Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 01:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
6849 commits 388 branches 195 tags 264 MiB
Commit graph

6849 commits

This branch
This branch
All branches
Author SHA1 Message Date
Robin Sommer
b36df2a272 Updating submodule(s). 
[nomail]
 2014-05-15 11:48:11 -07:00
Robin Sommer
525e757d2a Merge remote-tracking branch 'origin/topic/vladg/radius' into topic/robin/radius-merge 
* origin/topic/vladg/radius:
  Radius functionality and memleak test.
  Update test baselines.
  Move seq to uint64 to match recent changes in seq processing.

BIT-1129 #merged
 2014-05-15 11:39:05 -07:00
Robin Sommer
ebc8ebf5f9 Merge remote-tracking branch 'origin/master' into topic/robin/radius-merge 
Conflicts:
	scripts/base/init-default.bro
 2014-05-15 11:10:11 -07:00
Bernhard Amann
ccccda6da8 Merge remote-tracking branch 'origin/master' into topic/bernhard/even-more-ssl-changes 2014-05-15 10:59:13 -07:00
Bernhard Amann
10cc44b37f Add tls flag to smtp.log. Will be set if a connection switched to startls. 2014-05-15 10:53:11 -07:00
Seth Hall
c536db0feb Merge remote-tracking branch 'origin/topic/bernhard/ticket1177' 
* origin/topic/bernhard/ticket1177:
  define empty request_key method for sumstats in cluster mode.
 2014-05-15 13:50:16 -04:00
Bernhard Amann
388b8f92ec add starttls support for pop3 2014-05-15 10:25:21 -07:00
Bernhard Amann
6bc914458b Add smtp starttls support 2014-05-15 09:59:43 -07:00
Vlad Grigorescu
0706567e68 Merge branch 'topic/vladg/radius' of ssh://git.bro.org/bro into topic/vladg/radius 2014-05-15 11:50:58 -04:00
Vlad Grigorescu
9ab4744072 Radius functionality and memleak test. 2014-05-15 11:49:03 -04:00
Vlad Grigorescu
a3e00322a2 Update test baselines. 2014-05-15 11:18:00 -04:00
Vlad Grigorescu
d88f8d77cb Move seq to uint64 to match recent changes in seq processing. 2014-05-15 09:47:20 -04:00
Vlad Grigorescu
df99f87dbf Merge origin/master into topic/vladg/radius 2014-05-14 23:23:08 -04:00
Robin Sommer
bbd409d274 Merge remote-tracking branch 'origin/master' into topic/robin/dynamic-plugins-2.3 
(Never good to name a branch after version anticipated to include it ...)
 2014-05-14 16:23:04 -07:00
Bernhard Amann
746c073729 Replace errors when parsing x509 certs with weirds (as requested by Seth). 
The one I did not replace is a malloc issue which I think really should
raise an error.
 2014-05-14 15:53:26 -07:00
Bernhard Amann
5bd0c3fcaf move tls content types from heartbleed to consts.bro. Seems better to put them there... 2014-05-14 15:45:47 -07:00
Bernhard Amann
f0b244b8b0 Add new features from other branch to the heartbleed-detector (and clean them up). 
We should now quite reliably detect scans/attacks, even when encrypted and not succesful.
 2014-05-14 15:42:27 -07:00
Robin Sommer
37dd331256 Updating submodule(s). 
[nomail]
 2014-05-08 17:08:41 -07:00
Robin Sommer
96bcc2d69d Merge branch 'topic/robin/bit-348-merge' 
* topic/robin/bit-348-merge:
  Fixing compiler warnings.
  Update SNMP analyzer's DeliverPacket method signature.
  Fix reassembly of data w/ sizes beyond 32-bit capacities (BIT-348).

