Commit graph

6849 commits

Author SHA1 Message Date
Robin Sommer
7a43502607 Updating submodule(s).
[nomail]
2015-10-01 17:13:34 -07:00
Robin Sommer
24973e56bd Updating submodule(s).
[nomail]
2015-10-01 17:13:27 -07:00
Robin Sommer
45078e1d8c Merge remote-tracking branch 'origin/topic/yunzheng/x509-generalizedtime'
* origin/topic/yunzheng/x509-generalizedtime:
  Make x509 end-of-string-check nicer.
  Refactor X509 generalizedtime support and test.
  Fixed parsing of V_ASN1_GENERALIZEDTIME timestamps in x509 certificates
2015-10-01 16:48:16 -07:00
Robin Sommer
e66b236ae8 Tiny tweak for code consistency in RAW reader. 2015-10-01 16:31:25 -07:00
Robin Sommer
f3bf7b6c7b Merge remote-tracking branch 'origin/topic/johanna/bit-1479'
BIT-1479 #merged

* origin/topic/johanna/bit-1479:
  Fix offset=-1 (eof) for raw reader
2015-10-01 16:13:16 -07:00
Seth Hall
f1e0ca0be1 Update the cmake module to match the commit tcmalloc finding commit. 2015-09-29 15:20:26 -04:00
Robin Sommer
10bc4ad353 Merge remote-tracking branch 'origin/topic/dnthayer/ticket1481'
BIT-1481 #merged

* origin/topic/dnthayer/ticket1481:
  Improve a few test canonifiers
  Remove unnecessary use of TEST_DIFF_CANONIFIER
  Fixed some test canonifiers to read only from stdin
2015-09-29 09:56:42 -07:00
Robin Sommer
5cd99a7f4b Merge remote-tracking branch 'origin/topic/dnthayer/doc-fixes'
BIT-1484 #merged

* origin/topic/dnthayer/doc-fixes:
  Fix documentation of encode/decode_base64 BiFs
  Update some doc tests and baselines
  Update and improve install instructions
  More improvements to input framework documentation
  Update install instructions for CAF
  Improve documentation of input framework
  Fixed some examples in "Writing Bro Scripts" doc
  Clarifications to the script reference docs
  Split long lines in input framework docs
  Update documentation of Conn::Info history field
  Minor clarifications and typo fixes in broker doc
  Remove unnecessary blank lines from some broker doc files
  Fix some doc build warnings
  Improve documentation of table and set types
  Fix typo in documentation of a field in connection record
  Significant improvements to the GeoLocation doc
2015-09-29 09:51:17 -07:00
Robin Sommer
d1e10a4606 Merge remote-tracking branch 'origin/topic/dnthayer/configure'
* origin/topic/dnthayer/configure:
  Add configure option to disable broker python bindings

BIT-1485 #merged
2015-09-29 09:46:59 -07:00
Daniel Thayer
ec24524147 Add configure option to disable broker python bindings
Also improved the configure summary output to more clearly show
whether or not broker python bindings will be built.
2015-09-25 15:11:41 -05:00
Daniel Thayer
87170652ba Fix documentation of encode/decode_base64 BiFs
Some of these were generating warnings during "make doc".  Also
simplified the description for some, and corrected a few minor typos.
2015-09-23 13:23:38 -05:00
Daniel Thayer
6519103890 Merge remote-tracking branch 'origin/master' into topic/dnthayer/doc-fixes
Conflicts:
	scripts/base/protocols/conn/main.bro
2015-09-23 11:45:10 -05:00
Daniel Thayer
34adce126b Update some doc tests and baselines 2015-09-23 11:39:36 -05:00
Daniel Thayer
6ff68ce6ae Update and improve install instructions
Added info about optional dependencies, and what to do when the configure
script fails.  A few other clarifications and updates.
2015-09-22 17:42:58 -05:00
Daniel Thayer
8896679a01 More improvements to input framework documentation
Fixed more typos, reformatted the code examples to remove the
horizontal scroll bars, and removed some redundant sections that were
just outdated copies of information in the auto-generated reference
docs.
2015-09-22 17:41:24 -05:00
Daniel Thayer
160b852f64 Update install instructions for CAF 2015-09-22 13:03:28 -05:00
Daniel Thayer
aa5471ec15 Improve documentation of input framework 2015-09-21 16:42:53 -05:00
Daniel Thayer
b1d1d90de4 Fix a bug in diff-remove-x509-names canonifier
The last field in a log was being ignored, due to an off-by-one
error in a "for" loop.  Also simplified the script by combining
two patterns into one.
2015-09-20 00:21:04 -05:00
Daniel Thayer
a7aa393aef Improve a few test canonifiers 2015-09-19 18:08:31 -05:00
Daniel Thayer
8a16145e31 Remove unnecessary use of TEST_DIFF_CANONIFIER
Removed a TEST_DIFF_CANONIFIER from a test, because it is already
set in btest.cfg, and this one also doesn't actually specify the
path to the script.
2015-09-18 17:32:30 -05:00
Daniel Thayer
6f1e07f6d5 Fixed some test canonifiers to read only from stdin
Fixed some test canonifier scripts to read from stdin instead of
from a filename specified as a cmd-line argument.  This is needed
in order to be able to reliably use them in a pipeline with other
test canonifiers.

