Fix typos and formatting in the file analysis docs 2013-10-10 12:46:11 -05:00
Daniel Thayer
0d712b35d8 Fix typos and a broken link in the file analysis doc 2013-10-10 12:23:34 -05:00
Daniel Thayer
1a36031874 Fix typos and formatting in the input framework docs 2013-10-10 00:53:13 -05:00
Bernhard Amann
00b622f54d IANA assigned a couple of new tls extension numbers 2013-10-08 13:52:44 -07:00
Bernhard Amann
737b15aef9 add 3 more really new ciphers. 2013-10-08 13:02:55 -07:00
Bernhard Amann
2b87499fd9 rip out x509 code from ssl analyzer. Note that since at the moment
the file analyzer does not yet re-populate the info record that
means quite a lot of information is simply not available.
2013-10-01 16:25:33 -07:00
Bernhard Amann
ea766d71bb add ciphers to cipher_desc table that were already present
but apparently forgotten.
2013-10-01 16:01:37 -07:00
Bernhard Amann
497ada12e8 ...and a few more ciphers. 2013-09-26 10:03:17 -07:00
Bernhard Amann
9264e2e7d3 add new tls cipher suites 2013-09-25 22:21:56 -07:00
Seth Hall
706363a295 Fixes for the 2.2 beta. 2013-09-25 16:44:39 -04:00
Bernhard Amann
df552ca87d parse out extension. One event for general extensions (just returns the
openssl-parsed string-value), one event for basicconstraints (is a certificate
a CA or not) and one event for subject-alternative-names (only DNS parts).
2013-09-19 14:41:34 -07:00
Bernhard Amann
8b48a476ec update mozilla root ca list 2013-09-19 12:53:45 -07:00
Jon Siwek
d05a02e848 Update Mozilla root CA certs. 2013-09-19 12:57:14 -05:00
Robin Sommer
3738b4136b Merge remote-tracking branch 'origin/topic/bernhard/ticket950'
* origin/topic/bernhard/ticket950:
  make client and server random available on script-level.

BIT-950 #merged
2013-09-18 15:02:55 -07:00
Robin Sommer
c6de23ebe1 Merge remote-tracking branch 'origin/topic/bernhard/ticket1072'
* origin/topic/bernhard/ticket1072:
  and const 2 more functions
  update hll documentation, make a few functions private and create a new copy constructor.
  fix case where hll_error_margin could be undefined (thanks John)

BIT-1072 #merged
2013-09-18 15:00:06 -07:00
Bernhard Amann
e5a589dbfe Very basic file-analyzer for x509 certificates. Mostly ripped from
the ssl-analyzer and the topic/bernhard/x509 branch.

Simply prints information about the encountered certificates (I have
not yet my mind up, what I will log...).

Next step: extensions...
2013-09-16 14:08:22 -07:00
Bernhard Amann
9834755948 fix case where hll_error_margin could be undefined (thanks John) 2013-09-11 12:50:29 -07:00
Bernhard Amann
c40a97156a make client and server random available on script-level.
Patch by ewust

Addresses BIT-950
2013-09-11 12:39:23 -07:00
Seth Hall
7c1dffa66f Fixed an issue with the HLL_UNIQUE SumStats plugin that caused a reporter error. 2013-09-06 15:31:00 -04:00
Jon Siwek
a9a245e017 Workaround type ambiguity w/ default record field. 2013-09-05 16:41:51 -05:00
Seth Hall
ef50802fd7 Make the notice $actions field have a default empty set to avoid having to check for it's presence. 2013-09-05 12:07:21 -04:00
Jon Siwek
db470a637a Documentation fixes.
This cleans up most of the warnings from sphinx (broken :doc: links,
broxygen role misuses, etc.).  The remaining ones should be harmless,
but not quick to silence.

