Commit graph

9059 commits

Author SHA1 Message Date
Daniel Thayer
be182aac83 More bro-to-zeek renaming in scripts and other files 2019-05-16 02:36:41 -05:00
Daniel Thayer
3f9e7138bd More bro-to-zeek renaming in the unit tests 2019-05-16 02:27:54 -05:00
Jon Siwek
72b46268f7 Updating submodule(s).
[nomail]
2019-05-15 15:53:26 -07:00
Jon Siwek
bf42dd02bd Merge remote-tracking branch 'origin/topic/dnthayer/gh-359'
* origin/topic/dnthayer/gh-359:
  Changes needed due to bro-to-zeek renaming in broker
2019-05-15 15:03:31 -07:00
Jon Siwek
a8c0cd7dee Fix potential race in openflow broker plugin
Broker::subscribe() after Broker::peer() may result in losing messages,
always best to do the reverse order.

Also possibly improved chance of unstable unit test output order.
2019-05-15 10:12:32 -07:00
Johanna Amann
2bb529f5b7 Merge remote-tracking branch 'origin/topic/jsiwek/dns-mgr-fixes'
* origin/topic/jsiwek/dns-mgr-fixes:
  Fix timing out DNS lookups that were already resolved
  Remove an unhelpful/optimistic DNS_Mgr optimization
  Fix DNS_Mgr priority_queue usage
  Remove dead code from DNS_Mgr
  Improve DNS_Mgr I/O loop: prevent starvation due to busy Broker
  Fix a ref counnting bug in DNS_Mgr
2019-05-15 09:02:41 -07:00
Daniel Thayer
3bbd11b1cd Changes needed due to bro-to-zeek renaming in broker 2019-05-15 00:22:05 -05:00
Jon Siwek
fcc840044d Updating submodule(s).
[nomail]
2019-05-14 19:31:51 -07:00
Jon Siwek
b3c4b986ef Fix maybe-uninitialized compiler warning 2019-05-14 19:01:41 -07:00
Jon Siwek
8abf0fad57 Updating submodule(s).
[nomail]
2019-05-14 19:00:54 -07:00
Jon Siwek
13867f53c3 Update btest.cfg path to use zeek-aux 2019-05-14 18:36:20 -07:00
Jon Siwek
bee69222b1 Update NEWS 2019-05-14 18:21:58 -07:00
Jon Siwek
385a3a5ae8 Update CMake to use aux/zeekctl and aux/zeek-aux submodules
Instead of the old "bro" versions of those which are no symlinks.
2019-05-14 17:48:18 -07:00
Jon Siwek
f37a16b715 Rename broctl submodule to zeekctl 2019-05-14 17:42:01 -07:00
Jon Siwek
6ad7099f7e Merge remote-tracking branch 'origin/topic/robin/gh-239'
* origin/topic/robin/gh-239:
  Undo a change to btest.cfg from a recent commit
  Updating submodule.
  Fix zeek-wrapper
  Update for renaming BroControl to ZeekControl.
  Updating submodule.
  GH-239: Rename bro to zeek, bro-config to zeek-config, and bro-path-dev to zeek-path-dev.
2019-05-14 13:27:40 -07:00
Jon Siwek
58d55d0f95 GH-365: improve un-indexable type error message 2019-05-13 20:04:03 -07:00
Daniel Thayer
bbaee15280 Undo a change to btest.cfg from a recent commit
Remove a line from btest.cfg that was added (probably unintentionally)
in commit 789cb376.
2019-05-12 19:17:25 -05:00
Robin Sommer
b953a5516f Updating submodule. 2019-05-12 16:02:37 +00:00
Daniel Thayer
a87d1fd875 Fix zeek-wrapper
The script was not passing command-line arguments to the new program.

Also improved some error messages.
2019-05-11 19:05:25 -05:00
Jon Siwek
aced89ac9e Updating submodule(s).
[nomail]
2019-05-10 19:18:50 -07:00
Jon Siwek
3ae4ffc66e Improve Broker I/O loop integration: less mutex locking
Checking a subscriber for available messages required locking a mutex,
but we should never actually need to do that in the main-loop to check
for Broker readiness since we can rely on file descriptor polling.
2019-05-10 09:16:29 -07:00
Johanna Amann
474efe9e69 Remove value serialization.
Note - this compiles, but you cannot run Bro anymore - it crashes
immediately with a 0-pointer access. The reason behind it is that the
required clone functionality does not work anymore.
2019-05-09 11:54:38 -07:00
Jon Siwek
cb6b9a1f1a Allow tuning Broker log batching via scripts
Via redefining "Broker::log_batch_size" or "Broker::log_batch_interval"
2019-05-08 12:44:55 -07:00
Johanna Amann
312713810f Merge remote-tracking branch 'origin/topic/jsiwek/force-idle-broker'
* origin/topic/jsiwek/force-idle-broker:
  Force the Broker IOSource to idle periodically
2019-05-08 09:04:25 -07:00
Johanna Amann
6f82899466 Merge remote-tracking branch 'origin/topic/jsiwek/gh-353'
* origin/topic/jsiwek/gh-353:
  GH-353: Add `/<re>/i` case-insensitive signature syntax
2019-05-08 08:58:41 -07:00
Jon Siwek
dbb49b17f4 Reduce data copying in Broker message processing 2019-05-07 20:15:31 -07:00
Jon Siwek
9029acd7e5 Merge remote-tracking branch 'origin/topic/johanna/243'
* origin/topic/johanna/243:
  Fix missing include file on Linux
  Deprecations: Update NEWS, and tie up a few loose ends.
  Remove support for using &&/|| with patterns.
  Remove RemoteSerializer and related code/types.
  Remove PersistenceSerializer.
  Remove synchrnized and persistent attributes.
2019-05-06 18:45:10 -07:00
Robin Sommer
89b8d6e7ba Update for renaming BroControl to ZeekControl. 2019-05-06 21:22:19 +00:00
Jon Siwek
5484c40b1f GH-353: Add /<re>/i case-insensitive signature syntax 2019-05-06 14:22:12 -07:00
Johanna Amann
9b49c7cbc6 Fix missing include file on Linux 2019-05-06 18:56:47 +00:00
Johanna Amann
72ec093d56 Deprecations: Update NEWS, and tie up a few loose ends.
Broccoli was still present in the source in a few places, debug outputs
that do no longer exist were too.

