Commit graph

14 commits

Author SHA1 Message Date
Christian Kreibich
0b674eb851 Baseline refresh to reflect btest 0.64 2020-12-06 20:19:49 -08:00
Johanna Amann
3bce313b12 Switch file UID hashing from md5 to highwayhash.
This commit switches UID hashing from md5 to a highway hash. It also
moves the salt value out of the file plugin - and makes it
installation-specific instead - it is moved to the global namespace.

There now are digest hash functions to make "static"
installation-specific hashes that are stable over workers available to
everyone; hashes can be 64, 128 or 256 bits in size.

Due to the fact that we switch the file hashing algorithm, all file
hashes change.

The underlyigng algorithm that is used for hashing is highwayhash-128,
which is significantly faster than md5.
2020-04-30 10:20:09 -07:00
Jeff Barber
4336de6651 Duplicate TCP segment should trigger tcp_multiple_retransmissions 2019-07-28 15:15:40 -06:00
Jon Siwek
1239a286e2 Merge branch 'patch-1' of https://github.com/neu5ron/bro
* 'patch-1' of https://github.com/neu5ron/bro:
  Update main.bro
  Update main.bro
2019-03-13 13:49:17 -07:00
Johanna Amann
6f9524e082 Make tunnel_parents in conn.log optional.
This makes conn.logs a bit prettier (and smaller) because all lines that
do not use a tunnel will now have a "-" instead of the "(empty)" for
tunnel_parents.
2018-01-12 13:46:00 -08:00
Johanna Amann
cdb6a1b6e6 Baseline updates after hash function change. 2016-07-13 10:11:37 -07:00
Seth Hall
f5a689a760 Switch the MIME fields in smtp.log back to showing what's actually given.
- SMTP protocol headers now do some minimal parsing to clean up
   email addresses.
 - New function named split_mime_email_addresses to take MIME headers
   and get addresses split apart but including the display name.
 - Update tests.
2016-06-16 16:40:52 -04:00
Seth Hall
7c2307e079 Move the HTTP "filename" field to "orig_filenames" and "resp_filenames"
This changes the HTTP log format slightly but shouldn't mess
up anything that anyone was doing because the old "filename"
field was never actually filled out.  Tests are updated as well.
2016-06-15 01:44:18 -04:00
Robin Sommer
adb3fab019 Updating test baselines for http.log now including version. 2016-01-15 12:18:16 -08:00
Albert Zaharovits
b4e8a44630 SMTP logs include CC: addresses [BIT-1429] 2015-07-26 22:08:43 +03:00
Robin Sommer
5dea09b7c1 Baseline updates for the addition of local_resp.
That patch is a strong contender for the smallest ever ratio of
lines-of-code-changed to lines-of-baselines-updated. :-)
2015-02-23 16:25:11 -08:00
Bernhard Amann
10cc44b37f Add tls flag to smtp.log. Will be set if a connection switched to startls. 2014-05-15 10:53:11 -07:00
Bernhard Amann
01d075bf2d Change #types description of sets to set
Addresses BIT-1163
2014-04-01 16:25:47 -07:00
Seth Hall
dd0856a57f HTTP CONNECT proxy support.
- The HTTP analyzer now supports handling HTTP CONNECT proxies
   same as the SOCKS analyzer handles proxying.
2014-02-12 22:38:59 -05:00