mirror of
https://github.com/zeek/zeek.git
synced 2025-10-07 09:08:20 +00:00
Merge branch 'master' into topic/jsiwek/file-analysis
This commit is contained in:
commit
1f6cac9b6d
37 changed files with 114 additions and 225 deletions
17
CHANGES
17
CHANGES
|
@ -1,4 +1,21 @@
|
||||||
|
|
||||||
|
2.1-357 | 2013-03-08 09:18:35 -0800
|
||||||
|
|
||||||
|
* Fix race-condition in table-event test. (Bernhard Amann)
|
||||||
|
|
||||||
|
* s/bro-ids.org/bro.org/g. (Robin Sommer)
|
||||||
|
|
||||||
|
2.1-353 | 2013-03-07 13:31:37 -0800
|
||||||
|
|
||||||
|
* Fix function type-equivalence requiring same parameter names.
|
||||||
|
Addresses #957. (Jon Siwek)
|
||||||
|
|
||||||
|
2.1-351 | 2013-03-07 13:27:29 -0800
|
||||||
|
|
||||||
|
* Fix new/delete mismatch. Addresses #958. (Jacob Baines)
|
||||||
|
|
||||||
|
* Fix compiler warnings. (Jon Siwek)
|
||||||
|
|
||||||
2.1-347 | 2013-03-06 16:48:44 -0800
|
2.1-347 | 2013-03-06 16:48:44 -0800
|
||||||
|
|
||||||
* Remove unused parameter from vector assignment method. (Bernhard Amann)
|
* Remove unused parameter from vector assignment method. (Bernhard Amann)
|
||||||
|
|
12
INSTALL
12
INSTALL
|
@ -4,7 +4,7 @@
|
||||||
.. _MacPorts: http://www.macports.org
|
.. _MacPorts: http://www.macports.org
|
||||||
.. _Fink: http://www.finkproject.org
|
.. _Fink: http://www.finkproject.org
|
||||||
.. _Homebrew: http://mxcl.github.com/homebrew
|
.. _Homebrew: http://mxcl.github.com/homebrew
|
||||||
.. _bro downloads page: http://bro-ids.org/download/index.html
|
.. _bro downloads page: http://bro.org/download/index.html
|
||||||
|
|
||||||
==============
|
==============
|
||||||
Installing Bro
|
Installing Bro
|
||||||
|
@ -189,15 +189,15 @@ Bro releases are bundled into source packages for convenience and
|
||||||
available from the `bro downloads page`_.
|
available from the `bro downloads page`_.
|
||||||
|
|
||||||
Alternatively, the latest Bro development version can be obtained through git
|
Alternatively, the latest Bro development version can be obtained through git
|
||||||
repositories hosted at `git.bro-ids.org <http://git.bro-ids.org>`_. See
|
repositories hosted at `git.bro.org <http://git.bro.org>`_. See
|
||||||
our `git development documentation
|
our `git development documentation
|
||||||
<http://bro-ids.org/development/process.html>`_ for comprehensive
|
<http://bro.org/development/process.html>`_ for comprehensive
|
||||||
information on Bro's use of git revision control, but the short story
|
information on Bro's use of git revision control, but the short story
|
||||||
for downloading the full source code experience for Bro via git is:
|
for downloading the full source code experience for Bro via git is:
|
||||||
|
|
||||||
.. console::
|
.. console::
|
||||||
|
|
||||||
git clone --recursive git://git.bro-ids.org/bro
|
git clone --recursive git://git.bro.org/bro
|
||||||
|
|
||||||
.. note:: If you choose to clone the ``bro`` repository non-recursively for
|
.. note:: If you choose to clone the ``bro`` repository non-recursively for
|
||||||
a "minimal Bro experience", be aware that compiling it depends on
|
a "minimal Bro experience", be aware that compiling it depends on
|
||||||
|
@ -230,7 +230,7 @@ automatically. Finally, use ``make install-aux`` to install some of
|
||||||
the other programs that are in the ``aux/bro-aux`` directory.
|
the other programs that are in the ``aux/bro-aux`` directory.
|
||||||
|
|
||||||
OpenBSD users, please see our FAQ at
|
OpenBSD users, please see our FAQ at
|
||||||
http://www.bro-ids.org/documentation/faq.html if you are having
|
http://www.bro.org/documentation/faq.html if you are having
|
||||||
problems installing Bro.
|
problems installing Bro.
