Commit graph

6192 commits

Author SHA1 Message Date
Jon Siwek
8e4d37d5c1 Improve comm tests.
Same old problems: hard to get termination conditions right.
2015-02-11 11:21:01 -06:00
Jon Siwek
07cba950b8 Fix gcc compile warnings. 2015-02-10 16:14:49 -06:00
Jon Siwek
6d868d83be broker integration: fix unit tests to work when broker is not enabled. 2015-02-10 13:44:04 -06:00
Jon Siwek
fc36777e66 Add --enable-c++11 configure flag.
And try to detect that compiler version is sufficient for C++11 support.
--enable-broker implies --enable-c++11
2015-02-10 12:34:47 -06:00
Jon Siwek
bdf21c054a broker integration: add (un)publish/(un)advertise functions
For when one wants to manually tune pub/sub behavior instead of use the
default automatic settings of allowing publication to all peers and
advertising all subscriptions to all peers.
2015-02-10 09:51:57 -06:00
Jon Siwek
ebc9407a2b broker integration: add knobs to set auto publish/advertise behavior 2015-02-09 16:26:31 -06:00
Jon Siwek
cfb666af2b broker integration: move listen port for unit tests to a btest variable
Later, this might be something btest itself could provide to help
parallelize communication tests.  E.g. unit tests requests a unique
number from some range and btest coordinates the distribution of those
among all tests.
2015-02-09 16:01:31 -06:00
Jon Siwek
afc5767165 broker integration: add events for incoming connection status updates
e.g. for the listen() side of connections to tell when peers have
connected or disconnected.
2015-02-09 15:48:42 -06:00
Johanna Amann
5f0a27ca31 Submodule update - newest sqlite version 2015-02-09 12:10:49 -08:00
Robin Sommer
23b9705a7b Fixing analyzer tag types for some Files::* functions. 2015-02-08 18:23:22 -08:00
Robin Sommer
530c3c0c6b Changing load order for plugin scripts.
This can be need if they depends on each other.
2015-02-08 18:22:59 -08:00
Vlad Grigorescu
4a2d7f1d39 SIP: Move to the new string BIFs 2015-02-06 20:00:38 -05:00
Vlad Grigorescu
dde3ce90f8 SIP: Move to new analyzer format. 2015-02-06 19:57:48 -05:00
Vlad Grigorescu
d852fe8b52 Merge remote-tracking branch 'origin/master' into topic/vladg/sip 2015-02-06 19:49:23 -05:00
Vlad Grigorescu
95f3696c91 Kerberos: Remove debugging output. 2015-02-06 19:44:57 -05:00
Vlad Grigorescu
843afce7d9 Kerberos: Fix a memleak. 2015-02-06 19:42:34 -05:00
Vlad Grigorescu
3190ca275e SSH: Fix some memleaks. 2015-02-06 19:32:08 -05:00
Vlad Grigorescu
fc721d2d25 Merge remote-tracking branch 'origin/master' into topic/vladg/ssh 2015-02-06 18:58:38 -05:00
Jon Siwek
0253f49a94 broker integration: adapt to change in expiration_time 2015-02-06 16:54:01 -06:00
Vlad Grigorescu
9f19c74a10 Kerberos: A couple small tweaks. 2015-02-06 13:05:09 -05:00
Vlad Grigorescu
dfc42ffe8a Kerberos: Fix parsing of the cipher in tickets, and add it to the log. 2015-02-06 11:48:46 -05:00
Vlad Grigorescu
5bba7ad1eb Kerberos: A couple more formatting fixes. 2015-02-05 16:06:31 -05:00
Vlad Grigorescu
a8373b60e7 Change krb Info string to success bool 2015-02-05 14:30:18 -05:00
Vlad Grigorescu
7e1fcb1a10 Merge remote-tracking branch 'origin/master' into topic/vladg/kerberos 2015-02-05 14:22:29 -05:00
Vlad Grigorescu
444ff240bd Clean up formatting. 2015-02-05 14:21:34 -05:00
Vlad Grigorescu
aea0ae453e Documentation update, and rework events a bit. 2015-02-05 14:05:56 -05:00
Seth Hall
9592f64225 Update the SOCKS analyzer to support user/pass login.
- This addresses BIT-1011
 - Add a new field to socks.log; "password".
 - Two new events; socks_login_userpass and socks_login_reply.
 - One new weird for unsupported authentication method.
 - A new test for authenticated socks traffic.
 - Credit to Nicolas Retrain for the initial patch.  Thanks!
2015-02-05 12:44:10 -05:00
Jon Siwek
1012539ded Merge branch 'topic/seth/small-files-bof-handling-fix'
* topic/seth/small-files-bof-handling-fix:
  Fix a bug in the core files framework with handling the BOF buffer.

