Commit graph

1653 commits

Author SHA1 Message Date
Vlad Grigorescu
092a78d14b Merge remote-tracking branch 'origin/master' into topic/vladg/ssh 2015-03-17 12:36:30 -04:00
Vlad Grigorescu
65d982acc1 Update baselines for new SSH analyzer. 2015-03-16 16:12:18 -04:00
Jon Siwek
0b957cbe75 Include timestamp in default extracted file names.
And add a policy script to extract all files.

BIT-1335 #close
2015-03-13 14:25:30 -05:00
Jon Siwek
6fbceb6a98 Identify GRE tunnels as Tunnel::GRE, not Tunnel::IP.
BIT-1311 #close
2015-03-13 13:03:58 -05:00
Jon Siwek
c56df225b0 Fix Broker leak tests.
Forgot to update Broker module names when they changed.
2015-03-12 16:17:34 -05:00
Jon Siwek
9e53722b57 Rename comm/ directories to broker/ 2015-03-05 17:02:25 -06:00
Jon Siwek
fa08083a92 Rename broker-related namespaces.
c++ namespace "comm" -> bro_broker
script module "Comm" -> BrokerComm
script module "Store" -> BrokerStore
2015-03-05 16:20:51 -06:00
Jon Siwek
25a4d0ebed Improve remote logging via broker.
Only send fields with the &log attribute.
2015-03-05 14:07:06 -06:00
Jon Siwek
4f918f1f98 Improve some broker communication unit tests.
For testing data store queries, when statements may not work well if
time stops advancing e.g. due to lack of input sources, so try to
workaround by reading a trace file in unit test.
2015-03-05 11:46:55 -06:00
Robin Sommer
e5adc768cc Merge branch 'stats-bytes-recvd' of https://github.com/msmiley/bro 2015-03-04 13:16:19 -08:00
Johanna Amann
946f19fb9d Use our new features to send the CN and SAN fields of certificates to
the intel framework.
2015-03-03 17:15:24 -08:00
Johanna Amann
e48c6ccc4a Do not log common name by default (it is most interesting for scripts)
and add a test case.
2015-03-03 16:38:25 -08:00
Robin Sommer
6fa03abdbc Merge remote-tracking branch 'origin/topic/gilbert/plugin-api-tweak'
* origin/topic/gilbert/plugin-api-tweak:
  Updating plugin.hooks baseline so that test succeeds
  Revert spacing change that shouldn't have been included with the previous changeset ... should fix all of the plugin tests save hooks, which needs to be updated.
  More small fixes
  Small fixes
  Incremental
  Re-updating plugin.hooks test to include new argument output (after merge).
  Fixing logic errors in HandlePluginResult
  Updating tests and tweaking HookArgument to include Frame support.
  Incremental commit: implementing a wrapper for the Val class.
  Reverting change to const status of network_time.  Also, see FIXME: in Func.cc / HandlePluginResult ...
  Tweaks to result handling to make things a little more sane.
  Plugin API: minor change (adding parent frame) to support calling methods from hook.  Also declare network time update argument to be const because good practice.

BIT-1270 #merged

Conflicts:
	testing/btest/Baseline/plugins.hooks/output
2015-03-02 18:17:52 -08:00
Robin Sommer
07222bb107 Merge remote-tracking branch 'origin/topic/johanna/ssl-policy'
* origin/topic/johanna/ssl-policy:
  Extend the weak-keys policy file to also alert when encountering ssl connections with old versions as well as unsafe cipher suites.

BIT-1321 #merged
2015-03-02 17:19:00 -08:00
Robin Sommer
d8d13df406 Updating docs for recent addition of local_resp. 2015-03-02 17:11:51 -08:00
Robin Sommer
dfc88094ab Merge remote-tracking branch 'origin/topic/jsiwek/broker'
* origin/topic/jsiwek/broker: (34 commits)
  Update broker submodule.
  Update broker submodule.
  broker integration: add missing baselines for doc tests
  broker integration: add prof.log statistics
  broker integration: add high-level usage documentation
  broker integration: add API documentation (broxygen/doxygen)
  broker integration: fix memory leak, add leak tests
  Update broker submodule.
  Improve comm tests.
  Fix gcc compile warnings.
  broker integration: fix unit tests to work when broker is not enabled.
  Add --enable-c++11 configure flag.
  broker integration: add (un)publish/(un)advertise functions
  broker integration: add knobs to set auto publish/advertise behavior
  broker integration: move listen port for unit tests to a btest variable
  broker integration: add events for incoming connection status updates
  broker integration: adapt to change in expiration_time
  Update coverage unit test baselines.
  broker integration: add Comm::enable function
  broker integration: process debug/diagnostic reports from broker
  ...

