Commit graph

7741 commits

Author SHA1 Message Date
Seth Hall
3131952762 Cleaned up and moved parsing to binpac.
Too much parsing was being done in C++ so I moved more of
it into binpac.  Also, fixed up a bunch of the whitespace
(the new code was indented with spaces).
2018-04-03 01:56:34 -04:00
Seth Hall
5b07bbe0a5 Merge branch 'gssapi-krb-fix' of https://github.com/jrolli/bro into jrolli-gssapi-krb-fix 2018-04-02 22:28:11 -04:00
Seth Hall
95fbe150df Improving the new SMB2 create command test.
It's now a less fragile test than it was.
2018-04-02 22:25:51 -04:00
Seth Hall
3a3ac27d20 Merge branch 'jwallior-smb_changes'
Addresses pull request #122
2018-04-02 17:45:18 -04:00
Seth Hall
68d0085d35 Merge branch 'smb_changes' of https://github.com/jwallior/bro into jwallior-smb_changes 2018-04-02 17:06:30 -04:00
Robin Sommer
f710d9a199 Updating submodule(s).
[nomail]
2018-03-29 14:11:56 -07:00
Robin Sommer
aec449cccc Merge remote-tracking branch 'origin/topic/johanna/cleanup'
Good stuff!

Closes BIT-1915

* origin/topic/johanna/cleanup:
  Mark one-parameter constructors as explicit & use override where possible
  Remove unimplemented & unused functions from header files.
  Make data flow more explicit for complilers.
2018-03-29 13:43:01 -07:00
Robin Sommer
bb34477b91 Merge remote-tracking branch 'origin/topic/johanna/tls13-version'
Closes BIT-1916.

* origin/topic/johanna/tls13-version:
  Recognize TLS 1.3 negotiation correctly.
2018-03-29 13:00:46 -07:00
Johanna Amann
f39efd0317 Recognize TLS 1.3 negotiation correctly.
The way in which TLS 1.3 is negotiated was changed slightly in later
revisions of the standard. The final version is only sent in an
extension - while the version field in the server hello still shows TLS
1.2.

This patch makes ssl.log show the correct version again.
2018-03-27 14:58:06 -07:00
Vladimir Ruzanov
5145b5cb4e Fix NETBIOSSSN analyzer name 2018-03-27 23:32:06 +03:00
Johanna Amann
6d612ced3d Mark one-parameter constructors as explicit & use override where possible
This commit marks (hopefully) ever one-parameter constructor as explicit.

It also uses override in (hopefully) all circumstances where a virtual
method is overridden.

There are a very few other minor changes - most of them were necessary
to get everything to compile (like one additional constructor). In one
case I changed an implicit operation to an explicit string conversion -
I think the automatically chosen conversion was much more convoluted.

This took longer than I want to admit but not as long as I feared :)
2018-03-27 07:17:32 -07:00
Johanna Amann
961f0dfb25 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix the travis-job script to always run external tests
2018-03-25 09:43:29 -07:00
Philippe Antoine
ecf2788740 Better reporter for Brostring with embedded NUL
Can be reproduced with something like
curl 127.0.0.1:8002/readme.html%00lol
2018-03-23 10:10:01 +01:00
Daniel Thayer
aadcd5d2cc Fix the travis-job script to always run external tests
Run the external tests even when the Bro tests fail.
2018-03-22 19:36:40 -05:00
Robin Sommer
9271b2032d Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci-updates'
I've moved .travis.job to testing/scripts/travis-job and adapted
.travis.yml accordingly.

* origin/topic/dnthayer/travis-ci-updates:
  Fix information leak in the update-traces script
  Add coverity scan and private testing to Travis CI
2018-03-22 14:26:21 -07:00
Robin Sommer
288fcd0039 Merge remote-tracking branch 'origin/topic/seth/smb-mapping-memleak-fix'
Closes BIT-1911.

* origin/topic/seth/smb-mapping-memleak-fix:
  Fix a memory leak in SMBv1 share mapping
2018-03-21 13:57:26 -07:00
Seth Hall
551f57ea97 Fix a memory leak in SMBv1 share mapping 2018-03-21 16:29:59 -04:00
Daniel Thayer
3584495562 Fix information leak in the update-traces script
For trace files that require authentication to download, hide
part of the URL in output messages.  This avoids leaking potentially
sensitive info when running tests using a continuous integration
service.
2018-03-21 15:24:29 -05:00
Daniel Thayer
9ee739421b Add coverity scan and private testing to Travis CI 2018-03-21 14:10:54 -05:00
Johanna Amann
1f2bf50b49 Remove unimplemented & unused functions from header files.
All of these functions were defined in header files without ever being
implemented or used.
2018-03-16 18:38:04 -07:00
Johanna Amann
911018347f Make data flow more explicit for complilers.
gcc likes complaining about ev potentially not being initialized. Make
it clear that this cannot happen by marking the default case as
unreachable after the error output.
2018-03-16 14:36:13 -07:00
Daniel Thayer
8fe998c5f7 Fix one new minor typo in the config framework docs 2018-03-15 18:52:08 -05:00
Robin Sommer
77bc5da6f9 Updating submodule(s).
[nomail]
2018-03-15 15:00:34 -07:00
Robin Sommer
78f4ed690d Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci-changes'
* origin/topic/dnthayer/travis-ci-changes:
  Configure Travis CI email recipients and build branches
2018-03-15 14:59:34 -07:00
Robin Sommer
31a48bf4ad Merge remote-tracking branch 'origin/topic/dnthayer/ticket1905'
Includes slight editing of the new text.

