Commit graph

7932 commits

Author SHA1 Message Date
Jon Siwek
81a8961f16 BIT-1858: fix logged-names for DNS RR types 44 and 45 2018-08-16 14:13:31 -05:00
Jon Siwek
15dc5d1dda BIT-1850: add missing DCE/RPC PDU type enum values 2018-08-16 14:09:03 -05:00
Jon Siwek
da9f91fc19 Add env. variables to override Broker listen/connect retry intervals
And use them to default retries to 1sec for all unit tests.
2018-08-16 12:16:03 -05:00
Jon Siwek
05b10fe2e7 BIT-1544: allow NULs in file analysis handles 2018-08-15 18:03:02 -05:00
Jon Siwek
f336c8c710 Fix seg fault on trying to type-cast invalid/nil Broker::Data
This situation now throws a runtime expression exception instead of
crashing on null pointer access.
2018-08-15 11:02:52 -05:00
Jon Siwek
0e6913fba0 BIT-1798: fix PPTP GRE tunnel decapsulation 2018-08-14 16:48:04 -05:00
Jon Siwek
5821c16490 Fix SumStats::observe key normalization logic
The loop over Reducers in SumStats::observe performs a key normalization
and inadvertently modifies the key used for subsequent iterations.

Reported by Jim Mellander.
2018-08-13 17:53:26 -05:00
Jon Siwek
2d47586473 Merge remote-tracking branch 'origin/topic/johanna/config-framework-fixes'
* origin/topic/johanna/config-framework-fixes:
  Fix test that fails now that options are automatically redefable.
  Make options redef-able by default.
  Ascii formatter: do not complain about port text.
  Make parsing of booleans a little bit more lenient.
2018-08-13 10:54:39 -05:00
Jon Siwek
4e3db97379 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Improve the travis-job script to work outside of Travis
2018-08-13 10:25:05 -05:00
Jon Siwek
a2f8d81fb6 Fix validate-certs.bro comments 2018-08-13 10:20:58 -05:00
Jon Siwek
67524f26d5 Immediately apply broker subscriptions made during bro_init()
Otherwise that's begging for unit test failures due to races
2018-08-10 17:18:21 -05:00
Jon Siwek
083947af41 Update default broker threading configuration
Now defaults to a max of 4 threads typically indepedent of core
count (previously could go up to a hard cap of 8).  Also now allow
controlling this setting via BRO_BROKER_MAX_THREADS environment
variable.
2018-08-10 17:08:26 -05:00
Jon Siwek
9f12b56105 Misc. unit test improvements 2018-08-10 16:58:27 -05:00
Johanna Amann
7b44a64994 Fix test that fails now that options are automatically redefable. 2018-08-10 14:28:17 -07:00
Johanna Amann
c34fbee0d1 Make options redef-able by default. 2018-08-10 11:53:36 -07:00
Johanna Amann
26ea1999ec Ascii formatter: do not complain about port text.
The ascii formatter already was happy to read ports in the form
"42/tcp"; however it emitted a warning message for each line.

This patch fixes this and adds a bit more testing for the existing
behavior.
2018-08-10 11:29:35 -07:00
Johanna Amann
116079a9ad Make parsing of booleans a little bit more lenient.
This makes the input framework (and everything else that uses the Ascii
parser) accept 0 and 1 as valid values for booleans.
2018-08-10 10:03:22 -07:00
Daniel Thayer
5d3ef4daf4 Improve the travis-job script to work outside of Travis
Improved the travis-job test script so that it works outside of Travis.
This can be useful to test changes to the docker container config before
pushing to master, for testing changes on a branch, or for debugging
some problem with the tests running on Travis.  This required the
following changes:
-The script no longer requires the TRAVIS env. variable to be set.
-Added an "all" command as a more convenient way to run all steps in a
 build.
-Added a "coverity" command-line option to do a coverity build.
-Before building Bro or downloading coverity tools, do a cleanup from any
 previous build.

Also other minor improvements (code comments, reorganization, etc.).
2018-08-09 14:00:55 -05:00
Johanna Amann
ff22230a73 Update submodule
[nomail]
2018-08-08 13:25:06 -07:00
Johanna Amann
7b12fd8c4a Updating submodule(s).
[nomail]
2018-08-08 13:18:10 -07:00
Johanna Amann
c95985f472 Merge branch 'master' of https://github.com/chungmin99/bro
* 'master' of https://github.com/chungmin99/bro:
  Renamed verify-run to verify_run
  Minor edits due to typo and field changes
  Added coverage to .PHONY in Makefile due to testing/coverage
  Fixing up `make html` target
  Refactoring, making error messages nicer, & lcov
  Add code coverage for bro source files after btest test suite
2018-08-08 13:11:20 -07:00
Jon Siwek
2c9dbdd055 Fix cluster layout graphic and doc warnings 2018-08-08 13:03:45 -05:00
Johanna Amann
07043d6dd8 Merge branch 'topic/zhongjie/fix-sig' of https://github.com/bro/bro
* 'topic/zhongjie/fix-sig' of https://github.com/bro/bro:
  Added missing tcp-state for signature dpd_rfb_server
2018-08-08 09:34:51 -07:00
Jon Siwek
df2e2672d9 Updating submodule(s).
[nomail]
2018-08-08 09:43:46 -05:00
Jon Siwek
7126616707 Fix an "uninitialized" compiler warning
Though it is actually initialized on all non-aborting code paths.
2018-08-06 17:10:18 -05:00
Jon Siwek
e6042940dc Fix (non)suppression of proxy-bound events in known-*.bro scripts
When not using data stores, these scripts were intended to suppress
sending duplicate events to proxies by looking up the key in the local
cache.
2018-08-06 17:04:42 -05:00
Jon Siwek
29359ffff2 Updating submodule(s).
[nomail]
2018-08-06 16:36:10 -05:00
Jon Siwek
02900c9401 Updating submodule(s).
[nomail]
2018-08-06 16:15:47 -05:00
Jon Siwek
599af26496 Merge remote-tracking branch 'origin/topic/vern/vec-append'
* origin/topic/vern/vec-append:
  d'oh, still have a (deprecated) string_array rather than string_vector
  forgot to update test suite results for v += e
  reap the fruits of v += e
  test case for v += e
  documentation of v += e
  v += e implemented

