Commit graph

11634 commits

Author SHA1 Message Date
Palumbo Mauro
ce07b10aa8 extend and refact script-side of NTP analyzer 2019-06-03 17:50:32 +02:00
Palumbo Mauro
411908a102 extend and refactor several fields 2019-06-03 17:46:22 +02:00
Palumbo Mauro
19fd5f66e8 refactor mode 7 2019-06-03 17:26:46 +02:00
Robin Sommer
0767598771 GH-293: Protect copy() against reference cycles.
Reference cycles shouldn't occur but there's nothing really preventing
people from creating them, so may just as well be safe and deal with
them when cloning values. While the code is a bit more cumbersome this
way, it could actually be bit faster as well as it no longer caches
non-mutable values. (I measured it with the test suite: That's about
the same in execution time, maybe tiny little bit faster now;
definitly not slower).
2019-06-03 15:20:30 +00:00
Palumbo Mauro
8b0098a8d4 remove events ntp_mode6_message and ntp_mode7_message 2019-06-03 17:17:38 +02:00
Palumbo Mauro
145c7f9a25 Merge remote-tracking branch 'origin/topic/vlad/ntp_rewrite' into ntp2 2019-06-03 17:04:17 +02:00
Johanna Amann
86ac468882 support the newer TLS 1.3 key_share extension.
This one adds a separate new case that has to be parsed differently - if
a hello-retry-request is sent, only the namedgroup is sent - without the
additional key material.

Support for the legacy extension is retained.
2019-06-03 14:40:33 +10:00
Johanna Amann
af59ed6bdb Merge remote-tracking branch 'origin/master' into topic/johanna/tls13-details 2019-06-03 12:19:12 +10:00
Jon Siwek
1e488d7ebe Remove old documentation reference to rotate_interval 2019-05-31 13:37:44 -07:00
Tim Wojtulewicz
2d61ea5cd6 Allow passing a location to BroObj::Warning and BroObj::Error.
This allows callers (such as check_and_promote) to pass an expression location to be logged if the location doesn't exist in the value being promoted.
2019-05-31 12:11:42 -07:00
Jon Siwek
39c201f88e Updating submodule(s).
[nomail]
2019-05-30 21:35:40 -07:00
Tim Wojtulewicz
8ca2cff13f Add CLion directories to gitignore 2019-05-30 16:00:18 -07:00
Tim Wojtulewicz
7243292136 Move #define outside of max_type for clarity 2019-05-30 16:00:18 -07:00
Jon Siwek
6860d5b083 Merge branch 'topic/christian/inputframework-warning-fix' of https://github.com/ckreibich/zeek
* 'topic/christian/inputframework-warning-fix' of https://github.com/ckreibich/zeek:
  Tweak to ASCII reader warning suppression
2019-05-30 11:00:19 -07:00
ZekeMedley
0733c857d2 Use the right delete and improve the leak test.
Increases the size of the table being loaded in the pattern leak
test and uses the right delete method.
2019-05-30 09:31:02 -07:00
Christian Kreibich
c21a411bfb Tweak to ASCII reader warning suppression
Warnings in the ASCII reader so far remained suppressed even when an
input file changed. It's helpful to learn about problems in the data
when putting in place new data files, so this isn't great. This change
maintains the existing warning suppression while processing a file,
but re-enables warnings after updates to a file.

Also includes minor comment clarifications, and maintains the
not-so-great code duplication between the ASCII and Config readers
until we refactor this properly.
2019-05-29 23:59:45 -07:00
Jon Siwek
1ce0fcce49 GH-387: update Broker topic names to use "zeek/" prefix 2019-05-29 15:56:37 -07:00
ZekeMedley
7227908d74 Fix formatting. 2019-05-29 15:34:31 -07:00
ZekeMedley
7584bf65e2 Fix memory leak and add test. 2019-05-29 15:29:30 -07:00
Jon Siwek
c25520cf3f Updating submodule(s).
[nomail]
2019-05-29 14:55:51 -07:00
ZekeMedley
cfeb6f0f0d Add pattern support to input framework. 2019-05-29 12:19:40 -07:00
Jon Siwek
c3725a5e3f Merge remote-tracking branch 'origin/topic/vlad/rdp_bluekeep'
* origin/topic/vlad/rdp_bluekeep:
  RDP: Add weird if specification violated for max channels allowed.
2019-05-29 09:48:31 -07:00
Vlad Grigorescu
2005a76896 WIP: BinPAC NTP analyzer 2019-05-29 09:37:55 -05:00
Vlad Grigorescu
be4f6eae0e Ran binpac_quickstart for NTP (UDP, not buffered) 2019-05-29 09:04:48 -05:00
Vlad Grigorescu
232bee4096 Remove old NTP analyzer. 2019-05-29 08:36:25 -05:00
Vlad Grigorescu
10109b6b93 RDP: Add weird if specification violated for max channels allowed. 2019-05-29 08:25:08 -05:00
Jon Siwek
574d2c363a Merge remote-tracking branch 'origin/topic/jsiwek/broker-less-copies'
* origin/topic/jsiwek/broker-less-copies:
  Reduce data copying in Broker message processing
2019-05-28 17:58:59 -07:00
Jon Siwek
ebbeb4517b Merge remote-tracking branch 'origin/topic/jsiwek/broker-store-process-n'
* origin/topic/jsiwek/broker-store-process-n:
  Improve Broker I/O loop integration: less mutex locking
  Improve processing of broker data store responses
2019-05-28 17:43:52 -07:00
Jon Siwek
4ff473a596 Updating submodule(s).
[nomail]
2019-05-28 14:07:35 -07:00
Jon Siwek
f88843c5e9 Updating submodule(s).
[nomail]
2019-05-28 13:33:46 -07:00
Jon Siwek
7bc9a3934d Merge remote-tracking branch 'origin/topic/vlad/rdp_bluekeep'
* origin/topic/vlad/rdp_bluekeep:
  RDP: Update existing baselines with new client_channels field
  RDP: Add parsing and logging of channels requested by the client. Can determine capabilities requested by the client, as well as attacks such as CVE-2019-0708
2019-05-28 11:33:20 -07:00
Jon Siwek
f2b7764769 Merge branch 'table-error' of https://github.com/ZekeMedley/zeek
* 'table-error' of https://github.com/ZekeMedley/zeek:
  Check table yield type on assignment.

