Commit graph

2206 commits

Author SHA1 Message Date
Robin Sommer
19d66be0aa Removing pkg/make-*-packages scripts.
We aren't using them anymore for the packages we distribute. Because
of that, they haven't been supported in a while, and have problems.

BIT-1509 #closed
2016-08-01 08:35:38 -07:00
Robin Sommer
3513cfc219 Merge remote-tracking branch 'origin/topic/johanna/bit-1644'
BIT-1644 #merged

* origin/topic/johanna/bit-1644:
  Correct endianness of IP addresses in SNMP.
2016-08-01 08:14:54 -07:00
Robin Sommer
dd06f8b290 Merge remote-tracking branch 'origin/topic/johanna/bit-1651'
BIT-1651 #merged

* origin/topic/johanna/bit-1651:
  Fix behavior of connection_pending event
2016-08-01 08:13:57 -07:00
Robin Sommer
743e563dd9 Updating doc test baseline. 2016-07-26 15:06:23 -07:00
Robin Sommer
5b73345b73 Merge remote-tracking branch 'origin/topic/johanna/bit-1181'
BIT-1181 #merged

* origin/topic/johanna/bit-1181:
  Input: Further small changes to error handling
  Add error events to input framework.
2016-07-26 14:52:27 -07:00
Robin Sommer
f6ff7f1e66 Updating link in docs for deprecated plugin. 2016-07-23 07:29:32 -07:00
Robin Sommer
990f2ab0ea Merge branch 'topic/robin/bit-1612-merge' 2016-07-15 09:17:44 -07:00
Robin Sommer
4d84ee82da Merge remote-tracking branch 'origin/topic/johanna/bit-1612'
Addig a new random seed for external tests.

I added a wrapper around the siphash() function to make calling it a
little bit safer at least.

BIT-1612 #merged

* origin/topic/johanna/bit-1612:
  HLL: Fix missing typecast in test case.
  Remove the -K/-J options for setting keys.
  Add test checking the quality of HLL by adding a lot of elements.
  Fix serializing probabilistic hashers.
  Baseline updates after hash function change.
  Also switch BloomFilters from H3 to siphash.
  Change Hashing from H3 to Siphash.
  HLL: Remove unnecessary comparison.
  Hyperloglog: change calculation of Rho
2016-07-14 16:26:17 -07:00
Johanna Amann
1ba33bf66e Merge remote-tracking branch 'origin/topic/robin/missing-syn-2'
* origin/topic/robin/missing-syn-2:
  Change TCP analysis to process connections without the initial SYN as non-partial connections.

BIT-1492 #merged
2016-07-12 11:42:32 -07:00
Robin Sommer
214abc6180 Merge remote-tracking branch 'origin/topic/johanna/sigalg'
BIT-1646 #merged

* origin/topic/johanna/sigalg:
  Forgotten types file for signature algorithm extension
  SSL: add support for signature_algorithms extension.
2016-07-12 10:21:25 -07:00
Johanna Amann
fa83497f26 Merge remote-tracking branch 'origin/topic/dnthayer/ticket1645'
* origin/topic/dnthayer/ticket1645:
  Disable broker by default

I added the --disable-broker back to configure (as a no-op), to not
break the build for everyone that is currently doing that in their build
scripts.

BIT-1645 #merged
2016-07-11 11:25:37 -07:00
Johanna Amann
74e98565f4 Merge remote-tracking branch 'origin/topic/robin/history-rxmit'
* origin/topic/robin/history-rxmit:
  Flagging retransmissions in connection history.
  Removing ack_above_hole event.

BIT-977 #merged
2016-07-08 19:30:10 -07:00
Robin Sommer
0c080bca7a Extendign connection history field to flag when Bro flips a
connection's endpoints.

The character is '^'.

Addresses BIT-1629.
2016-07-08 14:56:52 -07:00
Robin Sommer
75e3f9bc69 Removing ack_above_hole event.
This was a subset of content_gap and led to plenty noise.

Addresses BIT-688.
2016-07-06 15:35:21 -07:00
Robin Sommer
ca3f7eadbe Fix segfault when an existing enum identifier is added again with a
different value.

Addresses BIT-931.

