Commit graph

9059 commits

Author SHA1 Message Date
Jon Siwek
7fdf621a1d BIT-1924: add DHCP port to software.log for completeness 2018-08-16 16:08:29 -05:00
Daniel Thayer
c941c565a6 Replace references to libgeoip in the documentation
Replace references to the old libgeoip library with "libmaxminddb" or
"GeoIP support".
2018-08-16 15:45:58 -05:00
Daniel Thayer
f40e317c0d Update install instructions for python-ipaddress 2018-08-16 15:41:18 -05:00
Daniel Thayer
4613347a95 Update documentation of "option" and "redef" declarations
Add documentation of using "redef" on a runtime option.  Also mention
how to change an option's value at runtime.
2018-08-16 14:23:25 -05:00
Jon Siwek
81a8961f16 BIT-1858: fix logged-names for DNS RR types 44 and 45 2018-08-16 14:13:31 -05:00
Jon Siwek
15dc5d1dda BIT-1850: add missing DCE/RPC PDU type enum values 2018-08-16 14:09:03 -05:00
Daniel Thayer
6ef98cdb77 Improvements to the config framework documentation
Add documentation of using redef to redefine initial value of options.
Mention caveats for changing the value of specific data types.
Show an example of how to use the Config::set_value() function.
Other small improvements to the examples and text.
2018-08-16 13:32:46 -05:00
Jon Siwek
da9f91fc19 Add env. variables to override Broker listen/connect retry intervals
And use them to default retries to 1sec for all unit tests.
2018-08-16 12:16:03 -05:00
Daniel Thayer
ccfca956e9 Rearrange some lines on the "Log Files" documentation page
Moved config.log out of the "Network Protocols" section.  Moved broker.log
so that it appears in alphabetical order.
2018-08-16 11:31:26 -05:00
Jon Siwek
05b10fe2e7 BIT-1544: allow NULs in file analysis handles 2018-08-15 18:03:02 -05:00
Daniel Thayer
9291fef6d2 Merge remote-tracking branch 'origin/master' into topic/dnthayer/doc-fixes-for-2.6 2018-08-15 15:27:44 -05:00
Jon Siwek
f336c8c710 Fix seg fault on trying to type-cast invalid/nil Broker::Data
This situation now throws a runtime expression exception instead of
crashing on null pointer access.
2018-08-15 11:02:52 -05:00
Daniel Thayer
d7be90c3ca Remove unused redef-able constants 2018-08-15 10:30:09 -05:00
Daniel Thayer
dc0904a7f3 Convert some redef-able constants to runtime options 2018-08-15 10:17:14 -05:00
Jon Siwek
0e6913fba0 BIT-1798: fix PPTP GRE tunnel decapsulation 2018-08-14 16:48:04 -05:00
Jon Siwek
5821c16490 Fix SumStats::observe key normalization logic
The loop over Reducers in SumStats::observe performs a key normalization
and inadvertently modifies the key used for subsequent iterations.

Reported by Jim Mellander.
2018-08-13 17:53:26 -05:00
Jon Siwek
d66a589558 Add 'smtp_excessive_pending_cmds' weird 2018-08-13 16:31:11 -05:00
Jon Siwek
1f7e112879 Fix SMTP command string comparisons 2018-08-13 16:30:44 -05:00
Jon Siwek
2d47586473 Merge remote-tracking branch 'origin/topic/johanna/config-framework-fixes'
* origin/topic/johanna/config-framework-fixes:
  Fix test that fails now that options are automatically redefable.
  Make options redef-able by default.
  Ascii formatter: do not complain about port text.
  Make parsing of booleans a little bit more lenient.
2018-08-13 10:54:39 -05:00
Jon Siwek
4e3db97379 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Improve the travis-job script to work outside of Travis
2018-08-13 10:25:05 -05:00
Jon Siwek
a2f8d81fb6 Fix validate-certs.bro comments 2018-08-13 10:20:58 -05:00
Jon Siwek
67524f26d5 Immediately apply broker subscriptions made during bro_init()
Otherwise that's begging for unit test failures due to races
2018-08-10 17:18:21 -05:00
Jon Siwek
083947af41 Update default broker threading configuration
Now defaults to a max of 4 threads typically indepedent of core
count (previously could go up to a hard cap of 8).  Also now allow
controlling this setting via BRO_BROKER_MAX_THREADS environment
variable.
2018-08-10 17:08:26 -05:00
Jon Siwek
9f12b56105 Misc. unit test improvements 2018-08-10 16:58:27 -05:00
Johanna Amann
7b44a64994 Fix test that fails now that options are automatically redefable. 2018-08-10 14:28:17 -07:00
Johanna Amann
c34fbee0d1 Make options redef-able by default. 2018-08-10 11:53:36 -07:00
Johanna Amann
26ea1999ec Ascii formatter: do not complain about port text.
The ascii formatter already was happy to read ports in the form
"42/tcp"; however it emitted a warning message for each line.

