Commit graph

2206 commits

Author SHA1 Message Date
Jon Siwek
5c9813eadb Merge branch 'topic/feature/upstream/refresh-maxmind-db' of https://github.com/corelight/bro
* 'topic/feature/upstream/refresh-maxmind-db' of https://github.com/corelight/bro:
  Detect MaxMind DB changes and auto-reload
2018-08-24 10:27:26 -05:00
Jon Siwek
d43238fe69 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix finding of kerberos and libmaxminddb in CMakeLists.txt
2018-08-23 16:55:50 -05:00
Jon Siwek
b9dfca7789 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Improve readability of the Travis job log
2018-08-23 15:21:25 -05:00
Robin Sommer
45338b1942 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1885'
* origin/topic/jsiwek/bit-1885:
  BIT-1885: fix input framework memory leak
  Increase timeout for a memleak test
2018-08-23 15:53:35 +00:00
Jon Siwek
66871ba948 Ensure external test repo hashes track origin/master 2018-08-22 12:06:33 -05:00
Jon Siwek
1f70f607ce Fix "unused CMake variable" configuration warnings 2018-08-22 11:49:33 -05:00
Jon Siwek
ef3d451af3 Fix Travis CI script to checkout particular commits of external tests 2018-08-21 16:49:06 -05:00
Jon Siwek
9121c0436f Add --with-broker configure option 2018-08-21 15:55:56 -05:00
Jon Siwek
b679a51376 Merge remote-tracking branch 'origin/topic/jazoff/fix-snaplen'
* origin/topic/jazoff/fix-snaplen:
  problem: default snaplen is too small for jumbo frames
2018-08-21 14:54:55 -05:00
Jon Siwek
ee0bbdad34 Fix outdated documentation test baselines 2018-08-20 15:51:51 -05:00
Jon Siwek
000072978a Merge remote-tracking branch 'origin/topic/dnthayer/ticket1700-part2'
* origin/topic/dnthayer/ticket1700-part2:
  Remove the node-specific local-*.bro scripts
2018-08-20 15:02:41 -05:00
Jon Siwek
4912513517 Improve diff-remove-abspath canonifier: collapse '/' sequences 2018-08-20 12:47:57 -05:00
Jon Siwek
1671244a64 Merge remote-tracking branch 'origin/topic/dnthayer/doc-fixes-for-2.6'
* origin/topic/dnthayer/doc-fixes-for-2.6:
  Fix some typos and improve formatting in NEWS
  Update the operators documentation
  Replace references to libgeoip in the documentation
  Update install instructions for python-ipaddress
  Update documentation of "option" and "redef" declarations
  Improvements to the config framework documentation
  Rearrange some lines on the "Log Files" documentation page
  Improve install/setup instructions for libmaxminddb
  Update NEWS for config framework clusterization changes
  Update config framework doc for clusterization changes
  Fix typos and formatting issues in config framework docs
2018-08-17 17:10:34 -05:00
Jon Siwek
edf8658b11 Merge remote-tracking branch 'origin/topic/vladg/dhcp_event_deprecation'
* origin/topic/vladg/dhcp_event_deprecation:
  Add script to support the old DHCP events

