Bro is an open-source, Unix-based Network Intrusion Detection System (NIDS)
that passively monitors network traffic and looks for suspicious activity.
Bro detects intrusions by first parsing network traffic to extract its
application-level semantics and then executing event-oriented analyzers that
compare the activity with patterns deemed troublesome. Its analysis includes
detection of specific attacks (including those defined by signatures, but
also those defined in terms of events) and unusual activities (e.g., certain
hosts connecting to certain services, or patterns of failed connection
attempts).
Bro is documented in the USENIX 1998 Security Conference proceedings.
WWW: https://www.bro.org/
===> The following configuration options are available for bro-2.6.4_1:
BROCCOLI=off: Build support for libbroccoli communications (DEPRECATED)
BROCTL=on: BroControl support (implies BROKER and IPSUMDUMP)
BROKER=on: Enable the Broker communication library
DEBUG=off: Build with debugging support
GEOIP2=on: Build with GeoIP2 (MaxMindDB) support
IPSUMDUMP=on: Enables traffic summaries
LBL_CF=on: Unix time to formated time/date filter support
LBL_HF=on: Address to hostname filter support
NETMAP=on: Native Netmap Packet IOSource for Bro
PERFTOOLS=off: Use Perftools to improve memory & CPU usage
===> Use 'make config' to modify these settings
security/bro: Deprecate giving users until June 1st, 2020 to migrate
to the new security/zeek port. Add CONFLICTS=zeek due to overlap.
Approved by: matthew (mentor, implicit)
security/bro: Deprecate BROCCOLI
Broccoli is deprecated in favor of broker; flag this in the BROCCOLI
option description and change the BROCTL option to imply BROKER.
PR: 240909
Submitted by: Jeremy Baggs
Approved by: ler (mentor, implicit)
security/bro: Update to 2.6.4 and address a potential Denial of
Service vulnerability:
https://raw.githubusercontent.com/zeek/zeek/3b5a9f88ece1d274edee897837e280ef751bde94/NEWS
- The NTLM analyzer did not properly handle AV Pair sequences that
were either empty or unterminated, resulting in invalid memory
access or heap buffer over-read. The NTLM analyzer is enabled
by default and used in the analysis of SMB, DCE/RPC, and GSSAPI
protocols.
Approved by: ler (mentor, implicit)
MFH: 2019Q3
Security: 55571619-454e-4769-b1e5-28354659e152
security/bro: Update to 2.6.3 and address potential denial of service
vulnerabilities:
https://raw.githubusercontent.com/zeek/zeek/1d874e5548a58b3b8fd2a342fe4aa0944e779809/NEWS
- Null pointer dereference in the RPC analysis code. RPC analyzers
(e.g. MOUNT or NFS) are not enabled in the default configuration.
- Signed integer overflow in BinPAC-generated parser code. The
result of this is Undefined Behavior with respect to the array
bounds checking conditions that BinPAC generates, so it's
unpredictable what an optimizing compiler may actually do under
the assumption that signed integer overlows should never happen.
The specific symptom which lead to finding this issue was with
the PE analyzer causing out-of-memory crashes due to large
allocations that were otherwise prevented when the array bounds
checking logic was changed to prevent any possible signed integer
overlow.
Approved by: matthew (mentor, implicit)
MFH: 2019Q3
Security: f56669f5-d799-4ff5-9174-64a6d571c451
Bump PORTREVISION for ports depending on the canonical version of GCC
as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3
to GCC 9.1 under most circumstances now after revision 507371.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.
PR: 238330
security/bro: Update to 2.6.2 and address several denial of service
vulnerabilities:
https://raw.githubusercontent.com/zeek/zeek/bb979702cf9a2fa67b8d1a1c7f88d0b56c6af104/NEWS
- Integer type mismatches in BinPAC-generated parser code and Bro
analyzer code may allow for crafted packet data to cause
unintentional code paths in the analysis logic to be taken due
to unsafe integer conversions causing the parser and analysis
logic to each expect different fields to have been parsed. One
such example, reported by Maksim Shudrak, causes the Kerberos
analyzer to dereference a null pointer. CVE-2019-12175 was
assigned for this issue.
- The Kerberos parser allows for several fields to be left
(Only the first 15 lines of the commit message are shown above )
Restore GeoIP support via net/libmaxminddb and a new GEOIP2 option
which defaults to enabled, mimicking pre-geoip-deprecation.
PR: 235138
Submitted by: bofh
Approved by: ler (mentor, implicit)
Change cmake default behaviour to outsource.