Conflicts:
	cmake
	testing/btest/Baseline/plugins.hooks/output
2015-03-02 17:10:15 -08:00
Gilbert Clark
d7f5464a6c Updating plugin.hooks baseline so that test succeeds 2015-02-26 11:25:11 -05:00
Johanna Amann
897351f87e Extend the weak-keys policy file to also alert when encountering
ssl connections with old versions as well as unsafe cipher suites.

Also make the notice suppression handling of other ssl policy files
a tad more robust.
2015-02-25 13:57:04 -08:00
Robin Sommer
6350d330f3 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Crashing bug in WriterBackend when deserializing WriterInfo where config is present. Testcase crashes on unpatched versions of Bro.
  Fix wrong value test in WriterBackend. Found by Aaron Eppert (aeppert@gmail.com)
2015-02-23 16:33:58 -08:00
Robin Sommer
5dea09b7c1 Baseline updates for the addition of local_resp.
That patch is a strong contender for the smallest ever ratio of
lines-of-code-changed to lines-of-baselines-updated. :-)
2015-02-23 16:25:11 -08:00
Johanna Amann
ee290c3d7a Crashing bug in WriterBackend when deserializing WriterInfo where config
is present. Testcase crashes on unpatched versions of Bro.

Found by Aaron Eppert <aeppert@gmail.com>.

This (probably) fixes the crash issue with sqlite a few people have
reported on the mailing list in the past.
2015-02-23 13:54:44 -08:00
Gilbert Clark
d3a5440cff Merge branch 'master' into topic/gilbert/plugin-api-tweak 2015-02-23 13:22:47 -05:00
Jon Siwek
8a758d2eb7 Merge remote-tracking branch 'origin/topic/robin/plugin-updates'
* origin/topic/robin/plugin-updates:
  Doc tweak.
  Submodule update.
  Updating plugin docs to recent changes.
  Update submodules.
  Updating submodule.
  Updating submodules.
  Updating plugin tests.
  Making plugin names case-insensitive for some internal comparisions.
  Updating submodules.
  Explicitly removing some old scripts on install.
  Removing setting installation plugin path from  bro-path-dev.sh .
  Creating the installation directory for plugins at install time.

BIT-1318 #merged
BIT-1302 #closed
BIT-1312 #closed
2015-02-23 12:20:39 -06:00
Gilbert Clark
ce18a2867e Merge branch 'master' of ssh://git.bro-ids.org/bro into topic/gilbert/plugin-api-tweak 2015-02-23 00:00:38 -05:00
Jon Siwek
25aac35af1 broker integration: add missing baselines for doc tests 2015-02-18 15:08:22 -06:00
Jon Siwek
8d19bf6381 broker integration: add high-level usage documentation
i.e. documentation of the new "comm framework" w/ examples.
2015-02-18 12:16:46 -06:00
Robin Sommer
b6bbf90643 Updating plugin tests.
The init-plugin scripts now expects a destination directory. Normally
that would be a new subdirectory, but for the tests to keep working we
can also put it right into the current directory.
2015-02-16 20:26:26 -08:00
Jon Siwek
e95116ba85 Merge branch 'master' into topic/jsiwek/broker 2015-02-16 10:00:17 -06:00
Jon Siwek
062baefde0 Add 'while' statement to Bro language. 2015-02-13 11:26:54 -06:00
Jon Siwek
212368b245 Merge remote-tracking branch 'origin/topic/jsiwek/socks-authentication'
* origin/topic/jsiwek/socks-authentication:
  Refactor SOCKS5 user/pass authentication support.
  Update the SOCKS analyzer to support user/pass login.