|
||||||
|
|
||||||
|
|
||||||
|
@ -298,7 +298,7 @@ Running Bro
|
||||||
|
|
||||||
Bro is a complex program and it takes a bit of time to get familiar
|
Bro is a complex program and it takes a bit of time to get familiar
|
||||||
with it. A good place for newcomers to start is the Quick Start Guide
|
with it. A good place for newcomers to start is the Quick Start Guide
|
||||||
at http://www.bro-ids.org/documentation/quickstart.html.
|
at http://www.bro.org/documentation/quickstart.html.
|
||||||
|
|
||||||
For developers that wish to run Bro directly from the ``build/``
|
For developers that wish to run Bro directly from the ``build/``
|
||||||
directory (i.e., without performing ``make install``), they will have
|
directory (i.e., without performing ``make install``), they will have
|
||||||
|
|
4
NEWS
4
NEWS
|
@ -292,7 +292,7 @@ Bro 2.0
|
||||||
As the version number jump suggests, Bro 2.0 is a major upgrade and
|
As the version number jump suggests, Bro 2.0 is a major upgrade and
|
||||||
lots of things have changed. We have assembled a separate upgrade
|
lots of things have changed. We have assembled a separate upgrade
|
||||||
guide with the most important changes compared to Bro 1.5 at
|
guide with the most important changes compared to Bro 1.5 at
|
||||||
http://www.bro-ids.org/documentation/upgrade.html. You can find
|
http://www.bro.org/documentation/upgrade.html. You can find
|
||||||
the offline version of that document in ``doc/upgrade.rst.``.
|
the offline version of that document in ``doc/upgrade.rst.``.
|
||||||
|
|
||||||
Compared to the earlier 2.0 Beta version, the major changes in the
|
Compared to the earlier 2.0 Beta version, the major changes in the
|
||||||
|
@ -300,7 +300,7 @@ final release are:
|
||||||
|
|
||||||
* The default scripts now come with complete reference
|
* The default scripts now come with complete reference
|
||||||
documentation. See
|
documentation. See
|
||||||
http://www.bro-ids.org/documentation/index.html.
|
http://www.bro.org/documentation/index.html.
|
||||||
|
|
||||||
* libz and libmagic are now required dependencies.
|
* libz and libmagic are now required dependencies.
|
||||||
|
|
||||||
|
|
2
README
2
README
|
@ -11,7 +11,7 @@ Please see COPYING for licensing information.
|
||||||
For more documentation, research publications, and community contact
|
For more documentation, research publications, and community contact
|
||||||
information, please see Bro's home page:
|
information, please see Bro's home page:
|
||||||
|
|
||||||
http://www.bro-ids.org
|
http://www.bro.org
|
||||||
|
|
||||||
On behalf of the Bro Development Team,
|
On behalf of the Bro Development Team,
|
||||||
|
|
||||||
|
|
2
VERSION
2
VERSION
|
@ -1 +1 @@
|
||||||
2.1-347
|
2.1-357
|
||||||
|
|
|
@ -1 +1 @@
|
||||||
Subproject commit 09ff521f9804a711a59e64192eb110286b56ae23
|
Subproject commit 72d121ade5a37df83d3252646de51cb77ce69a89
|
|
@ -1 +1 @@
|
||||||
Subproject commit a9900d03a0bcc7f5e94999e63068cd36118f9fac
|
Subproject commit ae14da422bfb252c8a53bd00d3e5fd7da8bc112e
|
|
@ -1 +1 @@
|
||||||
Subproject commit 6a7ce301bab11bfeabf7c03e0a236c8c1f85181c
|
Subproject commit e64204fec55759c614a276c1933bbff2069a63db
|
|
@ -1 +1 @@
|
||||||
Subproject commit 90a400410c3c22e579f9ee0d23881c6f25bd259d
|
Subproject commit 3d2172a60aa503745c92cef8ab3020d1dfc13f0d
|
|
@ -1 +1 @@
|
||||||
Subproject commit ba0700fe448895b654b90d50f389f6f1341234cb
|
Subproject commit d5b8df42cb9c398142e02d4bf8ede835fd0227f4
|
2
cmake
2
cmake
|
@ -1 +1 @@
|
||||||
Subproject commit 599c3fa916a8d746a535666955ab4439bea20471
|
Subproject commit 94e72a3075bb0b9550ad05758963afda394bfb2c
|
4
doc/_templates/layout.html
vendored
4
doc/_templates/layout.html
vendored
|
@ -10,7 +10,7 @@
|
||||||
{% endblock %}
|
{% endblock %}
|
||||||
|
|
||||||
{% block header %}
|
{% block header %}
|
||||||
<iframe src="http://www.bro-ids.org/frames/header-no-logo.html" width="100%" height="100px" frameborder="0" marginheight="0" scrolling="no" marginwidth="0">
|
<iframe src="http://www.bro.org/frames/header-no-logo.html" width="100%" height="100px" frameborder="0" marginheight="0" scrolling="no" marginwidth="0">