Ports that build out of source now simply can use "USES=cmake"
instead of "USES=cmake:outsource". Ports that fail to build
out of source now need to specify "USES=cmake:insource".
I tried to only set insource where explictely needed.
PR: 232038
Exp-run by: antoine
Update to 2.6.1:
- Update the embedded SQLite library from 3.18.0 to 3.26.0 to
address a remote code execution vulnerability ("Magellan").
- Uses a bundled version of the actor-framework (caf) library so
we can remove the port-local build for caf.
Replace broctl-config.sh absolute symlink with a relative one.
Approved by: ler (mentor, implicit)
MFH: 2018Q4
Security: b80f039d-579e-4b82-95ad-b534a709f220
Bump PORTREVISION for ports depending on the canonical version of GCC
defined via Mk/bsd.default-versions.mk which has moved from GCC 7.4 t
GCC 8.2 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, as a double check, everything INDEX-11 showed depending on lang/gcc7.
PR: 231590
Bro 2.5.5 does not build under 12.0-ALPHA10 due to openssl 1.1.1
in the base. Unbreak build by statically linking against
security/openssl. This is a stopgap until Bro 2.6 which supports
openssl 1.1 is released. It is currently in beta and due in a
few weeks.
Add missing NETMAP_DESC while we're here.
Reviewed by: ler (mentor)
Approved by: ler (mentor)
Differential Revision: https://reviews.freebsd.org/D17602
Update to 2.5.5 which addresses security issues:
- Fix array bounds checking in BinPAC: for arrays that are
fields within a record, the bounds check was based on a pointer
to the start of the record rather than the start of the array
field, potentially resulting in a buffer over-read.
- Fix SMTP command string comparisons: the number of bytes
compared was based on the user-supplied string length and can
lead to incorrect matches. e.g. giving a command of "X"
incorrectly matched "X-ANONYMOUSTLS" (and an empty commands
match anything).
- Weird" events are now generally suppressed/sampled by default
according to some tunable parameters.
(Only the first 15 lines of the commit message are shown above )
Bump PORTREVISION for ports depending on the canonical version of GCC
in the ports tree (via Mk/bsd.default-versions.mk and lang/gcc) which
has now moved from GCC 6 to GCC 7 by default.
This includes ports
- featuring USE_GCC=yes or USE_GCC=any,
- featuring USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and those
- with USES=compiler specifying one of openmp, nestedfct, c11, c++0x,
c++11-lib, c++11-lang, c++14-lang, c++17-lang, or gcc-c++11-lib.
PR: 222542
Update to 2.5.4 which fixes multiple memory allocation issues:
- Multiple fixes and improvements to BinPAC generated code
related to array parsing, with potential impact to all Bro's
BinPAC-generated analyzers in the form of buffer over-reads
or other invalid memory accesses depending on whether a
particular analyzer incorrectly assumed that the
evaulated-array-length expression is actually the number of
elements that were parsed out from the input.
- The NCP analyzer (not enabled by default and also updated
to actually work with newer Bro APIs in the release) performed
a memory allocation based directly on a field in the input
packet and using signed integer storage. This could result
in a signed integer overflow and memory allocations of
(Only the first 15 lines of the commit message are shown above )
r412841 of devel/google-perftools changed the path for bin/pprof
to bin/perftools-pprof; update RUN_DEPENDS for security/bro
accordingly.
Reported by: James Welcher
Reviewed by: ler (mentor)
Approved by: ler (mentor)
Differential Revision: https://reviews.freebsd.org/D14708
Add a NETMAP option to build and install the bro netmap plugin.
PR: 224918
Reported by: Shane Peters
Reviewed by: matthew (mentor)
Approved by: matthew (mentor)
Differential Revision: https://reviews.freebsd.org/D14378
Update to 2.5.2. Changes since 2.5.1:
- Patch OOB write in content-line analyzer:
https://bro-tracker.atlassian.net/browse/BIT-1856
A combination of packets can trigger an out of bound write of
'0' byte in the content-line analyzer.
Reviewed by: ler (mentor)
Approved by: ler (mentor)
Differential Revision: https://reviews.freebsd.org/D12754
Bump PORTREVISION for ports depending on the canonical version of GCC
(via Mk/bsd.default-versions.mk and lang/gcc) which has moved from
GCC 5.4 to GCC 6.4 under most circumstances.
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using Mk/bsd.octave.mk which in turn features USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c++11-lib, c++11-lang,
c++14-lang, c++0x, c11, or gcc-c++11-lib.