Part of GH-243
2019-05-06 11:12:47 -07:00
Mauro Palumbo
3f7eb7436f add SMB2_0_INFO_FILESYSTEM option and move SMB2_FILE_FSCONTROL_INFO and SMB2_FILE_FSOBJECTID_INFO under this option 2019-05-05 22:40:33 +02:00
Mauro Palumbo
bdb1e6a640 add missing changes in init-bare.zeek 2019-05-05 21:13:11 +02:00
Mauro Palumbo
8afa4616ff Extend File EA info to several items, minor fixes 2019-05-05 21:11:14 +02:00
Mauro Palumbo
9253357d4b minor fix 2019-05-05 18:29:22 +02:00
Mauro Palumbo
c90eec6b54 update master and merge into this branch 2019-05-05 16:46:41 +02:00
Jon Siwek
69eee058c1 Improve processing of broker data store responses
Now retrieves and processes all N available responses at once instead
of one-by-one-until-empty.  The later may be problematic from two
points: (1) hitting the shared queue/mailbox matching logic once per
response instead of once per Process() and (2) looping until empty is
not clearly bounded -- imagining a condition where there's a thread
trying to push a large influx of responses into the mailbox while at
the same time we're trying to take from it until it's empty.
2019-05-04 11:13:48 -07:00
Johanna Amann
ed644e39a0 Remove support for using &&/|| with patterns.
This was never documented and previously deprecated.
2019-05-03 15:26:21 -07:00
Johanna Amann
4c19e60488 Merge remote-tracking branch 'origin/master' into topic/johanna/remove-deprecated-functions-events 2019-05-03 15:15:22 -07:00
Johanna Amann
dcd6454530 Remove RemoteSerializer and related code/types.
Also removes broccoli from the source tree.
2019-05-03 15:00:13 -07:00
Jon Siwek
eda7610806 Fix sporadic openflow/broker test failure
Looked like a possible race condition in how the test was structured: an
endpoint sees its peer got lost and likewise exits immediately before
having a chance to process events the peer had sent just before exiting.
Fix is to reverse which endpoint initiates the termination sequence so
we can be sure we see the required events.
2019-05-03 11:22:56 -07:00
Jon Siwek
c640dd70cc Install local.zeek as symlink to pre-existing local.bro
This a convenience for those that are upgrading.  If we didn't do
this, then deployments can silently break until the user intervenes
since BroControl now prefers to load the initially-vanilla local.zeek
instead of the formerly-customized local.bro.
2019-05-02 23:06:52 -07:00
Jon Siwek
84ca12fdb4 Rename Zeexygen to Zeekygen 2019-05-02 21:39:21 -07:00
Jon Siwek
f2f06d66c0 Remove previously deprecated policy/protocols/smb/__load__ 2019-05-02 20:50:30 -07:00
Jon Siwek
1a77c1b287 Merge remote-tracking branch 'origin/topic/johanna/remove-deprecated-functions-events'
* origin/topic/johanna/remove-deprecated-functions-events:
  Remove deprecated functions/events
2019-05-02 19:18:45 -07:00
Johanna Amann
ca1b1dd6bb Remove PersistenceSerializer. 2019-05-02 13:45:36 -07:00
Johanna Amann
61c84a0a40 Remove synchrnized and persistent attributes.
Code that was used by them is still there.
2019-05-02 13:10:37 -07:00
Johanna Amann
6d47077222 Merge remote-tracking branch 'origin/topic/jsiwek/gh-340'
* origin/topic/jsiwek/gh-340:
  GH-340: Improve IPv4/IPv6 regexes, extraction, and validity functions
2019-05-02 12:28:31 -07:00
Johanna Amann
5d44735209 Remove deprecated functions/events
This commit removed functions/events that have been deprecated in Bro
2.6. It also removes the detection code that checks if the old
communication framework is used (since all the functions that are
checked were removed).

Addresses parts of GH-243
2019-05-02 12:06:39 -07:00
Jon Siwek
46799f7540 Fix timing out DNS lookups that were already resolved
This could happen in the case of making repeated lookup requests
for the same thing within a short period of time: cleaning up an
old request that already got resolved would mistakenly see a new,
yet-to-be-resolved request with identical host/addr and mistakenly
assume it's in need of being timed out.
2019-05-01 23:08:52 -07:00