|
||||||
</iframe>
|
</iframe>
|
||||||
{% endblock %}
|
{% endblock %}
|
||||||
|
|
||||||
|
@ -108,6 +108,6 @@
|
||||||
{% endblock %}
|
{% endblock %}
|
||||||
|
|
||||||
{% block footer %}
|
{% block footer %}
|
||||||
<iframe src="http://www.bro-ids.org/frames/footer.html" width="100%" height="420px" frameborder="0" marginheight="0" scrolling="no" marginwidth="0">
|
<iframe src="http://www.bro.org/frames/footer.html" width="100%" height="420px" frameborder="0" marginheight="0" scrolling="no" marginwidth="0">
|
||||||
</iframe>
|
</iframe>
|
||||||
{% endblock %}
|
{% endblock %}
|
||||||
|
|
|
@ -53,7 +53,7 @@ Other Bro Components
|
||||||
The following are snapshots of documentation for components that come
|
The following are snapshots of documentation for components that come
|
||||||
with this version of Bro (|version|). Since they can also be used
|
with this version of Bro (|version|). Since they can also be used
|
||||||
independently, see the `download page
|
independently, see the `download page
|
||||||
<http://bro-ids.org/download/index.html>`_ for documentation of any
|
<http://bro.org/download/index.html>`_ for documentation of any
|
||||||
current, independent component releases.
|
current, independent component releases.
|
||||||
|
|
||||||
.. toctree::
|
.. toctree::
|
||||||
|
|
|
@ -111,7 +111,7 @@ protocol-dependent activity that's occurring. E.g. ``http.log``'s next few
|
||||||
columns (shortened for brevity) show a request to the root of Bro website::
|
columns (shortened for brevity) show a request to the root of Bro website::
|
||||||
|
|
||||||
# method host uri referrer user_agent
|
# method host uri referrer user_agent
|
||||||
GET bro-ids.org / - <...>Chrome/12.0.742.122<...>
|
GET bro.org / - <...>Chrome/12.0.742.122<...>
|
||||||
|
|
||||||
Some logs are worth explicit mention:
|
Some logs are worth explicit mention:
|
||||||
|
|
||||||
|
|
|
@ -19,7 +19,7 @@ Reporting Problems
|
||||||
|
|
||||||
Generally, when you encounter a problem with Bro, the best thing to do
|
Generally, when you encounter a problem with Bro, the best thing to do
|
||||||
is opening a new ticket in `Bro's issue tracker
|
is opening a new ticket in `Bro's issue tracker
|
||||||
<http://tracker.bro-ids.org/>`__ and include information on how to
|
<http://tracker.bro.org/>`__ and include information on how to
|
||||||
reproduce the issue. Ideally, your ticket should come with the
|
reproduce the issue. Ideally, your ticket should come with the
|
||||||
following:
|
following:
|
||||||
|
|
||||||
|
|
|
@ -254,7 +254,7 @@ Variable Naming
|
||||||
|
|
||||||
- Identifiers may have been renamed to conform to new `scripting
|
- Identifiers may have been renamed to conform to new `scripting
|
||||||
conventions
|
conventions
|
||||||
<http://www.bro-ids.org/development/script-conventions.html>`_
|
<http://www.bro.org/development/script-conventions.html>`_
|
||||||
|
|
||||||
|
|
||||||
BroControl
|
BroControl
|
||||||
|
@ -296,7 +296,7 @@ Development Infrastructure
|
||||||
Bro development has moved from using SVN to Git for revision control.
|
Bro development has moved from using SVN to Git for revision control.
|
||||||
Users that want to use the latest Bro development snapshot by checking it out
|
Users that want to use the latest Bro development snapshot by checking it out
|
||||||
from the source repositories should see the `development process
|
from the source repositories should see the `development process
|
||||||
<http://www.bro-ids.org/development/process.html>`_. Note that all the various
|
<http://www.bro.org/development/process.html>`_. Note that all the various
|
||||||
sub-components now reside in their own repositories. However, the
|
sub-components now reside in their own repositories. However, the
|
||||||
top-level Bro repository includes them as git submodules so it's easy
|
top-level Bro repository includes them as git submodules so it's easy
|
||||||
to check them all out simultaneously.
|
to check them all out simultaneously.