Also extended the type checking to include sets as well as the full
table type (yield type as well as index types).
2019-05-28 10:51:50 -07:00
Vlad Grigorescu
85fc553136 RDP: Update existing baselines with new client_channels field 2019-05-28 09:31:32 -05:00
Vlad Grigorescu
8eb14fcb83 RDP: Add parsing and logging of channels requested by the client. Can determine capabilities requested by the client, as well as attacks such as CVE-2019-0708 2019-05-28 09:25:50 -05:00
Zeke Medley
4ae764f74b Check table yield type on assignment. 2019-05-25 12:53:36 -07:00
Jon Siwek
748a4f2ea2 Merge branch '001-dhcp-options' of https://github.com/jrwren/zeek
* '001-dhcp-options' of https://github.com/jrwren/zeek:
  add some dhcp options
2019-05-24 18:08:34 -07:00
Jon Siwek
9192d9289e Merge branch 'topic/christian/inputframework-reporter-filenames' of https://github.com/ckreibich/zeek
* 'topic/christian/inputframework-reporter-filenames' of https://github.com/ckreibich/zeek:
  Add input file name to additional ASCII reader warning messages
2019-05-24 17:06:39 -07:00
Christian Kreibich
8c60f6afa6 Add input file name to additional ASCII reader warning messages
The ASCII reader had a few messages that did not indicate in which
file it notices a problem. With the input framework it simplifies
troubleshooting when that file is spelled out, because you may have
multiple such files on your system.

Includes test baseline updates.
2019-05-24 16:04:06 -07:00
Jay Wren
1eda26d16f add some dhcp options 2019-05-24 16:52:12 -04:00
Jon Siwek
d886f40728 GH-378: check validity of missing 'val' field in Input::add_table
It's only allowed to be missing when the 'destination' field is a
"set" type, but not for a "table" type.

Fixes GH-378
2019-05-24 10:30:49 -07:00
Jon Siwek
88278214a9 Fix memory leak when no protocol_violation event handler exists 2019-05-24 09:01:45 -07:00
Daniel Thayer
5a253d355b Rename directories from bro to zeek 2019-05-24 03:32:14 -05:00
Jon Siwek
7f0fb49612 Add an internal getenv wrapper function: zeekenv
It maps newer environment variable names starting with ZEEK to the
legacy names starting with BRO.
2019-05-23 20:42:42 -07:00
Jon Siwek
580822a32c Merge remote-tracking branch 'origin/topic/dnthayer/gh-339'
* origin/topic/dnthayer/gh-339:
  Rename all BRO-prefixed environment variables
2019-05-23 20:23:14 -07:00
Johanna Amann
9f4749adce Remove const from ShallowClone.
It was not actually const due to Ref-ing.
2019-05-23 18:52:53 -07:00
Johanna Amann
38652ee8d9 Remove test-case for removed functionality 2019-05-23 18:52:33 -07:00
Jon Siwek
ce17ae8ea2 Update broker unit test output.
Due to string representation of Broker vectors changing (they now
use parentheses instead of square brackets).

Related to https://github.com/zeek/broker/issues/43
2019-05-23 18:06:47 -07:00
Jon Siwek
30db17464d Merge remote-tracking branch 'origin/topic/timw/173-port-ranges'
* origin/topic/timw/173-port-ranges:
  GH-173: Support ranges of values for value_list elements in the signature parser
  GH-173: Modify the signature parser so ID components (such as variable names) can't start with numbers
2019-05-23 13:05:50 -07:00
Jon Siwek
812ca7d2ab Remove redundant RecordVal::record_type member
Val objects already store a reference to the type, no need for another.
2019-05-23 12:12:48 -07:00
Tim Wojtulewicz
e10f9e4047 GH-173: Support ranges of values for value_list elements in the signature parser
This adds support for ranged values everywhere a value_list is used, not just for source port fields.
2019-05-23 10:58:04 -07:00