Closes BIT-1905.

* origin/topic/dnthayer/ticket1905:
  Add documentation of the configuration framework
  Add documentation of "option" declarations
  Improve config framework documentation comments
  Fix minor typos and doc build warnings in NEWS
2018-03-15 14:54:43 -07:00
Daniel Thayer
8aeedba066 Add documentation of the configuration framework 2018-03-15 14:50:42 -05:00
Daniel Thayer
79afd99229 Add documentation of "option" declarations 2018-03-15 14:29:26 -05:00
Daniel Thayer
f3e42874b8 Improve config framework documentation comments
Fixed typos and formatting.
2018-03-15 14:16:00 -05:00
Daniel Thayer
c759583d11 Fix minor typos and doc build warnings in NEWS 2018-03-15 14:13:54 -05:00
Jon Siwek
54aa7d1911 Updating submodule(s).
[nomail]
2018-03-07 13:54:53 -06:00
Jon Siwek
57fa8f2708 Update a doc test/baseline 2018-03-07 12:48:08 -06:00
Seth Hall
e76b56ce53 Rework to the DHCP analyzer.
Highlights:
 - Reduced all DHCP events into a single dhcp_message event. (removed legacy events since they weren't widely used anyway)
 - Support many more DHCP options.
 - DHCP log is completely reworked and now represents DHCP sessions
   based on the transaction ID (and works on clusters).
 - Removed the known-devices-and-hostnames script since it's generally
   less relevant now with the updated log.
2018-03-01 08:36:32 -08:00
Daniel Thayer
1d3a0e26e4 Configure Travis CI email recipients and build branches 2018-02-22 14:59:04 -06:00
Johanna Amann
01a96239e1 Add removed root certificate back to test that requires it.
Test has a trace that contains a WoSign certificate - they are no longer
recognized by pretty much anyone.
2018-02-20 09:02:55 -08:00
Jon Siwek
c54b607de1 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix another warning when building the documentation
  Fix a warning when building documentation
  Fix the config framework several-files.bro test
2018-02-18 17:37:34 -06:00
Johanna Amann
8ea7de9380 Update Mozilla CA list to state of NSS 3.35. 2018-02-16 10:53:51 -08:00
Johanna Amann
981c889352 Update list of Certificate Transparency logs. 2018-02-16 10:44:29 -08:00
Johanna Amann
9bc42385f3 Update submodule
[nomail]
2018-02-16 09:02:21 -08:00
Daniel Thayer
45cc4d0e2f Fix another warning when building the documentation 2018-02-14 18:43:34 -06:00
Daniel Thayer
d0c29e81e1 Fix a warning when building documentation 2018-02-14 17:01:04 -06:00
Johanna Amann
94b422c88d Updating CHANGES and VERSION. 2018-02-14 10:01:17 -08:00
Johanna Amann
1aa9578021 Update submodule
[nomail]
2018-02-14 08:49:27 -08:00
Daniel Thayer
873049ce12 Fix the config framework several-files.bro test
The test script needs to wait until the Input::end_of_data event has
been raised for each of the config input files.
2018-02-12 15:05:38 -06:00
Jon Siwek
85b5c6ffbd Fix pessimizing-move compiler warning.
Returning via move() should never be needed and may result in a compiler
warning: "moving a local object in a return statement prevents copy
elision".
2018-02-12 11:13:04 -06:00
Jon Siwek
6766f52cdd Add limit to number of auth flavors parsed out of MNT replies 2018-02-12 11:01:25 -06:00
Xiaogrill
cbe585dd87 Treat LibreSSL as an older OpenSSL 2018-02-11 09:07:22 -08:00
Robin Sommer
0e83bd3193 Fixing unstable test. 2018-02-07 14:21:25 -08:00
Robin Sommer
fff4db5145 Merge remote-tracking branch 'origin/topic/johanna/config'
Closes BIT-1900.

* origin/topic/johanna/config:
  Use port_mgr->Get() in the input framework config changes.
  Allow the empty field separator to be empty; use in config framework.
  Fix small bug in config reader.
  Fix segmentation fault when parsing sets containing invalid elements.
  Add config framework.
2018-02-07 14:10:48 -08:00
Robin Sommer
c0aab7cf15 Fix compile.
One final change hadn't made it in.
2018-02-06 17:05:09 -08:00
Robin Sommer
ae51f72de0 Updating NEWS. 2018-02-06 08:54:54 -08:00