|
||||||
|
|
|
@ -39,7 +39,7 @@ export {
|
||||||
## The node type doing all the actual traffic analysis.
|
## The node type doing all the actual traffic analysis.
|
||||||
WORKER,
|
WORKER,
|
||||||
## A node acting as a traffic recorder using the
|
## A node acting as a traffic recorder using the
|
||||||
## `Time Machine <http://tracker.bro-ids.org/time-machine>`_ software.
|
## `Time Machine <http://tracker.bro.org/time-machine>`_ software.
|
||||||
TIME_MACHINE,
|
TIME_MACHINE,
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
@ -496,7 +496,7 @@ static RE_Matcher* matcher_merge(const RE_Matcher* re1, const RE_Matcher* re2,
|
||||||
safe_snprintf(merge_text, n, "(%s)%s(%s)", text1, merge_op, text2);
|
safe_snprintf(merge_text, n, "(%s)%s(%s)", text1, merge_op, text2);
|
||||||
|
|
||||||
RE_Matcher* merge = new RE_Matcher(merge_text);
|
RE_Matcher* merge = new RE_Matcher(merge_text);
|
||||||
delete merge_text;
|
delete [] merge_text;
|
||||||
|
|
||||||
merge->Compile();
|
merge->Compile();
|
||||||
|
|
||||||
|
|
|
@ -155,7 +155,7 @@ SerialObj* SerialObj::Unserialize(UnserialInfo* info, SerialType type)
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
// Broccoli compatibility mode with 32bit pids.
|
// Broccoli compatibility mode with 32bit pids.
|
||||||
uint32 tmp;
|
uint32 tmp = 0;
|
||||||
result = UNSERIALIZE(&full_obj) && UNSERIALIZE(&tmp);
|
result = UNSERIALIZE(&full_obj) && UNSERIALIZE(&tmp);
|
||||||
pid = tmp;
|
pid = tmp;
|
||||||
}
|
}
|
||||||
|
|
|
@ -712,7 +712,7 @@ int FuncType::MatchesIndex(ListExpr*& index) const
|
||||||
MATCHES_INDEX_SCALAR : DOES_NOT_MATCH_INDEX;
|
MATCHES_INDEX_SCALAR : DOES_NOT_MATCH_INDEX;
|
||||||
}
|
}
|
||||||
|
|
||||||
int FuncType::CheckArgs(const type_list* args) const
|
int FuncType::CheckArgs(const type_list* args, bool is_init) const
|
||||||
{
|
{
|
||||||
const type_list* my_args = arg_types->Types();
|
const type_list* my_args = arg_types->Types();
|
||||||
|
|
||||||
|
@ -720,7 +720,7 @@ int FuncType::CheckArgs(const type_list* args) const
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
for ( int i = 0; i < my_args->length(); ++i )
|
for ( int i = 0; i < my_args->length(); ++i )
|
||||||
if ( ! same_type((*args)[i], (*my_args)[i]) )
|
if ( ! same_type((*args)[i], (*my_args)[i], is_init) )
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
return 1;
|
return 1;
|
||||||
|
@ -1722,7 +1722,7 @@ int same_type(const BroType* t1, const BroType* t2, int is_init)
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
return same_type(ft1->Args(), ft2->Args(), is_init);
|
return ft1->CheckArgs(ft2->ArgTypes()->Types(), is_init);
|
||||||
}
|
}
|
||||||
|
|
||||||
case TYPE_RECORD:
|
case TYPE_RECORD:
|
||||||
|
|
|
@ -370,11 +370,9 @@ public:
|
||||||
{ Unref(yield); yield = 0; flavor = arg_flav; }
|
{ Unref(yield); yield = 0; flavor = arg_flav; }
|
||||||
|
|
||||||
int MatchesIndex(ListExpr*& index) const;
|
int MatchesIndex(ListExpr*& index) const;
|
||||||
int CheckArgs(const type_list* args) const;
|
int CheckArgs(const type_list* args, bool is_init = false) const;
|
||||||
|
|
||||||
TypeList* ArgTypes() { return arg_types; }
|
TypeList* ArgTypes() const { return arg_types; }
|
||||||
|
|
||||||
ID* GetReturnValueID() const;
|
|
||||||
|
|
||||||
void Describe(ODesc* d) const;
|
void Describe(ODesc* d) const;
|
||||||
void DescribeReST(ODesc* d) const;
|
void DescribeReST(ODesc* d) const;