Fixed a mistake in find_ip_addresses()
2018-08-03 11:38:40 -05:00
Daniel Thayer
29c179c30d Improve a travis output message in pull request builds
The output message is now more explicit and doesn't look like an
error message.
2018-08-02 16:13:42 -05:00
Daniel Thayer
8c8b55cd18 Use default version of OpenSSL on all travis docker containers 2018-08-02 15:44:47 -05:00
Jon Siwek
06c6e1188a Merge remote-tracking branch 'origin/topic/vern/set-ops2'
* origin/topic/vern/set-ops2:
  documentation, test suite update
  implemented set relationals
  bug fix for set intersection
  set intersection implemented
  mirroring previous topic/vern/set-ops to get branch up to date, since I'm a n00b

Fixed a couple memory leaks and added a leak test
2018-08-02 10:43:41 -05:00
Jon Siwek
5804c940f1 Merge remote-tracking branch 'origin/topic/vern/perf-history'
* origin/topic/vern/perf-history:
  only generate history threshold events for > 1 instance mention those events in NEWS
  a different sort of history update
  'W' for zero window implemented; logarithmic 'T'/'C'/'W' history repetitions

I reverted a change that made TCP window tracking unconditional (possibly
accepting out-of-order packets) until further verification of test suite
changes.
2018-08-01 16:37:10 -05:00
Jon Siwek
a4dbc5b310 Merge branch 'fix-ntlm-negotiate-flags' of https://github.com/jbencteux/bro
* 'fix-ntlm-negotiate-flags' of https://github.com/jbencteux/bro:
  fix NTLM NegotiateFlags field offsets
2018-08-01 12:16:19 -05:00
Jon Siwek
08a1480fd9 Fix --with-binpac configure option 2018-08-01 11:26:04 -05:00
Jon Siwek
4243a5d5b0 Update CAF-finding logic 2018-08-01 11:21:24 -05:00
Jon Siwek
509efc58db Updating submodule(s).
[nomail]
2018-07-31 17:15:34 -05:00
Jon Siwek
46bf6731e7 Merge branch 'topic/feature/upstream/cfp' of https://github.com/corelight/bro
* 'topic/feature/upstream/cfp' of https://github.com/corelight/bro:
  Add Cisco FabricPath support
2018-07-31 16:51:41 -05:00
Jon Siwek
a71d84c968 Merge branch 'topic/feature/upstream/geoip' of https://github.com/corelight/bro
* 'topic/feature/upstream/geoip' of https://github.com/corelight/bro:
  Replace GeoIP Legacy DB support with MaxMind DB support
2018-07-31 16:50:15 -05:00
Chung Min Kim
9edd380262 Renamed verify-run to verify_run 2018-07-31 13:28:21 -07:00
Johanna Amann
38296842be Update submodule[s]
nomail
2018-07-31 13:13:10 +02:00
Johanna Amann
a251b32d85 Merge remote-tracking branch 'origin/topic/jsiwek/openssl-1.1'
* origin/topic/jsiwek/openssl-1.1:
  Update install instructions for OpenSSL 1.1 compat
  Remove requestorName parameter of ocsp_request event
  Adjust x509 unit tests to work around OpenSSL 1.0 vs. 1.1 differences
  Fixes for OpenSSL 1.1 support
2018-07-31 13:13:06 +02:00
Jonathan Perkins
1ae7d3b349 Replace GeoIP Legacy DB support with MaxMind DB support
This updates the "lookup_location" and "lookup_asn" BIFs to use
libmaxminddb.  The motivation for this is that MaxMind is discontinuing
GeoLite Legacy databases: no updates after April 1, 2018, no downloads
after January 2, 2019.  It's also noted that all GeoIP Legacy databases
may be discontinued as they are superseded by GeoIP2.
2018-07-30 16:04:58 -05:00
Chung Min Kim
e11cc8778f Minor edits due to typo and field changes 2018-07-30 13:34:53 -07:00
Chung Min Kim
c4cb27b12f Added coverage to .PHONY in Makefile due to testing/coverage 2018-07-30 12:17:40 -07:00
Chung Min Kim
a8e65d908e Fixing up make html target
Add types of files that genhtml (the program that generates html files
from .gcno/.gcda files, included in lcov) should ignore, such as .yy and
.ll files.
2018-07-30 12:11:18 -07:00
Damani Wade
3710ff936f Add Cisco FabricPath support 2018-07-27 16:00:54 -05:00
Vern Paxson
f7358a3351 d'oh, still have a (deprecated) string_array rather than string_vector 2018-07-26 14:35:57 -07:00
Vern Paxson
2375c0c4be forgot to update test suite results for v += e 2018-07-26 14:35:30 -07:00
Vern Paxson
88fd7510c6 reap the fruits of v += e 2018-07-26 12:51:36 -07:00