Commit graph

7605 commits

Author SHA1 Message Date
Robin Sommer
135fa9dc69 Updating submodule(s).
[nomail]
2018-04-20 07:47:10 -07:00
Robin Sommer
0cc8436eee Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Reduce number of btest threads running tests on Travis CI
2018-04-20 07:45:57 -07:00
Daniel Thayer
b23029a09d Reduce number of btest threads running tests on Travis CI
On Travis CI, btest was using 32 threads when running with "-j".  Reducing
this to "-j 4" seems to make the tests run a bit faster overall and
somewhat reduces the number of test failures.
2018-04-20 09:30:06 -05:00
Jon Siwek
e2b48ceb80 Updating submodule(s).
[nomail]
2018-04-19 11:56:57 -05:00
Jon Siwek
eb0c989ab3 Improve std::map usages in SMB code
Removed redundant lookup operations
2018-04-18 11:46:38 -05:00
Jon Siwek
55a925db96 Improve HLL cardinality estimate unit test.
The test could fail on the order of 100s of iterations, so I bumped to
desired accuracy to actually check for results that are outside the
error margin.
2018-04-18 10:55:37 -05:00
Jon Siwek
181b36cafb Merge remote-tracking branch 'origin/topic/seth/smb-pending-fix'
* origin/topic/seth/smb-pending-fix:
  Updating the defined SMB2 dialects to match Microsofts current docs.
  On rare occasions the server doesn't return the tree id on read responses.
  Fix an issue with pending commands.

BIT-1862 #merged
2018-04-18 10:48:03 -05:00
Johanna Amann
0747080e5f Merge branch 'Reporter/MessageFix' of https://github.com/catenacyber/bro
* 'Reporter/MessageFix' of https://github.com/catenacyber/bro:
  Better reporter for Brostring with embedded NUL

I slightly changed the code for beautification purposes and added a
testcase. No functional changes.
2018-04-16 10:58:45 -07:00
Johanna Amann
46a87f741b Merge remote-tracking branch 'origin/topic/dnthayer/fix-for-gcc48'
* origin/topic/dnthayer/fix-for-gcc48:
  Fix config input reader on systems with gcc 4.8

BIT-1917 #merged
2018-04-11 07:22:35 +09:00
Jon Siwek
b55c78917a Updating submodule(s).
[nomail]
2018-04-10 10:25:21 -05:00
Daniel Thayer
6e933199dc Fix config input reader on systems with gcc 4.8
Systems that have gcc 4.8 (such as RHEL 7 or ubuntu 14.04 LTS) have a
version of libstdc++ that doesn't implement the C++11 regex functions
(the header and functions exist, but calling them results in the process
being terminated).  On those systems, the following tests fail:
scripts.base.frameworks.config.basic ... failed
scripts.base.frameworks.config.read_config ... failed
scripts.base.frameworks.config.several-files ... failed
scripts.base.frameworks.config.updates ... failed
scripts.base.frameworks.input.config.basic ... failed
scripts.base.frameworks.input.config.errors ... failed

As a workaround, this commit switches to using the POSIX regex.h
functions.
2018-04-06 13:58:23 -05:00
Robin Sommer
361b57ee09 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Trim the Travis CI build log output
  Remove unneeded lines from .travis.yml
2018-04-06 10:51:55 -07:00
Robin Sommer
281c9a5ba3 Merge branch 'master' of https://github.com/nnovzver/bro 2018-04-06 10:50:38 -07:00
Seth Hall
a80131c06e Updating the defined SMB2 dialects to match Microsofts current docs. 2018-04-05 17:13:10 -04:00
Seth Hall
9c85d3f3a9 On rare occasions the server doesn't return the tree id on read responses.
This tracks the tree id given by the request

This also addresses BIT-1862 with code submitted by Stefano Rinaldi
and took some hints from his changes in other areas of the code.
2018-04-05 17:12:33 -04:00
Daniel Thayer
8c91cafad8 Trim the Travis CI build log output
Remove some output from the Travis CI build log to make it easier
to read.