Updated coverage tests and fixed incorrect DHCP:: scoping on some things
2018-08-17 16:38:19 -05:00
Jon Siwek
bd24421734 BIT-466: add redef += support to vectors 2018-08-17 15:16:15 -05:00
Jon Siwek
fcabd72b92 BIT-1815: move SMB::write_cmd_log functionality into policy/ script
The option is removed, but same functionality is now enabled simply
by loading policy/protocols/smb/log-cmds.bro
2018-08-17 11:15:18 -05:00
Jon Siwek
fc7d3cd981 Fix possible race in netcontrol acld/broker plugins
Best to subscribe before connecting
2018-08-17 10:31:31 -05:00
Jon Siwek
a04c76c035 Enable SMB by default by moving scripts from policy/ to base/ 2018-08-16 17:23:28 -05:00
Jon Siwek
7fdf621a1d BIT-1924: add DHCP port to software.log for completeness 2018-08-16 16:08:29 -05:00
Jon Siwek
81a8961f16 BIT-1858: fix logged-names for DNS RR types 44 and 45 2018-08-16 14:13:31 -05:00
Jon Siwek
da9f91fc19 Add env. variables to override Broker listen/connect retry intervals
And use them to default retries to 1sec for all unit tests.
2018-08-16 12:16:03 -05:00
Jon Siwek
05b10fe2e7 BIT-1544: allow NULs in file analysis handles 2018-08-15 18:03:02 -05:00
Jon Siwek
f336c8c710 Fix seg fault on trying to type-cast invalid/nil Broker::Data
This situation now throws a runtime expression exception instead of
crashing on null pointer access.
2018-08-15 11:02:52 -05:00
Jon Siwek
0e6913fba0 BIT-1798: fix PPTP GRE tunnel decapsulation 2018-08-14 16:48:04 -05:00
Jon Siwek
5821c16490 Fix SumStats::observe key normalization logic
The loop over Reducers in SumStats::observe performs a key normalization
and inadvertently modifies the key used for subsequent iterations.

Reported by Jim Mellander.
2018-08-13 17:53:26 -05:00
Jon Siwek
2d47586473 Merge remote-tracking branch 'origin/topic/johanna/config-framework-fixes'
* origin/topic/johanna/config-framework-fixes:
  Fix test that fails now that options are automatically redefable.
  Make options redef-able by default.
  Ascii formatter: do not complain about port text.
  Make parsing of booleans a little bit more lenient.
2018-08-13 10:54:39 -05:00
Jon Siwek
67524f26d5 Immediately apply broker subscriptions made during bro_init()
Otherwise that's begging for unit test failures due to races
2018-08-10 17:18:21 -05:00
Johanna Amann
c95985f472 Merge branch 'master' of https://github.com/chungmin99/bro
* 'master' of https://github.com/chungmin99/bro:
  Renamed verify-run to verify_run
  Minor edits due to typo and field changes
  Added coverage to .PHONY in Makefile due to testing/coverage
  Fixing up `make html` target
  Refactoring, making error messages nicer, & lcov
  Add code coverage for bro source files after btest test suite
2018-08-08 13:11:20 -07:00
Jon Siwek
2c9dbdd055 Fix cluster layout graphic and doc warnings 2018-08-08 13:03:45 -05:00
Jon Siwek
7126616707 Fix an "uninitialized" compiler warning
Though it is actually initialized on all non-aborting code paths.
2018-08-06 17:10:18 -05:00
Jon Siwek
599af26496 Merge remote-tracking branch 'origin/topic/vern/vec-append'
* origin/topic/vern/vec-append:
  d'oh, still have a (deprecated) string_array rather than string_vector
  forgot to update test suite results for v += e
  reap the fruits of v += e
  test case for v += e
  documentation of v += e
  v += e implemented

Fixed a mistake in find_ip_addresses()
2018-08-03 11:38:40 -05:00
Jon Siwek
06c6e1188a Merge remote-tracking branch 'origin/topic/vern/set-ops2'
* origin/topic/vern/set-ops2:
  documentation, test suite update
  implemented set relationals
  bug fix for set intersection
  set intersection implemented
  mirroring previous topic/vern/set-ops to get branch up to date, since I'm a n00b

Fixed a couple memory leaks and added a leak test
2018-08-02 10:43:41 -05:00
Jon Siwek
5804c940f1 Merge remote-tracking branch 'origin/topic/vern/perf-history'
* origin/topic/vern/perf-history:
  only generate history threshold events for > 1 instance mention those events in NEWS
  a different sort of history update
  'W' for zero window implemented; logarithmic 'T'/'C'/'W' history repetitions