BIT-1310 #merged
2015-02-05 10:10:00 -06:00
Jon Siwek
8859c73bde Add/fix log fields in x509 diff canonifier. 2015-02-05 10:04:04 -06:00
Jon Siwek
08bb4b2274 Merge branch 'master' of https://github.com/msmiley/bro
* 'master' of https://github.com/msmiley/bro:
  "id" not defined for debug code
2015-02-05 10:03:39 -06:00
Seth Hall
a97cd1f3a2 Fix a bug in the core files framework with handling the BOF buffer.
- Any files where the total size was below the size of the
   default bof_buffer size couldn't have stream analyzers successfully
   attached because the bof_buffer never reached the full size
   and was never flushed.  This branch explicitly marks the buf_buffer
   as full and flushes it when the file is being removed.
2015-02-05 09:09:08 -05:00
Vlad Grigorescu
457ad73e6d Add support for the SAFE message type. 2015-02-04 17:28:09 -05:00
Vlad Grigorescu
b981bc6c62 Add support for AP_REQ, AP_REP, PRIV, and CRED message types. 2015-02-04 16:28:44 -05:00
Vlad Grigorescu
3b4bec18d6 Fix parsing error for KRB_Ticket_Sequence 2015-02-04 16:01:13 -05:00
Vlad Grigorescu
0071a1c003 Continue clean-up. Some reformatting, removing hard-coded values, documentation, etc. 2015-02-04 15:29:06 -05:00
Jon Siwek
ec39eee786 Merge branch 'master' into topic/jsiwek/broker 2015-02-03 17:07:04 -06:00
Jon Siwek
67271ea897 Update coverage unit test baselines. 2015-02-03 17:05:54 -06:00
Jon Siwek
565ad360c6 Add x509 canonifier to a unit test. 2015-02-03 17:04:26 -06:00
Jon Siwek
4dfec04135 broker integration: add Comm::enable function
Works like old enable_communication(), but for new broker communication
mechanism.  Scripts have to explicitly call this if they want to use the
broker communication functionality.  Saves a decent chunk of Bros'
initialization time when one doesn't need communication features.
2015-02-03 16:38:56 -06:00
Jon Siwek
0cf982f1d1 broker integration: process debug/diagnostic reports from broker 2015-02-03 15:11:16 -06:00
Jon Siwek
bb9e6583e0 broker integration: Comm::Data/Store::Handle opaque serialization
For now, this is needed when locally cloning Vals.  E.g. "when"
statements will clone an entire frame and data store queries use "when"
statements, so it's likely there will be locals of these opaque types
that get cloned.
2015-02-03 14:05:04 -06:00
Mike Smiley
51203d7193 "id" not defined for debug code
"id" not defined for debug code when using -DPROFILE_BRO_FUNCTIONS
2015-02-03 14:29:34 -05:00
Jon Siwek
441c46df76 broker integration: add unit test for store clones 2015-02-03 11:57:40 -06:00
Vlad Grigorescu
2d11fafd5e Kerberos analyzer updates:
- Split up the (quite length) krb-protocol.pac into krb-protocol, krb-defs, krb-types and krb-padata
  - Add some supporting types to get rid of awkward and difficult to read case true/false statements
  - Clean up the conversion code in krb-analyzer.pac
2015-02-02 18:47:48 -05:00
Jon Siwek
05a865a907 broker integration: add master data store unti test
And fix bug w/ looking up nonexistent keys -- the resulting value data
should be "null" not "false".
2015-02-02 14:56:28 -06:00
Jon Siwek
6b115c6999 Merge branch 'master' into topic/jsiwek/broker 2015-02-02 11:45:21 -06:00
Jon Siwek
21c7642f62 Fix memory leak in new split_string* functions. 2015-02-02 11:18:06 -06:00
Robin Sommer
f82adb724c Merge remote-tracking branch 'origin/topic/jsiwek/deprecation'
Fixing one missing index adjustment (I believe ...)

BIT-757 #merged

* origin/topic/jsiwek/deprecation:
  Fix typo.
  Update documentation (broken links, outdated tests).
  Update NEWS for deprecated/changed functions.
  Deprecate split* family of BIFs.
  Improve use of &deprecated on functions.
  Add a new attribute: &deprecated.
2015-01-30 14:37:05 -08:00
Jon Siwek
9875f5d3eb broker integration: add distributed data store api
But haven't done the full gamut of testing on it yet.
2015-01-30 14:39:16 -06:00
Jon Siwek
d2ea87735a broker integration: add bifs to inspect/manipulate broker data
i.e. script-layer functions to convert between bro values and broker
values; mostly for use w/ Bro's data store interface (coming soon).
2015-01-29 10:42:48 -06:00