|
||||||
|
|
|
@ -3535,7 +3535,7 @@ function lookup_addr%(host: addr%) : string
|
||||||
|
|
||||||
## Issues an asynchronous TEXT DNS lookup and delays the function result.
|
## Issues an asynchronous TEXT DNS lookup and delays the function result.
|
||||||
## This function can therefore only be called inside a ``when`` condition,
|
## This function can therefore only be called inside a ``when`` condition,
|
||||||
## e.g., ``when ( local h = lookup_hostname_txt("www.bro-ids.org") ) { f(h); }``.
|
## e.g., ``when ( local h = lookup_hostname_txt("www.bro.org") ) { f(h); }``.
|
||||||
##
|
##
|
||||||
## host: The hostname to lookup.
|
## host: The hostname to lookup.
|
||||||
##
|
##
|
||||||
|
@ -3564,7 +3564,7 @@ function lookup_hostname_txt%(host: string%) : string
|
||||||
|
|
||||||
## Issues an asynchronous DNS lookup and delays the function result.
|
## Issues an asynchronous DNS lookup and delays the function result.
|
||||||
## This function can therefore only be called inside a ``when`` condition,
|
## This function can therefore only be called inside a ``when`` condition,
|
||||||
## e.g., ``when ( local h = lookup_hostname("www.bro-ids.org") ) { f(h); }``.
|
## e.g., ``when ( local h = lookup_hostname("www.bro.org") ) { f(h); }``.
|
||||||
##
|
##
|
||||||
## host: The hostname to lookup.
|
## host: The hostname to lookup.
|
||||||
##
|
##
|
||||||
|
|
|
@ -167,7 +167,7 @@ string DataSeries::BuildDSSchemaFromFieldTypes(const vector<SchemaValue>& vals,
|
||||||
|
|
||||||
string xmlschema = "<ExtentType name=\""
|
string xmlschema = "<ExtentType name=\""
|
||||||
+ sTitle
|
+ sTitle
|
||||||
+ "\" version=\"1.0\" namespace=\"bro-ids.org\">\n";
|
+ "\" version=\"1.0\" namespace=\"bro.org\">\n";
|
||||||
|
|
||||||
for( size_t i = 0; i < vals.size(); ++i )
|
for( size_t i = 0; i < vals.size(); ++i )
|
||||||
{
|
{
|
||||||
|
|
|
@ -38,7 +38,7 @@ flow NetFlow_Flow {
|
||||||
# %cleanup does not only put the cleanup code into the destructor,
|
# %cleanup does not only put the cleanup code into the destructor,
|
||||||
# but also at the end of the catch clause in NewData(). This is
|
# but also at the end of the catch clause in NewData(). This is
|
||||||
# different from the documentation at
|
# different from the documentation at
|
||||||
# http://www.bro-ids.org/wiki/index.php/BinPAC_Userguide#.25cleanup.7B....25.7D
|
# http://www.bro.org/wiki/index.php/BinPAC_Userguide#.25cleanup.7B....25.7D
|
||||||
#
|
#
|
||||||
# Unfortunately this means that we cannot clean up the identifier
|
# Unfortunately this means that we cannot clean up the identifier
|
||||||
# string. Note that IOSource destructors seemingly are never
|
# string. Note that IOSource destructors seemingly are never
|
||||||
|
|
|
@ -336,7 +336,7 @@ ascii2prefix (int family, char *string)
|
||||||
memcpy (save, string, cp - string);
|
memcpy (save, string, cp - string);
|
||||||
save[cp - string] = '\0';
|
save[cp - string] = '\0';
|
||||||
string = save;
|
string = save;
|
||||||
if (bitlen < 0 || bitlen > maxbitlen)
|
if (bitlen > maxbitlen)
|
||||||
bitlen = maxbitlen;
|
bitlen = maxbitlen;
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
|
|
|
@ -76,7 +76,7 @@ typedef int32 ptr_compat_int;
|
||||||
#define PRI_PTR_COMPAT_INT PRId32
|
#define PRI_PTR_COMPAT_INT PRId32
|
||||||
#define PRI_PTR_COMPAT_UINT PRIu32
|
#define PRI_PTR_COMPAT_UINT PRIu32
|
||||||
#else
|
#else
|
||||||
# error "Unusual pointer size. Please report to bro@bro-ids.org."
|
# error "Unusual pointer size. Please report to bro@bro.org."
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
extern "C"
|
extern "C"
|
||||||
|
|
4
testing/btest/Baseline/language.func-assignment/out
Normal file
4
testing/btest/Baseline/language.func-assignment/out
Normal file
|
@ -0,0 +1,4 @@
|
||||||
|
Brogrammers, like bowties, are cool. Brogrammers, like bowties, are cool. Brogrammers, like bowties, are cool.
|
||||||
|
Brogrammers, like bowties, are cool. Brogrammers, like bowties, are cool.
|
||||||
|
BROGRAMMERS, LIKE BOWTIES, ARE COOL.
