Commit graph

9176 commits

Author SHA1 Message Date
Zeke Medley
bd605bfc3a Stop execution on paraglob error. 2019-06-07 09:45:18 -07:00
Johanna Amann
05e519439e Merge remote-tracking branch 'origin/topic/jsiwek/gh-209-radius-attr-66'
* origin/topic/jsiwek/gh-209-radius-attr-66:
  GH-209: replace "remote_ip" field of radius.log with "tunnel_client"
2019-06-07 17:43:27 +10:00
Johanna Amann
6707328c55 Merge remote-tracking branch 'origin/master' into topic/johanna/tls13-details 2019-06-07 16:52:38 +10:00
Johanna Amann
8d96dea23f Update SSL documentation. 2019-06-07 16:48:19 +10:00
Jon Siwek
c6378c56e2 Update plugin unit tests to use --zeek-dist 2019-06-06 20:02:47 -07:00
Jon Siwek
2fa74e4bcb Change default value of peer_description "zeek" 2019-06-06 19:49:30 -07:00
Jon Siwek
be091271f7 Rename Bro to Zeek in Zeekygen-generated documentation 2019-06-06 18:52:22 -07:00
Jon Siwek
7c5e74e577 Merge branch 'master' of https://github.com/anthonykasza/zeek
* 'master' of https://github.com/anthonykasza/zeek:
  add: rdp_native_encrytped_data event

I added a unit test.
2019-06-06 17:22:49 -07:00
Jon Siwek
c193582623 Merge branch 'rdp_client_security' of https://github.com/neslog/zeek
* 'rdp_client_security' of https://github.com/neslog/zeek:
  Adding comments specific to client security data in record definition.
  Cleaning up indentations and return true.
  Adding record to init-bare
  Adding client_security_data to the analyzer.

I added a unit test.
2019-06-06 16:53:48 -07:00
Zeke Medley
145bfe50af Update paraglob submodule 2019-06-06 15:35:02 -07:00
Anthony Kasza
0b5acebfb9 add: rdp_native_encrytped_data event 2019-06-06 13:52:09 -06:00
jatkinosn
ab4becc454 Adding comments specific to client security data in record definition. 2019-06-06 15:16:47 -04:00
Jon Siwek
eef669f048 Improve sqlite logging unit tests
By using a consistent timestamp. That avoids rare chances of sqlite
output from rounding the current time into such a form that happens
to bypass the timestamp canonifier script (whenever it happened to
land on a whole or tenth second).
2019-06-06 12:06:55 -07:00
jatkinosn
326ff6f6c0 Cleaning up indentations and return true. 2019-06-06 15:05:34 -04:00
Mauro Palumbo
01ae5203e3 Merge branch 'fix-ntp-mac' into ntp-rewrite 2019-06-06 16:53:55 +02:00
Mauro Palumbo
38ad648082 update tests and add a new one for key_id and mac 2019-06-06 16:45:09 +02:00
Mauro Palumbo
2cd2c65fe3 fix auth field (key_id and mac) in standard and control msg 2019-06-06 16:38:05 +02:00
jatkinosn
17512bb8db Adding record to init-bare 2019-06-06 10:06:58 -04:00
jatkinosn
b6746bc9e0 Adding client_security_data to the analyzer. 2019-06-06 09:49:24 -04:00
Mauro Palumbo
c8253e0499 remove old NTP record in init-bare.zeek 2019-06-06 11:50:12 +02:00
Jon Siwek
d3927d9266 Rename BRO_DEPRECATED macro to ZEEK_DEPRECATED 2019-06-05 16:23:43 -07:00
Jon Siwek
dfed213f31 Deprecate functions with "bro" in them.
* "bro_is_terminating" is now "zeek_is_terminating"

* "bro_version" is now "zeek_version"