There is an issue with Travis CI when using encrypted environment
variables.  In this case, when btest calls the python function
sys.stdout.isatty() it returns False, which causes btest to output one
line for each test (passed or failed).  As a result, it is difficult to
see at a glance which tests failed.  Switching to btest brief output to
address this issue.
2018-04-05 14:12:24 -05:00
Daniel Thayer
cd6e541e3e Remove unneeded lines from .travis.yml 2018-04-05 14:10:04 -05:00
Seth Hall
31223caccd Fix an issue with pending commands.
This is a change from Stefano Rinaldi in ticket number 1862
2018-04-03 03:24:50 -04:00
Seth Hall
f6e5f0b1a5 A small fix for the last merge related to fixing Kerberos in GSSAPI.
We really need to figure out some way to expand our public tests
for SMB.  This problem crept in due to not having a test for
this particular case.
2018-04-03 02:58:54 -04:00
Seth Hall
f7e16a487c Merge branch 'jrolli-gssapi-krb-fix'
* jrolli-gssapi-krb-fix:
  Cleaned up and moved parsing to binpac.
  removed check on kerberos request or response type.  allow the kerberos analyzer to handle what it can, gssapi shouldn't check this
  modified GSSAPI analyzer to parse NTLM and KRB tokens
  Added and verified correct test results
  Initial btest structure
  Changes proposed in #104

Addresses #110
2018-04-03 02:11:13 -04:00
Seth Hall
3131952762 Cleaned up and moved parsing to binpac.
Too much parsing was being done in C++ so I moved more of
it into binpac.  Also, fixed up a bunch of the whitespace
(the new code was indented with spaces).
2018-04-03 01:56:34 -04:00
Seth Hall
5b07bbe0a5 Merge branch 'gssapi-krb-fix' of https://github.com/jrolli/bro into jrolli-gssapi-krb-fix 2018-04-02 22:28:11 -04:00
Seth Hall
95fbe150df Improving the new SMB2 create command test.
It's now a less fragile test than it was.
2018-04-02 22:25:51 -04:00
Seth Hall
3a3ac27d20 Merge branch 'jwallior-smb_changes'
Addresses pull request #122
2018-04-02 17:45:18 -04:00
Seth Hall
68d0085d35 Merge branch 'smb_changes' of https://github.com/jwallior/bro into jwallior-smb_changes 2018-04-02 17:06:30 -04:00
Robin Sommer
f710d9a199 Updating submodule(s).
[nomail]
2018-03-29 14:11:56 -07:00
Robin Sommer
aec449cccc Merge remote-tracking branch 'origin/topic/johanna/cleanup'
Good stuff!

Closes BIT-1915

* origin/topic/johanna/cleanup:
  Mark one-parameter constructors as explicit & use override where possible
  Remove unimplemented & unused functions from header files.
  Make data flow more explicit for complilers.
2018-03-29 13:43:01 -07:00
Robin Sommer
bb34477b91 Merge remote-tracking branch 'origin/topic/johanna/tls13-version'
Closes BIT-1916.

* origin/topic/johanna/tls13-version:
  Recognize TLS 1.3 negotiation correctly.
2018-03-29 13:00:46 -07:00
Johanna Amann
f39efd0317 Recognize TLS 1.3 negotiation correctly.
The way in which TLS 1.3 is negotiated was changed slightly in later
revisions of the standard. The final version is only sent in an
extension - while the version field in the server hello still shows TLS
1.2.

This patch makes ssl.log show the correct version again.
2018-03-27 14:58:06 -07:00
Vladimir Ruzanov
5145b5cb4e Fix NETBIOSSSN analyzer name 2018-03-27 23:32:06 +03:00
Johanna Amann
6d612ced3d Mark one-parameter constructors as explicit & use override where possible
This commit marks (hopefully) ever one-parameter constructor as explicit.

It also uses override in (hopefully) all circumstances where a virtual
method is overridden.

