Commit graph

9176 commits

Author SHA1 Message Date
Johanna Amann
911018347f Make data flow more explicit for complilers.
gcc likes complaining about ev potentially not being initialized. Make
it clear that this cannot happen by marking the default case as
unreachable after the error output.
2018-03-16 14:36:13 -07:00
Daniel Thayer
8fe998c5f7 Fix one new minor typo in the config framework docs 2018-03-15 18:52:08 -05:00
Robin Sommer
77bc5da6f9 Updating submodule(s).
[nomail]
2018-03-15 15:00:34 -07:00
Robin Sommer
78f4ed690d Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci-changes'
* origin/topic/dnthayer/travis-ci-changes:
  Configure Travis CI email recipients and build branches
2018-03-15 14:59:34 -07:00
Robin Sommer
31a48bf4ad Merge remote-tracking branch 'origin/topic/dnthayer/ticket1905'
Includes slight editing of the new text.

Closes BIT-1905.

* origin/topic/dnthayer/ticket1905:
  Add documentation of the configuration framework
  Add documentation of "option" declarations
  Improve config framework documentation comments
  Fix minor typos and doc build warnings in NEWS
2018-03-15 14:54:43 -07:00
Daniel Thayer
8aeedba066 Add documentation of the configuration framework 2018-03-15 14:50:42 -05:00
Daniel Thayer
79afd99229 Add documentation of "option" declarations 2018-03-15 14:29:26 -05:00
Daniel Thayer
f3e42874b8 Improve config framework documentation comments
Fixed typos and formatting.
2018-03-15 14:16:00 -05:00
Daniel Thayer
c759583d11 Fix minor typos and doc build warnings in NEWS 2018-03-15 14:13:54 -05:00
Jon Siwek
54aa7d1911 Updating submodule(s).
[nomail]
2018-03-07 13:54:53 -06:00
Jon Siwek
57fa8f2708 Update a doc test/baseline 2018-03-07 12:48:08 -06:00
Seth Hall
e76b56ce53 Rework to the DHCP analyzer.
Highlights:
 - Reduced all DHCP events into a single dhcp_message event. (removed legacy events since they weren't widely used anyway)
 - Support many more DHCP options.
 - DHCP log is completely reworked and now represents DHCP sessions
   based on the transaction ID (and works on clusters).
 - Removed the known-devices-and-hostnames script since it's generally
   less relevant now with the updated log.
2018-03-01 08:36:32 -08:00
Daniel Thayer
1d3a0e26e4 Configure Travis CI email recipients and build branches 2018-02-22 14:59:04 -06:00
Johanna Amann
01a96239e1 Add removed root certificate back to test that requires it.
Test has a trace that contains a WoSign certificate - they are no longer
recognized by pretty much anyone.
2018-02-20 09:02:55 -08:00
Jon Siwek
c54b607de1 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix another warning when building the documentation
  Fix a warning when building documentation
  Fix the config framework several-files.bro test
2018-02-18 17:37:34 -06:00
Johanna Amann
8ea7de9380 Update Mozilla CA list to state of NSS 3.35. 2018-02-16 10:53:51 -08:00
Johanna Amann
981c889352 Update list of Certificate Transparency logs. 2018-02-16 10:44:29 -08:00
Johanna Amann
9bc42385f3 Update submodule
[nomail]
2018-02-16 09:02:21 -08:00
Daniel Thayer
45cc4d0e2f Fix another warning when building the documentation 2018-02-14 18:43:34 -06:00
Daniel Thayer
d0c29e81e1 Fix a warning when building documentation 2018-02-14 17:01:04 -06:00
Johanna Amann
94b422c88d Updating CHANGES and VERSION. 2018-02-14 10:01:17 -08:00
Johanna Amann
1aa9578021 Update submodule
[nomail]
2018-02-14 08:49:27 -08:00
Daniel Thayer
873049ce12 Fix the config framework several-files.bro test
The test script needs to wait until the Input::end_of_data event has
been raised for each of the config input files.
2018-02-12 15:05:38 -06:00
Jon Siwek
85b5c6ffbd Fix pessimizing-move compiler warning.
Returning via move() should never be needed and may result in a compiler
warning: "moving a local object in a return statement prevents copy
elision".
2018-02-12 11:13:04 -06:00
Jon Siwek
6766f52cdd Add limit to number of auth flavors parsed out of MNT replies 2018-02-12 11:01:25 -06:00
Xiaogrill
cbe585dd87 Treat LibreSSL as an older OpenSSL 2018-02-11 09:07:22 -08:00
Robin Sommer
0e83bd3193 Fixing unstable test. 2018-02-07 14:21:25 -08:00
Robin Sommer
fff4db5145 Merge remote-tracking branch 'origin/topic/johanna/config'
Closes BIT-1900.

* origin/topic/johanna/config:
  Use port_mgr->Get() in the input framework config changes.
  Allow the empty field separator to be empty; use in config framework.
  Fix small bug in config reader.
  Fix segmentation fault when parsing sets containing invalid elements.
  Add config framework.
2018-02-07 14:10:48 -08:00
Robin Sommer
c0aab7cf15 Fix compile.
One final change hadn't made it in.
2018-02-06 17:05:09 -08:00
Robin Sommer
ae51f72de0 Updating NEWS. 2018-02-06 08:54:54 -08:00
Robin Sommer
cbd96a65cf Merge remote-tracking branch 'origin/topic/jsiwek/bit-1854-reassembler-improvements'
Includes small readability tweaks, see BIT-1854.

Closes BIT-1854.

