Commit graph

9176 commits

Author SHA1 Message Date
Jon Siwek
4bd6da7186 Update default Broker/CAF thread tuning 2018-09-07 17:50:28 -05:00
Jon Siwek
9af0255ef7 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Update NEWS explaining Bro runs as 1 process instead of 2
  Update NEWS for changes to broctl "top" command output
2018-09-07 11:24:57 -05:00
Daniel Thayer
359cb0e255 Update NEWS explaining Bro runs as 1 process instead of 2 2018-09-07 10:58:48 -05:00
Daniel Thayer
e0d782d038 Update NEWS for changes to broctl "top" command output 2018-09-07 10:37:47 -05:00
Jon Siwek
73c8cf733a Give Cluster::rr_topic "key" argument a default value 2018-09-07 09:58:57 -05:00
Jon Siwek
c73bb8fdc4 Disable broker message forwarding by default
Still finding it to not be foolproof enough to enable generally for all
nodes in a cluster.  Specific/advanced use-cases may still consider
enabling, possibly just for specific nodes.
2018-09-06 18:32:22 -05:00
Jon Siwek
ddcd7f3405 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Added a documentation comment for the Input::Event type
  Update NEWS
  Update the install documentation
  Fix a typo and indentation in the configure script
  Add krb5 devel package to Travis docker containers
2018-09-06 08:59:43 -05:00
Daniel Thayer
d1ed09bddb Added a documentation comment for the Input::Event type 2018-09-05 22:27:15 -05:00
Daniel Thayer
35241fc1f1 Update NEWS
Listed the bro package website (packages.bro.org) instead of
github.com/bro/packages, as the bro package website is much
easier to use when browsing the list of available packages.

Also wrapped a long line in the text.
2018-09-05 21:42:32 -05:00
Daniel Thayer
d3347bc90f Update the install documentation
Added krb5 headers and libraries to the list of optional dependencies.

Removed an obsolete section on installing a new compiler on old FreeBSD
versions.  The system compiler can build Bro on all currently supported
versions of FreeBSD.
2018-09-05 20:47:18 -05:00
Daniel Thayer
563fc8c6ae Fix a typo and indentation in the configure script 2018-09-05 20:46:09 -05:00
Daniel Thayer
65a4c8ab92 Merge remote-tracking branch 'origin/master' into fastpath 2018-09-05 20:15:11 -05:00
Daniel Thayer
3f3344d007 Add krb5 devel package to Travis docker containers
Added the kerberos devel package to the debian-based docker containers
so that fewer tests are skipped.
2018-09-05 18:07:42 -05:00
Jon Siwek
b99be6458b Merge remote-tracking branch 'origin/topic/johanna/weird-options'
* origin/topic/johanna/weird-options:
  Update test baselines (weird options)
  Weird settings: make constants into options.
  Permit weird sampling rate of 0.
2018-09-05 16:57:08 -05:00
Jon Siwek
f896bec05a Merge remote-tracking branch 'origin/topic/robin/uint64-packet-stats'
* origin/topic/robin/uint64-packet-stats:
  Switch packet stats to uint64.
2018-09-05 16:24:04 -05:00
Johanna Amann
9f0e422bec Update test baselines (weird options) 2018-09-05 13:33:56 -07:00
Robin Sommer
c8aa6f757e Switch packet stats to uint64. 2018-09-05 20:33:30 +00:00
Jon Siwek
f00e2167a7 BIT-1208: remove unused weirds from Weird::actions table 2018-09-05 15:13:38 -05:00
Johanna Amann
bec98b98f3 Weird settings: make constants into options.
The new weird settings are now all updateable during runtime.
2018-09-05 13:12:23 -07:00
Johanna Amann
5c68093bc3 Permit weird sampling rate of 0.
This change allows a weird sampling rate of 0, which completely suppresses
all notifications (previously this crashed Bro). If also fixes the sampling
threshold to work with sampling rates of 0.
2018-09-05 13:12:23 -07:00
Jon Siwek
4bbdd63054 BIT-1779: use BRO_LOG_SUFFIX env var in ascii log rotation function 2018-09-05 15:09:57 -05:00
Robin Sommer
e275927a64 Fix printf format specification for reporting packet stats.
We were using '%d' for unsigned integers, leading to output like this:

    1535403189.557168 -483803356 packets received on interface 0:1, 0 dropped
2018-09-05 19:32:15 +00:00
fatema
ff5c11975d DNSSEC support in Bro 2018-09-05 14:12:07 -04:00
Jon Siwek
7dbd6366f9 Updating submodule(s).
[nomail]
2018-09-05 10:00:44 -05:00
Jon Siwek
60da98fa73 Merge remote-tracking branch 'origin/topic/seth/ntlm-fixes'
* origin/topic/seth/ntlm-fixes:
  Test baseline updates.
  Updates to NTLM script handling.
2018-09-04 17:18:56 -05:00
Jon Siwek
fcca789bc7 Improve update-changes output 2018-09-04 12:11:39 -05:00
Jon Siwek
07aac5f84f Sort output of a coverage unit test 2018-09-04 12:09:20 -05:00
Jon Siwek
47ea7e7ad2 Remove non-ascii char from rdp/consts.bro 2018-09-04 12:07:17 -05:00
Jon Siwek
dee22f6839 Updating submodule(s).
[nomail]
2018-09-04 10:50:20 -05:00
Jon Siwek
fa1d48e1d2 Updating submodule(s).
[nomail]
2018-09-04 10:43:24 -05:00
Jon Siwek
ced5718071 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix the find-bro-logs.test
  Fix typos/formatting in NEWS
2018-09-04 09:29:25 -05:00
Jon Siwek
60d0343845 Clarify 'old_comm_usage_is_ok' error message 2018-09-04 09:26:12 -05:00
Daniel Thayer
4bd1668915 Fix the find-bro-logs.test
Updated the find-bro-logs.test to output the correct list of log files.
The test now runs about 50 times faster.

Also corrected a typo on the "Log Files" documentation page.
2018-08-31 22:52:16 -05:00
Daniel Thayer
9ec0ffe798 Fix typos/formatting in NEWS 2018-08-31 22:29:06 -05:00
Johanna Amann
452eb0cba9 Update Mozilla CA list to NSS 3.39 2018-08-31 16:50:04 -07:00
Jon Siwek
56c14fb6d5 Update NEWS (finalizations/formatting) 2018-08-31 17:30:50 -05:00
Jon Siwek
d1e4dbe5e3 Improve make dist 2018-08-31 15:34:28 -05:00
Johanna Amann
33a8e7a7c7 Merge remote-tracking branch 'origin/topic/jsiwek/at-deprecated'
* origin/topic/jsiwek/at-deprecated:
  Add @deprecate to policy/protocols/smb/__load__.bro
  Add @deprecated directive
2018-08-31 09:06:52 -07:00
Jon Siwek
c85cfdd470 Add @deprecate to policy/protocols/smb/__load__.bro 2018-08-31 09:26:22 -05:00
Jon Siwek
a467d0c92d Add @deprecated directive
It emits a warning stating that the script is deprecated.
2018-08-31 09:24:03 -05:00
Jon Siwek
57a505b0e4 Allow loading policy/protocols/smb once again
It just redirects to base/protocols/smb
2018-08-30 16:07:04 -05:00
Jon Siwek
1baf946e52 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Update NEWS with more info about runtime options
2018-08-30 09:51:41 -05:00
Jon Siwek
7e6fc58ab4 Merge remote-tracking branch 'origin/topic/johanna/tls-more-data'
* origin/topic/johanna/tls-more-data:
  Update NEWS for ssl changes.
  SSL: test updates for record_layer version
  Final touches to SSL events with record layer version.
  Introduce ssl_plaintext_data event.
  Add record layer version to event ssl_encrypted_data.
  Add compression methods to ssl_client_hello event.
2018-08-30 09:48:25 -05:00
Jon Siwek
12aa37f242 Update binpac submodule and unit test baseline 2018-08-30 09:14:06 -05:00
Daniel Thayer
be9d4556f6 Update NEWS with more info about runtime options 2018-08-30 00:08:45 -05:00
Robin Sommer
82862d8114 Baseline update. 2018-08-30 00:11:38 +00:00
Robin Sommer
6de436f3f6 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1967'
* origin/topic/jsiwek/bit-1967:
  Fix a routing loop in control framework
  Add Broker::forward() function
  Enable implicit Broker message forwarding by default
  Remove Cluster::broadcast_topic
  Remove Intel Broker topics, re-use existing Cluster topics
  Remove "relay" family of Broker functions
2018-08-30 00:08:12 +00:00
Jon Siwek
611c00a605 Merge remote-tracking branch 'origin/topic/johanna/bit-1976'
* origin/topic/johanna/bit-1976:
  Allow event/function definitions to be wrapped in directives.

Fixed to work with attributes (e.g. &priority).
2018-08-29 18:28:54 -05:00
Jon Siwek
01300f8706 Fix a unit test 2018-08-29 17:23:48 -05:00
Jon Siwek
0c9878f136 Fix strict-aliasing compiler warning 2018-08-29 17:18:56 -05:00