Commit graph

9059 commits

Author SHA1 Message Date
Robin Sommer
361b57ee09 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Trim the Travis CI build log output
  Remove unneeded lines from .travis.yml
2018-04-06 10:51:55 -07:00
Robin Sommer
281c9a5ba3 Merge branch 'master' of https://github.com/nnovzver/bro 2018-04-06 10:50:38 -07:00
Seth Hall
340cb556db Test baseline updates. 2018-04-06 13:49:13 -04:00
Seth Hall
be9f97d8b4 Updates to NTLM script handling.
- This separates NTLM handling away from SMB.
 - It logs more accurately when logins are succeed or fail
   or even if the resulting status of an authentication is
   unknown.
 - Adds some new fields where the server is indicating information
   about itself (server_nb_computer_name, server_dns_computer_name,
   and server_tree_name)
2018-04-06 13:09:24 -04:00
Seth Hall
a80131c06e Updating the defined SMB2 dialects to match Microsofts current docs. 2018-04-05 17:13:10 -04:00
Seth Hall
9c85d3f3a9 On rare occasions the server doesn't return the tree id on read responses.
This tracks the tree id given by the request

This also addresses BIT-1862 with code submitted by Stefano Rinaldi
and took some hints from his changes in other areas of the code.
2018-04-05 17:12:33 -04:00
Daniel Thayer
8c91cafad8 Trim the Travis CI build log output
Remove some output from the Travis CI build log to make it easier
to read.

There is an issue with Travis CI when using encrypted environment
variables.  In this case, when btest calls the python function
sys.stdout.isatty() it returns False, which causes btest to output one
line for each test (passed or failed).  As a result, it is difficult to
see at a glance which tests failed.  Switching to btest brief output to
address this issue.
2018-04-05 14:12:24 -05:00
Daniel Thayer
cd6e541e3e Remove unneeded lines from .travis.yml 2018-04-05 14:10:04 -05:00
Devin Trejo
17202e9df4 Add unit tests for new SMB2 event -- smb2_file_sattr. 2018-04-04 16:55:10 -04:00
Devin Trejo
868cb5838d Add smb2_file_sattr 2018-04-04 14:40:43 -04:00
Seth Hall
31223caccd Fix an issue with pending commands.
This is a change from Stefano Rinaldi in ticket number 1862
2018-04-03 03:24:50 -04:00
Seth Hall
f6e5f0b1a5 A small fix for the last merge related to fixing Kerberos in GSSAPI.
We really need to figure out some way to expand our public tests
for SMB.  This problem crept in due to not having a test for
this particular case.
2018-04-03 02:58:54 -04:00
Seth Hall
f7e16a487c Merge branch 'jrolli-gssapi-krb-fix'
* jrolli-gssapi-krb-fix:
  Cleaned up and moved parsing to binpac.
  removed check on kerberos request or response type.  allow the kerberos analyzer to handle what it can, gssapi shouldn't check this
  modified GSSAPI analyzer to parse NTLM and KRB tokens
  Added and verified correct test results
  Initial btest structure
  Changes proposed in #104

Addresses #110
2018-04-03 02:11:13 -04:00
Seth Hall
3131952762 Cleaned up and moved parsing to binpac.
Too much parsing was being done in C++ so I moved more of
it into binpac.  Also, fixed up a bunch of the whitespace
(the new code was indented with spaces).
2018-04-03 01:56:34 -04:00
Seth Hall
5b07bbe0a5 Merge branch 'gssapi-krb-fix' of https://github.com/jrolli/bro into jrolli-gssapi-krb-fix 2018-04-02 22:28:11 -04:00
Seth Hall
95fbe150df Improving the new SMB2 create command test.
It's now a less fragile test than it was.
2018-04-02 22:25:51 -04:00
Seth Hall
3a3ac27d20 Merge branch 'jwallior-smb_changes'
Addresses pull request #122
2018-04-02 17:45:18 -04:00
Seth Hall
68d0085d35 Merge branch 'smb_changes' of https://github.com/jwallior/bro into jwallior-smb_changes 2018-04-02 17:06:30 -04:00
Robin Sommer
f710d9a199 Updating submodule(s).
[nomail]
2018-03-29 14:11:56 -07:00
Robin Sommer
aec449cccc Merge remote-tracking branch 'origin/topic/johanna/cleanup'
Good stuff!

Closes BIT-1915

* origin/topic/johanna/cleanup:
  Mark one-parameter constructors as explicit & use override where possible
  Remove unimplemented & unused functions from header files.
  Make data flow more explicit for complilers.
2018-03-29 13:43:01 -07:00
Robin Sommer
bb34477b91 Merge remote-tracking branch 'origin/topic/johanna/tls13-version'
Closes BIT-1916.

* origin/topic/johanna/tls13-version:
  Recognize TLS 1.3 negotiation correctly.
2018-03-29 13:00:46 -07:00
Johanna Amann
f39efd0317 Recognize TLS 1.3 negotiation correctly.
The way in which TLS 1.3 is negotiated was changed slightly in later
revisions of the standard. The final version is only sent in an
extension - while the version field in the server hello still shows TLS
1.2.

This patch makes ssl.log show the correct version again.
2018-03-27 14:58:06 -07:00
Vladimir Ruzanov
5145b5cb4e Fix NETBIOSSSN analyzer name 2018-03-27 23:32:06 +03:00
Johanna Amann
6d612ced3d Mark one-parameter constructors as explicit & use override where possible
This commit marks (hopefully) ever one-parameter constructor as explicit.

