Commit graph

7390 commits

Author SHA1 Message Date
Johanna Amann
ec0ffc5452 Update submodule
[nomail]
2016-08-22 15:41:46 -07:00
Johanna Amann
1f2dc28bf7 Update submodule
[nomail]
2016-08-19 07:58:46 -07:00
Johanna Amann
2e5e811a9c Merge branch 'patch-2' of https://github.com/moshekaplan/bro
* 'patch-2' of https://github.com/moshekaplan/bro:
  Update events.bif

This slightly clarifies the explanation of the mime_entity_data event.
2016-08-19 07:52:35 -07:00
Johanna Amann
46b67b92ee Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Update NEWS
2016-08-19 07:38:33 -07:00
Johanna Amann
077a5cbda8 Remove old ack_above_hole event from scripts.
Fixes BIT-1673
2016-08-19 07:26:34 -07:00
Daniel Thayer
e8bfa49f69 Update NEWS
Corrected some typos, fixed some reST formatting, and added some more
useful info.
2016-08-19 00:46:49 -05:00
Moshe Kaplan
c5b82cb9b4 Update events.bif 2016-08-18 12:43:20 -04:00
Johanna Amann
058e378ced Update local-compat test for 2.5 2016-08-17 10:38:18 -07:00
Johanna Amann
fbddd0b554 Updating CHANGES and VERSION. 2016-08-17 09:28:34 -07:00
Johanna Amann
4238f67900 Update submodules
[nomail]
2016-08-17 09:25:49 -07:00
Johanna Amann
04fa937129 And update one last test baseline 2016-08-17 09:19:44 -07:00
Johanna Amann
55f99c0da9 Fix sphinx build errors 2016-08-17 09:16:16 -07:00
Justin Azoff
f9b3f739e4 Move lookup_addr when statement
Move the when statement to a function so that the connection record is
not in scope. Cloning a connection record is an expensive operation and
this avoids it and this avoids it.
2016-08-17 10:41:41 -04:00
Seth Hall
eebd896f63 Change failure in utf16_bytestring_to_utf8_val to be a conn weird.
Whenever we saw errors in UTF16->UTF8 conversion before, we would
get a reporter message with no connection information.  Now we
get a weird attached to a connection so that debugging these
problems will hopefully be a bit easier in the future.
2016-08-17 00:57:49 -04:00
Johanna Amann
cf548e9302 Fix test failure caused by uninitialized memory. 2016-08-16 17:05:18 -07:00
Johanna Amann
fd54892da3 SMB: fix rounding error due to value truncation when converting timestamps. 2016-08-16 16:02:44 -07:00
Johanna Amann
ff114709db Merge remote-tracking branch 'origin/topic/jazoff/bit-1649'
* origin/topic/jazoff/bit-1649:
  Track outstanding_global_views updates by uid
  Also track recent_global_view_keys on manager

BIT-1649 #merged
2016-08-16 12:11:09 -07:00
Johanna Amann
5d8da0b182 Address coverity errors. 2016-08-16 11:16:50 -07:00
Johanna Amann
e3e3fdfb9d Merge remote-tracking branch 'origin/bro-config'
* origin/bro-config:
  Add 'bro-config' script.