PR: 219275
Bump PORTREVISIONs for ports depending on the canonical version of GCC and
lang/gcc which have moved from GCC 4.9.4 to GCC 5.4 (at least under some
circumstances such as versions of FreeBSD or platforms).
This includes ports
- with USE_GCC=yes or USE_GCC=any,
- with USES=fortran,
- using using Mk/bsd.octave.mk which in turn has USES=fortran, and
- with USES=compiler specifying openmp, nestedfct, c++11-lib, c++14-lang,
c++11-lang, c++0x, c11, or gcc-c++11-lib.
PR: 216707
Do not redefine DEBUG_DESC when its meaning more or less matches the default
option description. Those ports where it meant something more specific were
left untouched.
securty/bro: Modernize options, remove Ports SSL option, support LibreSSL
The "build with Ports SSL" option is no longer valid. The SSL library is
selected through the SSL_DEFAULT value. While removing the PORTS_SSL
option, modernize the entire set of options under the general
infrastructure blanket. The SSL work, including the support for LibreSSL
was done under the SSL blanket.
Fix usage of WITH_OPENSSL_BASE, WITH_OPENSSL_PORT and OPENSSL_PORT.
WITH_OPENSSL_* can't be set after bsd.port.pre.mk.
Fold all other usage into using SSL_DEFAULT == foo
PR: 210149
Submitted by: mat
Exp-run by: antoine
Sponsored by: The FreeBSD Foundation, Absolight
Differential Revision: https://reviews.freebsd.org/D6577
security/bro, security/broccoli: 2.3 -> 2.3.2
This updates bro and broccoli from 2.3 and 2.3.2, which is a security
update.
Changes to the bro port:
- Rework openssl option logic
- Remove obsolete
- pkgng related changes
Changes to the broccoli port:
- Remove unused DOCS option
- Enable PYTHON by default
- pkgng related changes
- Minor portlint changes
(Only the first 15 lines of the commit message are shown above )
Remove support for pkg_install
Merge back bsd.pkgng.mk into bsd.port.mk
Add a note about @stopdaemon not being supported anymore
With hat: portmgr
Differential Revision: https://reviews.freebsd.org/D693
- Fix packaging with pkgng: create empty dirs to be packed in STAGEDIR
- Fix build on FreeBSD 8: depend on libmagic ABI version from ports
- While here, use new LIB_DEPENDS syntax
PR: ports/184194
PR: ports/184381
Submitted by: Craig Leres (maintainer)
Reported by: Mark Martinec and pkg-fallout
- Split broccoli library into separate port
- Use new infrastructure
- Bump PORTREVISION
PR: ports/182475
Submitted by: Craig Leres <leres@ee.lbl.gov> (maintainer)
- Make as BROKEN: missing prerequisites
CMake Error at aux/binpac/CMakeLists.txt:17 (message):
Could not find prerequisite package 'Perl'
Reported by: pointyhat
Feature safe: yes
The vast majority of pkg-descr files had the following format when they
had both lines:
Author: ...
WWW: ....
So standardize on that, and move them to the end of the file when necessary.
Also fix some more whitespace, and remove more "signature tags" of varying
forms, like -- name, etc.
s/AUTHOR/Author/
A few other various formatting issues
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS)
- Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead
PR: 157936
Submitted by: myself
Exp-runs by: pav
Approved by: pav
Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script.
Specifically, newer autoconf (> 2.13) has different semantic of the
configure target. In short, one should use --build=CONFIGURE_TARGET
instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning
and the old semantic may be removed in later autoconf releases.
To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.
To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.
Changes to Mk/*:
- Add runtime detection magic in bsd.port.mk
(Only the first 15 lines of the commit message are shown above )
security/bro, port upgrade to version 1.2.1, take over maintainership
This is an upgrade of the security/bro port to the current
stable version. The port is very complex, so it needs to
be tested carefully to make sure that I'm not screwing
anything up or using wrong conventions. Also, I'm willing
to take over maintainership of the port if it's accepted
into the tree.
Please note, there are several files that need to be removed
from the port and quite a few that need to be added. All
these files are in FILESDIR. I have provided blank patches
for the files that need to be removed, so the patches will
create blank files.
Added IS_INTERACTIVE to the port
Left original freebsd header comments in it.
Next time please use one big patch-file instead of lots of little ones :-)
PR: ports/114999
Submitted by: Paul Schmehl <pauls@utdallas.edu>
Mark BROKEN (see bento logs). These ports are scheduled for removal
after Feb 2 2004 if they are still broken at that time and no fixes
have been submitted by PR.