I reverted a change that made TCP window tracking unconditional (possibly
accepting out-of-order packets) until further verification of test suite
changes.
2018-08-01 16:37:10 -05:00
Jon Siwek
a4dbc5b310 Merge branch 'fix-ntlm-negotiate-flags' of https://github.com/jbencteux/bro
* 'fix-ntlm-negotiate-flags' of https://github.com/jbencteux/bro:
  fix NTLM NegotiateFlags field offsets
2018-08-01 12:16:19 -05:00
Jon Siwek
08a1480fd9 Fix --with-binpac configure option 2018-08-01 11:26:04 -05:00
Jon Siwek
46bf6731e7 Merge branch 'topic/feature/upstream/cfp' of https://github.com/corelight/bro
* 'topic/feature/upstream/cfp' of https://github.com/corelight/bro:
  Add Cisco FabricPath support
2018-07-31 16:51:41 -05:00
Johanna Amann
a251b32d85 Merge remote-tracking branch 'origin/topic/jsiwek/openssl-1.1'
* origin/topic/jsiwek/openssl-1.1:
  Update install instructions for OpenSSL 1.1 compat
  Remove requestorName parameter of ocsp_request event
  Adjust x509 unit tests to work around OpenSSL 1.0 vs. 1.1 differences
  Fixes for OpenSSL 1.1 support
2018-07-31 13:13:06 +02:00
Jon Siwek
026f78e5a3 Add broker/binpac/caf dirs to bro-config script 2018-07-24 16:46:59 -05:00
Robin Sommer
8ac17d99a1 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1950'
BIT-1950 #merged

* origin/topic/jsiwek/bit-1950:
  BIT-1950: support PPPoE over QinQ
2018-07-24 15:05:48 +00:00
Robin Sommer
d62079b59a Updating submodule(s).
[nomail]
2018-07-24 02:43:06 +00:00
Robin Sommer
0f74e1eedd Add serialization group to clustered config framework tests. 2018-07-24 01:39:39 +00:00
Robin Sommer
f4cd567f84 Merge remote-tracking branch 'origin/topic/johanna/config-cluster'
BIT-1958 #merged

* origin/topic/johanna/config-cluster:
  Add vector to read_config_cluster test.
  Fix special-case-bug for vectors in UnaryExpr.
  Config: another cluster test-case, this time reading in a file.
  Add sending of values to nodes that dropped out.
  Continue work on config framework clusterization.
  Teach Option::set to unwrap Broker::Data values
  Start clusterizing configuration framework.
2018-07-24 01:36:59 +00:00
Jon Siwek
385350a1f3 Make Broker congestion queue size tunable and increase default 2018-07-20 12:14:33 -05:00
Jon Siwek
d245513e0a Improve some netcontrol unit tests 2018-07-18 09:51:49 -05:00
Jon Siwek
bf67076cdc Improve an input framework unit test 2018-07-17 17:51:52 -05:00
Jon Siwek
1d1a63c16c Add explicit key in Travis known_hosts 2018-07-17 16:51:29 -05:00
Jon Siwek
9caad8a042 Port broker::data variant usages to use CAF API directly
Old code still all worked, but made use of Broker functions which
now just redirect to CAF ones.
2018-07-17 14:25:21 -05:00
Jon Siwek
c09fe427a8 Improve Specific_RE_Matcher::CompileSet() error condition cleanup 2018-07-16 16:07:34 -05:00
Jon Siwek
463e540c9b Merge remote-tracking branch 'origin/topic/vern/case-insensitive-patterns'
* origin/topic/vern/case-insensitive-patterns:
  use PCRE syntax instead of the beautiful new (?i ...) syntax
  nitlet in NEWS entry
  test suite update for case-insensitive patterns
  document use of double quotes to escape case-insensitivity
  bug fix for recent memory leak patch
  documentation updates for case-insensitive patterns
  d'oh there's isalpha.  I looked earlier for isletter :-P
  fix for handling [:(lower|upper):] in case-insensitive patterns
  implemented /re/i for case-insensitive patterns
2018-07-16 16:04:38 -05:00
Jon Siwek
a45039de00 Merge remote-tracking branch 'origin/topic/vern/runtime-pattern-bifs'
* origin/topic/vern/runtime-pattern-bifs:
  de-restrict pattern-oriented BiFs to no longer require only running at init
2018-07-16 11:03:27 -05:00