zeek-dev December 2015

zeek-dev@lists.zeek.org

79 discussions

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ---------- ------------ ---------- ------------- ---------- ------------------------------------------------------------- BIT-1490 [1] BroControl Seth Hall Justin Azoff 2015-12-11 2.5 Low Need ability to expire logs with more granularity than #days. Open GitHub Pull Requests ========================= Issue Component User Updated Title ------- ----------- -------------------- ---------- ------------------------------------------------------------------------ #49 [2] bro wglodek [3] 2015-12-23 update ParseRequest to handle missing uri [4] #46 [5] bro albertzaharovits [6] 2015-12-18 HTTP Content-Disposition header updates filename field in HTTP::Info [7] #3 [8] broctl aeppert [9] 2015-12-30 Wrap interface for running a custom plugin [10] [1] BIT-1490 https://bro-tracker.atlassian.net/browse/BIT-1490 [2] Pull Request #49 https://github.com/bro/bro/pull/49 [3] wglodek https://github.com/wglodek [4] Merge Pull Request #49 with git pull --no-ff --no-commit https://github.com/0xcc-labs/bro.git topic/http-missing-uri [5] Pull Request #46 https://github.com/bro/bro/pull/46 [6] albertzaharovits https://github.com/albertzaharovits [7] Merge Pull Request #46 with git pull --no-ff --no-commit https://github.com/albertzaharovits/bro.git master [8] Pull Request #3 https://github.com/bro/broctl/pull/3 [9] aeppert https://github.com/aeppert [10] Merge Pull Request #3 with git pull --no-ff --no-commit https://github.com/aeppert/broctl.git master

5 years, 2 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

5 years, 2 months

[Bro-Dev] Error: Analyzer:: defined more than once.

by reda sabir

Hello everyone, I tried recently to add an analyzer of RLogin protocol by using BinPac. The problem that I encount is after doing the make and make install, I have this message every I launch bro : fatal error in /usr/local/bro/share/bro/base/init-bare.bro, line 1: Component 'Analyzer::RLOGIN' defined more than once. You can find in the email the src that I use in "src/analyzer/protocol/rlogin/" Thank you for your help

5 years, 2 months

[Bro-Dev] [JIRA] (BIT-1516) openbsd build issues

by Justin Azoff (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1516?page=com.atlassian.jira.p… ] Justin Azoff commented on BIT-1516: ----------------------------------- {code} [ 2%] bifs.enable_raw_output ... failed [ 7%] bifs.piped_exec ... failed [ 25%] core.pcap.dumper ... failed [ 39%] doc.sphinx.include-doc_frameworks_sumstats-countconns_bro ... failed [ 49%] istate.pybroccoli ... failed [ 56%] language.raw_output_attr ... failed [ 63%] plugins.api-version-mismatch ... failed [ 63%] plugins.bifs-and-scripts ... failed [ 63%] plugins.bifs-and-scripts-install ... failed [ 63%] plugins.file ... failed [ 63%] plugins.hooks ... failed [ 63%] plugins.init-plugin ... failed [ 63%] plugins.pktdumper ... failed [ 64%] plugins.pktsrc ... failed [ 64%] plugins.protocol ... failed [ 64%] plugins.reader ... failed [ 64%] plugins.writer ... failed [ 64%] scripts.base.files.extract.limit ... failed [ 65%] scripts.base.frameworks.analyzer.schedule-analyzer ... failed [ 65%] scripts.base.frameworks.control.shutdown ... failed [ 66%] scripts.base.frameworks.file-analysis.http.get ... failed [ 67%] scripts.base.frameworks.file-analysis.http.multipart ... failed [ 67%] scripts.base.frameworks.file-analysis.http.pipeline ... failed [ 67%] scripts.base.frameworks.file-analysis.http.post ... failed [ 67%] scripts.base.frameworks.file-analysis.irc ... failed [ 70%] scripts.base.frameworks.input.raw.executestdin ... failed [ 77%] scripts.base.frameworks.logging.remote-types ... failed [ 77%] scripts.base.frameworks.logging.rotate ... failed [ 78%] scripts.base.frameworks.logging.rotate-custom ... failed [ 78%] scripts.base.frameworks.logging.sqlite.wikipedia ... failed [ 85%] scripts.base.protocols.http.content-range-gap ... failed [ 95%] scripts.policy.frameworks.intel.seen.certs ... failed {code} > openbsd build issues > -------------------- > > Key: BIT-1516 > URL: https://bro-tracker.atlassian.net/browse/BIT-1516 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.4 > Environment: OpenBSD > Reporter: Justin Azoff > Priority: Low > Labels: openbsd > Attachments: openbsd_diag.log.gz > > > Someone on IRC asked about bro on openbsd issues. I took a look and here is what I have found so far. There are 3 issues: > bro needs the libbind port installed to build, but cmake has trouble finding it > Changing FindBIND.cmake lets configure works: > {code} > - HINTS ${BIND_ROOT_DIR}/lib > + HINTS ${BIND_ROOT_DIR}/lib/libbind > {code} > This probably needs to be > {code} > HINTS ${BIND_ROOT_DIR}/lib ${BIND_ROOT_DIR}/lib/libbind > {code} > or such to not break other platforms > The second is that {code}pcap_offline_filter{code} does not exist in the version of pcap it has (though I did my testing on openbsd 5.5 so the latest (5.8) may be different) > Finally, openbsd does not have {code}wordexp{code} so src/broxygen/Manager.cc does not build. I ifdef'd it out most of {code}Manager::Manager{code} and bro built ok after that. I'm not sure what it is doing there anyway.. -- This message was sent by Atlassian JIRA (v7.1.0-OD-02-030#71001)