Also removed some unused test canonifier scripts.
2015-09-18 17:30:26 -05:00
Johanna Amann
5785530c6b Make x509 end-of-string-check nicer.
Use remaining instead of the total length, in case someone changes the
code later and changes pString before.
2015-09-18 12:55:55 -07:00
Johanna Amann
708ede22c6 Refactor X509 generalizedtime support and test.
The generalizedtime support in for certificates now fits more
seamlessly to how the rest of the code was structured and does the
different processing for UTC and generalized times at the beginning,
when checking for them.

The test does not output the common name anymore, since the output
format might change accross openssl versions (inserted the serial
instead).

I also added a bit more error checking for the UTC time case.
2015-09-18 12:46:49 -07:00
Johanna Amann
a052dc4e35 Fix offset=-1 (eof) for raw reader
Addresses BIT-1479
2015-09-16 15:16:04 -07:00
Daniel Thayer
401743313c Fixed some examples in "Writing Bro Scripts" doc 2015-09-14 13:30:25 -05:00
Johanna Amann
09904aeb54 Updating sumbodule
[nomail]
2015-09-11 12:26:15 -07:00
Johanna Amann
e11c101698 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Add README.rst -> README symlink. Addresses BIT-1413
2015-09-11 12:17:10 -07:00
Johanna Amann
5a93a4bfc8 Merge branch 'hash-dependency' of https://github.com/RichieB2B/bro
* 'hash-dependency' of https://github.com/RichieB2B/bro:
  hash-all-files.bro depends on base/files/hash
2015-09-11 11:59:41 -07:00
Richard van den Berg
aa8f56c2bd hash-all-files.bro depends on base/files/hash 2015-09-11 13:01:43 +02:00
Vlad Grigorescu
20ac0c5aeb Add README.rst -> README symlink. Addresses BIT-1413 2015-09-10 15:22:13 -05:00
Yun Zheng Hu
2327f5bba5 Fixed parsing of V_ASN1_GENERALIZEDTIME timestamps in x509 certificates 2015-09-10 10:50:35 +02:00
Daniel Thayer
bebd08484c Clarifications to the script reference docs 2015-09-07 03:35:23 -05:00
Johanna Amann
4833d2ffd0 Merge remote-tracking branch 'origin/topic/vladg/bit-1460'
* origin/topic/vladg/bit-1460:
  Make dns_max_queries redef-able, and bump up the default from 5 to 25.

BIT-1460 #merged
2015-09-05 20:37:59 -07:00
Vlad Grigorescu
4ac8ae61f7 Make dns_max_queries redef-able, and bump up the default from 5 to 25.
Addresses BIT-1460
2015-09-04 07:39:31 -05:00
Johanna Amann
ab57c72251 Merge remote-tracking branch 'origin/topic/vladg/bit-1458'
* origin/topic/vladg/bit-1458:
  Move SIP analyzer to flowunit instead of datagram

BIT-1458 #merged
2015-09-03 20:21:19 -07:00
Vlad Grigorescu
d85e5d776d Move SIP analyzer to flowunit instead of datagram
Moving to flowunit simplifies the BinPAC constructs by allowing
the use of &oneline instead of relying on regular expressions
which sometimes didn't work as intended.