It also uses override in (hopefully) all circumstances where a virtual
method is overridden.

There are a very few other minor changes - most of them were necessary
to get everything to compile (like one additional constructor). In one
case I changed an implicit operation to an explicit string conversion -
I think the automatically chosen conversion was much more convoluted.

This took longer than I want to admit but not as long as I feared :)
2018-03-27 07:17:32 -07:00
Johanna Amann
961f0dfb25 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix the travis-job script to always run external tests
2018-03-25 09:43:29 -07:00
Philippe Antoine
ecf2788740 Better reporter for Brostring with embedded NUL
Can be reproduced with something like
curl 127.0.0.1:8002/readme.html%00lol
2018-03-23 10:10:01 +01:00
Daniel Thayer
aadcd5d2cc Fix the travis-job script to always run external tests
Run the external tests even when the Bro tests fail.
2018-03-22 19:36:40 -05:00
Robin Sommer
9271b2032d Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci-updates'
I've moved .travis.job to testing/scripts/travis-job and adapted
.travis.yml accordingly.

* origin/topic/dnthayer/travis-ci-updates:
  Fix information leak in the update-traces script
  Add coverity scan and private testing to Travis CI
2018-03-22 14:26:21 -07:00
Robin Sommer
288fcd0039 Merge remote-tracking branch 'origin/topic/seth/smb-mapping-memleak-fix'
Closes BIT-1911.

* origin/topic/seth/smb-mapping-memleak-fix:
  Fix a memory leak in SMBv1 share mapping
2018-03-21 13:57:26 -07:00
Seth Hall
551f57ea97 Fix a memory leak in SMBv1 share mapping 2018-03-21 16:29:59 -04:00
Daniel Thayer
3584495562 Fix information leak in the update-traces script
For trace files that require authentication to download, hide
part of the URL in output messages.  This avoids leaking potentially
sensitive info when running tests using a continuous integration
service.
2018-03-21 15:24:29 -05:00
Daniel Thayer
9ee739421b Add coverity scan and private testing to Travis CI 2018-03-21 14:10:54 -05:00
Johanna Amann
1f2bf50b49 Remove unimplemented & unused functions from header files.
All of these functions were defined in header files without ever being
implemented or used.
2018-03-16 18:38:04 -07:00
Johanna Amann
911018347f Make data flow more explicit for complilers.
gcc likes complaining about ev potentially not being initialized. Make
it clear that this cannot happen by marking the default case as
unreachable after the error output.
2018-03-16 14:36:13 -07:00
Daniel Thayer
8fe998c5f7 Fix one new minor typo in the config framework docs 2018-03-15 18:52:08 -05:00
Robin Sommer
77bc5da6f9 Updating submodule(s).
[nomail]
2018-03-15 15:00:34 -07:00
Robin Sommer
78f4ed690d Merge remote-tracking branch 'origin/topic/dnthayer/travis-ci-changes'
* origin/topic/dnthayer/travis-ci-changes:
  Configure Travis CI email recipients and build branches
2018-03-15 14:59:34 -07:00
Robin Sommer
31a48bf4ad Merge remote-tracking branch 'origin/topic/dnthayer/ticket1905'
Includes slight editing of the new text.

Closes BIT-1905.

* origin/topic/dnthayer/ticket1905:
  Add documentation of the configuration framework
  Add documentation of "option" declarations
  Improve config framework documentation comments
  Fix minor typos and doc build warnings in NEWS
2018-03-15 14:54:43 -07:00
Daniel Thayer
8aeedba066 Add documentation of the configuration framework 2018-03-15 14:50:42 -05:00
Daniel Thayer
79afd99229 Add documentation of "option" declarations 2018-03-15 14:29:26 -05:00
Daniel Thayer
f3e42874b8 Improve config framework documentation comments
Fixed typos and formatting.
2018-03-15 14:16:00 -05:00
Daniel Thayer
c759583d11 Fix minor typos and doc build warnings in NEWS 2018-03-15 14:13:54 -05:00
Jon Siwek
54aa7d1911 Updating submodule(s).
[nomail]
2018-03-07 13:54:53 -06:00
Jon Siwek
57fa8f2708 Update a doc test/baseline 2018-03-07 12:48:08 -06:00
Seth Hall
e76b56ce53 Rework to the DHCP analyzer.
Highlights:
 - Reduced all DHCP events into a single dhcp_message event. (removed legacy events since they weren't widely used anyway)
 - Support many more DHCP options.
 - DHCP log is completely reworked and now represents DHCP sessions
   based on the transaction ID (and works on clusters).
 - Removed the known-devices-and-hostnames script since it's generally
   less relevant now with the updated log.
2018-03-01 08:36:32 -08:00
Daniel Thayer
1d3a0e26e4 Configure Travis CI email recipients and build branches 2018-02-22 14:59:04 -06:00
Johanna Amann
01a96239e1 Add removed root certificate back to test that requires it.
Test has a trace that contains a WoSign certificate - they are no longer
recognized by pretty much anyone.
2018-02-20 09:02:55 -08:00
Jon Siwek
c54b607de1 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix another warning when building the documentation
  Fix a warning when building documentation
  Fix the config framework several-files.bro test
2018-02-18 17:37:34 -06:00
Johanna Amann
8ea7de9380 Update Mozilla CA list to state of NSS 3.35. 2018-02-16 10:53:51 -08:00
Johanna Amann
981c889352 Update list of Certificate Transparency logs. 2018-02-16 10:44:29 -08:00