|
||||||
|
BROGRAMMERS, LIKE BOWTIES, ARE COOL.
|
|
@ -1,189 +1,21 @@
|
||||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::MANUAL, name=input, destination={
|
|
||||||
[2] = T,
|
|
||||||
[4] = F,
|
|
||||||
[6] = F,
|
|
||||||
[7] = T,
|
|
||||||
[1] = T,
|
|
||||||
[5] = F,
|
|
||||||
[3] = F
|
|
||||||
}, idx=<no value description>, val=<no value description>, want_record=F, ev=line
|
|
||||||
{
|
|
||||||
print outfile, description;
|
|
||||||
print outfile, tpe;
|
|
||||||
print outfile, left;
|
|
||||||
print outfile, right;
|
|
||||||
try = try + 1;
|
|
||||||
if (7 == try)
|
|
||||||
{
|
|
||||||
close(outfile);
|
|
||||||
terminate();
|
|
||||||
}
|
|
||||||
|
|
||||||
}, pred=<uninitialized>, config={
|
|
||||||
|
|
||||||
}]
|
|
||||||
Input::EVENT_NEW
|
Input::EVENT_NEW
|
||||||
[i=1]
|
[i=1]
|
||||||
T
|
T
|
||||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::MANUAL, name=input, destination={
|
|
||||||
[2] = T,
|
|
||||||
[4] = F,
|
|
||||||
[6] = F,
|
|
||||||
[7] = T,
|
|
||||||
[1] = T,
|
|
||||||
[5] = F,
|
|
||||||
[3] = F
|
|
||||||
}, idx=<no value description>, val=<no value description>, want_record=F, ev=line
|
|
||||||
{
|
|
||||||
print outfile, description;
|
|
||||||
print outfile, tpe;
|
|
||||||
print outfile, left;
|
|
||||||
print outfile, right;
|
|
||||||
try = try + 1;
|
|
||||||
if (7 == try)
|
|
||||||
{
|
|
||||||
close(outfile);
|
|
||||||
terminate();
|
|
||||||
}
|
|
||||||
|
|
||||||
}, pred=<uninitialized>, config={
|
|
||||||
|
|
||||||
}]
|
|
||||||
Input::EVENT_NEW
|
Input::EVENT_NEW
|
||||||
[i=2]
|
[i=2]
|
||||||
T
|
T
|
||||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::MANUAL, name=input, destination={
|
|
||||||
[2] = T,
|
|
||||||
[4] = F,
|
|
||||||
[6] = F,
|
|
||||||
[7] = T,
|
|
||||||
[1] = T,
|
|
||||||
[5] = F,
|
|
||||||
[3] = F
|
|
||||||
}, idx=<no value description>, val=<no value description>, want_record=F, ev=line
|
|
||||||
{
|
|
||||||
print outfile, description;
|
|
||||||
print outfile, tpe;
|
|
||||||
print outfile, left;
|
|
||||||
print outfile, right;
|
|
||||||
try = try + 1;
|
|
||||||
if (7 == try)
|
|
||||||
{
|
|
||||||
close(outfile);
|
|
||||||
terminate();
|
|
||||||
}
|
|
||||||
|
|
||||||
}, pred=<uninitialized>, config={
|
|
||||||
|
|
||||||
}]
|
|
||||||
Input::EVENT_NEW
|
Input::EVENT_NEW
|
||||||
[i=3]
|
[i=3]
|
||||||
F
|
F
|
||||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::MANUAL, name=input, destination={
|
|
||||||
[2] = T,
|
|
||||||
[4] = F,
|
|
||||||
[6] = F,
|
|
||||||
[7] = T,
|
|
||||||
[1] = T,
|
|
||||||
[5] = F,
|
|
||||||
[3] = F
|
|
||||||
}, idx=<no value description>, val=<no value description>, want_record=F, ev=line
|
|
||||||
{
|
|
||||||
print outfile, description;
|
|
||||||
print outfile, tpe;
|
|
||||||
print outfile, left;
|
|
||||||
print outfile, right;
|
|
||||||
try = try + 1;
|
|
||||||
if (7 == try)
|
|
||||||
{
|
|
||||||
close(outfile);
|
|
||||||
terminate();
|
|
||||||
}
|
|
||||||
|
|
||||||
}, pred=<uninitialized>, config={
|
|
||||||
|
|
||||||
}]
|
|
||||||
Input::EVENT_NEW
|
Input::EVENT_NEW
|
||||||
[i=4]
|
[i=4]
|
||||||
F
|
F
|
||||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::MANUAL, name=input, destination={
|
|
||||||
[2] = T,
|
|
||||||
[4] = F,
|
|
||||||
[6] = F,
|
|
||||||
[7] = T,
|
|
||||||
[1] = T,
|
|
||||||
[5] = F,
|
|
||||||
[3] = F
|
|
||||||
}, idx=<no value description>, val=<no value description>, want_record=F, ev=line
|
|
||||||
{
|
|
||||||
print outfile, description;
|
|
||||||
print outfile, tpe;
|
|
||||||
print outfile, left;
|
|
||||||
print outfile, right;
|
|
||||||
try = try + 1;
|
|
||||||
if (7 == try)
|
|
||||||
{
|
|
||||||
close(outfile);
|
|
||||||
terminate();
|
|
||||||
}
|
|
||||||
|
|
||||||
}, pred=<uninitialized>, config={
|
|
||||||
|
|
||||||
}]
|
|
||||||
Input::EVENT_NEW
|
Input::EVENT_NEW
|
||||||
[i=5]
|
[i=5]
|
||||||
F
|
F
|
||||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::MANUAL, name=input, destination={
