Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
6849 commits 388 branches 195 tags 265 MiB
Commit graph

6849 commits

This branch
This branch
All branches
Author SHA1 Message Date
Jon Siwek
13d8908a8d Fix a memory leak in ASCII log writer. 2014-04-14 16:53:49 -05:00
Seth Hall
db80947b5f Updated snmp script. Feedback would be welcome! 2014-04-14 15:58:37 -04:00
Bernhard Amann
cc838c6b2e rip out state handline from ssl analyzer. 
still seems to work, but basically untested.
 2014-04-10 15:12:33 -07:00
Robin Sommer
9b672f9e7f Merge remote-tracking branch 'origin/fastpath' 
* origin/fastpath:
  Small logic fix for main ssl script.
  test for new ssl/tls dpd signature
 2014-04-10 15:05:44 -07:00
Bernhard Amann
c741ea7c50 Small logic fix for main ssl script. 
Thank you, Jon
 2014-04-10 14:35:05 -07:00
Bernhard Amann
5d9fb1631c test for new ssl/tls dpd signature 2014-04-10 14:33:14 -07:00
Robin Sommer
a5fdf7996f Updating submodule(s). 
[nomail]
 2014-04-10 08:32:33 -07:00
Robin Sommer
8af9fbf7e5 Merge remote-tracking branch 'origin/fastpath' 
* origin/fastpath:
  update dpd for tls 1.2
  Remove unused data member of SMTP_Analyzer.
  Fix missing @load dependencies in some scripts.
 2014-04-10 08:24:18 -07:00
Bernhard Amann
4405121fb2 Merge branch 'fastpath' into topic/bernhard/heartbeat 2014-04-10 08:13:29 -07:00
Bernhard Amann
aa73d42120 update dpd for tls 1.2 
all tests still pass
 2014-04-10 08:12:02 -07:00
Jon Siwek
c617be6f50 Remove unused data member of SMTP_Analyzer. 
To silence a Coverity warning.
 2014-04-09 16:39:46 -05:00
Jon Siwek
d4ef9f3693 Fix missing @load dependencies in some scripts. 
And update the unit test which is supposed to catch such errors.
 2014-04-09 16:32:23 -05:00
Jon Siwek
04344d09eb Update SNMP analyzer's DeliverPacket method signature. 2014-04-09 13:36:44 -05:00
Jon Siwek
f3bb4a455f Merge branch 'master' into topic/jsiwek/bit-348 2014-04-09 13:14:32 -05:00
Jon Siwek
2b3c2bd394 Fix reassembly of data w/ sizes beyond 32-bit capacities (BIT-348). 
The main change is that reassembly code (e.g. for TCP) now uses
int64/uint64 (signedness is situational) data types in place of int
types in order to support delivering data to analyzers that pass 2GB
thresholds.  There's also changes in logic that accompany the change in
data types, e.g. to fix TCP sequence space arithmetic inconsistencies.

Another significant change is in the Analyzer API: the *Packet and
*Undelivered methods now use a uint64 in place of an int for the
relative sequence space offset parameter.
 2014-04-09 13:03:24 -05:00
Bernhard Amann
2414aaf4bb enable detection of encrypted heartbleeds. 2014-04-08 21:57:37 -07:00
Robin Sommer
285ef548ff Updating test baselines. 2014-04-08 15:47:11 -07:00
Robin Sommer
cf7e25643e Merge remote-tracking branch 'origin/topic/jsiwek/snmp' 
* origin/topic/jsiwek/snmp:
  Add memory leak unit test for SNMP.
  Fix compiler nitpicks from new SNMP code.
  Add SNMP datagram parsing support.

BIT-1142
 2014-04-08 15:31:03 -07:00
Bernhard Amann
2942a26280 also extract payload data in ssl_heartbeat 2014-04-08 12:44:51 -07:00
Bernhard Amann
f2c2da92c6 add to local.bro, add disclaimer 2014-04-08 11:53:01 -07:00
Bernhard Amann
cb87f834f9 make tls heartbeat messages a bit better. 2014-04-08 11:40:48 -07:00
Bernhard Amann
4d33bdbb1e fix tabs. 2014-04-08 11:28:13 -07:00
Bernhard Amann
c41810a337 polish script and probably detect encrypted attacks too. 2014-04-08 11:19:30 -07:00
Bernhard Amann
335a30b08f detect and alert on simple case of heartbleed 2014-04-08 11:03:12 -07:00
Bernhard Amann
018735a574 default to TLS when not being able to determine version 2014-04-08 09:49:00 -07:00
Bernhard Amann
902d52e261 add is_orig to heartbeat event 2014-04-08 08:43:38 -07:00
Bernhard Amann
ffd4711a41 Throw new event for heartbeat messages. 
Not tested.
 2014-04-08 07:42:12 -07:00
Robin Sommer
6b47350579 Merge remote-tracking branch 'origin/fastpath' 
* origin/fastpath:
  change the sumstats table that tracks recent intermediate requests back to create interval.
 2014-04-03 15:56:33 -07:00
Robin Sommer
36358461ff Updating submodule(s). 
[nomail]
 2014-04-03 15:53:51 -07:00
Robin Sommer
2dcc631da6 Merge remote-tracking branch 'origin/topic/jsiwek/bif-loader-scripts' 
BIT-1175 #merged

