Commit graph

2596 commits

Author SHA1 Message Date
Daniel Thayer
bc337f3d5a Fix typos and formatting in the dns protocol docs 2013-10-15 16:44:28 -05:00
Daniel Thayer
e36fcf0190 Fix typos and formatting in the dhcp protocol docs
Also added a link to an RFC and a Bro script (and corrected the name of the
script being referenced).
2013-10-15 16:19:06 -05:00
Daniel Thayer
3850399fa2 Fix typos and formatting in the conn protocol docs 2013-10-14 17:19:29 -05:00
Daniel Thayer
93c1073673 Merge remote-tracking branch 'origin/master' into topic/dnthayer/doc-changes-for-2.2 2013-10-11 23:16:57 -05:00
Daniel Thayer
b5af589246 Improvements to file analysis docs
Fixed reference to wrong field name.
Added documentation of a function arg.
Added a couple references to other parts of the documentation.
Explained how not specifying extraction filename results in automatic
filename generation.
Several other minor clarifications.
2013-10-11 16:31:53 -05:00
Daniel Thayer
60b2c5f1fe Add README files for most Bro frameworks
The text from these README files appears on the "Bro Script Packages"
page after building the documentation.  The text for these was mostly just
copied from the existing docs.
2013-10-11 00:19:37 -05:00
Daniel Thayer
50aca717d0 Fix typos and formatting in various other framework docs 2013-10-10 23:18:27 -05:00
Daniel Thayer
960ddc22d1 Fix typos and formatting in the software framework docs 2013-10-10 23:16:19 -05:00
Daniel Thayer
0753853726 Fix typos and formatting in the sumstats docs 2013-10-10 23:15:12 -05:00
Daniel Thayer
3812716ace Fix typos and formatting in the packet filter docs 2013-10-10 20:44:31 -05:00
Daniel Thayer
ee921a419f Fix typos and formatting in the logging framework docs 2013-10-10 16:10:00 -05:00
Robin Sommer
3d010f3bb6 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  IANA assigned a couple of new tls extension numbers
  add 3 more really new ciphers.
2013-10-10 13:37:19 -07:00
Daniel Thayer
ff15e0832f Fix typos and formatting in the intel framework docs 2013-10-10 15:23:19 -05:00
Daniel Thayer
e2c5a5c4a5 Fix typos and formatting in the communication framework doc
Fixed a link that was pointing to the wrong "connect".
2013-10-10 14:42:01 -05:00
Daniel Thayer
f21f45ac1a Fix typos and formatting in the cluster framework docs
Changed a Time Machine link to point to something useful.
2013-10-10 14:39:44 -05:00
Daniel Thayer
7ddc670a02 Fix typos and formatting in the file analysis docs 2013-10-10 12:46:11 -05:00
Daniel Thayer
0d712b35d8 Fix typos and a broken link in the file analysis doc 2013-10-10 12:23:34 -05:00
Daniel Thayer
1a36031874 Fix typos and formatting in the input framework docs 2013-10-10 00:53:13 -05:00
Robin Sommer
30d1b97400 Removing ICSI notary from default site config.
This should not have been in there in the first place.
2013-10-09 13:22:25 -07:00
Bernhard Amann
00b622f54d IANA assigned a couple of new tls extension numbers 2013-10-08 13:52:44 -07:00
Bernhard Amann
737b15aef9 add 3 more really new ciphers. 2013-10-08 13:02:55 -07:00
Bernhard Amann
2b87499fd9 rip out x509 code from ssl analyzer. Note that since at the moment
the file analyzer does not yet re-populate the info record that
means quite a lot of information is simply not available.
2013-10-01 16:25:33 -07:00
Bernhard Amann
ea766d71bb add ciphers to cipher_desc table that were already present
but apparently forgotten.
2013-10-01 16:01:37 -07:00
Bernhard Amann
497ada12e8 ...and a few more ciphers. 2013-09-26 10:03:17 -07:00
Bernhard Amann
9264e2e7d3 add new tls cipher suites 2013-09-25 22:21:56 -07:00
Seth Hall
706363a295 Fixes for the 2.2 beta. 2013-09-25 16:44:39 -04:00
Bernhard Amann
df552ca87d parse out extension. One event for general extensions (just returns the
openssl-parsed string-value), one event for basicconstraints (is a certificate
a CA or not) and one event for subject-alternative-names (only DNS parts).
2013-09-19 14:41:34 -07:00
Bernhard Amann
8b48a476ec update mozilla root ca list 2013-09-19 12:53:45 -07:00
Jon Siwek
d05a02e848 Update Mozilla root CA certs. 2013-09-19 12:57:14 -05:00
Robin Sommer
3738b4136b Merge remote-tracking branch 'origin/topic/bernhard/ticket950'
* origin/topic/bernhard/ticket950:
  make client and server random available on script-level.

