Commit graph

6667 commits

Author SHA1 Message Date
Jon Siwek
88af106b6b Fix use of deprecated gperftools headers.
As of gperftools 2.0 (Feb. 2012), they've been renamed in to
gperftools/ instead of google/, and as of gperftools 2.2, including
the later emits deprecation warnings.
2015-02-11 13:56:34 -06:00
Jon Siwek
07cba950b8 Fix gcc compile warnings. 2015-02-10 16:14:49 -06:00
Jon Siwek
6d868d83be broker integration: fix unit tests to work when broker is not enabled. 2015-02-10 13:44:04 -06:00
Jon Siwek
bdf21c054a broker integration: add (un)publish/(un)advertise functions
For when one wants to manually tune pub/sub behavior instead of use the
default automatic settings of allowing publication to all peers and
advertising all subscriptions to all peers.
2015-02-10 09:51:57 -06:00
Jon Siwek
ebc9407a2b broker integration: add knobs to set auto publish/advertise behavior 2015-02-09 16:26:31 -06:00
Jon Siwek
afc5767165 broker integration: add events for incoming connection status updates
e.g. for the listen() side of connections to tell when peers have
connected or disconnected.
2015-02-09 15:48:42 -06:00
Johanna Amann
5f0a27ca31 Submodule update - newest sqlite version 2015-02-09 12:10:49 -08:00
Robin Sommer
530c3c0c6b Changing load order for plugin scripts.
This can be need if they depends on each other.
2015-02-08 18:22:59 -08:00
Vlad Grigorescu
dde3ce90f8 SIP: Move to new analyzer format. 2015-02-06 19:57:48 -05:00
Vlad Grigorescu
d852fe8b52 Merge remote-tracking branch 'origin/master' into topic/vladg/sip 2015-02-06 19:49:23 -05:00
Vlad Grigorescu
95f3696c91 Kerberos: Remove debugging output. 2015-02-06 19:44:57 -05:00
Vlad Grigorescu
843afce7d9 Kerberos: Fix a memleak. 2015-02-06 19:42:34 -05:00
Vlad Grigorescu
3190ca275e SSH: Fix some memleaks. 2015-02-06 19:32:08 -05:00
Vlad Grigorescu
fc721d2d25 Merge remote-tracking branch 'origin/master' into topic/vladg/ssh 2015-02-06 18:58:38 -05:00
Jon Siwek
0253f49a94 broker integration: adapt to change in expiration_time 2015-02-06 16:54:01 -06:00
Vlad Grigorescu
9f19c74a10 Kerberos: A couple small tweaks. 2015-02-06 13:05:09 -05:00
Vlad Grigorescu
dfc42ffe8a Kerberos: Fix parsing of the cipher in tickets, and add it to the log. 2015-02-06 11:48:46 -05:00
Vlad Grigorescu
7e1fcb1a10 Merge remote-tracking branch 'origin/master' into topic/vladg/kerberos 2015-02-05 14:22:29 -05:00
Vlad Grigorescu
444ff240bd Clean up formatting. 2015-02-05 14:21:34 -05:00
Vlad Grigorescu
aea0ae453e Documentation update, and rework events a bit. 2015-02-05 14:05:56 -05:00
Seth Hall
9592f64225 Update the SOCKS analyzer to support user/pass login.
- This addresses BIT-1011
 - Add a new field to socks.log; "password".
 - Two new events; socks_login_userpass and socks_login_reply.
 - One new weird for unsupported authentication method.
 - A new test for authenticated socks traffic.
 - Credit to Nicolas Retrain for the initial patch.  Thanks!
2015-02-05 12:44:10 -05:00
Jon Siwek
1012539ded Merge branch 'topic/seth/small-files-bof-handling-fix'
* topic/seth/small-files-bof-handling-fix:
  Fix a bug in the core files framework with handling the BOF buffer.