* origin/topic/jsiwek/bif-loader-scripts:
  Improve __load__.bro creation for .bif.bro stubs.
 2014-04-03 15:53:46 -07:00
Bernhard Amann
9438bc166b change the sumstats table that tracks recent intermediate requests 
back to create interval.

In this instance a read expiry actually makes much less sense.
 2014-04-03 13:52:26 -07:00
Seth Hall
2f57c26d5b Merge remote-tracking branch 'origin/topic/seth/signatures-uid' 
* origin/topic/seth/signatures-uid:
  Add a uid field to the signatures.log (contributed by Anthony Verez)
 2014-04-03 10:52:54 -04:00
Seth Hall
df1647ee00 Add a uid field to the signatures.log (contributed by Anthony Verez) 
- Addresses BIT-1172
 2014-04-03 10:49:41 -04:00
Vlad Grigorescu
78b5f6b94b BinPAC SSH analyzer basic functionality. 2014-04-02 23:03:24 -04:00
Robin Sommer
2d170edb1e Merge remote-tracking branch 'origin/topic/bernhard/ticket-1163' 
* origin/topic/bernhard/ticket-1163:
  Change #types description of sets to set

BIT-1163 #merged
 2014-04-01 16:50:58 -07:00
Robin Sommer
141865d2ea Merge remote-tracking branch 'origin/topic/jsiwek/coverity' 
* origin/topic/jsiwek/coverity:
  Fix a couple nits reported by Coverity.
  Fix potential mem leak in IP frag reassembly.

BIT-1174 #merged
 2014-04-01 16:43:12 -07:00
Bernhard Amann
01d075bf2d Change #types description of sets to set 
Addresses BIT-1163
 2014-04-01 16:25:47 -07:00
Jon Siwek
e2c71abe9b Improve __load__.bro creation for .bif.bro stubs. 
The new loader scripts should not try to @load .bif.bro scripts that
were part of a build of an earlier Bro version, but have since had their
.bif file removed.
 2014-04-01 14:23:09 -05:00
Jon Siwek
0c82b6aa14 Fix a couple nits reported by Coverity. 
An unnecessary null pointer check and uninitialized scalar fields.
Don't expect these to be actual problems, but easy enough to fix in
order to silence Coverity.
 2014-04-01 11:00:10 -05:00
Jon Siwek
a30caf6960 Fix potential mem leak in IP frag reassembly. 
Reported by Coverity, but it's not a typical code path.
 2014-04-01 10:29:41 -05:00
Robin Sommer
9ec657eeb1 Merge remote-tracking branch 'origin/fastpath' 
* origin/fastpath:
  Fix mem leak and unchecked dynamic cast reported by Coverity.
  fix potential memleak in x509 parser reported by coverity
 2014-03-31 18:56:37 -07:00
Robin Sommer
4f031449b4 Updating submodule(s). 
[nomail]
 2014-03-31 18:09:42 -07:00
Jon Siwek
acc721c36c Fix mem leak and unchecked dynamic cast reported by Coverity. 2014-03-31 16:32:58 -05:00
Bernhard Amann
b2f8196dc2 fix potential memleak in x509 parser reported by coverity 2014-03-31 14:06:34 -07:00
Robin Sommer
a9bbff932b Updating submodule(s). 
[nomail]
 2014-03-31 12:01:16 -07:00
Robin Sommer
559fa595c7 Updating submodule(s). 
[nomail]
 2014-03-31 11:57:53 -07:00
Robin Sommer
8fe5103176 Adding test baseline for scripts.policy.misc.dump-events. 2014-03-30 23:06:20 +02:00
Robin Sommer
f0eb144303 Updating submodule(s). 
[nomail]
 2014-03-30 22:51:26 +02:00
Robin Sommer
9efb549236 Merge remote-tracking branch 'origin/topic/jsiwek/file-signatures' 
* origin/topic/jsiwek/file-signatures:
  File type detection changes and fix https.log {orig,resp}_fuids fields.
  Various minor changes related to file mime type detection.
  Refactor common MIME magic matching code.
  Replace libmagic w/ Bro signatures for file MIME type identification.

Conflicts:
	scripts/base/init-default.bro
	testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
	testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log

BIT-1143 #merged
 2014-03-30 22:51:05 +02:00
Robin Sommer
4fb0288aa2 Updating submodule(s). 
[nomail]
 2014-03-30 22:21:58 +02:00