Commit graph

11634 commits

Author SHA1 Message Date
Brittany Donowho
97c8912443 Fixed stats.zeek to log all data before zeek terminates rather than return too soon 2020-04-29 17:37:29 -04:00
Jon Siwek
fddb06c3cd Update submodule(s)
[nomail]
2020-04-29 14:25:53 -07:00
Seth Hall
43661a2b0b Adds a note in NEWS about the signature addition and restructuring 2020-04-29 11:34:00 -04:00
Seth Hall
dac96a6be3 Fixes a small bug in one signature with a duplicate name.
Also update a single failing test.
2020-04-29 11:22:42 -04:00
Seth Hall
15d43dfbcd Organized and added to the shipped file identification signatures.
- Added ISO 9660 disk image
 - Created new files for categorizing signatures better.
   - executable.sig - Executable (and bytecode) files.
   - java.sig - Java related files (class/jar, etc).
   - programming.sig - Mostly scripting language identification
2020-04-29 11:08:32 -04:00
Jan Grashoefer
bcf2357632 Improve network_time_init() test and add baseline. 2020-04-29 13:53:30 +02:00
Jan Grashoefer
97d1acf86f Add network_time_init() event. 2020-04-29 13:19:57 +02:00
Jan Grashoefer
c99f825e22 Add test for network_time behavior. 2020-04-29 13:18:49 +02:00
Jon Siwek
2107c3e0b7 Extend CI config to cover building with libmaxminddb support 2020-04-28 17:37:31 -07:00
Jon Siwek
d533212a6a Merge branch 'master' into topic/jsiwek/fuzzing 2020-04-28 17:25:32 -07:00
Jon Siwek
4a76229209 GH-941: Fix build when configured to use libmaxminddb 2020-04-28 17:12:51 -07:00
Jon Siwek
db5248ad85 Test fuzzers against seed corpus under CI ASan build 2020-04-28 16:17:39 -07:00
Jon Siwek
f1d21fa489 Update fuzzing README with OSS-Fuzz integration notes 2020-04-28 14:32:37 -07:00
Robin Sommer
f7fd24cf15 Updating submodule. 2020-04-28 10:07:31 +00:00
Jon Siwek
8ec807bd76 Link fuzzers against shared library to reduce executable sizes 2020-04-27 20:04:33 -07:00
Jon Siwek
2922bf71b6 Improve FuzzBuffer chunking
Now allocates a new buffer for each chunk to better detect over-reads
2020-04-27 16:33:05 -07:00
Jon Siwek
8e6539b55f Fix compiler warning in standalone fuzzer driver 2020-04-27 15:53:40 -07:00
Jon Siwek
0623539d80 Adjust minor fuzzing documentation 2020-04-27 15:53:32 -07:00
Jon Siwek
91eff92335 Exit immediately after running unit tests 2020-04-27 15:26:44 -07:00
Jon Siwek
034b4b5ea7 Merge remote-tracking branch 'origin/topic/timw/intrusiveptr-warnings'
* origin/topic/timw/intrusiveptr-warnings:
  Fix a few more IntrusivePtr deprecation warnings
2020-04-27 13:38:45 -07:00
Jon Siwek
b776f17cea Merge remote-tracking branch 'origin/topic/vern/any-typetype-when-fix'
- Minor whitespace adjutment in merge