BIT-1310 #merged
2015-02-05 10:10:00 -06:00
Seth Hall
a97cd1f3a2 Fix a bug in the core files framework with handling the BOF buffer.
- Any files where the total size was below the size of the
   default bof_buffer size couldn't have stream analyzers successfully
   attached because the bof_buffer never reached the full size
   and was never flushed.  This branch explicitly marks the buf_buffer
   as full and flushes it when the file is being removed.
2015-02-05 09:09:08 -05:00
Seth Hall
9a71f8aa86 Initial commit of RadioTap encapsulation support)
- It works for me, but I believe that one of the headers I'm stripping
   is variable length so this is unlikely to be complete.
2015-02-04 23:33:20 -05:00
Vlad Grigorescu
457ad73e6d Add support for the SAFE message type. 2015-02-04 17:28:09 -05:00
Vlad Grigorescu
b981bc6c62 Add support for AP_REQ, AP_REP, PRIV, and CRED message types. 2015-02-04 16:28:44 -05:00
Vlad Grigorescu
3b4bec18d6 Fix parsing error for KRB_Ticket_Sequence 2015-02-04 16:01:13 -05:00
Vlad Grigorescu
0071a1c003 Continue clean-up. Some reformatting, removing hard-coded values, documentation, etc. 2015-02-04 15:29:06 -05:00
Jon Siwek
4dfec04135 broker integration: add Comm::enable function
Works like old enable_communication(), but for new broker communication
mechanism.  Scripts have to explicitly call this if they want to use the
broker communication functionality.  Saves a decent chunk of Bros'
initialization time when one doesn't need communication features.
2015-02-03 16:38:56 -06:00
Jon Siwek
0cf982f1d1 broker integration: process debug/diagnostic reports from broker 2015-02-03 15:11:16 -06:00
Jon Siwek
bb9e6583e0 broker integration: Comm::Data/Store::Handle opaque serialization
For now, this is needed when locally cloning Vals.  E.g. "when"
statements will clone an entire frame and data store queries use "when"
statements, so it's likely there will be locals of these opaque types
that get cloned.
2015-02-03 14:05:04 -06:00
Seth Hall
9c692bad39 Update and clean up to file entropy measurement.
- Updated to newer file analyzer api.
2015-02-03 15:04:36 -05:00
Mike Smiley
51203d7193 "id" not defined for debug code
"id" not defined for debug code when using -DPROFILE_BRO_FUNCTIONS
2015-02-03 14:29:34 -05:00
Seth Hall
b81510592a Merge remote-tracking branch 'origin/master' into topic/seth/file-entropy 2015-02-03 14:19:57 -05:00
Jon Siwek
441c46df76 broker integration: add unit test for store clones 2015-02-03 11:57:40 -06:00
Vlad Grigorescu
2d11fafd5e Kerberos analyzer updates:
- Split up the (quite length) krb-protocol.pac into krb-protocol, krb-defs, krb-types and krb-padata
  - Add some supporting types to get rid of awkward and difficult to read case true/false statements
  - Clean up the conversion code in krb-analyzer.pac
2015-02-02 18:47:48 -05:00
Jon Siwek
05a865a907 broker integration: add master data store unti test
And fix bug w/ looking up nonexistent keys -- the resulting value data
should be "null" not "false".
2015-02-02 14:56:28 -06:00
Jon Siwek
6b115c6999 Merge branch 'master' into topic/jsiwek/broker 2015-02-02 11:45:21 -06:00
Jon Siwek
21c7642f62 Fix memory leak in new split_string* functions. 2015-02-02 11:18:06 -06:00
Robin Sommer
f82adb724c Merge remote-tracking branch 'origin/topic/jsiwek/deprecation'
Fixing one missing index adjustment (I believe ...)

BIT-757 #merged

* origin/topic/jsiwek/deprecation:
  Fix typo.
  Update documentation (broken links, outdated tests).
  Update NEWS for deprecated/changed functions.
  Deprecate split* family of BIFs.
  Improve use of &deprecated on functions.
  Add a new attribute: &deprecated.
2015-01-30 14:37:05 -08:00
Jon Siwek
9875f5d3eb broker integration: add distributed data store api
But haven't done the full gamut of testing on it yet.
2015-01-30 14:39:16 -06:00
Seth Hall
8e53e719f3 Merge remote-tracking branch 'origin/master' into topic/seth/file-entropy 2015-01-30 00:52:41 -05:00
Jon Siwek
d2ea87735a broker integration: add bifs to inspect/manipulate broker data
i.e. script-layer functions to convert between bro values and broker
values; mostly for use w/ Bro's data store interface (coming soon).
2015-01-29 10:42:48 -06:00
Jon Siwek
5527543601 broker integration: add unit tests for remote log/print/event 2015-01-26 16:53:13 -06:00
Jon Siwek
2b598e3d5a broker integration: add remote logging
It now works a bit differently than before: whether to send a remote log
write is now a property of the logging stream, not the logging filter
and it's now up the the receiver side filters to instantiate the desired
writer.  i.e. the sender now has no say in what the receiver should use
as the log writer backend.

Under the new style of remote logging, the "Log::enable_remote_logging"
option is repurposed to set the default behavior for new logging
streams.  There's also "Comm::{enable,disable}_remote_logging()" to
explicitly set the desired behavior for a given logging stream.  To
receive remote logs, one calls "Comm::subscribe_to_logs(<topic>)", where
senders implicitly use topics of the form "bro/log/<stream id>".
2015-01-26 14:24:42 -06:00
Vlad Grigorescu
1f41c0470c Improve Kerberos DPD and fix a few parse errors. 2015-01-23 17:22:10 -05:00
Jon Siwek
6cedd67c38 DNP3: fix reachable assertion and buffer over-read/overflow.
A DNP3 packet using a link layer header that specifies a zero length can
trigger an assertion failure if assertions are enabled.  Assertions are
enabled unless Bro is compiled with the NDEBUG preprocessor macro
defined.  The default configuration of Bro will define this macro and so
disables assertions, but using the --enable-debug option in the
configure script will enable assertions.  When assertions are disabled,
or also for certain length values, the DNP3 parser may attempt to pass a
negative value as the third argument to memcpy (number of bytes to copy)
and result in a buffer over-read or overflow.

Reported by Travis Emmert.
2015-01-23 11:25:00 -06:00
Jon Siwek
5df71ddc91 broker integration: add auto sending remote events
i.e. ability to toggle whether all local dispatches of an event also
generate a remote event message to peers.
2015-01-22 11:29:53 -06:00
Jon Siwek
7b2316262d Update documentation (broken links, outdated tests). 2015-01-21 16:38:31 -06:00
Jon Siwek
23f04835c6 Deprecate split* family of BIFs.
These functions are now deprecated in favor of alternative versions that
return a vector of strings rather than a table of strings.

Deprecated functions:

- split: use split_string instead.
- split1: use split_string1 instead.
- split_all: use split_string_all instead.
- split_n: use split_string_n instead.
- cat_string_array: see join_string_vec instead.
- cat_string_array_n: see join_string_vec instead.
- join_string_array: see join_string_vec instead.
- sort_string_array: use sort instead instead.
- find_ip_addresses: use extract_ip_addresses instead.

Changed functions:

- has_valid_octets: uses a string_vec parameter instead of string_array.

Addresses BIT-924, BIT-757.
2015-01-21 15:34:42 -06:00