BIT-950 #merged
2013-09-18 15:02:55 -07:00
Robin Sommer
c6de23ebe1 Merge remote-tracking branch 'origin/topic/bernhard/ticket1072'
* origin/topic/bernhard/ticket1072:
  and const 2 more functions
  update hll documentation, make a few functions private and create a new copy constructor.
  fix case where hll_error_margin could be undefined (thanks John)

BIT-1072 #merged
2013-09-18 15:00:06 -07:00
Bernhard Amann
e5a589dbfe Very basic file-analyzer for x509 certificates. Mostly ripped from
the ssl-analyzer and the topic/bernhard/x509 branch.

Simply prints information about the encountered certificates (I have
not yet my mind up, what I will log...).

Next step: extensions...
2013-09-16 14:08:22 -07:00
Bernhard Amann
9834755948 fix case where hll_error_margin could be undefined (thanks John) 2013-09-11 12:50:29 -07:00
Bernhard Amann
c40a97156a make client and server random available on script-level.
Patch by ewust

Addresses BIT-950
2013-09-11 12:39:23 -07:00
Seth Hall
7c1dffa66f Fixed an issue with the HLL_UNIQUE SumStats plugin that caused a reporter error. 2013-09-06 15:31:00 -04:00
Jon Siwek
a9a245e017 Workaround type ambiguity w/ default record field. 2013-09-05 16:41:51 -05:00
Seth Hall
ef50802fd7 Make the notice $actions field have a default empty set to avoid having to check for it's presence. 2013-09-05 12:07:21 -04:00
Jon Siwek
db470a637a Documentation fixes.
This cleans up most of the warnings from sphinx (broken :doc: links,
broxygen role misuses, etc.).  The remaining ones should be harmless,
but not quick to silence.

I found that the README for each component was a copy from the actual
repo, so I turned those in to symlinks so they don't get out of date.
2013-09-03 15:59:40 -05:00
Robin Sommer
6f9d28cc18 Merge branch 'topic/robin/hyperloglog-merge'
* topic/robin/hyperloglog-merge: (35 commits)
  Making the confidence configurable.
  Renaming HyperLogLog->CardinalityCounter.
  Fixing bug introduced during merging.
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  ...
2013-08-31 10:42:42 -07:00
Robin Sommer
295987c8d0 Making the confidence configurable. 2013-08-31 10:34:50 -07:00
Robin Sommer
4dcf8fc0db Merge remote-tracking branch 'origin/topic/bernhard/hyperloglog'
* origin/topic/bernhard/hyperloglog: (32 commits)
  add clustered leak test for hll. No issues.
  make gcc happy
  (hopefully) fix refcounting problem in hll/bloom-filter opaque vals. Thanks Robin.
  re-use same hash class for all add operations
  get hll ready for merging
  and forgot a file...
  adapt to new structure
  fix opaqueval-related memleak.
  make it compile on case-sensitive file systems and fix warnings
  make error rate configureable
  add persistence test not using predetermined random seeds.
  update cluster test to also use hll
  persistence really works.
  well, with this commit synchronizing the data structure should work.. ...if we had consistent hashing.
  and also serialize the other things we need
  ok, this bug was hard to find.
  serialization compiles.
  change plugin after feedback of seth
  Forgot a file. Again. Like always. Basically.
  do away with old file.
  ...
2013-08-30 11:30:05 -07:00
Bernhard Amann
2dd0d057e6 Merge remote-tracking branch 'origin/master' into topic/bernhard/hyperloglog
Conflicts:
	src/NetVar.cc
	src/NetVar.h
2013-08-30 08:43:47 -07:00
Bernhard Amann
dc9fd36497 Merge remote branch 'origin/master' into topic/bernhard/hyperloglog 2013-08-28 17:48:59 -07:00
Jon Siwek
5c119561ad UID optimizations addressing BIT-1016.
Max UID bit-length is now 128, but can be increased w/ trivial source
code change of BRO_UID_LEN.
2013-08-28 15:35:18 -05:00
Seth Hall
0592b528ef Merge branch 'master' of ssh://git.bro-ids.org/bro 2013-08-28 00:58:03 -04:00
Seth Hall
2b78922af8 Added a $unique_max field to Reducers for the SumStats::UNIQUE calculation
- Using the new option in scan.bro and the FTP bruteforce detection.
2013-08-28 00:57:44 -04:00
Jon Siwek
d31b59a5d0 Merge branch 'master' into topic/jsiwek/uid 2013-08-26 15:51:18 -05:00
Jon Siwek
22bf3e1196 Increase UIDs to 96 bits w/ C/F prefix - BIT-1016
- The bit-length is adjustable via redef'ing bits_per_uid.

- Prefix 'C' is used for connection UIDS (including IP tunnels) and
  'F' for files.
2013-08-26 15:36:31 -05:00
Bernhard Amann
74f96d22ef Merge remote branch 'origin/master' into topic/bernhard/hyperloglog
Conflicts:
	src/3rdparty
2013-08-26 12:53:13 -07:00
Seth Hall
ea89e30a9c One more tiny SumStats change to clean up cluster state. 2013-08-26 15:29:27 -04:00