BIT-348 #merged
 2014-05-08 16:33:59 -07:00
Bernhard Amann
9014629a7d Let TLS analyzer fail better when no longer in sync with the data stream. The 
version field in each record-layer packet is now re-checked.
 2014-05-08 11:32:52 -07:00
Jon Siwek
012156e9f1 Merge branch 'topic/jsiwek/asan-fixes' 2014-05-07 11:03:05 -05:00
Jon Siwek
4ea8a4e8ef Change handling of atypical OpenSSL error case in x509 verification. 2014-05-07 10:45:00 -05:00
Jon Siwek
6277be6e60 Fix memory leaks in X509 certificate parsing/verification. 2014-05-06 20:50:37 -05:00
Jon Siwek
37b860d325 Fix new []/delete mismatch in input::reader::Raw::DoClose(). 2014-05-06 12:55:50 -05:00
Jon Siwek
af3b87e100 Fix buffer over-reads in file_analysis::Manager::Terminate() 2014-05-06 12:36:02 -05:00
Jon Siwek
965e4d421d Fix buffer overlows in IP address masking logic. 
That could occur either in taking a zero-length mask on an IPv6 address
(e.g. [fe80::]/0) or a reverse mask of length 128 on any address (e.g.
via the remask_addr BuiltIn Function).
 2014-05-06 12:13:43 -05:00
Jon Siwek
713fd2fbaf Fix new []/delete mismatch in ~Base64Converter. 2014-05-06 12:07:23 -05:00
Seth Hall
b29703469d Merge branch 'master' into topic/seth/file-entropy 
Conflicts:
	src/3rdparty
 2014-05-02 22:55:04 -04:00
Daniel Thayer
0cfdb8cbfa Merge remote-tracking branch 'origin/master' into topic/dnthayer/ticket1186 2014-05-02 17:15:18 -05:00
Daniel Thayer
99b13d3cfd Add a new section "Cluster Configuration" to the docs 
Added a new section that is intended as a how-to for configuring a Bro
cluster (this section does not discuss cluster architecture or theory)
that is aimed at beginners to Bro.  Most of this content was moved here
from the BroControl doc (which is now intended as more of a reference guide
for more experienced users) and the load balancing FAQ on the website.
 2014-05-02 16:57:55 -05:00
Jon Siwek
b15bbf4f33 Replace an unneeded OPENSSL_malloc call. 2014-05-02 12:52:11 -05:00
Jon Siwek
3905b6fc70 Clean up base SNMP script. Mostly docs, some logic refactors. 2014-05-02 12:36:02 -05:00
Jon Siwek
2e84e1f78c Merge branch 'topic/seth/snmp' 
BIT-1142 #merged
 2014-05-02 11:39:19 -05:00
Robin Sommer
bf9bddd4fc Updating submodule(s). 
[nomail]
 2014-05-01 21:05:17 -07:00
Robin Sommer
8d1b47fae6 Merge remote-tracking branch 'origin/topic/bernhard/ec-curve' 
BIT-1189 #merged

* origin/topic/bernhard/ec-curve:
  fix broxygen errors
  Polish changes for ecdhe/dhe
  Add DH support to SSL analyzer.
  Add a few more ciphers Bro did not know at all so far.
  Forgot a few ciphers in the EC list...
  Log chosen curve when using ec cipher suite in TLS.
 2014-05-01 20:52:50 -07:00
Robin Sommer
83a15886a7 Updating CHANGES and NEWS for earlier X509 updates. 
BIT-1150 #merged
 2014-05-01 20:45:35 -07:00
Robin Sommer
a9eb31b461 Merge remote-tracking branch 'origin/fastpath' 
* origin/fastpath:
  Fix reference counting for lookup_ID() usages.
 2014-05-01 20:30:45 -07:00
Robin Sommer
55dfc54dd6 Merge remote-tracking branch 'origin/fastpath' 
* origin/fastpath:
  Fix missing "irc-dcc-data" service field from IRC DCC connections.
  Change X509 extension value parsing to not abort on malloc failures.
 2014-05-01 20:26:12 -07:00
Jon Siwek
8b7d5a68b2 Fix reference counting for lookup_ID() usages. 
That function refs the ID before returning it, but callers were never
assuming responsibility for that reference.
 2014-05-01 15:00:03 -05:00
Jon Siwek
5b9d190f2c Fix missing "irc-dcc-data" service field from IRC DCC connections. 2014-05-01 14:08:07 -05:00
Jon Siwek
385438d47c Change X509 extension value parsing to not abort on malloc failures. 
Also comes with factoring that out in to it's own function and
additional error check before using a return value from BIO_pending.
 2014-05-01 13:04:34 -05:00
Robin Sommer
eed94fab76 Merge remote-tracking branch 'origin/fastpath' 
* origin/fastpath:
  Correct a notice for heartbleed. The notice is thrown correctly, just the message conteined wrong values.
  Improve/standardize some malloc/realloc return val checks.
  Improve file analysis manager shutdown/cleanup.
 2014-05-01 09:30:31 -07:00
Bernhard Amann
636262d865 Correct a notice for heartbleed. The notice is thrown correctly, just the message 
conteined wrong values.
 2014-04-30 12:35:09 -07:00
Jon Siwek
d7d5497436 Improve/standardize some malloc/realloc return val checks. 2014-04-29 15:26:19 -05:00
Jon Siwek
4b059ea15a Improve file analysis manager shutdown/cleanup. 
file_analysis::Manager's dtor now doesn't assume any more analysis
progress can be made because too many of Bro's other subsystems
are shutdown by that point.  Any file analysis requests made after
Terminate cannot be reliably processed.
 2014-04-29 12:44:53 -05:00
Bernhard Amann
7d0e5067c7 fix broxygen errors 2014-04-27 16:25:32 -07:00
Bernhard Amann
ef5b021e77 Polish changes for ecdhe/dhe 2014-04-27 00:15:49 -07:00
Bernhard Amann
fb56b22cff Add DH support to SSL analyzer. 
When using DHE or DH-Anon, sever key parameters are now available
in scriptland.

Also add script to alert on weak certificate keys or weak dh-params.
 2014-04-26 23:52:51 -07:00
Bernhard Amann
b1a2bccdc7 Add a few more ciphers Bro did not know at all so far. 2014-04-26 15:24:28 -07:00
Bernhard Amann
24b63f5fc8 Forgot a few ciphers in the EC list... 2014-04-26 09:57:20 -07:00