There are a very few other minor changes - most of them were necessary
to get everything to compile (like one additional constructor). In one
case I changed an implicit operation to an explicit string conversion -
I think the automatically chosen conversion was much more convoluted.

This took longer than I want to admit but not as long as I feared :)
2018-03-27 07:17:32 -07:00
Johanna Amann
961f0dfb25 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix the travis-job script to always run external tests
2018-03-25 09:43:29 -07:00
Philippe Antoine
ecf2788740 Better reporter for Brostring with embedded NUL
Can be reproduced with something like
curl 127.0.0.1:8002/readme.html%00lol
2018-03-23 10:10:01 +01:00
Daniel Thayer
aadcd5d2cc Fix the travis-job script to always run external tests
Run the external tests even when the Bro tests fail.
2018-03-22 19:36:40 -05:00
Robin Sommer
9271b2032d Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci-updates'
I've moved .travis.job to testing/scripts/travis-job and adapted
.travis.yml accordingly.

* origin/topic/dnthayer/travis-ci-updates:
  Fix information leak in the update-traces script
  Add coverity scan and private testing to Travis CI
2018-03-22 14:26:21 -07:00
Robin Sommer
288fcd0039 Merge remote-tracking branch 'origin/topic/seth/smb-mapping-memleak-fix'
Closes BIT-1911.

* origin/topic/seth/smb-mapping-memleak-fix:
  Fix a memory leak in SMBv1 share mapping
2018-03-21 13:57:26 -07:00
Seth Hall
551f57ea97 Fix a memory leak in SMBv1 share mapping 2018-03-21 16:29:59 -04:00
Daniel Thayer
3584495562 Fix information leak in the update-traces script
For trace files that require authentication to download, hide
part of the URL in output messages.  This avoids leaking potentially
sensitive info when running tests using a continuous integration
service.
2018-03-21 15:24:29 -05:00
Daniel Thayer
9ee739421b Add coverity scan and private testing to Travis CI 2018-03-21 14:10:54 -05:00
Johanna Amann
1f2bf50b49 Remove unimplemented & unused functions from header files.
All of these functions were defined in header files without ever being
implemented or used.
2018-03-16 18:38:04 -07:00
Johanna Amann
911018347f Make data flow more explicit for complilers.
gcc likes complaining about ev potentially not being initialized. Make
it clear that this cannot happen by marking the default case as
unreachable after the error output.
2018-03-16 14:36:13 -07:00
Daniel Thayer
8fe998c5f7 Fix one new minor typo in the config framework docs 2018-03-15 18:52:08 -05:00
Robin Sommer
77bc5da6f9 Updating submodule(s).
[nomail]
2018-03-15 15:00:34 -07:00
Robin Sommer
78f4ed690d Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci-changes'
* origin/topic/dnthayer/travis-ci-changes:
  Configure Travis CI email recipients and build branches
2018-03-15 14:59:34 -07:00
Robin Sommer
31a48bf4ad Merge remote-tracking branch 'origin/topic/dnthayer/ticket1905'
Includes slight editing of the new text.

Closes BIT-1905.

* origin/topic/dnthayer/ticket1905:
  Add documentation of the configuration framework
  Add documentation of "option" declarations
  Improve config framework documentation comments
  Fix minor typos and doc build warnings in NEWS
2018-03-15 14:54:43 -07:00
Daniel Thayer
8aeedba066 Add documentation of the configuration framework 2018-03-15 14:50:42 -05:00
Daniel Thayer
79afd99229 Add documentation of "option" declarations 2018-03-15 14:29:26 -05:00
Daniel Thayer
f3e42874b8 Improve config framework documentation comments
Fixed typos and formatting.
2018-03-15 14:16:00 -05:00
Daniel Thayer
c759583d11 Fix minor typos and doc build warnings in NEWS 2018-03-15 14:13:54 -05:00
Jon Siwek
54aa7d1911 Updating submodule(s).
[nomail]
2018-03-07 13:54:53 -06:00