Addresses BIT-1458
2015-09-03 16:29:58 -05:00
Daniel Thayer
6df54a3168 Merge remote-tracking branch 'origin/master' into topic/dnthayer/ticket1467 2015-09-01 13:08:24 -05:00
Robin Sommer
be89bcd115 Fixing line endings in CHANGES.
No content change.
2015-08-31 14:44:12 -07:00
Robin Sommer
16e12cab02 Fixing errors in 2.4 release notes. 2015-08-31 14:41:38 -07:00
Robin Sommer
0494a6d882 Merge remote-tracking branch 'origin/topic/johanna/bit-1463'
* origin/topic/johanna/bit-1463:
  Refactor oob tests using different approach.
  Add a number of out_of_bound checks to Packet.cc

BIT-1463 #merged
2015-08-31 14:35:49 -07:00
Johanna Amann
8763e1a485 Refactor oob tests using different approach. 2015-08-31 13:45:00 -07:00
Johanna Amann
fd6f9e470f Add a number of out_of_bound checks to Packet.cc
Mostly this verifies that we actually have the full headers that we are
trying to read in a packet.

Addresses BIT-1463
2015-08-31 13:09:18 -07:00
Johanna Amann
710409507c Fix FreeBSD build errors 2015-08-31 10:56:21 -07:00
Robin Sommer
f8323837fa Merge remote-tracking branch 'origin/topic/dnthayer/fix-rdp'
* origin/topic/dnthayer/fix-rdp:
  Fix initialization of a pointer in RDP analyzer
2015-08-31 10:35:19 -07:00
Robin Sommer
36b5a4db08 Merge branch 'master' of https://github.com/knielander/bro
I reworked this a bit:

    - Moved the globals into a new Pcap::* namespace, and renamed them
      slightly.

    - Moved the definitions of the globals into pcap/const.bif.

    - Also moved the existing 'snaplen' into Pcap::* and removed
      SnapLen() from the PktSrc API (it's really a pcap thing).

    - Likewise moved the existing functions precompile_pcap_filter,
      install_pcap_filter, and pcap_error, into Pcap::*.

    - Did some more refactoring for the pcap code.

* 'master' of https://github.com/knielander/bro:
  Refactored patch (removed options, less ambiguous name)
  Allow Bro to run in fanout mode.
  Allow libpcap buffer size to be set manually.
  Allow Bro to run in fanout mode.
  Allowed libpcap buffer size to be set via configuration.
2015-08-30 22:09:32 -07:00
Robin Sommer
f2dbe7f01d Merge branch 'topic/jgras/base64-logging' of https://github.com/J-Gras/bro
* 'topic/jgras/base64-logging' of https://github.com/J-Gras/bro:
  Update calls of Base64 functions.
  Refactoring of Base64 functions.

I've removed the additional bif for encoding with a connection, as I'm
not sure there's much of a use case for it; we can always add it back
later if it turns out there is. I've also renamed
decode_base64_intern() to decode_base64_conn() to be a bit more
explicit about the difference.
2015-08-30 20:24:55 -07:00
Robin Sommer
1b9ee38e69 Fix potential crash TCP headers were captured incompletely.
Test case provided by Jonathan Ganz.

BIT-1425 #close
2015-08-30 18:49:05 -07:00
Daniel Thayer
587fac5924 Fix initialization of a pointer in RDP analyzer
A pointer to the end of a buffer was incorrectly being initialized
to a value beyond the end of the buffer.
2015-08-30 17:21:42 -05:00
Robin Sommer
d88e6b3f1a Updating CHANGES and VERSION. 2015-08-29 11:42:31 -07:00
Robin Sommer
07210faa3d Merge remote-tracking branch 'origin/topic/johanna/BIT-1465'
I did a bit more cleanup in GetTimeFromAsn1().

BIT-1465 #merged

* origin/topic/johanna/BIT-1465:
  Make asn.1 date/time parsing more robust.
2015-08-29 10:51:55 -07:00