5 years, 2 months

[Bro-Dev] [JIRA] (BIT-1516) openbsd build issues

by Justin Azoff (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1516?page=com.atlassian.jira.p… ] Justin Azoff commented on BIT-1516: ----------------------------------- Trying to get the test suite to run: {code} sudo ln -s /usr/local/bin/python2.7 /usr/local/bin/python {code} to get it to find python.. The testing makefile fails with: {code} mktemp: insufficient number of Xs in template `brocov.tmp.XXX' {code} apparently you need 6 X's. same for aux/btest/sphinx/btest-rst-cmd even though it seems to run fine, it outputs {code} bro:/usr/lib/libc.so.73.1: /usr/local/lib/libbind/libbind.so.4.0 : WARNING: symbol(_res) size mismatch, relink your program {code} every time you run it, which is making btest think every test failed.. I added {code} grep -v 'relink your program' {code} to btest-diff in 2 places as a hack to work around that... and it is still showing up in some places.. Plugin testing looks to be broken: {code} plugins.api-version-mismatch ... failed % 'bash /home/vagrant/bro-2.4.1/testing/btest/.tmp/plugins.api-version-mismatch/api-version-mismatch.sh' failed unexpectedly (exit code 1) % cat .stderr find: -not: unknown option cat: src/Plugin.cc: No such file or directory {code} End result: 32 of 802 tests failed, 61 skipped > openbsd build issues > -------------------- > > Key: BIT-1516 > URL: https://bro-tracker.atlassian.net/browse/BIT-1516 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.4 > Environment: OpenBSD > Reporter: Justin Azoff > Priority: Low > Labels: openbsd > Attachments: openbsd_diag.log.gz > > > Someone on IRC asked about bro on openbsd issues. I took a look and here is what I have found so far. There are 3 issues: > bro needs the libbind port installed to build, but cmake has trouble finding it > Changing FindBIND.cmake lets configure works: > {code} > - HINTS ${BIND_ROOT_DIR}/lib > + HINTS ${BIND_ROOT_DIR}/lib/libbind > {code} > This probably needs to be > {code} > HINTS ${BIND_ROOT_DIR}/lib ${BIND_ROOT_DIR}/lib/libbind > {code} > or such to not break other platforms > The second is that {code}pcap_offline_filter{code} does not exist in the version of pcap it has (though I did my testing on openbsd 5.5 so the latest (5.8) may be different) > Finally, openbsd does not have {code}wordexp{code} so src/broxygen/Manager.cc does not build. I ifdef'd it out most of {code}Manager::Manager{code} and bro built ok after that. I'm not sure what it is doing there anyway.. -- This message was sent by Atlassian JIRA (v7.1.0-OD-02-030#71001)

5 years, 2 months

[Bro-Dev] [JIRA] (BIT-1516) openbsd build issues

by Justin Azoff (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1516?page=com.atlassian.jira.p… ] Justin Azoff updated BIT-1516: ------------------------------ Attachment: openbsd_diag.log.gz > openbsd build issues > -------------------- > > Key: BIT-1516 > URL: https://bro-tracker.atlassian.net/browse/BIT-1516 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.4 > Environment: OpenBSD > Reporter: Justin Azoff > Priority: Low > Labels: openbsd > Attachments: openbsd_diag.log.gz > > > Someone on IRC asked about bro on openbsd issues. I took a look and here is what I have found so far. There are 3 issues: > bro needs the libbind port installed to build, but cmake has trouble finding it > Changing FindBIND.cmake lets configure works: > {code} > - HINTS ${BIND_ROOT_DIR}/lib > + HINTS ${BIND_ROOT_DIR}/lib/libbind > {code} > This probably needs to be > {code} > HINTS ${BIND_ROOT_DIR}/lib ${BIND_ROOT_DIR}/lib/libbind > {code} > or such to not break other platforms > The second is that {code}pcap_offline_filter{code} does not exist in the version of pcap it has (though I did my testing on openbsd 5.5 so the latest (5.8) may be different) > Finally, openbsd does not have {code}wordexp{code} so src/broxygen/Manager.cc does not build. I ifdef'd it out most of {code}Manager::Manager{code} and bro built ok after that. I'm not sure what it is doing there anyway.. -- This message was sent by Atlassian JIRA (v7.1.0-OD-02-030#71001)

5 years, 2 months

[Bro-Dev] [JIRA] (BIT-1516) openbsd build issues

by Justin Azoff (JIRA)