BIT-1669 #merged
2016-08-15 17:05:25 -07:00
Johanna Amann
ed3447acaa Fix one more format error found by gcc 5.3.1 2016-08-15 16:54:22 -07:00
Johanna Amann
0d706bcccd add certificate to external list for debian 8.
The OpenSSL on debian 8 refuses to validate one connection; everyone
else can. The easiest fix is to add the CA certificate to the root list.
Once debian has a newer version of OpenSSL, we should be able to remove
it again.
2016-08-15 16:47:44 -07:00
Johanna Amann
a467f593de KRB: fix field value missing error for msg$client_name.
Reported by giesiger on IRC.
2016-08-15 16:05:10 -07:00
Johanna Amann
bfdce4d419 Add argument checking to a few more printf-style calls. 2016-08-15 15:34:27 -07:00
Johanna Amann
697b68ab01 One more small serialization format fix to make gcc 4.9 happy. 2016-08-15 15:20:14 -07:00
Jon Siwek
c29cd54618 Add 'bro-config' script. 2016-08-15 14:45:29 -05:00
Seth Hall
5c0d8c649a Tiny SMB cleanup.
Pipe handling is done by derived fields and there was a left
over check in the event generating event.
2016-08-15 11:15:51 -04:00
Seth Hall
c06dca3565 Fixes for NTLM.
- Attempted fix for some NTLM handling fixes that were leading
   to DPD errors.
 - Added some status codes to the list of auth failure status codes.
2016-08-14 01:31:07 -04:00
Johanna Amann
a2c8f8a9b6 More format specifier cleanup 2016-08-12 15:54:39 -07:00
Johanna Amann
c464cf78dd Fix a number of format errors when using debug macros. 2016-08-12 15:42:02 -07:00
Johanna Amann
1889f409e9 Change timings of intel expire-item test.
Seems to be stable on slow systems with this.
2016-08-12 13:10:04 -07:00
Johanna Amann
33c85895b8 Make netcontrol cluster test stable.
It now consistently works for me.
2016-08-12 11:39:34 -07:00
Robin Sommer
8b7e8ecf15 Adding missing baseline update. 2016-08-12 08:21:26 -07:00
Robin Sommer
83ff3f8cdc Attempt to make test more stable. 2016-08-12 08:19:51 -07:00
Johanna Amann
b11d9b5ccd Add missing include directive. 2016-08-12 06:54:53 -07:00
Johanna Amann
fb3bc05df5 Merge remote-tracking branch 'origin/topic/johanna/component-initialization-order'
* origin/topic/johanna/component-initialization-order:
  Make tags generated during component initialization stable.
2016-08-11 21:50:53 -07:00
Johanna Amann
65d977f278 Make tags generated during component initialization stable.
The order in which the plugin initializers are executed is compiler
dependent. With this change, Tags will always be generated in
alphabetical ordering, not in compiler-dependent order.
2016-08-11 19:48:53 -07:00
Johanna Amann
2756dfe581 Make x509 intel seen script robust against file analyzer ordering.
Now it consistently works, even if the SHA1 file analyzer gets the data
before the X509 file analyzer.
2016-08-11 16:12:08 -07:00
Johanna Amann
19057c663f Input: DisableFrontend was not called upon Init failure.
This was introduced in 5b73345b73 due to a
chance how disable messages are handled.
2016-08-11 12:44:39 -07:00
Seth Hall
c9666086e4 DCE_RPC code simplification attempting to address a crash. 2016-08-11 14:05:50 -04:00
Johanna Amann
abbb01edb9 Update submodules
[nomail]
2016-08-11 07:58:17 -07:00
Johanna Amann
0e44b91cd9 Merge remote-tracking branch 'origin/topic/seth/log-framework-ext'
* origin/topic/seth/log-framework-ext:
  Log extensions: series of small fixes and new tests.
  Change the function for log extension to take a path only and update tests.
  Final changes to log framework ext code.
  Add logging framework metadata mechanism.
  Add unrolling separator & field name map to logging framework.
2016-08-11 07:47:13 -07:00
Johanna Amann
5ec2108bc7 Make invalidtext.bro test stable. 2016-08-10 18:28:38 -07:00
Johanna Amann
e7611e8521 Fix memory leak in EnumType.
Introduced in ca3f7eadbe.

This took a while to find.
2016-08-10 18:12:26 -07:00
Johanna Amann
6e769db23b Log extensions: series of small fixes and new tests.
The extensions now work with optional types, as well with complex types
(like subrecords). Not returning a record in the ext_func no longer
crashes bro.

The default_ext_func was switched to return void in
cases where no extension revord is defined (was bool).

I also got rid of the offsets in the indices - with the rest of the
implementation, that was not really necessary and made the code more
complex.
2016-08-10 14:14:03 -07:00
Seth Hall
79e49e1ab5 Change the function for log extension to take a path only and update tests.
We were having stack overflow issues creep in with the self-referential
field for the log extension function.
2016-08-10 13:53:27 -04:00
Johanna Amann
a3b7c91ba4 Fix configure warning when compiling with --enable-broker
We do no longer need to define BROKER_PYTHON_HOME, because as of
5bae0ee6f202038ad6ed74c1c2fdf1c07c81, broker uses PY_MOD_INSTALL_DIR as
the install location, which is already set.

Please note that this means that now the broker python bindings will be
installed to /lib/broctl instead of /lib/python.

Addresses BIT-1667
2016-08-10 10:21:55 -07:00
Johanna Amann
f9f948f617 Add netcontrol-connectors to aux 2016-08-10 10:16:10 -07:00
Seth Hall
5f6565d62c Final changes to log framework ext code.
The "metadata" functionality has been renamed to "ext" to
represent that the logs are being extended.  The function that
returns the record which is used to extend the log now receives
a log filter as it's single argument.

The field name "unrolling" is now renamed to "scope" so the variables
names now look like this: "Log::default_scope_sep"
2016-08-10 12:43:32 -04:00
Johanna Amann
fa4806d375 Update Mozilla CA list.
We now use the list from NSS 3.26
2016-08-10 09:21:46 -07:00
Johanna Amann
ba825e8910 update scripts loaded by default in local.bro.
We now load stats and capture-loss by default. Traceroute is disabled by
default because it can cause a lot of message load.
2016-08-10 08:57:22 -07:00