This patch fixes this and adds a bit more testing for the existing
behavior.
2018-08-10 11:29:35 -07:00
Johanna Amann
116079a9ad Make parsing of booleans a little bit more lenient.
This makes the input framework (and everything else that uses the Ascii
parser) accept 0 and 1 as valid values for booleans.
2018-08-10 10:03:22 -07:00
Daniel Thayer
5d3ef4daf4 Improve the travis-job script to work outside of Travis
Improved the travis-job test script so that it works outside of Travis.
This can be useful to test changes to the docker container config before
pushing to master, for testing changes on a branch, or for debugging
some problem with the tests running on Travis.  This required the
following changes:
-The script no longer requires the TRAVIS env. variable to be set.
-Added an "all" command as a more convenient way to run all steps in a
 build.
-Added a "coverity" command-line option to do a coverity build.
-Before building Bro or downloading coverity tools, do a cleanup from any
 previous build.

Also other minor improvements (code comments, reorganization, etc.).
2018-08-09 14:00:55 -05:00
Johanna Amann
ff22230a73 Update submodule
[nomail]
2018-08-08 13:25:06 -07:00
Johanna Amann
7b12fd8c4a Updating submodule(s).
[nomail]
2018-08-08 13:18:10 -07:00
Johanna Amann
c95985f472 Merge branch 'master' of https://github.com/chungmin99/bro
* 'master' of https://github.com/chungmin99/bro:
  Renamed verify-run to verify_run
  Minor edits due to typo and field changes
  Added coverage to .PHONY in Makefile due to testing/coverage
  Fixing up `make html` target
  Refactoring, making error messages nicer, & lcov
  Add code coverage for bro source files after btest test suite
2018-08-08 13:11:20 -07:00
Jon Siwek
2c9dbdd055 Fix cluster layout graphic and doc warnings 2018-08-08 13:03:45 -05:00
Johanna Amann
07043d6dd8 Merge branch 'topic/zhongjie/fix-sig' of https://github.com/bro/bro
* 'topic/zhongjie/fix-sig' of https://github.com/bro/bro:
  Added missing tcp-state for signature dpd_rfb_server
2018-08-08 09:34:51 -07:00
Jon Siwek
df2e2672d9 Updating submodule(s).
[nomail]
2018-08-08 09:43:46 -05:00
Jon Siwek
7126616707 Fix an "uninitialized" compiler warning
Though it is actually initialized on all non-aborting code paths.
2018-08-06 17:10:18 -05:00
Jon Siwek
e6042940dc Fix (non)suppression of proxy-bound events in known-*.bro scripts
When not using data stores, these scripts were intended to suppress
sending duplicate events to proxies by looking up the key in the local
cache.
2018-08-06 17:04:42 -05:00
Jon Siwek
29359ffff2 Updating submodule(s).
[nomail]
2018-08-06 16:36:10 -05:00
Jon Siwek
02900c9401 Updating submodule(s).
[nomail]
2018-08-06 16:15:47 -05:00
Jon Siwek
599af26496 Merge remote-tracking branch 'origin/topic/vern/vec-append'
* origin/topic/vern/vec-append:
  d'oh, still have a (deprecated) string_array rather than string_vector
  forgot to update test suite results for v += e
  reap the fruits of v += e
  test case for v += e
  documentation of v += e
  v += e implemented

Fixed a mistake in find_ip_addresses()
2018-08-03 11:38:40 -05:00
Daniel Thayer
29c179c30d Improve a travis output message in pull request builds
The output message is now more explicit and doesn't look like an
error message.
2018-08-02 16:13:42 -05:00
Daniel Thayer
8c8b55cd18 Use default version of OpenSSL on all travis docker containers 2018-08-02 15:44:47 -05:00
Jon Siwek
06c6e1188a Merge remote-tracking branch 'origin/topic/vern/set-ops2'
* origin/topic/vern/set-ops2:
  documentation, test suite update
  implemented set relationals
  bug fix for set intersection
  set intersection implemented
  mirroring previous topic/vern/set-ops to get branch up to date, since I'm a n00b

Fixed a couple memory leaks and added a leak test
2018-08-02 10:43:41 -05:00
Jon Siwek
5804c940f1 Merge remote-tracking branch 'origin/topic/vern/perf-history'
* origin/topic/vern/perf-history:
  only generate history threshold events for > 1 instance mention those events in NEWS
  a different sort of history update
  'W' for zero window implemented; logarithmic 'T'/'C'/'W' history repetitions

I reverted a change that made TCP window tracking unconditional (possibly
accepting out-of-order packets) until further verification of test suite
changes.
2018-08-01 16:37:10 -05:00
Daniel Thayer
41a5ffa132 Improve install/setup instructions for libmaxminddb
Improved install instructions for libmaxminddb and location database.
Improved the explanation of how Bro finds the location database files,
fixed some reST formatting, and fixed a broken link.
2018-08-01 16:07:45 -05:00
Daniel Thayer
021115a6fa Merge remote-tracking branch 'origin/master' into topic/dnthayer/doc-fixes-for-2.6 2018-08-01 12:19:17 -05:00
Jon Siwek
a4dbc5b310 Merge branch 'fix-ntlm-negotiate-flags' of https://github.com/jbencteux/bro
* 'fix-ntlm-negotiate-flags' of https://github.com/jbencteux/bro:
  fix NTLM NegotiateFlags field offsets
2018-08-01 12:16:19 -05:00
Jon Siwek
08a1480fd9 Fix --with-binpac configure option 2018-08-01 11:26:04 -05:00
Jon Siwek
4243a5d5b0 Update CAF-finding logic 2018-08-01 11:21:24 -05:00
Jon Siwek
509efc58db Updating submodule(s).
[nomail]
2018-07-31 17:15:34 -05:00