I found that the README for each component was a copy from the actual
repo, so I turned those in to symlinks so they don't get out of date.
2013-09-03 15:59:40 -05:00
Robin Sommer
6f9d28cc18 Merge branch 'topic/robin/hyperloglog-merge'
* topic/robin/hyperloglog-merge: (35 commits)
  Making the confidence configurable.
  Renaming HyperLogLog->CardinalityCounter.
  Fixing bug introduced during merging.
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  ...
2013-08-31 10:42:42 -07:00
Robin Sommer
295987c8d0 Making the confidence configurable. 2013-08-31 10:34:50 -07:00
Robin Sommer
4dcf8fc0db Merge remote-tracking branch 'origin/topic/bernhard/hyperloglog'
* origin/topic/bernhard/hyperloglog: (32 commits)
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  change plugin after feedback of seth
  Forgot a file. Again. Like always. Basically.
  do away with old file.
  ...
2013-08-30 11:30:05 -07:00
Bernhard Amann
2dd0d057e6 Merge remote-tracking branch 'origin/master' into topic/bernhard/hyperloglog
Conflicts:
	src/NetVar.cc
	src/NetVar.h
2013-08-30 08:43:47 -07:00
Bernhard Amann
dc9fd36497 Merge remote branch 'origin/master' into topic/bernhard/hyperloglog 2013-08-28 17:48:59 -07:00
Jon Siwek
5c119561ad UID optimizations addressing BIT-1016.
Max UID bit-length is now 128, but can be increased w/ trivial source
code change of BRO_UID_LEN.
2013-08-28 15:35:18 -05:00
Seth Hall
0592b528ef Merge branch 'master' of ssh://git.bro-ids.org/bro 2013-08-28 00:58:03 -04:00
Seth Hall
2b78922af8 Added a $unique_max field to Reducers for the SumStats::UNIQUE calculation
- Using the new option in scan.bro and the FTP bruteforce detection.
2013-08-28 00:57:44 -04:00
Jon Siwek
d31b59a5d0 Merge branch 'master' into topic/jsiwek/uid 2013-08-26 15:51:18 -05:00
Jon Siwek
22bf3e1196 Increase UIDs to 96 bits w/ C/F prefix - BIT-1016
- The bit-length is adjustable via redef'ing bits_per_uid.

- Prefix 'C' is used for connection UIDS (including IP tunnels) and
  'F' for files.
2013-08-26 15:36:31 -05:00
Bernhard Amann
74f96d22ef Merge remote branch 'origin/master' into topic/bernhard/hyperloglog
Conflicts:
	src/3rdparty
2013-08-26 12:53:13 -07:00
Seth Hall
ea89e30a9c One more tiny SumStats change to clean up cluster state. 2013-08-26 15:29:27 -04:00
Seth Hall
abd7cdff43 Merge branch 'master' of ssh://git.bro-ids.org/bro 2013-08-26 13:57:47 -04:00
Seth Hall
72d2cd363e Removed the when statement from general use in the sumstats cluster code. 2013-08-26 13:57:42 -04:00
Jon Siwek
17d0ecd388 File extraction tweaks.
- Default extraction limit of 100MB now provided via a tuning script
  loaded in local.bro so that command-line Bro is unlimited by default.

- Extraction directory is now created on request of file extraction
  rather than unconditionally in bro_init().
2013-08-23 11:57:07 -05:00
Jon Siwek
89ae4ffd05 Add options to limit extracted file sizes w/ 100MB default. 2013-08-22 16:37:58 -05:00
Seth Hall
b3a5c5f412 Tiny fix to correct a reporter message. 2013-08-21 19:11:34 -04:00
Seth Hall
2091bbbf6f Fixing a problem with resetting sumstats on managers in the wrong location. 2013-08-21 14:47:05 -04:00
Seth Hall
22b1e78ec1 Changing how threshold reseting happens (actually do it on managers!) 2013-08-21 14:08:14 -04:00
Seth Hall
1430c28ba3 Merge remote-tracking branch 'origin/master' into topic/seth/sumstats-updates 2013-08-21 12:45:50 -04:00
Vlad Grigorescu
73a5106bd9 Fix some reporter.log errors by adding a few extra key membership checks. 2013-08-21 07:29:22 -04:00
Robin Sommer
a646fde884 Merge remote-tracking branch 'origin/topic/seth/unified2-analyzer' into topic/robin/unified2-analyzer-merge
* origin/topic/seth/unified2-analyzer:
  Fixed a problem where the Unified2 analyzer was attached to every file.
  Fixing intel framework tests.
  Updating submodule(s).
  Add file name support to intel framework.
  Add file support to intel framework and slightly restructure intel http handling.

Conflicts:
	CHANGES
	VERSION
	scripts/base/files/unified2/main.bro
	testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
2013-08-14 10:27:26 -07:00
Seth Hall
f8f465e259 Fixed a problem where the Unified2 analyzer was attached to every file. 2013-08-14 01:01:03 -04:00
Seth Hall
efca3c0840 Merge remote-tracking branch 'origin/master' into topic/seth/unified2-analyzer
Conflicts:
	testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
2013-08-14 00:54:41 -04:00
Seth Hall
a98c78c0d1 Fixing intel framework tests. 2013-08-13 23:49:39 -04:00
Robin Sommer
83eae53f54 Merge remote-tracking branch 'origin/topic/seth/unified2-analyzer'
BIT-1054 #merged

* origin/topic/seth/unified2-analyzer:
  Fixes in case a packet isn't seen that matches an event.
  Finished work on unified2 analyzer.
  Fixed some tests.
  Working unified2 analyzer.
  Unified2 file analyzer updated to new plugin style.
  Adding the unified2 analyzer.

Conflicts:
	testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
2013-08-13 18:37:52 -07:00