Commit graph

16 commits

Author SHA1 Message Date
Tim Wojtulewicz
9cb6de7447 Add weird for unknown HTTP/0.9 request method 2023-03-10 15:45:11 -07:00
Tim Wojtulewicz
e27008ef26 GH-1184: Add 'source' field to weird log denoting where the weird was reported 2020-12-01 09:34:37 -07:00
Johanna Amann
3bce313b12 Switch file UID hashing from md5 to highwayhash.
This commit switches UID hashing from md5 to a highway hash. It also
moves the salt value out of the file plugin - and makes it
installation-specific instead - it is moved to the global namespace.

There now are digest hash functions to make "static"
installation-specific hashes that are stable over workers available to
everyone; hashes can be 64, 128 or 256 bits in size.

Due to the fact that we switch the file hashing algorithm, all file
hashes change.

The underlyigng algorithm that is used for hashing is highwayhash-128,
which is significantly faster than md5.
2020-04-30 10:20:09 -07:00
Jon Siwek
2fa74e4bcb Change default value of peer_description "zeek" 2019-06-06 19:49:30 -07:00
Johanna Amann
cdb6a1b6e6 Baseline updates after hash function change. 2016-07-13 10:11:37 -07:00
Johanna Amann
642542ab17 Merge branch 'topic/http-evasion' of https://github.com/0xcc-labs/bro
* 'topic/http-evasion' of https://github.com/0xcc-labs/bro:
  updated weird message and tests
  update of http btest
  detect possible HTTP evasion attempts
2016-03-07 13:09:56 -08:00
wglodek
9ebe7b2a21 updated weird message and tests 2016-03-04 18:03:24 -05:00
wglodek
78c0e2355c update of http btest 2016-02-07 11:26:06 -05:00
Robin Sommer
642ef5d3c1 Tweaking how HTTP requests without URIs are handled.
The change from #49 made it an error to not have a URI. That however
then led requests with an URI yet no version to abort as well.
Instead, we now check if the token following the method is an "HTTP/"
version identifier. If, so accept that the URI is empty (and trigger
a weird) but otherwise keep processing.

Adding test cases for both HTTP requests without URI and without
version.
2016-01-15 12:59:11 -08:00
Robin Sommer
adb3fab019 Updating test baselines for http.log now including version. 2016-01-15 12:18:16 -08:00
Jon Siwek
df60015333 Remove "unmatched_HTTP_reply" weird.
BIT-725 #close
2015-03-20 11:13:50 -05:00
Jon Siwek
22bf3e1196 Increase UIDs to 96 bits w/ C/F prefix - BIT-1016
- The bit-length is adjustable via redef'ing bits_per_uid.

- Prefix 'C' is used for connection UIDS (including IP tunnels) and
  'F' for files.
2013-08-26 15:36:31 -05:00
Robin Sommer
e2d20cb7bc Changing the HTTP parser to accept methods that align with the RFC. 2012-12-07 19:42:03 -08:00
Robin Sommer
57510464a1 Adapting the HTTP request line parsing to only accept methods
consisting of letters [A-Za-z].

I had some bogus HTTP sessions now with the test-suite that reported
data as HTTP because it started with "<!... ". Requiring letters seems
a reasonable constraint.
2012-12-05 16:56:54 -08:00
Robin Sommer
177c014cb7 Merge remote-tracking branch 'vlad/topic/vladg/http-verbs'
* vlad/topic/vladg/http-verbs:
  A test for HTTP methods, including some horribly illegal requests.
  Remove hardcoded HTTP verbs from the analyzer (#741)

I added a "bad_HTTP_request" weird for HTTP request lines that don't
have more than a single word.

Closes #741.
2012-12-05 15:27:42 -08:00
Vlad Grigorescu
318f38df43 A test for HTTP methods, including some horribly illegal requests. 2012-11-30 22:06:54 -05:00