* origin/topic/jsiwek/bit-1854-reassembler-improvements:
  BIT-1854: improve reassembly overlap checking
  BIT-1854: fix the 'tcp_excessive_data_without_further_acks' option
2018-02-06 08:42:29 -08:00
Robin Sommer
2ecfae8810 Merge remote-tracking branch 'origin/topic/johanna/ssl_signature_details'
Closes BIT-1897.

* origin/topic/johanna/ssl_signature_details:
  Make parsing of ServerKeyExchange work for D(TLS) < 1.2.
  Add more details to ssl_server_signature.
2018-02-05 15:21:28 -08:00
Robin Sommer
9f4cef23ad Merge remote-tracking branch 'origin/topic/jsiwek/sumstats-non-cluster-fixes'
Closes BIT-1898.

* origin/topic/jsiwek/sumstats-non-cluster-fixes:
  Fix problems with SumStats non-cluster.bro script
2018-02-05 15:14:40 -08:00
Robin Sommer
f735ad382b Updating submodule(s).
Closes BIT-1902.
2018-02-05 15:08:22 -08:00
Robin Sommer
678cf7fa6c Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci'
* origin/topic/dnthayer/travis-ci:
  Add a .travis.yml file
2018-02-05 15:07:29 -08:00
Jon Siwek
4cd9f0edf9 Merge branch 'smb-transaction-messages' of https://github.com/jbencteux/bro
* 'smb-transaction-messages' of https://github.com/jbencteux/bro:
  add test for smb1_com_transaction_response event changes
  add test for smb1_com_transaction2_secondary_request event changes
  add test for smb1_com_transaction2_request event changes
  add test for smb1_com_transaction_secondary_request event changes
  add test for smb1_com_transaction_request event changes
  fix setup field handling in smb1_com_transaction_request messages
  fix smb1_com_transaction* messages
  add smb1_transaction2_secondary_request event
  add smb1_transaction_secondary_request event
  add parameters and data to smb1_transaction_request/response messages
  add SMB_Parameters.Words to smb1_transaction2_request event
2018-02-05 16:33:25 -06:00
Jon Siwek
7bdbcfc568 Fix warnings when building sphinx docs 2018-02-05 15:19:08 -06:00
Jon Siwek
9603deeb64 Merge branch 'nfs-updates' of https://github.com/dtrejod/bro
* 'nfs-updates' of https://github.com/dtrejod/bro:
  Format print nfs units tests to improve output readability. Add unit tests for new NFS events -- nfs_proc_symlink, nfs_proc_link, nfs_proc_sattr.
  Bug fix: nfs3_writeargs didn't properly return filehandle.
  Add nfs_proc_symlink, nfs_proc_link, nfs_proc_sattr.
2018-02-05 14:15:18 -06:00
Jon Siwek
35fa1261f3 Merge branch 'mount-protocol' of https://github.com/dtrejod/bro
* 'mount-protocol' of https://github.com/dtrejod/bro:
  Add unit tests for new MOUNT events -- mount_proc_mnt, mount_proc_umnt, mount_proc_umnt_all, mount_proc_not_implemented.
  Add mount_proc_null, mount_proc_mnt, mount_proc_umnt, mount_proc_umnt_all, mount_proc_not_implemented, mount_reply_status.
2018-02-05 13:32:36 -06:00
Jon Siwek
445e5bfc18 Fix (unlikely) memory leak in nb_dns.c 2018-02-05 10:45:02 -06:00
Daniel Thayer
97160b15da Add a .travis.yml file 2018-02-02 15:29:03 -06:00
Seth Hall
c2f35920fd First step of DHCP analyzer rearchitecture.
Old event prototypes have changed and the events are broken right
now and may be removed in favor of the new generic "dhcp_message"
event.

DHCP option parsing is abstracted from the main code base of the
protocol parser and are all now located in their own file.

Documentation, tests, and final code cleanup are still pending.
2018-02-02 10:14:15 -05:00
Johanna Amann
884f47a994 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Remove bro-plugins submodule from .gitmodules file
2018-02-01 13:21:31 -08:00
Daniel Thayer
5de87ce660 Remove bro-plugins submodule from .gitmodules file 2018-02-01 14:44:20 -06:00
Seth Hall
ba49ab8201 Merge branch 'feature/new_dhcp_data' of https://github.com/Mr-Click/bro into topic/seth/merge-121-dhcp-extensions 2018-02-01 10:06:35 -05:00
Jon Siwek
343dbf4100 BIT-1854: improve reassembly overlap checking
It now skips looping over buffered blocks in the common case where the
new block is at the end and so can't possibly overlap anything.
2018-01-31 21:14:45 -06:00
Jon Siwek
c2af3daa9f BIT-1854: fix the 'tcp_excessive_data_without_further_acks' option
This previously checked against the amount of out-of-sequence data
being buffered by the reassembler.  It now checks against the total
size of all blocks being buffered in the reassembler, which, by nature
of still being buffered there, means it's not been acked yet.
2018-01-31 21:09:12 -06:00
Johanna Amann
a8c0580b45 Merge branch 'topic/johanna/openssl-1.1'
* topic/johanna/openssl-1.1:
  Fix recently introduced double free in OpenSSL code.
  Adjust coding style & fix test failures.
  Adapt most of the X509 support to OpenSSL 1.1
2018-01-30 14:33:32 -08:00
Johanna Amann
eb32a44da5 Use port_mgr->Get() in the input framework config changes. 2018-01-29 14:43:39 -08:00
Johanna Amann
ac9fd000e0 Merge remote-tracking branch 'origin/master' into topic/johanna/config 2018-01-29 14:43:20 -08:00