* origin/topic/vern/any-typetype-when-fix:
  bug fixes for using "when" in functions that have a local of type "any"
2020-04-27 13:33:40 -07:00
Tim Wojtulewicz
07a1821bcc Fix a few more IntrusivePtr deprecation warnings 2020-04-27 12:59:19 -07:00
Johanna Amann
faa8a38578 Merge remote-tracking branch 'origin/topic/jsiwek/gh-854-preserve-header-name'
* origin/topic/jsiwek/gh-854-preserve-header-name:
  GH-854: provide access to original HTTP/MIME header names
2020-04-27 19:31:49 +00:00
Johanna Amann
0136648342 Merge remote-tracking branch 'origin/topic/jsiwek/empty-bloomfilter-lookup'
* origin/topic/jsiwek/empty-bloomfilter-lookup:
  Remove error message from empty bloomfilter lookups
2020-04-27 19:23:16 +00:00
Johanna Amann
bb2f328cff Merge remote-tracking branch 'origin/topic/vern/unused'
* origin/topic/vern/unused:
  unused variables found via use-def analysis (plus an indentation micro-nit)
2020-04-27 19:21:33 +00:00
Tim Wojtulewicz
13674e7c31 Merge remote-tracking branch 'origin/topic/jsiwek/bif-return-intrusive'
* origin/topic/jsiwek/bif-return-intrusive:
  Update various BIFs to return IntrusivePtr
2020-04-27 12:09:58 -07:00
Jon Siwek
9e56881c70 Update various BIFs to return IntrusivePtr 2020-04-27 11:50:35 -07:00
Vern Paxson
fe46ef06a0 unused variables found via use-def analysis (plus an indentation micro-nit) 2020-04-25 18:06:47 -07:00
Vern Paxson
b86d5b4424 bug fixes for using "when" in functions that have a local of type "any" 2020-04-25 16:56:24 -07:00
Johanna Amann
360c06a3f8 Start refactoring hashing.
This commit moves some of the hash datastructures and code from
util.cc into Hash.cc - where it seems more appropriate.

It also starts to make more Keyed hash functions available - still
using siphash as the default 64 bit keyed hash, but also making
128 and 256 bit highway hashes available.

There already are a few other functions that are defined but not
yet implemented - these will be "static" keyed hashes - which use
an installation specific key. These will be used to, e.g., get
rid of md5 hashing for the generation of file UIDs.
2020-04-24 18:27:09 -07:00
Jon Siwek
98845e89aa Add OSS-Fuzz Zeek script search path to fuzzers 2020-04-24 17:53:52 -07:00
Johanna Amann
d34532f847 Introduce calculate_digest convenience function
This function just calculates the chosen digest and returns the result
in either the passed buffer, or in a static buffer. Basically a superset
to the surprisingly popular internal_md5.
2020-04-24 17:00:10 -07:00
Tim Wojtulewicz
17f72d6be6 Update submodule
[nomail]
2020-04-24 16:22:33 -07:00
Tim Wojtulewicz
cb40dbd58b Merge remote-tracking branch 'origin/topic/jsiwek/intrusive-ptr-chipping'
* origin/topic/jsiwek/intrusive-ptr-chipping:
  Deprecate returning Val* from BIFs
  Deprecate binpac::string_to_val
  Deprecate binpac::bytestring_to_val, replace with binpac::to_stringval
  Update deprecated BifEvent::generate_* usages
  Deprecate Connection::Event and Analyzer::Event methods
  Deprecate BuildConnVal() methods and update usages to ConnVal()
  Update all BIFs to return IntrusivePtr instead of Val*
  Update deprecated ValManager::GetPort usages
  Update deprecated ValManager::GetEmptyString usages
  Update deprecated ValManager::GetCount usages
  Update deprecated ValManager::GetInt usages
  Update deprecated ValManager::GetBool usages
  Update deprecated ValManager GetTrue/GetFalse usages
  Deprecate all ValManager "Get" methods
  Change BIFs to return a wrapper object
2020-04-24 16:20:08 -07:00
Jon Siwek
a4244bc72b Assume libFuzzer when LIB_FUZZING_ENGINE file doesn't exist
i.e. environment variable may be set, but not point to existing file
2020-04-24 14:51:32 -07:00
Jon Siwek
2ef182076e Change handling of LIB_FUZZING_ENGINE
Should better support OSS-Fuzz, which may set it to either
be path to library to link against or linker flag like
"-fsanitize=fuzzer"
2020-04-24 14:43:14 -07:00
Johanna Amann
5e7915ae7a Remove the siphash->hmac-md5 switch after 36 bytes.
Currently, siphash is used for strings up to 36 bytes. hmac-md5 is used
for longer strings.

This switch-over is a remnant of the previous hash-function that was
used, which apparently was slower with longer input strings.

This change serves no purpose anymore. I performed a few performance tests
on strings of varying sizes:

For a 40 byte string with 10 million iterations:

siphash: 0.31 seconds
hmac-md5: 3.8 seconds

For a 1080 byte string with 10 million iterations:

siphash: 4.2 seconds
hmac-md5: 17 seconds

For a 18360 byte string with 10 million iterations:

siphash: 69 seconds
hmac-md5: 240 seconds

Hence, this commit removes the use of hmac-md5.