Justin Azoff created BIT-1516: --------------------------------- Summary: openbsd build issues Key: BIT-1516 URL: https://bro-tracker.atlassian.net/browse/BIT-1516 Project: Bro Issue Tracker Issue Type: Problem Components: Bro Affects Versions: 2.4 Environment: OpenBSD Reporter: Justin Azoff Priority: Low Someone on IRC asked about bro on openbsd issues. I took a look and here is what I have found so far. There are 3 issues: bro needs the libbind port installed to build, but cmake has trouble finding it Changing FindBIND.cmake lets configure works: {code} - HINTS ${BIND_ROOT_DIR}/lib + HINTS ${BIND_ROOT_DIR}/lib/libbind {code} This probably needs to be {code} HINTS ${BIND_ROOT_DIR}/lib ${BIND_ROOT_DIR}/lib/libbind {code} or such to not break other platforms The second is that {code}pcap_offline_filter{code} does not exist in the version of pcap it has (though I did my testing on openbsd 5.5 so the latest (5.8) may be different) Finally, openbsd does not have {code}wordexp{code} so src/broxygen/Manager.cc does not build. I ifdef'd it out most of {code}Manager::Manager{code} and bro built ok after that. I'm not sure what it is doing there anyway.. -- This message was sent by Atlassian JIRA (v7.1.0-OD-02-030#71001)

5 years, 2 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ---------- ------------ ---------- ------------- ---------- ------------------------------------------------------------- BIT-1490 [1] BroControl Seth Hall Justin Azoff 2015-12-11 2.5 Low Need ability to expire logs with more granularity than #days. Open GitHub Pull Requests ========================= Issue Component User Updated Title ------- ----------- -------------------- ---------- ------------------------------------------------------------------------ #49 [2] bro wglodek [3] 2015-12-23 update ParseRequest to handle missing uri [4] #46 [5] bro albertzaharovits [6] 2015-12-18 HTTP Content-Disposition header updates filename field in HTTP::Info [7] [1] BIT-1490 https://bro-tracker.atlassian.net/browse/BIT-1490 [2] Pull Request #49 https://github.com/bro/bro/pull/49 [3] wglodek https://github.com/wglodek [4] Merge Pull Request #49 with git pull --no-ff --no-commit https://github.com/0xcc-labs/bro.git topic/http-missing-uri [5] Pull Request #46 https://github.com/bro/bro/pull/46 [6] albertzaharovits https://github.com/albertzaharovits [7] Merge Pull Request #46 with git pull --no-ff --no-commit https://github.com/albertzaharovits/bro.git master

5 years, 2 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ---------- ------------ ---------- ------------- ---------- ------------------------------------------------------------- BIT-1490 [1] BroControl Seth Hall Justin Azoff 2015-12-11 2.5 Low Need ability to expire logs with more granularity than #days. Open GitHub Pull Requests ========================= Issue Component User Updated Title ------- ----------- -------------------- ---------- ------------------------------------------------------------------------ #49 [2] bro wglodek [3] 2015-12-23 update ParseRequest to handle missing uri [4] #46 [5] bro albertzaharovits [6] 2015-12-18 HTTP Content-Disposition header updates filename field in HTTP::Info [7] [1] BIT-1490 https://bro-tracker.atlassian.net/browse/BIT-1490 [2] Pull Request #49 https://github.com/bro/bro/pull/49 [3] wglodek https://github.com/wglodek [4] Merge Pull Request #49 with git pull --no-ff --no-commit https://github.com/0xcc-labs/bro.git topic/http-missing-uri [5] Pull Request #46 https://github.com/bro/bro/pull/46 [6] albertzaharovits https://github.com/albertzaharovits [7] Merge Pull Request #46 with git pull --no-ff --no-commit https://github.com/albertzaharovits/bro.git master

5 years, 2 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ---------- ------------ ---------- ------------- ---------- ------------------------------------------------------------- BIT-1490 [1] BroControl Seth Hall Justin Azoff 2015-12-11 2.5 Low Need ability to expire logs with more granularity than #days. Open GitHub Pull Requests ========================= Issue Component User Updated Title ------- ----------- -------------------- ---------- ------------------------------------------------------------------------ #49 [2] bro wglodek [3] 2015-12-23 update ParseRequest to handle missing uri [4] #46 [5] bro albertzaharovits [6] 2015-12-18 HTTP Content-Disposition header updates filename field in HTTP::Info [7] [1] BIT-1490 https://bro-tracker.atlassian.net/browse/BIT-1490 [2] Pull Request #49 https://github.com/bro/bro/pull/49 [3] wglodek https://github.com/wglodek [4] Merge Pull Request #49 with git pull --no-ff --no-commit https://github.com/0xcc-labs/bro.git topic/http-missing-uri [5] Pull Request #46 https://github.com/bro/bro/pull/46 [6] albertzaharovits https://github.com/albertzaharovits [7] Merge Pull Request #46 with git pull --no-ff --no-commit https://github.com/albertzaharovits/bro.git master

5 years, 2 months

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

zeek-dev December 2015