The old function names still exist for now, but are deprecated.
2019-06-05 16:18:57 -07:00
Jon Siwek
b5050437fa GH-379: move catch-and-release and unified2 scripts to policy/
These are no longer loaded by default due to the performance impact they
cause simply by being loaded (they have event handlers for commonly
generated events) and they aren't generally useful enough to justify it.
2019-06-05 13:33:45 -07:00
ZekeMedley
e100558658 Change C++11 detection in paraglob. 2019-06-05 12:33:20 -07:00
Jon Siwek
ed113918e7 GH-209: replace "remote_ip" field of radius.log with "tunnel_client"
The type of the field also changed from "addr" to "string" because the
former cannot represent all possible values of the
Tunnel-Client-Endpoint attribute, which may include FQDNs, not just IP
addresses.
2019-06-05 11:11:49 -07:00
Mauro Palumbo
df0a4b9bb7 fix key_id and digest (WIP) 2019-06-05 18:15:18 +02:00
Mauro Palumbo
2dc7695d87 fix wrong Assign with reference_id 2019-06-05 15:26:45 +02:00
Mauro Palumbo
48cda6a81d add tests for ntp protocol (finished) 2019-06-05 11:17:40 +02:00
Jon Siwek
80fe3d5583 Simplify threading::Value destructor 2019-06-04 19:30:21 -07:00
Jon Siwek
59596e0bfa Merge branch 'master' of https://github.com/ZekeMedley/zeek
* 'master' of https://github.com/ZekeMedley/zeek:
  Use the right delete and improve the leak test. Increases the size of the table being loaded in the pattern leak test and uses the right delete method.
  Fix formatting.
  Fix memory leak and add test.
  Add pattern support to input framework.
2019-06-04 19:19:19 -07:00
Jon Siwek
43104565a4 Merge remote-tracking branch 'origin/topic/timw/159-coerce-counts'
* origin/topic/timw/159-coerce-counts:
  GHI-155: set the type of a vector based on the variable's type, not the value's type
  GH-159: Allow coercion of numeric values into other types
  Allow passing a location to BroObj::Warning and BroObj::Error.
  Add CLion directories to gitignore
  Move #define outside of max_type for clarity
2019-06-04 17:57:15 -07:00
Tim Wojtulewicz
394aec5a72 GHI-155: set the type of a vector based on the variable's type, not the value's type 2019-06-04 14:59:17 -07:00
ZekeMedley
42b1f4fd2e Make paraglob serializable and copyable. 2019-06-04 14:56:48 -07:00
ZekeMedley
e1520a0d67 Initial paraglob integration. 2019-06-04 14:24:51 -07:00
Jon Siwek
9e43028137 Updating submodule(s).
[nomail]
2019-06-04 12:45:37 -07:00
Jon Siwek
264c571089 Updating submodule(s).
[nomail]
2019-06-04 11:22:30 -07:00
Jon Siwek
a388f51eaa Merge remote-tracking branch 'origin/topic/robin/clone-cycles'
* origin/topic/robin/clone-cycles:
  GH-293: Protect copy() against reference cycles.
2019-06-04 10:31:01 -07:00
Tim Wojtulewicz
76fe643c87 GH-159: Allow coercion of numeric values into other types 2019-06-04 10:08:41 -07:00
Mauro Palumbo
50f265353b add tests for ntp protocol (WIP) 2019-06-04 17:59:18 +02:00
Mauro Palumbo
75b7be302f fix problem with time vals 2019-06-04 17:10:57 +02:00
Mauro Palumbo
208768c0e9 add ntp records to init-bare.zeek 2019-06-04 16:09:32 +02:00
Mauro Palumbo
c8f4d68185 update ntp analyzer to val_mgr 2019-06-04 12:22:37 +02:00
Palumbo Mauro
ce07b10aa8 extend and refact script-side of NTP analyzer 2019-06-03 17:50:32 +02:00
Palumbo Mauro
411908a102 extend and refactor several fields 2019-06-03 17:46:22 +02:00
Palumbo Mauro
19fd5f66e8 refactor mode 7 2019-06-03 17:26:46 +02:00
Robin Sommer
0767598771 GH-293: Protect copy() against reference cycles.
Reference cycles shouldn't occur but there's nothing really preventing
people from creating them, so may just as well be safe and deal with
them when cloning values. While the code is a bit more cumbersome this
way, it could actually be bit faster as well as it no longer caches
non-mutable values. (I measured it with the test suite: That's about
the same in execution time, maybe tiny little bit faster now;
definitly not slower).
2019-06-03 15:20:30 +00:00
Palumbo Mauro
8b0098a8d4 remove events ntp_mode6_message and ntp_mode7_message 2019-06-03 17:17:38 +02:00
Palumbo Mauro
145c7f9a25 Merge remote-tracking branch 'origin/topic/vlad/ntp_rewrite' into ntp2 2019-06-03 17:04:17 +02:00
Johanna Amann
86ac468882 support the newer TLS 1.3 key_share extension.
This one adds a separate new case that has to be parsed differently - if
a hello-retry-request is sent, only the namedgroup is sent - without the
additional key material.

Support for the legacy extension is retained.
2019-06-03 14:40:33 +10:00
Johanna Amann
af59ed6bdb Merge remote-tracking branch 'origin/master' into topic/johanna/tls13-details 2019-06-03 12:19:12 +10:00