Also switching the internal enum ID map to storing std::string for
easier memory management.
2016-07-05 17:54:10 -07:00
Robin Sommer
09ea84bb6e Merge remote-tracking branch 'origin/topic/johanna/netcontrol-improvements'
Great work, and great documentation!

I'm getting one test failure with
scripts.base.frameworks.netcontrol.catch-and-release-cluster Going
ahead and commiting, Jenkins will show the details I assume.

BIT-1584 #merged

* origin/topic/johanna/netcontrol-improvements:
  SMTP does not need to pull in the notice framework.
  Write NetControl framework documentation.
  Use NetControl for ACTION_DROP of notice framework.
  NetControl: slightly update catch and release logging
  NetControl: fix several small logging issues
  NetControl: more catch and release logging and cluster fix
  NetControl: rewrite catch and release and small fixes.
  NetControl: find_rules_subnet works in cluster mode
  NetControl: fix acld whitelist command
  NetControl: add rule exists as state besides added and failure.
  NetControl: Suppress duplicate "plugin activated" messages.
  NetControl: make new broker plugin options accessible
  NetControl: add predicates to broker plugin
2016-06-30 17:34:44 -07:00
Robin Sommer
6e483c1f4f Updating submodule(s).
[nomail]
2016-06-30 16:55:40 -07:00
Robin Sommer
716a07adde Updating submodule(s).
[nomail]
2016-06-30 16:50:22 -07:00
Robin Sommer
7ce220f8e7 Updating submodule(s).
[nomail]
2016-06-21 22:09:45 -07:00
Robin Sommer
1b5af579be Merge remote-tracking branch 'origin/topic/johanna/leaks'
BIT-1633 #merged

* origin/topic/johanna/leaks:
  Fix one more memory leak.
  Fix two memory leaks reported on mailing list.
2016-06-21 18:25:57 -07:00
Seth Hall
5df4775cef Merge branch 'master' of ssh://git.bro.org/bro 2016-06-21 14:07:21 -04:00
Robin Sommer
66e7e4be04 Merge branch 'master' of git.bro.org:bro 2016-06-18 13:32:42 -07:00
Robin Sommer
0fc7eb1358 Merge remote-tracking branch 'origin/topic/johanna/bit-1578'
One tweak: I made ts optional and set it to network_time() if not given.

BIT-1578 #merged

* origin/topic/johanna/bit-1578:
  Weird: fix potential small issue when ignoring duplicates
  Rewrite weird logging.
2016-06-18 09:55:11 -07:00
Seth Hall
ba3214cee5 Add some documentation for modbus data types.
This also removes a field named "len" from the ModbusHeaders
record type because it's not really necessary.
2016-06-18 01:46:07 -04:00
Seth Hall
db659c55a1 Merge branch 'J-Gras-topic/jgras/bit-1507' 2016-06-16 16:50:17 -04:00
Johanna Amann
efab728876 Merge branch 'topic/jgras/input-default' of https://github.com/J-Gras/bro
* 'topic/jgras/input-default' of https://github.com/J-Gras/bro:
  Fixed &default values ignored by input framework.

BIT-1623 #merged
2016-06-15 17:32:50 -07:00
Robin Sommer
41eb50f9db Updating tests for HTTP filename field change.
(Updating NEWS as well.)
2016-06-15 09:28:49 -07:00
Robin Sommer
b698cfc2ce Fixing memory leak in changed table expiration code. 2016-06-15 09:09:27 -07:00
Robin Sommer
2335a62a07 Preventing the event processing from looping endlessly when an event
reraised itself during execution of its handlers.
2016-06-14 18:11:32 -07:00
Robin Sommer
ddabd13097 Updating submodule(s).
[nomail]
2016-06-14 17:43:09 -07:00
Robin Sommer
9da02ecae4 Merge branch 'topic/jgras/expire-redef' of https://github.com/J-Gras/bro
Extended error handling a bit, and increased serialization
data format version.
2016-06-14 17:22:25 -07:00
Robin Sommer
a4db7f1359 Merge remote-tracking branch 'origin/topic/johanna/bit-1619'
BIT-1619 #merged