BIT-1011 #merged
2015-02-13 09:15:50 -06:00
Jon Siwek
961fd06cad Refactor SOCKS5 user/pass authentication support.
- Rename event "socks_login_userpass" to "socks_login_userpass_request"
- Rename event "socks_login_reply" to "socks_login_userpass_reply"
- Split unsupported authN weird into 2 types: method vs. version

Addresses BIT-1011
2015-02-12 17:06:38 -06:00
Jon Siwek
5a73c11baa broker integration: fix memory leak, add leak tests
Leak tests won't pass w/ libcaf 0.12.2, needs the develop branch
(actor-framework@a89485a3098965f104264808994fabfbc3a1bf61).
2015-02-12 11:40:04 -06:00
Jon Siwek
8e4d37d5c1 Improve comm tests.
Same old problems: hard to get termination conditions right.
2015-02-11 11:21:01 -06:00
Jon Siwek
6d868d83be broker integration: fix unit tests to work when broker is not enabled. 2015-02-10 13:44:04 -06:00
Jon Siwek
cfb666af2b broker integration: move listen port for unit tests to a btest variable
Later, this might be something btest itself could provide to help
parallelize communication tests.  E.g. unit tests requests a unique
number from some range and btest coordinates the distribution of those
among all tests.
2015-02-09 16:01:31 -06:00
Jon Siwek
afc5767165 broker integration: add events for incoming connection status updates
e.g. for the listen() side of connections to tell when peers have
connected or disconnected.
2015-02-09 15:48:42 -06:00
Vlad Grigorescu
fc721d2d25 Merge remote-tracking branch 'origin/master' into topic/vladg/ssh 2015-02-06 18:58:38 -05:00
Seth Hall
9592f64225 Update the SOCKS analyzer to support user/pass login.
- This addresses BIT-1011
 - Add a new field to socks.log; "password".
 - Two new events; socks_login_userpass and socks_login_reply.
 - One new weird for unsupported authentication method.
 - A new test for authenticated socks traffic.
 - Credit to Nicolas Retrain for the initial patch.  Thanks!
2015-02-05 12:44:10 -05:00
Jon Siwek
1012539ded Merge branch 'topic/seth/small-files-bof-handling-fix'
* topic/seth/small-files-bof-handling-fix:
  Fix a bug in the core files framework with handling the BOF buffer.

BIT-1310 #merged
2015-02-05 10:10:00 -06:00
Jon Siwek
8859c73bde Add/fix log fields in x509 diff canonifier. 2015-02-05 10:04:04 -06:00
Seth Hall
a97cd1f3a2 Fix a bug in the core files framework with handling the BOF buffer.
- Any files where the total size was below the size of the
   default bof_buffer size couldn't have stream analyzers successfully
   attached because the bof_buffer never reached the full size
   and was never flushed.  This branch explicitly marks the buf_buffer
   as full and flushes it when the file is being removed.
2015-02-05 09:09:08 -05:00
Jon Siwek
ec39eee786 Merge branch 'master' into topic/jsiwek/broker 2015-02-03 17:07:04 -06:00
Jon Siwek
67271ea897 Update coverage unit test baselines. 2015-02-03 17:05:54 -06:00
Jon Siwek
565ad360c6 Add x509 canonifier to a unit test. 2015-02-03 17:04:26 -06:00
Jon Siwek
4dfec04135 broker integration: add Comm::enable function
Works like old enable_communication(), but for new broker communication
mechanism.  Scripts have to explicitly call this if they want to use the
broker communication functionality.  Saves a decent chunk of Bros'
initialization time when one doesn't need communication features.
2015-02-03 16:38:56 -06:00
Jon Siwek
441c46df76 broker integration: add unit test for store clones 2015-02-03 11:57:40 -06:00
Jon Siwek
05a865a907 broker integration: add master data store unti test
And fix bug w/ looking up nonexistent keys -- the resulting value data
should be "null" not "false".
2015-02-02 14:56:28 -06:00
Jon Siwek
6b115c6999 Merge branch 'master' into topic/jsiwek/broker 2015-02-02 11:45:21 -06:00
Jon Siwek
d2ea87735a broker integration: add bifs to inspect/manipulate broker data
i.e. script-layer functions to convert between bro values and broker
values; mostly for use w/ Bro's data store interface (coming soon).
2015-01-29 10:42:48 -06:00
Jon Siwek
5527543601 broker integration: add unit tests for remote log/print/event 2015-01-26 16:53:13 -06:00