|
|
||||||
[2] = T,
|
|
||||||
[4] = F,
|
|
||||||
[6] = F,
|
|
||||||
[7] = T,
|
|
||||||
[1] = T,
|
|
||||||
[5] = F,
|
|
||||||
[3] = F
|
|
||||||
}, idx=<no value description>, val=<no value description>, want_record=F, ev=line
|
|
||||||
{
|
|
||||||
print outfile, description;
|
|
||||||
print outfile, tpe;
|
|
||||||
print outfile, left;
|
|
||||||
print outfile, right;
|
|
||||||
try = try + 1;
|
|
||||||
if (7 == try)
|
|
||||||
{
|
|
||||||
close(outfile);
|
|
||||||
terminate();
|
|
||||||
}
|
|
||||||
|
|
||||||
}, pred=<uninitialized>, config={
|
|
||||||
|
|
||||||
}]
|
|
||||||
Input::EVENT_NEW
|
Input::EVENT_NEW
|
||||||
[i=6]
|
[i=6]
|
||||||
F
|
F
|
||||||
[source=../input.log, reader=Input::READER_ASCII, mode=Input::MANUAL, name=input, destination={
|
|
||||||
[2] = T,
|
|
||||||
[4] = F,
|
|
||||||
[6] = F,
|
|
||||||
[7] = T,
|
|
||||||
[1] = T,
|
|
||||||
[5] = F,
|
|
||||||
[3] = F
|
|
||||||
}, idx=<no value description>, val=<no value description>, want_record=F, ev=line
|
|
||||||
{
|
|
||||||
print outfile, description;
|
|
||||||
print outfile, tpe;
|
|
||||||
print outfile, left;
|
|
||||||
print outfile, right;
|
|
||||||
try = try + 1;
|
|
||||||
if (7 == try)
|
|
||||||
{
|
|
||||||
close(outfile);
|
|
||||||
terminate();
|
|
||||||
}
|
|
||||||
|
|
||||||
}, pred=<uninitialized>, config={
|
|
||||||
|
|
||||||
}]
|
|
||||||
Input::EVENT_NEW
|
Input::EVENT_NEW
|
||||||
[i=7]
|
[i=7]
|
||||||
T
|
T
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
<ExtentType name="ssh" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="ssh" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
|
|
@ -19,7 +19,7 @@ test.2011-03-07-12-00-05.ds test 11-03-07_12.00.05 11-03-07_12.59.55 1 dataserie
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -47,7 +47,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -75,7 +75,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -103,7 +103,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -131,7 +131,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -159,7 +159,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -187,7 +187,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -215,7 +215,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -243,7 +243,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
@ -271,7 +271,7 @@ t id.orig_h id.orig_p id.resp_h id.resp_p
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="test" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="test" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
|
|
@ -8,7 +8,7 @@
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="ssh" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="ssh" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="t" pack_relative="t" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
<field type="int64" name="id.orig_p" />
|
<field type="int64" name="id.orig_p" />
|
||||||
|
|
|
@ -8,7 +8,7 @@
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="conn" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="conn" version="1.0" namespace="bro.org">
|
||||||
<field type="int64" name="ts" pack_relative="ts" units="microseconds" epoch="unix"/>
|
<field type="int64" name="ts" pack_relative="ts" units="microseconds" epoch="unix"/>
|
||||||
<field type="variable32" name="uid" pack_unique="yes"/>
|
<field type="variable32" name="uid" pack_unique="yes"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
|
|
|
@ -8,7 +8,7 @@
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="conn" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="conn" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="ts" pack_relative="ts" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="ts" pack_relative="ts" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="uid" pack_unique="yes"/>
|
<field type="variable32" name="uid" pack_unique="yes"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
|
|
|
@ -8,7 +8,7 @@
|
||||||
<field type="variable32" name="xmltype" />
|