* origin/topic/johanna/bit-1619:
  Fix precedence of hook
2016-06-14 16:11:33 -07:00
Robin Sommer
151f9d6ced Fixing Covertity warning (CID 1356391). 2016-06-13 08:17:09 -07:00
Robin Sommer
f662989c09 Fixing typo in BIF macros.
Reported by Jeff Barber.
2016-06-07 15:53:55 -07:00
Robin Sommer
3189276320 Merge remote-tracking branch 'origin/topic/dnthayer/ticket1472'
* origin/topic/dnthayer/ticket1472:
  Add new functions for calculating geographic distance

BIT-1472 #merged
2016-06-07 12:40:31 -07:00
Robin Sommer
351014f48a Fixing memory leak triggered by new MAC address logging. 2016-06-07 11:46:56 -07:00
Johanna Amann
b2371752e4 Merge remote-tracking branch 'origin/topic/dnthayer/ticket1616'
I changed the patch slightly - now debug.log is only created, if a debug
stream is enabled.

BIT-1616 #merged

* origin/topic/dnthayer/ticket1616:
  Don't create debug.log immediately upon startup
2016-06-07 11:09:22 -07:00
Robin Sommer
58dea28504 Merge remote-tracking branch 'origin/topic/johanna/windows-newlines'
(Added a double-check that line isn't completely empty.)

BIT-1198 #merged

* origin/topic/johanna/windows-newlines:
  Ascii Input: Accept dos/windows newlines.
2016-06-06 18:14:21 -07:00
Robin Sommer
17dc28b8a8 Merge remote-tracking branch 'origin/topic/seth/remove-unescaped_special_char-weird'
BIT-1611 #merged

* origin/topic/seth/remove-unescaped_special_char-weird:
  Add urldecoding for the unofficial %u00AE style of encoding.
  Remove the unescaped_special_char HTTP weird.
2016-06-06 18:05:38 -07:00
Robin Sommer
a2423f7d43 Adding missing script file. 2016-05-30 10:58:43 -07:00
Robin Sommer
57aef6d49f Add MAC addresses to connection record.
c$eth_src and c$eth_dst now contain the Ethernet address if available.
A new script protocols/conn/mac-logging.bro adds these to conn.log
when loaded.
2016-05-29 17:18:47 -07:00
Robin Sommer
35686fb93a Fixing Coverity warning.
Addresses CID 1356116.
2016-05-29 11:02:39 -07:00
Robin Sommer
3581ead0d9 Ignoring packets with negative timestamps.
These used to stall Bro. Addresses BIT-1562 and BIT-1443.
2016-05-23 13:22:22 -07:00
Robin Sommer
4f9cb6912a Fix for a table refering to a expire function that's not defined.
I was hoping to report this right at startup through a static check
but turns out we don't have the right machinery in place for that.
That would need to be done after the AST has been finalized, but our
AST traversal code can't iterate over types. So instead I've changed
this so that it's still being reported at runtime but at least
doesn't crash Bro anymore.

Closes BIT-1597.
2016-05-23 12:48:34 -07:00
Robin Sommer
0fa9590902 Updating submodule(s).
[nomail]
2016-05-23 08:26:52 -07:00
Robin Sommer
85213e6b55 Merge remote-tracking branch 'origin/topic/johanna/fix-analyzer-addition'
* origin/topic/johanna/fix-analyzer-addition:
  DTLS: Use magix constant from rfc5389 for stun detection.
  DTLS: Fix binpac bug with DTLSv1.2 client hellos
  Forgot to remove debug output.
  DTLS: Fix interaction with STUN
  Fix the way that child analyzers are added.

BIT-1604 #merged
2016-05-18 07:41:18 -07:00
Robin Sommer
b1c0306e4a Updating submodule(s).
[nomail]
2016-05-17 16:26:45 -07:00
Johanna Amann
4851cbc7cc Merge remote-tracking branch 'origin/topic/dnthayer/ticket1601'
* origin/topic/dnthayer/ticket1601:
  Fix some failing plugin tests on OS X 10.11

BIT-1601 #merged
2016-05-16 20:11:20 -07:00
Johanna Amann
49ca47895d Merge remote-tracking branch 'origin/topic/dnthayer/ticket1595'
* origin/topic/dnthayer/ticket1595:
  Fix a bug in receiving remote logs via broker

BIT-1595 #merged
2016-05-12 08:06:42 -07:00
Robin Sommer
b23ed77819 Updating submodule(s).
[nomail]
2016-05-07 12:24:20 -07:00