This change causes reordering of lines in a few logs.

This commit also changes the datastructure for the seed in probabilistic/Hasher
to get rid of a type-punning warning.
2020-04-24 13:14:29 -07:00
Johanna Amann
bb050910bb Fix plugin compile problems with highwayhash
The way this is included is still hacky as hell - but now all tests pass.
2020-04-24 13:11:39 -07:00
Jon Siwek
6721685202 Change --enable-fuzzing to --enable-fuzzers
Since it controls whether to build the fuzzer targets, not whether those
fuzzer targets actually use a fuzzing engine.
2020-04-24 11:59:10 -07:00
Jon Siwek
f452f26d11 Remove error message from empty bloomfilter lookups
If a bloomfilter doesn't have a type, that just means no
bloomfilter_add() has been called yet, so seems undesirable to emit an
error for a lookup against something that's known to be empty.
2020-04-24 10:15:57 -07:00
Jon Siwek
78b0b2183d Add standalone driver for fuzz targets
Useful for cases that don't need to use a fuzzing engine, but just run
the fuzz targets over some set of inputs, like for regression/CI tests.

Also added a POP3 fuzzer dictionary, seed corpus, and README with
examples.
2020-04-23 20:14:11 -07:00
Johanna Amann
3937fff57f Replace siphash with Google implementation
This adds the entirety of the highwayhash implementation of Google.
This includes siphash as well as severl highwayhash variants - which
are faster.

This first commit only switches out the siphash implementation. All
hashes that are generated are exactly the same as before. However, this
does make all other hashes available to be used by us.

I did some performance tests vs the previous siphash implementation by
running the 2009-M57-day11-18 trace 100x through both cases. The average
runtime was virtually the same (within 0.014 seconds of each other).

Note that the way that I included the highwayhash implementation in our
cmake setup is... well, let's say hacky. This definitely needs to be
changed a bit before including this in a real build.
2020-04-23 16:05:03 -07:00
Jon Siwek
8f1b34b915 Add basic structure for fuzzing targets
General changes:

* Add -D/--deterministic command line option as
  convenience/alternative to -G/--load-seeds (i.e. no file needed, it just
  uses zero-initialized random seeds).  It also changes Broker data
  stores over to using deterministic timing rather than real time.

* Add option to make Reporter abort on runtime scripting errors
2020-04-23 12:51:25 -07:00
Jon Siwek
6e2cd3ae44 Merge branch 'ident_overflow' of https://github.com/MaxKellermann/zeek
* 'ident_overflow' of https://github.com/MaxKellermann/zeek:
  analyzer/protocol/ident: fix buffer overflow in ParsePort()
2020-04-22 10:44:43 -07:00
Max Kellermann
9b2709ca18 analyzer/protocol/ident: fix buffer overflow in ParsePort()
The given buffer is not null-terminated; the method must obey the
"end_of_line" pointer.
2020-04-22 17:26:06 +02:00
Jon Siwek
f849571910 Merge remote-tracking branch 'origin/topic/johanna/remove_connection_external'
* origin/topic/johanna/remove_connection_external:
  Remove connection_external
2020-04-21 10:26:07 -07:00
Johanna Amann
e3de46ba9b Remove connection_external
This event was forgotten in our broccoli cleanup. It cannot be
raised by anything anymore.
2020-04-21 09:00:05 -07:00
Jon Siwek
5032993b94 GH-854: provide access to original HTTP/MIME header names
The "http_header" event now has an "original_name" parameter that allows
access to the original header name (the "name" parameter reamins the
same as before: it's the uppercased header name).

The "mime_header_rec" record type now also includes an "original_name"
field to similarly provide access to original header name in the
following events: "http_all_headers", "mime_one_header", and
"mime_all_headers".
2020-04-20 16:56:41 -07:00
Jon Siwek
80d3918b13 Deprecate returning Val* from BIFs 2020-04-20 15:20:42 -07:00
Jon Siwek
6c0a9b0d8f Deprecate binpac::string_to_val 2020-04-20 14:43:06 -07:00