<field type="variable32" name="xmltype" />
|
||||||
</ExtentType>
|
</ExtentType>
|
||||||
|
|
||||||
<ExtentType name="http" version="1.0" namespace="bro-ids.org">
|
<ExtentType name="http" version="1.0" namespace="bro.org">
|
||||||
<field type="double" name="ts" pack_relative="ts" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
<field type="double" name="ts" pack_relative="ts" pack_scale="1e-6" print_format="%.6f" pack_scale_warn="no"/>
|
||||||
<field type="variable32" name="uid" pack_unique="yes"/>
|
<field type="variable32" name="uid" pack_unique="yes"/>
|
||||||
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
<field type="variable32" name="id.orig_h" pack_unique="yes"/>
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
This a test suite of small "unit tests" that verify individual pieces of Bro
|
This a test suite of small "unit tests" that verify individual pieces of Bro
|
||||||
functionality. They all utilize BTest, a simple framework/driver for
|
functionality. They all utilize BTest, a simple framework/driver for
|
||||||
writing unit tests. More information about BTest can be found at
|
writing unit tests. More information about BTest can be found at
|
||||||
http://www.bro-ids.org/development/btest.html
|
http://www.bro.org/development/btest.html
|
||||||
|
|
||||||
The test suite's BTest configuration is handled through the
|
The test suite's BTest configuration is handled through the
|
||||||
``btest.cfg`` file. Of particular interest is the "TestDirs" settings,
|
``btest.cfg`` file. Of particular interest is the "TestDirs" settings,
|
||||||
|
@ -61,7 +61,7 @@ Adding Tests
|
||||||
=============
|
=============
|
||||||
|
|
||||||
See either the `BTest documentation
|
See either the `BTest documentation
|
||||||
<http://www.bro-ids.org/development/btest.html>`_ or the existing unit
|
<http://www.bro.org/development/btest.html>`_ or the existing unit
|
||||||
tests for examples of what they actually look like. The essential
|
tests for examples of what they actually look like. The essential
|
||||||
components of a new test include:
|
components of a new test include:
|
||||||
|
|
||||||
|
|
39
testing/btest/language/func-assignment.bro
Normal file
39
testing/btest/language/func-assignment.bro
Normal file
|
@ -0,0 +1,39 @@
|
||||||
|
# @TEST-EXEC: bro -b %INPUT >out
|
||||||
|
# @TEST-EXEC: btest-diff out
|
||||||
|
|
||||||
|
function double_string(s: string): string
|
||||||
|
{
|
||||||
|
return string_cat(s, " ", s);
|
||||||
|
}
|
||||||
|
|
||||||
|
function triple_string(str: string): string
|
||||||
|
{
|
||||||
|
return string_cat(str, " ", str, " ", str);
|
||||||
|
}
|
||||||
|
|
||||||
|
type sample_function: record {
|
||||||
|
s: string;
|
||||||
|
f: function(str: string): string;
|
||||||
|
};
|
||||||
|
|
||||||
|
event bro_init()
|
||||||
|
{
|
||||||
|
local test_sf: sample_function;
|
||||||
|
test_sf$s = "Brogrammers, like bowties, are cool.";
|
||||||
|
|
||||||
|
test_sf$f = triple_string;
|
||||||
|
print test_sf$f(test_sf$s);
|
||||||
|
|
||||||
|
test_sf$f = double_string;
|
||||||
|
print test_sf$f(test_sf$s);
|
||||||
|
|
||||||
|
# Works as expected
|
||||||
|
test_sf$f = function(str: string): string
|
||||||
|
{ return to_upper(str); };
|
||||||
|
print test_sf$f(test_sf$s);
|
||||||
|
|
||||||
|
# Func arg names shouldn't factor in to the type check.
|
||||||
|
test_sf$f = function(s: string): string
|
||||||
|
{ return to_upper(s); };
|
||||||
|
print test_sf$f(test_sf$s);
|
||||||
|
}
|
|
@ -35,7 +35,6 @@ global destination: table[int] of Val = table();
|
||||||
|
|
||||||
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: bool)
|
event line(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: bool)
|
||||||
{
|
{
|
||||||
print outfile, description;
|
|
||||||
print outfile, tpe;
|
print outfile, tpe;
|
||||||
print outfile, left;
|
print outfile, left;
|
||||||
print outfile, right;
|
print outfile, right;
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue