diff --git a/CHANGES b/CHANGES
index a23d6a2fee..e3ebc76476 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,325 @@
+2.4-247 | 2016-01-19 10:19:48 -0800
+
+ * Fixing C++11 compiler warnings. (Seth Hall)
+
+ * Updating plugin documentation building. (Johanna Amann)
+
+2.4-238 | 2016-01-15 12:56:33 -0800
+
+ * Add HTTP version information to HTTP log file. (Aaron Eppert)
+
+ * Add NOTIFY as a valid SIP message, per RFC 3265. (Aaron Eppert)
+
+ * Improve HTTP parser's handling of requests that don't have a URI.
+ (William Glodek/Robin Sommer)
+
+ * Fix crash when deleting non existing record member. Addresses
+ BIT-1519. (Johanna Amann)
+
+2.4-228 | 2015-12-19 13:40:09 -0800
+
+ * Updating BroControl submodule.
+
+2.4-227 | 2015-12-18 17:47:24 -0800
+
+ * Update host name in windows-version-detection.bro. (Aaron Eppert)
+
+ * Update installation instructions to mention OpenSSL dependency for
+ newer OS X version. (Johanna Amann)
+
+ * Change a stale bro-ids.org to bro.org. (Johanna Amann)
+
+ * StartTLS support for IRC. (Johanna Amann)
+
+ * Adding usage guard to canonifier script. (Robin Sommer)
+
+2.4-217 | 2015-12-04 16:50:46 -0800
+
+ * SIP scripts code cleanup. (Seth Hall)
+
+ - Daniel Guerra pointed out a type issue for SIP request and
+ response code length fields which is now corrected.
+
+ - Some redundant code was removed.
+
+ - if/else tree modified to use switch instead.
+
+2.4-214 | 2015-12-04 16:40:15 -0800
+
+ * Delaying BinPAC initializaton until afte plugins have been
+ activated. (Robin Sommer)
+
+2.4-213 | 2015-12-04 15:25:48 -0800
+
+ * Use better data structure for storing BPF filters. (Robin Sommer)
+
+2.4-211 | 2015-11-17 13:28:29 -0800
+
+ * Making cluster reconnect timeout configurable. (Robin Sommer)
+
+ * Bugfix for child process' communication loop. (Robin Sommer)
+
+2.4-209 | 2015-11-16 07:31:22 -0800
+
+ * Updating submodule(s).
+
+2.4-207 | 2015-11-10 13:34:42 -0800
+
+ * Fix to compile with OpenSSL that has SSLv3 disalbed. (Christoph
+ Pietsch)
+
+ * Fix potential race condition when logging VLAN info to conn.log.
+ (Daniel Thayer)
+
+2.4-201 | 2015-10-27 16:11:15 -0700
+
+ * Updating NEWS. (Robin Sommer)
+
+2.4-200 | 2015-10-26 16:57:39 -0700
+
+ * Adding missing file. (Robin Sommer)
+
+2.4-199 | 2015-10-26 16:51:47 -0700
+
+ * Fix problem with the JSON Serialization code. (Aaron Eppert)
+
+2.4-188 | 2015-10-26 14:11:21 -0700
+
+ * Extending rexmit_inconsistency() event to receive an additional
+ parameter with the packet's TCP flags, if available. (Robin
+ Sommer)
+
+2.4-187 | 2015-10-26 13:43:32 -0700
+
+ * Updating NEWS for new plugins. (Robin Sommer)
+
+2.4-186 | 2015-10-23 15:07:06 -0700
+
+ * Removing pcap options for AF_PACKET support. Addresses BIT-1363.
+ (Robin Sommer)
+
+ * Correct a typo in controller.bro documentation. (Daniel Thayer)
+
+ * Extend SSL DPD signature to allow alert before server_hello.
+ (Johanna Amann)
+
+ * Make join_string_vec work with vectors containing empty elements.
+ (Johanna Amann)
+
+ * Fix support for HTTP CONNECT when server adds headers to response.
+ (Eric Karasuda).
+
+ * Load static CA list for validation tests too. (Johanna Amann)
+
+ * Remove cluster certificate validation script. (Johanna Amann)
+
+ * Fix a bug in diff-remove-x509-names canonifier. (Daniel Thayer)
+
+ * Fix test canonifiers in scripts/policy/protocols/ssl. (Daniel
+ Thayer)
+
+2.4-169 | 2015-10-01 17:21:21 -0700
+
+ * Fixed parsing of V_ASN1_GENERALIZEDTIME timestamps in x509
+ certificates. (Yun Zheng Hu)
+
+ * Improve X509 end-of-string-check code. (Johanna Amann)
+
+ * Refactor X509 generalizedtime support and test. (Johanna Amann)
+
+ * Fix case of offset=-1 (EOF) for RAW reader. Addresses BIT-1479.
+ (Johanna Amann)
+
+ * Improve a number of test canonifiers. (Daniel Thayer)
+
+ * Remove unnecessary use of TEST_DIFF_CANONIFIER. (Daniel Thayer)
+
+ * Fixed some test canonifiers to read only from stdin
+
+ * Remove unused test canonifier scripts. (Daniel Thayer)
+
+ * A potpourri of updates and improvements across the documentation.
+ (Daniel Thayer)
+
+ * Add configure option to disable Broker Python bindings. Also
+ improve the configure summary output to more clearly show whether
+ or not Broker Python bindings will be built. (Daniel Thayer)
+
+2.4-131 | 2015-09-11 12:16:39 -0700
+
+ * Add README.rst symlink. Addresses BIT-1413 (Vlad Grigorescu)
+
+2.4-129 | 2015-09-11 11:56:04 -0700
+
+ * hash-all-files.bro depends on base/files/hash (Richard van den Berg)
+
+ * Make dns_max_queries redef-able, and bump default to 25. Addresses
+ BIT-1460 (Vlad Grigorescu)
+
+2.4-125 | 2015-09-03 20:10:36 -0700
+
+ * Move SIP analyzer to flowunit instead of datagram Addresses
+ BIT-1458 (Vlad Grigorescu)
+
+2.4-122 | 2015-08-31 14:39:41 -0700
+
+ * Add a number of out-of-bound checks to layer 2 code. Addresses
+ BIT-1463 (Johanna Amann)
+
+ * Fix error in 2.4 release notes regarding SSH events. (Robin
+ Sommer)
+
+2.4-118 | 2015-08-31 10:55:29 -0700
+
+ * Fix FreeBSD build errors (Johanna Amann)
+
+2.4-117 | 2015-08-30 22:16:24 -0700
+
+ * Fix initialization of a pointer in RDP analyzer. (Daniel
+ Thayer/Robin Sommer)
+
+2.4-115 | 2015-08-30 21:57:35 -0700
+
+ * Enable Bro to leverage packet fanout mode on Linux. (Kris
+ Nielander).
+
+ ## Toggle whether to do packet fanout (Linux-only).
+ const Pcap::packet_fanout_enable = F &redef;
+
+ ## If packet fanout is enabled, the id to sue for it. This should be shared amongst
+ ## worker processes processing the same socket.
+ const Pcap::packet_fanout_id = 0 &redef;
+
+ ## If packet fanout is enabled, whether packets are to be defragmented before
+ ## fanout is applied.
+ const Pcap::packet_fanout_defrag = T &redef;
+
+ * Allow libpcap buffer size to be set via configuration. (Kris Nielander)
+
+ ## Number of Mbytes to provide as buffer space when capturing from live
+ ## interfaces.
+ const Pcap::bufsize = 128 &redef;
+
+ * Move the pcap-related script-level identifiers into the new Pcap
+ namespace. (Robin Sommer)
+
+ snaplen -> Pcap::snaplen
+ precompile_pcap_filter() -> Pcap::precompile_pcap_filter()
+ install_pcap_filter() -> Pcap::install_pcap_filter()
+ pcap_error() -> Pcap::pcap_error()
+
+
+2.4-108 | 2015-08-30 20:14:31 -0700
+
+ * Update Base64 decoding. (Jan Grashoefer)
+
+ - A new built-in function, decode_base64_conn() for Base64
+ decoding. It works like decode_base64() but receives an
+ additional connection argument that will be used for
+ reporting decoding errors into weird.log (instead of
+ reporter.log).
+
+ - FTP, POP3, and HTTP analyzers now likewise log Base64
+ decoding errors to weird.log.
+
+ - The built-in functions decode_base64_custom() and
+ encode_base64_custom() are now deprecated. Their
+ functionality is provided directly by decode_base64() and
+ encode_base64(), which take an optional parameter to change
+ the Base64 alphabet.
+
+ * Fix potential crash if TCP header was captured incompletely.
+ (Robin Sommer)
+
+2.4-103 | 2015-08-29 10:51:55 -0700
+
+ * Make ASN.1 date/time parsing more robust. (Johanna Amann)
+
+ * Be more permissive on what characters we accept as an unquoted
+ multipart boundary. Addresses BIT-1459. (Johanna Amann)
+
+2.4-99 | 2015-08-25 07:56:57 -0700
+
+ * Add ``Q`` and update ``I`` documentation for connection history
+ field. Addresses BIT-1466. (Vlad Grigorescu)
+
+2.4-96 | 2015-08-21 17:37:56 -0700
+
+ * Update SIP analyzer. (balintm)
+
+ - Allows space on both sides of ':'.
+ - Require CR/LF after request/reply line.
+
+2.4-94 | 2015-08-21 17:31:32 -0700
+
+ * Add file type detection support for video/MP2T. (Mike Freemon)
+
+2.4-93 | 2015-08-21 17:23:39 -0700
+
+ * Make plugin install honor DESTDIR= convention. (Jeff Barber)
+
+2.4-89 | 2015-08-18 07:53:36 -0700
+
+ * Fix diff-canonifier-external to use basename of input file.
+ (Daniel Thayer)
+
+2.4-87 | 2015-08-14 08:34:41 -0700
+
+ * Removing the yielding_teredo_decapsulation option. (Robin Sommer)
+
+2.4-86 | 2015-08-12 17:02:24 -0700
+
+ * Make Teredo DPD signature more precise. (Martina Balint)
+
+2.4-84 | 2015-08-10 14:44:39 -0700
+
+ * Add hook 'HookSetupAnalyzerTree' to allow plugins access to a
+ connection's initial analyzer tree for customization. (James
+ Swaro)
+
+ * Plugins now look for a file "__preload__.bro" in the top-level
+ script directory. If found, they load it first, before any scripts
+ defining BiF elements. This can be used to define types that the
+ BiFs already depend on (like a custom type for an event argument).
+ (Robin Sommer)
+
+2.4-81 | 2015-08-08 07:38:42 -0700
+
+ * Fix a test that is failing very frequently. (Daniel Thayer)
+
+2.4-78 | 2015-08-06 22:25:19 -0400
+
+ * Remove build dependency on Perl (now requiring Python instad).
+ (Daniel Thayer)
+
+ * CID 1314754: Fixing unreachable code in RSH analyzer. (Robin
+ Sommer)
+
+ * CID 1312752: Add comment to mark 'case' fallthrough as ok. (Robin
+ Sommer)
+
+ * CID 1312751: Removing redundant assignment. (Robin Sommer)
+
+2.4-73 | 2015-07-31 08:53:49 -0700
+
+ * BIT-1429: SMTP logs now include CC: addresses. (Albert Zaharovits)
+
+2.4-70 | 2015-07-30 07:23:44 -0700
+
+ * Updated detection of Flash and AdobeAIR. (Jan Grashoefer)
+
+ * Adding tests for Flash version parsing and browser plugin
+ detection. (Robin Sommer)
+
+2.4-63 | 2015-07-28 12:26:37 -0700
+
+ * Updating submodule(s).
+
+2.4-61 | 2015-07-28 12:13:39 -0700
+
+ * Renaming config.h to bro-config.h. (Robin Sommer)
+
2.4-58 | 2015-07-24 15:06:07 -0700
* Add script protocols/conn/vlan-logging.bro to record VLAN data in
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 30e1a4a545..b96923aa56 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -61,7 +61,7 @@ if (NOT SED_EXE)
endif ()
endif ()
-FindRequiredPackage(Perl)
+FindRequiredPackage(PythonInterp)
FindRequiredPackage(FLEX)
FindRequiredPackage(BISON)
FindRequiredPackage(PCAP)
@@ -170,8 +170,8 @@ include(RequireCXX11)
# Tell the plugin code that we're building as part of the main tree.
set(BRO_PLUGIN_INTERNAL_BUILD true CACHE INTERNAL "" FORCE)
-configure_file(${CMAKE_CURRENT_SOURCE_DIR}/config.h.in
- ${CMAKE_CURRENT_BINARY_DIR}/config.h)
+configure_file(${CMAKE_CURRENT_SOURCE_DIR}/bro-config.h.in
+ ${CMAKE_CURRENT_BINARY_DIR}/bro-config.h)
include_directories(${CMAKE_CURRENT_BINARY_DIR})
@@ -233,6 +233,7 @@ message(
"\nCPP: ${CMAKE_CXX_COMPILER}"
"\n"
"\nBroker: ${ENABLE_BROKER}"
+ "\nBroker Python: ${BROKER_PYTHON_BINDINGS}"
"\nBroccoli: ${INSTALL_BROCCOLI}"
"\nBroctl: ${INSTALL_BROCTL}"
"\nAux. Tools: ${INSTALL_AUX_TOOLS}"
diff --git a/NEWS b/NEWS
index 3e35d6f492..5348826e04 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,10 @@ New Dependencies
- Bro now requires the C++ Actor Framework, CAF, which must be
installed first. See http://actor-framework.org.
+- Bro now requires Python instead of Perl to compile the source code.
+
+- The pcap buffer size can set through the new option Pcap::bufsize.
+
New Functionality
-----------------
@@ -26,6 +30,42 @@ New Functionality
information. Use with care, generating events per packet is
expensive.
+- A new built-in function, decode_base64_conn() for Base64 decoding.
+ It works like decode_base64() but receives an additional connection
+ argument that will be used for decoding errors into weird.log
+ (instead of reporter.log).
+
+- The IRC analyzer now recognizes StartTLS sessions and enable the SSL
+ analyzer for them.
+
+- New Bro plugins in aux/plugins:
+
+ - af_packet: Native AF_PACKET support.
+ - myricom: Native Myricom SNF v3 support.
+ - pf_ring: Native PF_RING support.
+ - redis: An experimental log writer for Redis.
+ - tcprs: An TCP-level analyzer detecting retransmissions, reordering, and more.
+
+Changed Functionality
+---------------------
+
+- Some script-level identifier have changed their names:
+
+ snaplen -> Pcap::snaplen
+ precompile_pcap_filter() -> Pcap::precompile_pcap_filter()
+ install_pcap_filter() -> Pcap::install_pcap_filter()
+ pcap_error() -> Pcap::pcap_error()
+
+
+Deprecated Functionality
+------------------------
+
+ - The built-in functions decode_base64_custom() and
+ encode_base64_custom() are no longer needed and will be removed
+ in the future. Their functionality is now provided directly by
+ decode_base64() and encode_base64(), which take an optional
+ parameter to change the Base64 alphabet.
+
Bro 2.4
=======
@@ -186,8 +226,8 @@ Changed Functionality
- The SSH changes come with a few incompatibilities. The following
events have been renamed:
- * ``SSH::heuristic_failed_login`` to ``SSH::ssh_auth_failed``
- * ``SSH::heuristic_successful_login`` to ``SSH::ssh_auth_successful``
+ * ``SSH::heuristic_failed_login`` to ``ssh_auth_failed``
+ * ``SSH::heuristic_successful_login`` to ``ssh_auth_successful``
The ``SSH::Info`` status field has been removed and replaced with
the ``auth_success`` field. This field has been changed from a
diff --git a/README.rst b/README.rst
new file mode 120000
index 0000000000..100b93820a
--- /dev/null
+++ b/README.rst
@@ -0,0 +1 @@
+README
\ No newline at end of file
diff --git a/VERSION b/VERSION
index b85c5a6f78..1582f62cd4 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.4-58
+2.4-247
diff --git a/aux/binpac b/aux/binpac
index 4f33233aef..2edf0a5885 160000
--- a/aux/binpac
+++ b/aux/binpac
@@ -1 +1 @@
-Subproject commit 4f33233aef5539ae4f12c6d0e4338247833c3900
+Subproject commit 2edf0a58854ca5bdb444e74ec8cbac0fafbd42f4
diff --git a/aux/bro-aux b/aux/bro-aux
index 07af9748f4..f5da34fb4f 160000
--- a/aux/bro-aux
+++ b/aux/bro-aux
@@ -1 +1 @@
-Subproject commit 07af9748f40dc47d3a2b3290db494a90dcbddbdc
+Subproject commit f5da34fb4fbe00a683697e9052cffdd7d804f8c1
diff --git a/aux/broccoli b/aux/broccoli
index 74bb4bbd94..0880251535 160000
--- a/aux/broccoli
+++ b/aux/broccoli
@@ -1 +1 @@
-Subproject commit 74bb4bbd949e61e099178f8a97499d3f1355de8b
+Subproject commit 0880251535df5a3a16feb2b25c26a04aa52585f1
diff --git a/aux/broctl b/aux/broctl
index 4ec6cb683d..5d765dd9d9 160000
--- a/aux/broctl
+++ b/aux/broctl
@@ -1 +1 @@
-Subproject commit 4ec6cb683d4477a0e5acb23e8eb0d0469c8a4166
+Subproject commit 5d765dd9d94eb25b31d1ecf8df6561fc714694fc
diff --git a/aux/broker b/aux/broker
index d25efc7d5f..5c90543dee 160000
--- a/aux/broker
+++ b/aux/broker
@@ -1 +1 @@
-Subproject commit d25efc7d5f495c30294b11180c1857477078f2d6
+Subproject commit 5c90543dee9212121d08e6aa630fb81dd5133df7
diff --git a/aux/btest b/aux/btest
index a89cd0fda0..71a1e3efc4 160000
--- a/aux/btest
+++ b/aux/btest
@@ -1 +1 @@
-Subproject commit a89cd0fda0f17f69b96c935959cae89145b92927
+Subproject commit 71a1e3efc437aa9f981be71affa1c4615e8d98a5
diff --git a/aux/plugins b/aux/plugins
index 98ad8a5b97..1021ca5f24 160000
--- a/aux/plugins
+++ b/aux/plugins
@@ -1 +1 @@
-Subproject commit 98ad8a5b97f601a3ec9a773d87582438212b8290
+Subproject commit 1021ca5f248b9da01766e94d840896e029fb0e6e
diff --git a/config.h.in b/bro-config.h.in
similarity index 100%
rename from config.h.in
rename to bro-config.h.in
diff --git a/cmake b/cmake
index 6406fb79d3..23773d7107 160000
--- a/cmake
+++ b/cmake
@@ -1 +1 @@
-Subproject commit 6406fb79d30df8d7956110ce65a97d18e4bc8c3b
+Subproject commit 23773d7107e8d51e2b1bb0fd2e2d85fda50df743
diff --git a/configure b/configure
index ae2f337117..f94085f9d3 100755
--- a/configure
+++ b/configure
@@ -47,6 +47,7 @@ Usage: $0 [OPTION]... [VAR=VALUE]...
--disable-auxtools don't build or install auxiliary tools
--disable-perftools don't try to build with Google Perftools
--disable-python don't try to build python bindings for broccoli
+ --disable-pybroker don't try to build python bindings for broker
Required Packages in Non-Standard Locations:
--with-openssl=PATH path to OpenSSL install root
@@ -55,7 +56,7 @@ Usage: $0 [OPTION]... [VAR=VALUE]...
--with-binpac=PATH path to BinPAC install root
--with-flex=PATH path to flex executable
--with-bison=PATH path to bison executable
- --with-perl=PATH path to perl executable
+ --with-python=PATH path to Python executable
--with-libcaf=PATH path to C++ Actor Framework installation
(a required Broker dependency)
@@ -63,7 +64,6 @@ Usage: $0 [OPTION]... [VAR=VALUE]...
--with-geoip=PATH path to the libGeoIP install root
--with-perftools=PATH path to Google Perftools install root
--with-jemalloc=PATH path to jemalloc install root
- --with-python=PATH path to Python interpreter
--with-python-lib=PATH path to libpython
--with-python-inc=PATH path to Python headers
--with-ruby=PATH path to ruby interpreter
@@ -122,6 +122,7 @@ append_cache_entry PY_MOD_INSTALL_DIR PATH $prefix/lib/broctl
append_cache_entry BRO_SCRIPT_INSTALL_PATH STRING $prefix/share/bro
append_cache_entry BRO_ETC_INSTALL_DIR PATH $prefix/etc
append_cache_entry BROKER_PYTHON_HOME PATH $prefix
+append_cache_entry BROKER_PYTHON_BINDINGS BOOL false
append_cache_entry ENABLE_DEBUG BOOL false
append_cache_entry ENABLE_PERFTOOLS BOOL false
append_cache_entry ENABLE_PERFTOOLS_DEBUG BOOL false
@@ -218,6 +219,9 @@ while [ $# -ne 0 ]; do
--disable-python)
append_cache_entry DISABLE_PYTHON_BINDINGS BOOL true
;;
+ --disable-pybroker)
+ append_cache_entry DISABLE_PYBROKER BOOL true
+ ;;
--enable-ruby)
append_cache_entry DISABLE_RUBY_BINDINGS BOOL false
;;
@@ -239,9 +243,6 @@ while [ $# -ne 0 ]; do
--with-bison=*)
append_cache_entry BISON_EXECUTABLE PATH $optarg
;;
- --with-perl=*)
- append_cache_entry PERL_EXECUTABLE PATH $optarg
- ;;
--with-geoip=*)
append_cache_entry LibGeoIP_ROOT_DIR PATH $optarg
;;
diff --git a/doc/components/bro-plugins/af_packet/README.rst b/doc/components/bro-plugins/af_packet/README.rst
new file mode 120000
index 0000000000..b8f745bed2
--- /dev/null
+++ b/doc/components/bro-plugins/af_packet/README.rst
@@ -0,0 +1 @@
+../../../../aux/plugins/af_packet/README
\ No newline at end of file
diff --git a/doc/components/bro-plugins/dataseries/README.rst b/doc/components/bro-plugins/dataseries/README.rst
deleted file mode 120000
index 3362e911fc..0000000000
--- a/doc/components/bro-plugins/dataseries/README.rst
+++ /dev/null
@@ -1 +0,0 @@
-../../../../aux/plugins/dataseries/README
\ No newline at end of file
diff --git a/doc/components/bro-plugins/myricom/README.rst b/doc/components/bro-plugins/myricom/README.rst
new file mode 120000
index 0000000000..3bfabcdae3
--- /dev/null
+++ b/doc/components/bro-plugins/myricom/README.rst
@@ -0,0 +1 @@
+../../../../aux/plugins/myricom/README
\ No newline at end of file
diff --git a/doc/components/bro-plugins/pf_ring/README.rst b/doc/components/bro-plugins/pf_ring/README.rst
new file mode 120000
index 0000000000..5ea666e8c9
--- /dev/null
+++ b/doc/components/bro-plugins/pf_ring/README.rst
@@ -0,0 +1 @@
+../../../../aux/plugins/pf_ring/README
\ No newline at end of file
diff --git a/doc/components/bro-plugins/redis/README.rst b/doc/components/bro-plugins/redis/README.rst
new file mode 120000
index 0000000000..c42051828e
--- /dev/null
+++ b/doc/components/bro-plugins/redis/README.rst
@@ -0,0 +1 @@
+../../../../aux/plugins/redis/README
\ No newline at end of file
diff --git a/doc/components/bro-plugins/tcprs/README.rst b/doc/components/bro-plugins/tcprs/README.rst
new file mode 120000
index 0000000000..c0e84fd579
--- /dev/null
+++ b/doc/components/bro-plugins/tcprs/README.rst
@@ -0,0 +1 @@
+../../../../aux/plugins/tcprs/README
\ No newline at end of file
diff --git a/doc/devel/plugins.rst b/doc/devel/plugins.rst
index 091a0090d1..dc1c9a3cd4 100644
--- a/doc/devel/plugins.rst
+++ b/doc/devel/plugins.rst
@@ -209,8 +209,15 @@ directory. With the skeleton, ```` corresponds to ``build/``.
"@load"ed.
``scripts``/__load__.bro
- A Bro script that will be loaded immediately when the plugin gets
- activated. See below for more information on activating plugins.
+ A Bro script that will be loaded when the plugin gets activated.
+ When this script executes, any BiF elements that the plugin
+ defines will already be available. See below for more information
+ on activating plugins.
+
+``scripts``/__preload__.bro
+ A Bro script that will be loaded when the plugin gets activated,
+ but before any BiF elements become available. See below for more
+ information on activating plugins.
``lib/bif/``
Directory with auto-generated Bro scripts that declare the plugin's
@@ -279,7 +286,9 @@ Activating a plugin will:
1. Load the dynamic module
2. Make any bif items available
3. Add the ``scripts/`` directory to ``BROPATH``
- 4. Load ``scripts/__load__.bro``
+ 4. Load ``scripts/__preload__.bro``
+ 5. Make BiF elements available to scripts.
+ 6. Load ``scripts/__load__.bro``
By default, Bro will automatically activate all dynamic plugins found
in its search path ``BRO_PLUGIN_PATH``. However, in bare mode (``bro
diff --git a/doc/frameworks/broker.rst b/doc/frameworks/broker.rst
index 3cd8dab6e3..8c5ed24e25 100644
--- a/doc/frameworks/broker.rst
+++ b/doc/frameworks/broker.rst
@@ -9,10 +9,7 @@ Broker-Enabled Communication Framework
Bro can now use the `Broker Library
<../components/broker/README.html>`_ to exchange information with
- other Bro processes. To enable it run Bro's ``configure`` script
- with the ``--enable-broker`` option. Note that a C++11 compatible
- compiler (e.g. GCC 4.8+ or Clang 3.3+) is required as well as the
- `C++ Actor Framework `_.
+ other Bro processes.
.. contents::
@@ -23,26 +20,26 @@ Communication via Broker must first be turned on via
:bro:see:`BrokerComm::enable`.
Bro can accept incoming connections by calling :bro:see:`BrokerComm::listen`
-and then monitor connection status updates via
+and then monitor connection status updates via the
:bro:see:`BrokerComm::incoming_connection_established` and
-:bro:see:`BrokerComm::incoming_connection_broken`.
+:bro:see:`BrokerComm::incoming_connection_broken` events.
.. btest-include:: ${DOC_ROOT}/frameworks/broker/connecting-listener.bro
Bro can initiate outgoing connections by calling :bro:see:`BrokerComm::connect`
-and then monitor connection status updates via
+and then monitor connection status updates via the
:bro:see:`BrokerComm::outgoing_connection_established`,
:bro:see:`BrokerComm::outgoing_connection_broken`, and
-:bro:see:`BrokerComm::outgoing_connection_incompatible`.
+:bro:see:`BrokerComm::outgoing_connection_incompatible` events.
.. btest-include:: ${DOC_ROOT}/frameworks/broker/connecting-connector.bro
Remote Printing
===============
-To receive remote print messages, first use
-:bro:see:`BrokerComm::subscribe_to_prints` to advertise to peers a topic
-prefix of interest and then create an event handler for
+To receive remote print messages, first use the
+:bro:see:`BrokerComm::subscribe_to_prints` function to advertise to peers a
+topic prefix of interest and then create an event handler for
:bro:see:`BrokerComm::print_handler` to handle any print messages that are
received.
@@ -71,17 +68,17 @@ the Broker message format is simply:
Remote Events
=============
-Receiving remote events is similar to remote prints. Just use
-:bro:see:`BrokerComm::subscribe_to_events` and possibly define any new events
-along with handlers that peers may want to send.
+Receiving remote events is similar to remote prints. Just use the
+:bro:see:`BrokerComm::subscribe_to_events` function and possibly define any
+new events along with handlers that peers may want to send.
.. btest-include:: ${DOC_ROOT}/frameworks/broker/events-listener.bro
-To send events, there are two choices. The first is to use call
-:bro:see:`BrokerComm::event` directly. The second option is to use
-:bro:see:`BrokerComm::auto_event` to make it so a particular event is
-automatically sent to peers whenever it is called locally via the normal
-event invocation syntax.
+There are two different ways to send events. The first is to call the
+:bro:see:`BrokerComm::event` function directly. The second option is to call
+the :bro:see:`BrokerComm::auto_event` function where you specify a
+particular event that will be automatically sent to peers whenever the
+event is called locally via the normal event invocation syntax.
.. btest-include:: ${DOC_ROOT}/frameworks/broker/events-connector.bro
@@ -98,7 +95,7 @@ the Broker message format is:
broker::message{std::string{}, ...};
The first parameter is the name of the event and the remaining ``...``
-are its arguments, which are any of the support Broker data types as
+are its arguments, which are any of the supported Broker data types as
they correspond to the Bro types for the event named in the first
parameter of the message.
@@ -107,23 +104,23 @@ Remote Logging
.. btest-include:: ${DOC_ROOT}/frameworks/broker/testlog.bro
-Use :bro:see:`BrokerComm::subscribe_to_logs` to advertise interest in logs
-written by peers. The topic names that Bro uses are implicitly of the
+Use the :bro:see:`BrokerComm::subscribe_to_logs` function to advertise interest
+in logs written by peers. The topic names that Bro uses are implicitly of the
form "bro/log/".
.. btest-include:: ${DOC_ROOT}/frameworks/broker/logs-listener.bro
-To send remote logs either use :bro:see:`Log::enable_remote_logging` or
-:bro:see:`BrokerComm::enable_remote_logs`. The former allows any log stream
-to be sent to peers while the later toggles remote logging for
-particular streams.
+To send remote logs either redef :bro:see:`Log::enable_remote_logging` or
+use the :bro:see:`BrokerComm::enable_remote_logs` function. The former
+allows any log stream to be sent to peers while the latter enables remote
+logging for particular streams.
.. btest-include:: ${DOC_ROOT}/frameworks/broker/logs-connector.bro
Message Format
--------------
-For other applications that want to exchange logs messages with Bro,
+For other applications that want to exchange log messages with Bro,
the Broker message format is:
.. code:: c++
@@ -132,7 +129,7 @@ the Broker message format is:
The enum value corresponds to the stream's :bro:see:`Log::ID` value, and
the record corresponds to a single entry of that log's columns record,
-in this case a ``Test::INFO`` value.
+in this case a ``Test::Info`` value.
Tuning Access Control
=====================
@@ -152,11 +149,12 @@ that take a :bro:see:`BrokerComm::SendFlags` such as :bro:see:`BrokerComm::print
:bro:see:`BrokerComm::enable_remote_logs`.
If not using the ``auto_advertise`` flag, one can use the
-:bro:see:`BrokerComm::advertise_topic` and :bro:see:`BrokerComm::unadvertise_topic`
-to manupulate the set of topic prefixes that are allowed to be
-advertised to peers. If an endpoint does not advertise a topic prefix,
-the only way a peers can send messages to it is via the ``unsolicited``
-flag of :bro:see:`BrokerComm::SendFlags` and choosing a topic with a matching
+:bro:see:`BrokerComm::advertise_topic` and
+:bro:see:`BrokerComm::unadvertise_topic` functions
+to manipulate the set of topic prefixes that are allowed to be
+advertised to peers. If an endpoint does not advertise a topic prefix, then
+the only way peers can send messages to it is via the ``unsolicited``
+flag of :bro:see:`BrokerComm::SendFlags` and choosing a topic with a matching
prefix (i.e. full topic may be longer than receivers prefix, just the
prefix needs to match).
@@ -172,7 +170,7 @@ specific type of frontend, but a standalone frontend can also exist to
e.g. query and modify the contents of a remote master store without
actually "owning" any of the contents itself.
-A master data store can be be cloned from remote peers which may then
+A master data store can be cloned from remote peers which may then
perform lightweight, local queries against the clone, which
automatically stays synchronized with the master store. Clones cannot
modify their content directly, instead they send modifications to the
@@ -181,7 +179,7 @@ all clones.
Master and clone stores get to choose what type of storage backend to
use. E.g. In-memory versus SQLite for persistence. Note that if clones
-are used, data store sizes should still be able to fit within memory
+are used, then data store sizes must be able to fit within memory
regardless of the storage backend as a single snapshot of the master
store is sent in a single chunk to initialize the clone.
@@ -198,5 +196,5 @@ needed, just replace the :bro:see:`BrokerStore::create_clone` call with
:bro:see:`BrokerStore::create_frontend`. Queries will then be made against
the remote master store instead of the local clone.
-Note that all queries are made within Bro's asynchrounous ``when``
-statements and must specify a timeout block.
+Note that all data store queries must be made within Bro's asynchronous
+``when`` statements and must specify a timeout block.
diff --git a/doc/frameworks/broker/connecting-connector.bro b/doc/frameworks/broker/connecting-connector.bro
index a7e621e4a6..cd5c74add8 100644
--- a/doc/frameworks/broker/connecting-connector.bro
+++ b/doc/frameworks/broker/connecting-connector.bro
@@ -1,4 +1,3 @@
-
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef BrokerComm::endpoint_name = "connector";
diff --git a/doc/frameworks/broker/connecting-listener.bro b/doc/frameworks/broker/connecting-listener.bro
index c37af3ae4d..21c67f9696 100644
--- a/doc/frameworks/broker/connecting-listener.bro
+++ b/doc/frameworks/broker/connecting-listener.bro
@@ -1,4 +1,3 @@
-
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef BrokerComm::endpoint_name = "listener";
diff --git a/doc/frameworks/broker/events-listener.bro b/doc/frameworks/broker/events-listener.bro
index aa6ea9ee4e..dc18795903 100644
--- a/doc/frameworks/broker/events-listener.bro
+++ b/doc/frameworks/broker/events-listener.bro
@@ -1,4 +1,3 @@
-
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef BrokerComm::endpoint_name = "listener";
diff --git a/doc/frameworks/broker/printing-listener.bro b/doc/frameworks/broker/printing-listener.bro
index 080d09e8f5..f55c5b9bad 100644
--- a/doc/frameworks/broker/printing-listener.bro
+++ b/doc/frameworks/broker/printing-listener.bro
@@ -1,4 +1,3 @@
-
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef BrokerComm::endpoint_name = "listener";
diff --git a/doc/frameworks/broker/testlog.bro b/doc/frameworks/broker/testlog.bro
index f63c19ac48..506d359bb7 100644
--- a/doc/frameworks/broker/testlog.bro
+++ b/doc/frameworks/broker/testlog.bro
@@ -1,4 +1,3 @@
-
module Test;
export {
diff --git a/doc/frameworks/geoip.rst b/doc/frameworks/geoip.rst
index 98252d7184..d756f97589 100644
--- a/doc/frameworks/geoip.rst
+++ b/doc/frameworks/geoip.rst
@@ -20,11 +20,13 @@ GeoLocation
Install libGeoIP
----------------
+Before building Bro, you need to install libGeoIP.
+
* FreeBSD:
.. console::
- sudo pkg_add -r GeoIP
+ sudo pkg install GeoIP
* RPM/RedHat-based Linux:
@@ -40,80 +42,99 @@ Install libGeoIP
* Mac OS X:
- Vanilla OS X installations don't ship with libGeoIP, but if
- installed from your preferred package management system (e.g.
- MacPorts, Fink, or Homebrew), they should be automatically detected
- and Bro will compile against them.
+ You need to install from your preferred package management system
+ (e.g. MacPorts, Fink, or Homebrew). The name of the package that you need
+ may be libgeoip, geoip, or geoip-dev, depending on which package management
+ system you are using.
GeoIPLite Database Installation
-------------------------------------
+-------------------------------
A country database for GeoIPLite is included when you do the C API
install, but for Bro, we are using the city database which includes
cities and regions in addition to countries.
`Download `__ the GeoLite city
-binary database.
+binary database:
- .. console::
+.. console::
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
gunzip GeoLiteCity.dat.gz
-Next, the file needs to be put in the database directory. This directory
-should already exist and will vary depending on which platform and package
-you are using. For FreeBSD, use ``/usr/local/share/GeoIP``. For Linux,
-use ``/usr/share/GeoIP`` or ``/var/lib/GeoIP`` (choose whichever one
+Next, the file needs to be renamed and put in the GeoIP database directory.
+This directory should already exist and will vary depending on which platform
+and package you are using. For FreeBSD, use ``/usr/local/share/GeoIP``. For
+Linux, use ``/usr/share/GeoIP`` or ``/var/lib/GeoIP`` (choose whichever one
already exists).
- .. console::
+.. console::
mv GeoLiteCity.dat /GeoIPCity.dat
+Note that there is a separate database for IPv6 addresses, which can also
+be installed if you want GeoIP functionality for IPv6.
+
+Testing
+-------
+
+Before using the GeoIP functionality, it is a good idea to verify that
+everything is setup correctly. After installing libGeoIP and the GeoIP city
+database, and building Bro, you can quickly check if the GeoIP functionality
+works by running a command like this:
+
+.. console::
+
+ bro -e "print lookup_location(8.8.8.8);"
+
+If you see an error message similar to "Failed to open GeoIP City database",
+then you may need to either rename or move your GeoIP city database file (the
+error message should give you the full pathname of the database file that
+Bro is looking for).
+
+If you see an error message similar to "Bro was not configured for GeoIP
+support", then you need to rebuild Bro and make sure it is linked against
+libGeoIP. Normally, if libGeoIP is installed correctly then it should
+automatically be found when building Bro. If this doesn't happen, then
+you may need to specify the path to the libGeoIP installation
+(e.g. ``./configure --with-geoip=``).
Usage
-----
-There is a single built in function that provides the GeoIP
-functionality:
+There is a built-in function that provides the GeoIP functionality:
.. code:: bro
function lookup_location(a:addr): geo_location
-There is also the :bro:see:`geo_location` data structure that is returned
-from the :bro:see:`lookup_location` function:
-
-.. code:: bro
-
- type geo_location: record {
- country_code: string;
- region: string;
- city: string;
- latitude: double;
- longitude: double;
- };
-
+The return value of the :bro:see:`lookup_location` function is a record
+type called :bro:see:`geo_location`, and it consists of several fields
+containing the country, region, city, latitude, and longitude of the specified
+IP address. Since one or more fields in this record will be uninitialized
+for some IP addresses (for example, the country and region of an IP address
+might be known, but the city could be unknown), a field should be checked
+if it has a value before trying to access the value.
Example
-------
-To write a line in a log file for every ftp connection from hosts in
-Ohio, this is now very easy:
+To show every ftp connection from hosts in Ohio, this is now very easy:
.. code:: bro
- global ftp_location_log: file = open_log_file("ftp-location");
-
event ftp_reply(c: connection, code: count, msg: string, cont_resp: bool)
{
local client = c$id$orig_h;
local loc = lookup_location(client);
- if (loc$region == "OH" && loc$country_code == "US")
+
+ if (loc?$region && loc$region == "OH" && loc$country_code == "US")
{
- print ftp_location_log, fmt("FTP Connection from:%s (%s,%s,%s)", client, loc$city, loc$region, loc$country_code);
+ local city = loc?$city ? loc$city : "";
+
+ print fmt("FTP Connection from:%s (%s,%s,%s)", client, city,
+ loc$region, loc$country_code);
}
}
-
diff --git a/doc/frameworks/input.rst b/doc/frameworks/input.rst
index ef40756a26..aa2dce6417 100644
--- a/doc/frameworks/input.rst
+++ b/doc/frameworks/input.rst
@@ -32,7 +32,8 @@ For this example we assume that we want to import data from a blacklist
that contains server IP addresses as well as the timestamp and the reason
for the block.
-An example input file could look like this:
+An example input file could look like this (note that all fields must be
+tab-separated):
::
@@ -63,19 +64,23 @@ The two records are defined as:
reason: string;
};
-Note that the names of the fields in the record definitions have to correspond
+Note that the names of the fields in the record definitions must correspond
to the column names listed in the '#fields' line of the log file, in this
-case 'ip', 'timestamp', and 'reason'.
+case 'ip', 'timestamp', and 'reason'. Also note that the ordering of the
+columns does not matter, because each column is identified by name.
-The log file is read into the table with a simple call of the ``add_table``
-function:
+The log file is read into the table with a simple call of the
+:bro:id:`Input::add_table` function:
.. code:: bro
global blacklist: table[addr] of Val = table();
- Input::add_table([$source="blacklist.file", $name="blacklist", $idx=Idx, $val=Val, $destination=blacklist]);
- Input::remove("blacklist");
+ event bro_init() {
+ Input::add_table([$source="blacklist.file", $name="blacklist",
+ $idx=Idx, $val=Val, $destination=blacklist]);
+ Input::remove("blacklist");
+ }
With these three lines we first create an empty table that should contain the
blacklist data and then instruct the input framework to open an input stream
@@ -92,7 +97,7 @@ Because of this, the data is not immediately accessible. Depending on the
size of the data source it might take from a few milliseconds up to a few
seconds until all data is present in the table. Please note that this means
that when Bro is running without an input source or on very short captured
-files, it might terminate before the data is present in the system (because
+files, it might terminate before the data is present in the table (because
Bro already handled all packets before the import thread finished).
Subsequent calls to an input source are queued until the previous action has
@@ -101,8 +106,8 @@ been completed. Because of this, it is, for example, possible to call
will remain queued until the first read has been completed.
Once the input framework finishes reading from a data source, it fires
-the ``end_of_data`` event. Once this event has been received all data
-from the input file is available in the table.
+the :bro:id:`Input::end_of_data` event. Once this event has been received all
+data from the input file is available in the table.
.. code:: bro
@@ -111,9 +116,9 @@ from the input file is available in the table.
print blacklist;
}
-The table can also already be used while the data is still being read - it
-just might not contain all lines in the input file when the event has not
-yet fired. After it has been populated it can be used like any other Bro
+The table can be used while the data is still being read - it
+just might not contain all lines from the input file before the event has
+fired. After the table has been populated it can be used like any other Bro
table and blacklist entries can easily be tested:
.. code:: bro
@@ -130,10 +135,11 @@ changing. For these cases, the Bro input framework supports several ways to
deal with changing data files.
The first, very basic method is an explicit refresh of an input stream. When
-an input stream is open, the function ``force_update`` can be called. This
-will trigger a complete refresh of the table; any changed elements from the
-file will be updated. After the update is finished the ``end_of_data``
-event will be raised.
+an input stream is open (this means it has not yet been removed by a call to
+:bro:id:`Input::remove`), the function :bro:id:`Input::force_update` can be
+called. This will trigger a complete refresh of the table; any changed
+elements from the file will be updated. After the update is finished the
+:bro:id:`Input::end_of_data` event will be raised.
In our example the call would look like:
@@ -141,30 +147,35 @@ In our example the call would look like:
Input::force_update("blacklist");
-The input framework also supports two automatic refresh modes. The first mode
-continually checks if a file has been changed. If the file has been changed, it
+Alternatively, the input framework can automatically refresh the table
+contents when it detects a change to the input file. To use this feature,
+you need to specify a non-default read mode by setting the ``mode`` option
+of the :bro:id:`Input::add_table` call. Valid values are ``Input::MANUAL``
+(the default), ``Input::REREAD`` and ``Input::STREAM``. For example,
+setting the value of the ``mode`` option in the previous example
+would look like this:
+
+.. code:: bro
+
+ Input::add_table([$source="blacklist.file", $name="blacklist",
+ $idx=Idx, $val=Val, $destination=blacklist,
+ $mode=Input::REREAD]);
+
+When using the reread mode (i.e., ``$mode=Input::REREAD``), Bro continually
+checks if the input file has been changed. If the file has been changed, it
is re-read and the data in the Bro table is updated to reflect the current
state. Each time a change has been detected and all the new data has been
read into the table, the ``end_of_data`` event is raised.
-The second mode is a streaming mode. This mode assumes that the source data
-file is an append-only file to which new data is continually appended. Bro
-continually checks for new data at the end of the file and will add the new
-data to the table. If newer lines in the file have the same index as previous
-lines, they will overwrite the values in the output table. Because of the
-nature of streaming reads (data is continually added to the table),
-the ``end_of_data`` event is never raised when using streaming reads.
+When using the streaming mode (i.e., ``$mode=Input::STREAM``), Bro assumes
+that the source data file is an append-only file to which new data is
+continually appended. Bro continually checks for new data at the end of
+the file and will add the new data to the table. If newer lines in the
+file have the same index as previous lines, they will overwrite the
+values in the output table. Because of the nature of streaming reads
+(data is continually added to the table), the ``end_of_data`` event
+is never raised when using streaming reads.
-The reading mode can be selected by setting the ``mode`` option of the
-add_table call. Valid values are ``MANUAL`` (the default), ``REREAD``
-and ``STREAM``.
-
-Hence, when adding ``$mode=Input::REREAD`` to the previous example, the
-blacklist table will always reflect the state of the blacklist input file.
-
-.. code:: bro
-
- Input::add_table([$source="blacklist.file", $name="blacklist", $idx=Idx, $val=Val, $destination=blacklist, $mode=Input::REREAD]);
Receiving change events
-----------------------
@@ -173,34 +184,40 @@ When re-reading files, it might be interesting to know exactly which lines in
the source files have changed.
For this reason, the input framework can raise an event each time when a data
-item is added to, removed from or changed in a table.
+item is added to, removed from, or changed in a table.
-The event definition looks like this:
+The event definition looks like this (note that you can change the name of
+this event in your own Bro script):
.. code:: bro
- event entry(description: Input::TableDescription, tpe: Input::Event, left: Idx, right: Val) {
- # act on values
+ event entry(description: Input::TableDescription, tpe: Input::Event,
+ left: Idx, right: Val) {
+ # do something here...
+ print fmt("%s = %s", left, right);
}
-The event has to be specified in ``$ev`` in the ``add_table`` call:
+The event must be specified in ``$ev`` in the ``add_table`` call:
.. code:: bro
- Input::add_table([$source="blacklist.file", $name="blacklist", $idx=Idx, $val=Val, $destination=blacklist, $mode=Input::REREAD, $ev=entry]);
+ Input::add_table([$source="blacklist.file", $name="blacklist",
+ $idx=Idx, $val=Val, $destination=blacklist,
+ $mode=Input::REREAD, $ev=entry]);
-The ``description`` field of the event contains the arguments that were
+The ``description`` argument of the event contains the arguments that were
originally supplied to the add_table call. Hence, the name of the stream can,
-for example, be accessed with ``description$name``. ``tpe`` is an enum
-containing the type of the change that occurred.
+for example, be accessed with ``description$name``. The ``tpe`` argument of the
+event is an enum containing the type of the change that occurred.
If a line that was not previously present in the table has been added,
-then ``tpe`` will contain ``Input::EVENT_NEW``. In this case ``left`` contains
-the index of the added table entry and ``right`` contains the values of the
-added entry.
+then the value of ``tpe`` will be ``Input::EVENT_NEW``. In this case ``left``
+contains the index of the added table entry and ``right`` contains the
+values of the added entry.
If a table entry that already was present is altered during the re-reading or
-streaming read of a file, ``tpe`` will contain ``Input::EVENT_CHANGED``. In
+streaming read of a file, then the value of ``tpe`` will be
+``Input::EVENT_CHANGED``. In
this case ``left`` contains the index of the changed table entry and ``right``
contains the values of the entry before the change. The reason for this is
that the table already has been updated when the event is raised. The current
@@ -208,8 +225,9 @@ value in the table can be ascertained by looking up the current table value.
Hence it is possible to compare the new and the old values of the table.
If a table element is removed because it was no longer present during a
-re-read, then ``tpe`` will contain ``Input::REMOVED``. In this case ``left``
-contains the index and ``right`` the values of the removed element.
+re-read, then the value of ``tpe`` will be ``Input::EVENT_REMOVED``. In this
+case ``left`` contains the index and ``right`` the values of the removed
+element.
Filtering data during import
@@ -222,24 +240,26 @@ can either accept or veto the change by returning true for an accepted
change and false for a rejected change. Furthermore, it can alter the data
before it is written to the table.
-The following example filter will reject to add entries to the table when
+The following example filter will reject adding entries to the table when
they were generated over a month ago. It will accept all changes and all
removals of values that are already present in the table.
.. code:: bro
- Input::add_table([$source="blacklist.file", $name="blacklist", $idx=Idx, $val=Val, $destination=blacklist, $mode=Input::REREAD,
- $pred(typ: Input::Event, left: Idx, right: Val) = {
- if ( typ != Input::EVENT_NEW ) {
- return T;
- }
- return ( ( current_time() - right$timestamp ) < (30 day) );
- }]);
+ Input::add_table([$source="blacklist.file", $name="blacklist",
+ $idx=Idx, $val=Val, $destination=blacklist,
+ $mode=Input::REREAD,
+ $pred(typ: Input::Event, left: Idx, right: Val) = {
+ if ( typ != Input::EVENT_NEW ) {
+ return T;
+ }
+ return (current_time() - right$timestamp) < 30day;
+ }]);
To change elements while they are being imported, the predicate function can
manipulate ``left`` and ``right``. Note that predicate functions are called
before the change is committed to the table. Hence, when a table element is
-changed (``tpe`` is ``INPUT::EVENT_CHANGED``), ``left`` and ``right``
+changed (``typ`` is ``Input::EVENT_CHANGED``), ``left`` and ``right``
contain the new values, but the destination (``blacklist`` in our example)
still contains the old values. This allows predicate functions to examine
the changes between the old and the new version before deciding if they
@@ -250,14 +270,19 @@ Different readers
The input framework supports different kinds of readers for different kinds
of source data files. At the moment, the default reader reads ASCII files
-formatted in the Bro log file format (tab-separated values). At the moment,
-Bro comes with two other readers. The ``RAW`` reader reads a file that is
-split by a specified record separator (usually newline). The contents are
+formatted in the Bro log file format (tab-separated values with a "#fields"
+header line). Several other readers are included in Bro.
+
+The raw reader reads a file that is
+split by a specified record separator (newline by default). The contents are
returned line-by-line as strings; it can, for example, be used to read
configuration files and the like and is probably
only useful in the event mode and not for reading data to tables.
-Another included reader is the ``BENCHMARK`` reader, which is being used
+The binary reader is intended to be used with file analysis input streams (and
+is the default type of reader for those streams).
+
+The benchmark reader is being used
to optimize the speed of the input framework. It can generate arbitrary
amounts of semi-random data in all Bro data types supported by the input
framework.
@@ -270,75 +295,17 @@ aforementioned ones:
logging-input-sqlite
-Add_table options
------------------
-
-This section lists all possible options that can be used for the add_table
-function and gives a short explanation of their use. Most of the options
-already have been discussed in the previous sections.
-
-The possible fields that can be set for a table stream are:
-
- ``source``
- A mandatory string identifying the source of the data.
- For the ASCII reader this is the filename.
-
- ``name``
- A mandatory name for the filter that can later be used
- to manipulate it further.
-
- ``idx``
- Record type that defines the index of the table.
-
- ``val``
- Record type that defines the values of the table.
-
- ``reader``
- The reader used for this stream. Default is ``READER_ASCII``.
-
- ``mode``
- The mode in which the stream is opened. Possible values are
- ``MANUAL``, ``REREAD`` and ``STREAM``. Default is ``MANUAL``.
- ``MANUAL`` means that the file is not updated after it has
- been read. Changes to the file will not be reflected in the
- data Bro knows. ``REREAD`` means that the whole file is read
- again each time a change is found. This should be used for
- files that are mapped to a table where individual lines can
- change. ``STREAM`` means that the data from the file is
- streamed. Events / table entries will be generated as new
- data is appended to the file.
-
- ``destination``
- The destination table.
-
- ``ev``
- Optional event that is raised, when values are added to,
- changed in, or deleted from the table. Events are passed an
- Input::Event description as the first argument, the index
- record as the second argument and the values as the third
- argument.
-
- ``pred``
- Optional predicate, that can prevent entries from being added
- to the table and events from being sent.
-
- ``want_record``
- Boolean value, that defines if the event wants to receive the
- fields inside of a single record value, or individually
- (default). This can be used if ``val`` is a record
- containing only one type. In this case, if ``want_record`` is
- set to false, the table will contain elements of the type
- contained in ``val``.
Reading Data to Events
======================
The second supported mode of the input framework is reading data to Bro
-events instead of reading them to a table using event streams.
+events instead of reading them to a table.
Event streams work very similarly to table streams that were already
discussed in much detail. To read the blacklist of the previous example
-into an event stream, the following Bro code could be used:
+into an event stream, the :bro:id:`Input::add_event` function is used.
+For example:
.. code:: bro
@@ -348,12 +315,15 @@ into an event stream, the following Bro code could be used:
reason: string;
};
- event blacklistentry(description: Input::EventDescription, tpe: Input::Event, ip: addr, timestamp: time, reason: string) {
- # work with event data
+ event blacklistentry(description: Input::EventDescription,
+ t: Input::Event, data: Val) {
+ # do something here...
+ print "data:", data;
}
event bro_init() {
- Input::add_event([$source="blacklist.file", $name="blacklist", $fields=Val, $ev=blacklistentry]);
+ Input::add_event([$source="blacklist.file", $name="blacklist",
+ $fields=Val, $ev=blacklistentry]);
}
@@ -364,52 +334,3 @@ data types are provided in a single record definition.
Apart from this, event streams work exactly the same as table streams and
support most of the options that are also supported for table streams.
-The options that can be set when creating an event stream with
-``add_event`` are:
-
- ``source``
- A mandatory string identifying the source of the data.
- For the ASCII reader this is the filename.
-
- ``name``
- A mandatory name for the stream that can later be used
- to remove it.
-
- ``fields``
- Name of a record type containing the fields, which should be
- retrieved from the input stream.
-
- ``ev``
- The event which is fired, after a line has been read from the
- input source. The first argument that is passed to the event
- is an Input::Event structure, followed by the data, either
- inside of a record (if ``want_record is set``) or as
- individual fields. The Input::Event structure can contain
- information, if the received line is ``NEW``, has been
- ``CHANGED`` or ``DELETED``. Since the ASCII reader cannot
- track this information for event filters, the value is
- always ``NEW`` at the moment.
-
- ``mode``
- The mode in which the stream is opened. Possible values are
- ``MANUAL``, ``REREAD`` and ``STREAM``. Default is ``MANUAL``.
- ``MANUAL`` means that the file is not updated after it has
- been read. Changes to the file will not be reflected in the
- data Bro knows. ``REREAD`` means that the whole file is read
- again each time a change is found. This should be used for
- files that are mapped to a table where individual lines can
- change. ``STREAM`` means that the data from the file is
- streamed. Events / table entries will be generated as new
- data is appended to the file.
-
- ``reader``
- The reader used for this stream. Default is ``READER_ASCII``.
-
- ``want_record``
- Boolean value, that defines if the event wants to receive the
- fields inside of a single record value, or individually
- (default). If this is set to true, the event will receive a
- single record of the type provided in ``fields``.
-
-
-
diff --git a/doc/frameworks/logging-input-sqlite.rst b/doc/frameworks/logging-input-sqlite.rst
index 6f5e867686..e0f10308ae 100644
--- a/doc/frameworks/logging-input-sqlite.rst
+++ b/doc/frameworks/logging-input-sqlite.rst
@@ -23,17 +23,18 @@ In contrast to the ASCII reader and writer, the SQLite plugins have not yet
seen extensive use in production environments. While we are not aware
of any issues with them, we urge to caution when using them
in production environments. There could be lingering issues which only occur
-when the plugins are used with high amounts of data or in high-load environments.
+when the plugins are used with high amounts of data or in high-load
+environments.
Logging Data into SQLite Databases
==================================
Logging support for SQLite is available in all Bro installations starting with
-version 2.2. There is no need to load any additional scripts or for any compile-time
-configurations.
+version 2.2. There is no need to load any additional scripts or for any
+compile-time configurations.
-Sending data from existing logging streams to SQLite is rather straightforward. You
-have to define a filter which specifies SQLite as the writer.
+Sending data from existing logging streams to SQLite is rather straightforward.
+You have to define a filter which specifies SQLite as the writer.
The following example code adds SQLite as a filter for the connection log:
@@ -44,15 +45,15 @@ The following example code adds SQLite as a filter for the connection log:
# Make sure this parses correctly at least.
@TEST-EXEC: bro ${DOC_ROOT}/frameworks/sqlite-conn-filter.bro
-Bro will create the database file ``/var/db/conn.sqlite``, if it does not already exist.
-It will also create a table with the name ``conn`` (if it does not exist) and start
-appending connection information to the table.
+Bro will create the database file ``/var/db/conn.sqlite``, if it does not
+already exist. It will also create a table with the name ``conn`` (if it
+does not exist) and start appending connection information to the table.
-At the moment, SQLite databases are not rotated the same way ASCII log-files are. You
-have to take care to create them in an adequate location.
+At the moment, SQLite databases are not rotated the same way ASCII log-files
+are. You have to take care to create them in an adequate location.
-If you examine the resulting SQLite database, the schema will contain the same fields
-that are present in the ASCII log files::
+If you examine the resulting SQLite database, the schema will contain the
+same fields that are present in the ASCII log files::
# sqlite3 /var/db/conn.sqlite
@@ -75,27 +76,31 @@ from being created, you can remove the default filter:
Log::remove_filter(Conn::LOG, "default");
-To create a custom SQLite log file, you have to create a new log stream that contains
-just the information you want to commit to the database. Please refer to the
-:ref:`framework-logging` documentation on how to create custom log streams.
+To create a custom SQLite log file, you have to create a new log stream
+that contains just the information you want to commit to the database.
+Please refer to the :ref:`framework-logging` documentation on how to
+create custom log streams.
Reading Data from SQLite Databases
==================================
-Like logging support, support for reading data from SQLite databases is built into Bro starting
-with version 2.2.
+Like logging support, support for reading data from SQLite databases is
+built into Bro starting with version 2.2.
-Just as with the text-based input readers (please refer to the :ref:`framework-input`
-documentation for them and for basic information on how to use the input-framework), the SQLite reader
-can be used to read data - in this case the result of SQL queries - into tables or into events.
+Just as with the text-based input readers (please refer to the
+:ref:`framework-input` documentation for them and for basic information
+on how to use the input framework), the SQLite reader can be used to
+read data - in this case the result of SQL queries - into tables or into
+events.
Reading Data into Tables
------------------------
-To read data from a SQLite database, we first have to provide Bro with the information, how
-the resulting data will be structured. For this example, we expect that we have a SQLite database,
-which contains host IP addresses and the user accounts that are allowed to log into a specific
-machine.
+To read data from a SQLite database, we first have to provide Bro with
+the information, how the resulting data will be structured. For this
+example, we expect that we have a SQLite database, which contains
+host IP addresses and the user accounts that are allowed to log into
+a specific machine.
The SQLite commands to create the schema are as follows::
@@ -107,8 +112,8 @@ The SQLite commands to create the schema are as follows::
insert into machines_to_users values ('192.168.17.2', 'bernhard');
insert into machines_to_users values ('192.168.17.3', 'seth,matthias');
-After creating a file called ``hosts.sqlite`` with this content, we can read the resulting table
-into Bro:
+After creating a file called ``hosts.sqlite`` with this content, we can
+read the resulting table into Bro:
.. btest-include:: ${DOC_ROOT}/frameworks/sqlite-read-table.bro
@@ -117,22 +122,25 @@ into Bro:
# Make sure this parses correctly at least.
@TEST-EXEC: bro ${DOC_ROOT}/frameworks/sqlite-read-table.bro
-Afterwards, that table can be used to check logins into hosts against the available
-userlist.
+Afterwards, that table can be used to check logins into hosts against
+the available userlist.
Turning Data into Events
------------------------
-The second mode is to use the SQLite reader to output the input data as events. Typically there
-are two reasons to do this. First, when the structure of the input data is too complicated
-for a direct table import. In this case, the data can be read into an event which can then
-create the necessary data structures in Bro in scriptland.
+The second mode is to use the SQLite reader to output the input data as events.
+Typically there are two reasons to do this. First, when the structure of
+the input data is too complicated for a direct table import. In this case,
+the data can be read into an event which can then create the necessary
+data structures in Bro in scriptland.
-The second reason is, that the dataset is too big to hold it in memory. In this case, the checks
-can be performed on-demand, when Bro encounters a situation where it needs additional information.
+The second reason is, that the dataset is too big to hold it in memory. In
+this case, the checks can be performed on-demand, when Bro encounters a
+situation where it needs additional information.
-An example for this would be an internal huge database with malware hashes. Live database queries
-could be used to check the sporadically happening downloads against the database.
+An example for this would be an internal huge database with malware
+hashes. Live database queries could be used to check the sporadically
+happening downloads against the database.
The SQLite commands to create the schema are as follows::
@@ -151,9 +159,10 @@ The SQLite commands to create the schema are as follows::
insert into malware_hashes values ('73f45106968ff8dc51fba105fa91306af1ff6666', 'ftp-trace');
-The following code uses the file-analysis framework to get the sha1 hashes of files that are
-transmitted over the network. For each hash, a SQL-query is run against SQLite. If the query
-returns with a result, we had a hit against our malware-database and output the matching hash.
+The following code uses the file-analysis framework to get the sha1 hashes
+of files that are transmitted over the network. For each hash, a SQL-query
+is run against SQLite. If the query returns with a result, we had a hit
+against our malware-database and output the matching hash.
.. btest-include:: ${DOC_ROOT}/frameworks/sqlite-read-events.bro
@@ -162,5 +171,5 @@ returns with a result, we had a hit against our malware-database and output the
# Make sure this parses correctly at least.
@TEST-EXEC: bro ${DOC_ROOT}/frameworks/sqlite-read-events.bro
-If you run this script against the trace in ``testing/btest/Traces/ftp/ipv4.trace``, you
-will get one hit.
+If you run this script against the trace in
+``testing/btest/Traces/ftp/ipv4.trace``, you will get one hit.
diff --git a/doc/frameworks/logging.rst b/doc/frameworks/logging.rst
index 9b6fef0c15..a5128da202 100644
--- a/doc/frameworks/logging.rst
+++ b/doc/frameworks/logging.rst
@@ -537,6 +537,5 @@ Additional writers are available as external plugins:
.. toctree::
:maxdepth: 1
- ../components/bro-plugins/dataseries/README
- ../components/bro-plugins/elasticsearch/README
+ ../components/bro-plugins/README
diff --git a/doc/install/guidelines.rst b/doc/install/guidelines.rst
index d1e1777165..a56110f865 100644
--- a/doc/install/guidelines.rst
+++ b/doc/install/guidelines.rst
@@ -46,4 +46,4 @@ where Bro was originally installed). Review the files for differences
before copying and make adjustments as necessary (use the new version for
differences that aren't a result of a local change). Of particular note,
the copied version of ``$prefix/etc/broctl.cfg`` is likely to need changes
-to the ``SpoolDir`` and ``LogDir`` settings.
+to any settings that specify a pathname.
diff --git a/doc/install/install.rst b/doc/install/install.rst
index eff3ec9728..a9f1c85bdd 100644
--- a/doc/install/install.rst
+++ b/doc/install/install.rst
@@ -4,7 +4,7 @@
.. _MacPorts: http://www.macports.org
.. _Fink: http://www.finkproject.org
.. _Homebrew: http://brew.sh
-.. _bro downloads page: http://bro.org/download/index.html
+.. _bro downloads page: https://www.bro.org/download/index.html
.. _installing-bro:
@@ -32,24 +32,22 @@ before you begin:
* Libz
* Bash (for BroControl)
* Python (for BroControl)
- * C++ Actor Framework (CAF) (http://actor-framework.org)
+ * C++ Actor Framework (CAF) version 0.14 (http://actor-framework.org)
To build Bro from source, the following additional dependencies are required:
* CMake 2.8 or greater (http://www.cmake.org)
* Make
- * C/C++ compiler with C++11 support
+ * C/C++ compiler with C++11 support (GCC 4.8+ or Clang 3.3+)
* SWIG (http://www.swig.org)
* Bison (GNU Parser Generator)
* Flex (Fast Lexical Analyzer)
* Libpcap headers (http://www.tcpdump.org)
* OpenSSL headers (http://www.openssl.org)
* zlib headers
- * Perl
+ * Python
-.. todo::
-
- Update with instructions for installing CAF.
+To install CAF, first download the source code of the required version from: https://github.com/actor-framework/actor-framework/releases
To install the required dependencies, you can use:
@@ -72,7 +70,7 @@ To install the required dependencies, you can use:
.. console::
- sudo pkg install bash cmake swig bison python perl5 py27-sqlite3
+ sudo pkg install bash cmake swig bison python py27-sqlite3
Note that in older versions of FreeBSD, you might have to use the
"pkg_add -r" command instead of "pkg install".
@@ -84,11 +82,14 @@ To install the required dependencies, you can use:
"Preferences..." -> "Downloads" menus to install the "Command Line Tools"
component).
- OS X comes with all required dependencies except for CMake_ and SWIG_.
- Distributions of these dependencies can likely be obtained from your
- preferred Mac OS X package management system (e.g. MacPorts_, Fink_,
- or Homebrew_). Specifically for MacPorts, the ``cmake``, ``swig``,
- and ``swig-python`` packages provide the required dependencies.
+ OS X comes with all required dependencies except for CMake_, SWIG_,
+ OpenSSL, and CAF. (OpenSSL used to be part of OS X versions 10.10
+ and older, for which it does not need to be installed manually. It
+ was removed in OS X 10.11). Distributions of these dependencies can
+ likely be obtained from your preferred Mac OS X package management
+ system (e.g. Homebrew_, MacPorts_, or Fink_). Specifically for
+ Homebrew, the ``cmake``, ``swig``, ``openssl`` and ``caf`` packages
+ provide the required dependencies.
Optional Dependencies
@@ -101,6 +102,8 @@ build time:
* sendmail (enables Bro and BroControl to send mail)
* curl (used by a Bro script that implements active HTTP)
* gperftools (tcmalloc is used to improve memory and CPU usage)
+ * jemalloc (http://www.canonware.com/jemalloc/)
+ * PF_RING (Linux only, see :doc:`Cluster Configuration <../configuration/index>`)
* ipsumdump (for trace-summary; http://www.cs.ucla.edu/~kohler/ipsumdump)
LibGeoIP is probably the most interesting and can be installed
@@ -117,7 +120,7 @@ code forms.
Using Pre-Built Binary Release Packages
-=======================================
+---------------------------------------
See the `bro downloads page`_ for currently supported/targeted
platforms for binary releases and for installation instructions.
@@ -126,25 +129,21 @@ platforms for binary releases and for installation instructions.
Linux based binary installations are usually performed by adding
information about the Bro packages to the respective system packaging
- tool. Then the usual system utilities such as ``apt``, ``yum``
- or ``zypper`` are used to perform the installation. By default,
- installations of binary packages will go into ``/opt/bro``.
-
-* MacOS Disk Image with Installer
-
- Just open the ``Bro-*.dmg`` and then run the ``.pkg`` installer.
- Everything installed by the package will go into ``/opt/bro``.
+ tool. Then the usual system utilities such as ``apt``, ``dnf``, ``yum``,
+ or ``zypper`` are used to perform the installation.
The primary install prefix for binary packages is ``/opt/bro``.
Installing from Source
-======================
+----------------------
Bro releases are bundled into source packages for convenience and are
-available on the `bro downloads page`_. Alternatively, the latest
-Bro development version can be obtained through git repositories
+available on the `bro downloads page`_.
+
+Alternatively, the latest Bro development version
+can be obtained through git repositories
hosted at ``git.bro.org``. See our `git development documentation
-`_ for comprehensive
+`_ for comprehensive
information on Bro's use of git revision control, but the short story
for downloading the full source code experience for Bro via git is:
@@ -165,13 +164,23 @@ run ``./configure --help``):
make
make install
+If the ``configure`` script fails, then it is most likely because it either
+couldn't find a required dependency or it couldn't find a sufficiently new
+version of a dependency. Assuming that you already installed all required
+dependencies, then you may need to use one of the ``--with-*`` options
+that can be given to the ``configure`` script to help it locate a dependency.
+
The default installation path is ``/usr/local/bro``, which would typically
-require root privileges when doing the ``make install``. A different
-installation path can be chosen by specifying the ``--prefix`` option.
-Note that ``/usr`` and ``/opt/bro`` are the
+require root privileges when doing the ``make install``. A different
+installation path can be chosen by specifying the ``configure`` script
+``--prefix`` option. Note that ``/usr`` and ``/opt/bro`` are the
standard prefixes for binary Bro packages to be installed, so those are
typically not good choices unless you are creating such a package.
+OpenBSD users, please see our `FAQ
+`_ if you are having
+problems installing Bro.
+
Depending on the Bro package you downloaded, there may be auxiliary
tools and libraries available in the ``aux/`` directory. Some of them
will be automatically built and installed along with Bro. There are
@@ -180,10 +189,6 @@ turn off unwanted auxiliary projects that would otherwise be installed
automatically. Finally, use ``make install-aux`` to install some of
the other programs that are in the ``aux/bro-aux`` directory.
-OpenBSD users, please see our `FAQ
-`_ if you are having
-problems installing Bro.
-
Finally, if you want to build the Bro documentation (not required, because
all of the documentation for the latest Bro release is available on the
Bro web site), there are instructions in ``doc/README`` in the source
@@ -192,7 +197,7 @@ distribution.
Configure the Run-Time Environment
==================================
-Just remember that you may need to adjust your ``PATH`` environment variable
+You may want to adjust your ``PATH`` environment variable
according to the platform/shell/package you're using. For example:
Bourne-Shell Syntax:
diff --git a/doc/script-reference/attributes.rst b/doc/script-reference/attributes.rst
index d37cc2a98a..fec72570d2 100644
--- a/doc/script-reference/attributes.rst
+++ b/doc/script-reference/attributes.rst
@@ -54,13 +54,16 @@ Here is a more detailed explanation of each attribute:
.. bro:attr:: &redef
- Allows for redefinition of initial values of global objects declared as
- constant.
-
- In this example, the constant (assuming it is global) can be redefined
- with a :bro:keyword:`redef` at some later point::
+ Allows use of a :bro:keyword:`redef` to redefine initial values of
+ global variables (i.e., variables declared either :bro:keyword:`global`
+ or :bro:keyword:`const`). Example::
const clever = T &redef;
+ global cache_size = 256 &redef;
+
+ Note that a variable declared "global" can also have its value changed
+ with assignment statements (doesn't matter if it has the "&redef"
+ attribute or not).
.. bro:attr:: &priority
diff --git a/doc/script-reference/statements.rst b/doc/script-reference/statements.rst
index 1f5b388e7f..e2f93a5627 100644
--- a/doc/script-reference/statements.rst
+++ b/doc/script-reference/statements.rst
@@ -71,9 +71,11 @@ Statements
Declarations
------------
-The following global declarations cannot occur within a function, hook, or
-event handler. Also, these declarations cannot appear after any statements
-that are outside of a function, hook, or event handler.
+Declarations cannot occur within a function, hook, or event handler.
+
+Declarations must appear before any statements (except those statements
+that are in a function, hook, or event handler) in the concatenation of
+all loaded Bro scripts.
.. bro:keyword:: module
@@ -126,9 +128,12 @@ that are outside of a function, hook, or event handler.
.. bro:keyword:: global
Variables declared with the "global" keyword will be global.
+
If a type is not specified, then an initializer is required so that
the type can be inferred. Likewise, if an initializer is not supplied,
- then the type must be specified. Example::
+ then the type must be specified. In some cases, when the type cannot
+ be correctly inferred, the type must be specified even when an
+ initializer is present. Example::
global pi = 3.14;
global hosts: set[addr];
@@ -136,10 +141,11 @@ that are outside of a function, hook, or event handler.
Variable declarations outside of any function, hook, or event handler are
required to use this keyword (unless they are declared with the
- :bro:keyword:`const` keyword). Definitions of functions, hooks, and
- event handlers are not allowed to use the "global"
- keyword (they already have global scope), except function declarations
- where no function body is supplied use the "global" keyword.
+ :bro:keyword:`const` keyword instead).
+
+ Definitions of functions, hooks, and event handlers are not allowed
+ to use the "global" keyword. However, function declarations (i.e., no
+ function body is provided) can use the "global" keyword.
The scope of a global variable begins where the declaration is located,
and extends through all remaining Bro scripts that are loaded (however,
@@ -150,18 +156,22 @@ that are outside of a function, hook, or event handler.
.. bro:keyword:: const
A variable declared with the "const" keyword will be constant.
+
Variables declared as constant are required to be initialized at the
- time of declaration. Example::
+ time of declaration. Normally, the type is inferred from the initializer,
+ but the type can be explicitly specified. Example::
const pi = 3.14;
const ssh_port: port = 22/tcp;
- The value of a constant cannot be changed later (the only
- exception is if the variable is global and has the :bro:attr:`&redef`
- attribute, then its value can be changed only with a :bro:keyword:`redef`).
+ The value of a constant cannot be changed. The only exception is if the
+ variable is a global constant and has the :bro:attr:`&redef`
+ attribute, but even then its value can be changed only with a
+ :bro:keyword:`redef`.
The scope of a constant is local if the declaration is in a
function, hook, or event handler, and global otherwise.
+
Note that the "const" keyword cannot be used with either the "local"
or "global" keywords (i.e., "const" replaces "local" and "global").
@@ -184,7 +194,8 @@ that are outside of a function, hook, or event handler.
.. bro:keyword:: redef
There are three ways that "redef" can be used: to change the value of
- a global variable, to extend a record type or enum type, or to specify
+ a global variable (but only if it has the :bro:attr:`&redef` attribute),
+ to extend a record type or enum type, or to specify
a new event handler body that replaces all those that were previously
defined.
@@ -237,13 +248,14 @@ that are outside of a function, hook, or event handler.
Statements
----------
+Statements (except those contained within a function, hook, or event
+handler) can appear only after all global declarations in the concatenation
+of all loaded Bro scripts.
+
Each statement in a Bro script must be terminated with a semicolon (with a
few exceptions noted below). An individual statement can span multiple
lines.
-All statements (except those contained within a function, hook, or event
-handler) must appear after all global declarations.
-
Here are the statements that the Bro scripting language supports.
.. bro:keyword:: add
diff --git a/doc/script-reference/types.rst b/doc/script-reference/types.rst
index cc601db75f..847e0f8fab 100644
--- a/doc/script-reference/types.rst
+++ b/doc/script-reference/types.rst
@@ -340,15 +340,18 @@ Here is a more detailed description of each type:
table [ type^+ ] of type
- where *type^+* is one or more types, separated by commas.
- For example:
+ where *type^+* is one or more types, separated by commas. The
+ index type cannot be any of the following types: pattern, table, set,
+ vector, file, opaque, any.
+
+ Here is an example of declaring a table indexed by "count" values
+ and yielding "string" values:
.. code:: bro
global a: table[count] of string;
- declares a table indexed by "count" values and yielding
- "string" values. The yield type can also be more complex:
+ The yield type can also be more complex:
.. code:: bro
@@ -441,7 +444,9 @@ Here is a more detailed description of each type:
set [ type^+ ]
- where *type^+* is one or more types separated by commas.
+ where *type^+* is one or more types separated by commas. The
+ index type cannot be any of the following types: pattern, table, set,
+ vector, file, opaque, any.
Sets can be initialized by listing elements enclosed by curly braces:
diff --git a/doc/scripting/data_struct_record_01.bro b/doc/scripting/data_struct_record_01.bro
index a80d30faae..ab28501f96 100644
--- a/doc/scripting/data_struct_record_01.bro
+++ b/doc/scripting/data_struct_record_01.bro
@@ -4,7 +4,7 @@ type Service: record {
rfc: count;
};
-function print_service(serv: Service): string
+function print_service(serv: Service)
{
print fmt("Service: %s(RFC%d)",serv$name, serv$rfc);
diff --git a/doc/scripting/data_struct_record_02.bro b/doc/scripting/data_struct_record_02.bro
index b10b3feac0..515c8a716c 100644
--- a/doc/scripting/data_struct_record_02.bro
+++ b/doc/scripting/data_struct_record_02.bro
@@ -9,7 +9,7 @@ type System: record {
services: set[Service];
};
-function print_service(serv: Service): string
+function print_service(serv: Service)
{
print fmt(" Service: %s(RFC%d)",serv$name, serv$rfc);
@@ -17,7 +17,7 @@ function print_service(serv: Service): string
print fmt(" port: %s", p);
}
-function print_system(sys: System): string
+function print_system(sys: System)
{
print fmt("System: %s", sys$name);
diff --git a/scripts/base/frameworks/cluster/main.bro b/scripts/base/frameworks/cluster/main.bro
index 218e309bad..3451cb4169 100644
--- a/scripts/base/frameworks/cluster/main.bro
+++ b/scripts/base/frameworks/cluster/main.bro
@@ -43,35 +43,35 @@ export {
## software.
TIME_MACHINE,
};
-
+
## Events raised by a manager and handled by the workers.
const manager2worker_events = /Drop::.*/ &redef;
-
+
## Events raised by a manager and handled by proxies.
const manager2proxy_events = /EMPTY/ &redef;
-
+
## Events raised by proxies and handled by a manager.
const proxy2manager_events = /EMPTY/ &redef;
-
+
## Events raised by proxies and handled by workers.
const proxy2worker_events = /EMPTY/ &redef;
-
+
## Events raised by workers and handled by a manager.
const worker2manager_events = /(TimeMachine::command|Drop::.*)/ &redef;
-
+
## Events raised by workers and handled by proxies.
const worker2proxy_events = /EMPTY/ &redef;
-
+
## Events raised by TimeMachine instances and handled by a manager.
const tm2manager_events = /EMPTY/ &redef;
-
+
## Events raised by TimeMachine instances and handled by workers.
const tm2worker_events = /EMPTY/ &redef;
-
- ## Events sent by the control host (i.e. BroControl) when dynamically
+
+ ## Events sent by the control host (i.e. BroControl) when dynamically
## connecting to a running instance to update settings or request data.
const control_events = Control::controller_events &redef;
-
+
## Record type to indicate a node in a cluster.
type Node: record {
## Identifies the type of cluster node in this node's configuration.
@@ -96,13 +96,13 @@ export {
## Name of a time machine node with which this node connects.
time_machine: string &optional;
};
-
+
## This function can be called at any time to determine if the cluster
## framework is being enabled for this run.
##
## Returns: True if :bro:id:`Cluster::node` has been set.
global is_enabled: function(): bool;
-
+
## This function can be called at any time to determine what type of
## cluster node the current Bro instance is going to be acting as.
## If :bro:id:`Cluster::is_enabled` returns false, then
@@ -110,22 +110,25 @@ export {
##
## Returns: The :bro:type:`Cluster::NodeType` the calling node acts as.
global local_node_type: function(): NodeType;
-
+
## This gives the value for the number of workers currently connected to,
- ## and it's maintained internally by the cluster framework. It's
- ## primarily intended for use by managers to find out how many workers
+ ## and it's maintained internally by the cluster framework. It's
+ ## primarily intended for use by managers to find out how many workers
## should be responding to requests.
global worker_count: count = 0;
-
+
## The cluster layout definition. This should be placed into a filter
- ## named cluster-layout.bro somewhere in the BROPATH. It will be
+ ## named cluster-layout.bro somewhere in the BROPATH. It will be
## automatically loaded if the CLUSTER_NODE environment variable is set.
## Note that BroControl handles all of this automatically.
const nodes: table[string] of Node = {} &redef;
-
+
## This is usually supplied on the command line for each instance
## of the cluster that is started up.
const node = getenv("CLUSTER_NODE") &redef;
+
+ ## Interval for retrying failed connections between cluster nodes.
+ const retry_interval = 1min &redef;
}
function is_enabled(): bool
@@ -158,6 +161,6 @@ event bro_init() &priority=5
Reporter::error(fmt("'%s' is not a valid node in the Cluster::nodes configuration", node));
terminate();
}
-
+
Log::create_stream(Cluster::LOG, [$columns=Info, $path="cluster"]);
}
diff --git a/scripts/base/frameworks/cluster/setup-connections.bro b/scripts/base/frameworks/cluster/setup-connections.bro
index 4576f5b913..95aff64a6c 100644
--- a/scripts/base/frameworks/cluster/setup-connections.bro
+++ b/scripts/base/frameworks/cluster/setup-connections.bro
@@ -11,7 +11,7 @@ module Cluster;
event bro_init() &priority=9
{
local me = nodes[node];
-
+
for ( i in Cluster::nodes )
{
local n = nodes[i];
@@ -22,35 +22,35 @@ event bro_init() &priority=9
Communication::nodes["control"] = [$host=n$ip, $zone_id=n$zone_id,
$connect=F, $class="control",
$events=control_events];
-
+
if ( me$node_type == MANAGER )
{
if ( n$node_type == WORKER && n$manager == node )
Communication::nodes[i] =
[$host=n$ip, $zone_id=n$zone_id, $connect=F,
$class=i, $events=worker2manager_events, $request_logs=T];
-
+
if ( n$node_type == PROXY && n$manager == node )
Communication::nodes[i] =
[$host=n$ip, $zone_id=n$zone_id, $connect=F,
$class=i, $events=proxy2manager_events, $request_logs=T];
-
+
if ( n$node_type == TIME_MACHINE && me?$time_machine && me$time_machine == i )
Communication::nodes["time-machine"] = [$host=nodes[i]$ip,
$zone_id=nodes[i]$zone_id,
$p=nodes[i]$p,
- $connect=T, $retry=1min,
+ $connect=T, $retry=retry_interval,
$events=tm2manager_events];
}
-
+
else if ( me$node_type == PROXY )
{
if ( n$node_type == WORKER && n$proxy == node )
Communication::nodes[i] =
[$host=n$ip, $zone_id=n$zone_id, $connect=F, $class=i,
$sync=T, $auth=T, $events=worker2proxy_events];
-
- # accepts connections from the previous one.
+
+ # accepts connections from the previous one.
# (This is not ideal for setups with many proxies)
# FIXME: Once we're using multiple proxies, we should also figure out some $class scheme ...
if ( n$node_type == PROXY )
@@ -58,49 +58,49 @@ event bro_init() &priority=9
if ( n?$proxy )
Communication::nodes[i]
= [$host=n$ip, $zone_id=n$zone_id, $p=n$p,
- $connect=T, $auth=F, $sync=T, $retry=1mins];
+ $connect=T, $auth=F, $sync=T, $retry=retry_interval];
else if ( me?$proxy && me$proxy == i )
Communication::nodes[me$proxy]
= [$host=nodes[i]$ip, $zone_id=nodes[i]$zone_id,
$connect=F, $auth=T, $sync=T];
}
-
+
# Finally the manager, to send it status updates.
if ( n$node_type == MANAGER && me$manager == i )
- Communication::nodes["manager"] = [$host=nodes[i]$ip,
- $zone_id=nodes[i]$zone_id,
- $p=nodes[i]$p,
- $connect=T, $retry=1mins,
+ Communication::nodes["manager"] = [$host=nodes[i]$ip,
+ $zone_id=nodes[i]$zone_id,
+ $p=nodes[i]$p,
+ $connect=T, $retry=retry_interval,
$class=node,
$events=manager2proxy_events];
}
else if ( me$node_type == WORKER )
{
if ( n$node_type == MANAGER && me$manager == i )
- Communication::nodes["manager"] = [$host=nodes[i]$ip,
+ Communication::nodes["manager"] = [$host=nodes[i]$ip,
$zone_id=nodes[i]$zone_id,
$p=nodes[i]$p,
- $connect=T, $retry=1mins,
- $class=node,
+ $connect=T, $retry=retry_interval,
+ $class=node,
$events=manager2worker_events];
-
+
if ( n$node_type == PROXY && me$proxy == i )
- Communication::nodes["proxy"] = [$host=nodes[i]$ip,
+ Communication::nodes["proxy"] = [$host=nodes[i]$ip,
$zone_id=nodes[i]$zone_id,
$p=nodes[i]$p,
- $connect=T, $retry=1mins,
- $sync=T, $class=node,
+ $connect=T, $retry=retry_interval,
+ $sync=T, $class=node,
$events=proxy2worker_events];
-
- if ( n$node_type == TIME_MACHINE &&
+
+ if ( n$node_type == TIME_MACHINE &&
me?$time_machine && me$time_machine == i )
- Communication::nodes["time-machine"] = [$host=nodes[i]$ip,
+ Communication::nodes["time-machine"] = [$host=nodes[i]$ip,
$zone_id=nodes[i]$zone_id,
$p=nodes[i]$p,
- $connect=T,
- $retry=1min,
+ $connect=T,
+ $retry=retry_interval,
$events=tm2worker_events];
-
+
}
}
}
diff --git a/scripts/base/frameworks/files/magic/video.sig b/scripts/base/frameworks/files/magic/video.sig
index 5d499f2119..d939c15618 100644
--- a/scripts/base/frameworks/files/magic/video.sig
+++ b/scripts/base/frameworks/files/magic/video.sig
@@ -71,6 +71,14 @@ signature file-mp2p {
file-magic /\x00\x00\x01\xba([\x40-\x7f\xc0-\xff])/
}
+# MPEG transport stream data. These files typically have the extension "ts".
+# Note: The 0x47 repeats every 188 bytes. Using four as the number of
+# occurrences for the test here is arbitrary.
+signature file-mp2t {
+ file-mime "video/mp2t", 40
+ file-magic /^(\x47.{187}){4}/
+}
+
# Silicon Graphics video
signature file-sgi-movie {
file-mime "video/x-sgi-movie", 70
@@ -94,3 +102,4 @@ signature file-3gpp {
file-mime "video/3gpp", 60
file-magic /^....ftyp(3g[egps2]|avc1|mmp4)/
}
+
diff --git a/scripts/base/frameworks/input/main.bro b/scripts/base/frameworks/input/main.bro
index fa766ba27b..3df418315f 100644
--- a/scripts/base/frameworks/input/main.bro
+++ b/scripts/base/frameworks/input/main.bro
@@ -1,18 +1,25 @@
##! The input framework provides a way to read previously stored data either
-##! as an event stream or into a bro table.
+##! as an event stream or into a Bro table.
module Input;
export {
type Event: enum {
+ ## New data has been imported.
EVENT_NEW = 0,
+ ## Existing data has been changed.
EVENT_CHANGED = 1,
+ ## Previously existing data has been removed.
EVENT_REMOVED = 2,
};
+ ## Type that defines the input stream read mode.
type Mode: enum {
+ ## Do not automatically reread the file after it has been read.
MANUAL = 0,
+ ## Reread the entire file each time a change is found.
REREAD = 1,
+ ## Read data from end of file each time new data is appended.
STREAM = 2
};
@@ -24,20 +31,20 @@ export {
## Separator between fields.
## Please note that the separator has to be exactly one character long.
- ## Can be overwritten by individual writers.
+ ## Individual readers can use a different value.
const separator = "\t" &redef;
## Separator between set elements.
## Please note that the separator has to be exactly one character long.
- ## Can be overwritten by individual writers.
+ ## Individual readers can use a different value.
const set_separator = "," &redef;
## String to use for empty fields.
- ## Can be overwritten by individual writers.
+ ## Individual readers can use a different value.
const empty_field = "(empty)" &redef;
## String to use for an unset &optional field.
- ## Can be overwritten by individual writers.
+ ## Individual readers can use a different value.
const unset_field = "-" &redef;
## Flag that controls if the input framework accepts records
@@ -47,11 +54,11 @@ export {
## abort. Defaults to false (abort).
const accept_unsupported_types = F &redef;
- ## TableFilter description type used for the `table` method.
+ ## A table input stream type used to send data to a Bro table.
type TableDescription: record {
# Common definitions for tables and events
- ## String that allows the reader to find the source.
+ ## String that allows the reader to find the source of the data.
## For `READER_ASCII`, this is the filename.
source: string;
@@ -61,7 +68,8 @@ export {
## Read mode to use for this stream.
mode: Mode &default=default_mode;
- ## Descriptive name. Used to remove a stream at a later time.
+ ## Name of the input stream. This is used by some functions to
+ ## manipulate the stream.
name: string;
# Special definitions for tables
@@ -73,31 +81,35 @@ export {
idx: any;
## Record that defines the values used as the elements of the table.
- ## If this is undefined, then *destination* has to be a set.
+ ## If this is undefined, then *destination* must be a set.
val: any &optional;
- ## Defines if the value of the table is a record (default), or a single value.
- ## When this is set to false, then *val* can only contain one element.
+ ## Defines if the value of the table is a record (default), or a single
+ ## value. When this is set to false, then *val* can only contain one
+ ## element.
want_record: bool &default=T;
- ## The event that is raised each time a value is added to, changed in or removed
- ## from the table. The event will receive an Input::Event enum as the first
- ## argument, the *idx* record as the second argument and the value (record) as the
- ## third argument.
- ev: any &optional; # event containing idx, val as values.
+ ## The event that is raised each time a value is added to, changed in,
+ ## or removed from the table. The event will receive an
+ ## Input::TableDescription as the first argument, an Input::Event
+ ## enum as the second argument, the *idx* record as the third argument
+ ## and the value (record) as the fourth argument.
+ ev: any &optional;
- ## Predicate function that can decide if an insertion, update or removal should
- ## really be executed. Parameters are the same as for the event. If true is
- ## returned, the update is performed. If false is returned, it is skipped.
+ ## Predicate function that can decide if an insertion, update or removal
+ ## should really be executed. Parameters have same meaning as for the
+ ## event.
+ ## If true is returned, the update is performed. If false is returned,
+ ## it is skipped.
pred: function(typ: Input::Event, left: any, right: any): bool &optional;
- ## A key/value table that will be passed on the reader.
- ## Interpretation of the values is left to the writer, but
+ ## A key/value table that will be passed to the reader.
+ ## Interpretation of the values is left to the reader, but
## usually they will be used for configuration purposes.
- config: table[string] of string &default=table();
+ config: table[string] of string &default=table();
};
- ## EventFilter description type used for the `event` method.
+ ## An event input stream type used to send input data to a Bro event.
type EventDescription: record {
# Common definitions for tables and events
@@ -116,19 +128,26 @@ export {
# Special definitions for events
- ## Record describing the fields to be retrieved from the source input.
+ ## Record type describing the fields to be retrieved from the input
+ ## source.
fields: any;
- ## If this is false, the event receives each value in fields as a separate argument.
- ## If this is set to true (default), the event receives all fields in a single record value.
+ ## If this is false, the event receives each value in *fields* as a
+ ## separate argument.
+ ## If this is set to true (default), the event receives all fields in
+ ## a single record value.
want_record: bool &default=T;
- ## The event that is raised each time a new line is received from the reader.
- ## The event will receive an Input::Event enum as the first element, and the fields as the following arguments.
+ ## The event that is raised each time a new line is received from the
+ ## reader. The event will receive an Input::EventDescription record
+ ## as the first argument, an Input::Event enum as the second
+ ## argument, and the fields (as specified in *fields*) as the following
+ ## arguments (this will either be a single record value containing
+ ## all fields, or each field value as a separate argument).
ev: any;
- ## A key/value table that will be passed on the reader.
- ## Interpretation of the values is left to the writer, but
+ ## A key/value table that will be passed to the reader.
+ ## Interpretation of the values is left to the reader, but
## usually they will be used for configuration purposes.
config: table[string] of string &default=table();
};
@@ -155,28 +174,29 @@ export {
## field will be the same value as the *source* field.
name: string;
- ## A key/value table that will be passed on the reader.
- ## Interpretation of the values is left to the writer, but
+ ## A key/value table that will be passed to the reader.
+ ## Interpretation of the values is left to the reader, but
## usually they will be used for configuration purposes.
config: table[string] of string &default=table();
};
- ## Create a new table input from a given source.
+ ## Create a new table input stream from a given source.
##
## description: `TableDescription` record describing the source.
##
## Returns: true on success.
global add_table: function(description: Input::TableDescription) : bool;
- ## Create a new event input from a given source.
+ ## Create a new event input stream from a given source.
##
## description: `EventDescription` record describing the source.
##
## Returns: true on success.
global add_event: function(description: Input::EventDescription) : bool;
- ## Create a new file analysis input from a given source. Data read from
- ## the source is automatically forwarded to the file analysis framework.
+ ## Create a new file analysis input stream from a given source. Data read
+ ## from the source is automatically forwarded to the file analysis
+ ## framework.
##
## description: A record describing the source.
##
@@ -199,7 +219,11 @@ export {
## Event that is called when the end of a data source has been reached,
## including after an update.
- global end_of_data: event(name: string, source:string);
+ ##
+ ## name: Name of the input stream.
+ ##
+ ## source: String that identifies the data source (such as the filename).
+ global end_of_data: event(name: string, source: string);
}
@load base/bif/input.bif
diff --git a/scripts/base/frameworks/input/readers/raw.bro b/scripts/base/frameworks/input/readers/raw.bro
index b1e0fb6831..a1e95b71a1 100644
--- a/scripts/base/frameworks/input/readers/raw.bro
+++ b/scripts/base/frameworks/input/readers/raw.bro
@@ -11,7 +11,9 @@ export {
##
## name: name of the input stream.
## source: source of the input stream.
- ## exit_code: exit code of the program, or number of the signal that forced the program to exit.
- ## signal_exit: false when program exited normally, true when program was forced to exit by a signal.
+ ## exit_code: exit code of the program, or number of the signal that forced
+ ## the program to exit.
+ ## signal_exit: false when program exited normally, true when program was
+ ## forced to exit by a signal.
global process_finished: event(name: string, source:string, exit_code:count, signal_exit:bool);
}
diff --git a/scripts/base/frameworks/packet-filter/main.bro b/scripts/base/frameworks/packet-filter/main.bro
index b0a6f144e3..8a9cb4eb98 100644
--- a/scripts/base/frameworks/packet-filter/main.bro
+++ b/scripts/base/frameworks/packet-filter/main.bro
@@ -138,7 +138,7 @@ redef enum PcapFilterID += {
function test_filter(filter: string): bool
{
- if ( ! precompile_pcap_filter(FilterTester, filter) )
+ if ( ! Pcap::precompile_pcap_filter(FilterTester, filter) )
{
# The given filter was invalid
# TODO: generate a notice.
@@ -273,7 +273,7 @@ function install(): bool
return F;
local ts = current_time();
- if ( ! precompile_pcap_filter(DefaultPcapFilter, tmp_filter) )
+ if ( ! Pcap::precompile_pcap_filter(DefaultPcapFilter, tmp_filter) )
{
NOTICE([$note=Compile_Failure,
$msg=fmt("Compiling packet filter failed"),
@@ -303,7 +303,7 @@ function install(): bool
}
info$filter = current_filter;
- if ( ! install_pcap_filter(DefaultPcapFilter) )
+ if ( ! Pcap::install_pcap_filter(DefaultPcapFilter) )
{
# Installing the filter failed for some reason.
info$success = F;
diff --git a/scripts/base/frameworks/software/main.bro b/scripts/base/frameworks/software/main.bro
index bcb791b4f4..0c1c4cd302 100644
--- a/scripts/base/frameworks/software/main.bro
+++ b/scripts/base/frameworks/software/main.bro
@@ -280,6 +280,13 @@ function parse_mozilla(unparsed_version: string): Description
v = parse(parts[1])$version;
}
}
+ else if ( /AdobeAIR\/[0-9\.]*/ in unparsed_version )
+ {
+ software_name = "AdobeAIR";
+ parts = split_string_all(unparsed_version, /AdobeAIR\/[0-9\.]*/);
+ if ( 1 in parts )
+ v = parse(parts[1])$version;
+ }
else if ( /AppleWebKit\/[0-9\.]*/ in unparsed_version )
{
software_name = "Unspecified WebKit";
diff --git a/scripts/base/init-bare.bro b/scripts/base/init-bare.bro
index 046d1a67aa..53e33f5621 100644
--- a/scripts/base/init-bare.bro
+++ b/scripts/base/init-bare.bro
@@ -361,7 +361,7 @@ type connection: record {
## The outer VLAN, if applicable, for this connection.
vlan: int &optional;
- ## The VLAN vlan, if applicable, for this connection.
+ ## The inner VLAN, if applicable, for this connection.
inner_vlan: int &optional;
};
@@ -2521,7 +2521,7 @@ global dns_skip_all_addl = T &redef;
## If a DNS request includes more than this many queries, assume it's non-DNS
## traffic and do not process it. Set to 0 to turn off this functionality.
-global dns_max_queries = 5;
+global dns_max_queries = 25 &redef;
## HTTP session statistics.
##
@@ -3674,20 +3674,11 @@ export {
## Toggle whether to do GRE decapsulation.
const enable_gre = T &redef;
- ## With this option set, the Teredo analysis will first check to see if
- ## other protocol analyzers have confirmed that they think they're
- ## parsing the right protocol and only continue with Teredo tunnel
- ## decapsulation if nothing else has yet confirmed. This can help
- ## reduce false positives of UDP traffic (e.g. DNS) that also happens
- ## to have a valid Teredo encapsulation.
- const yielding_teredo_decapsulation = T &redef;
-
## With this set, the Teredo analyzer waits until it sees both sides
## of a connection using a valid Teredo encapsulation before issuing
## a :bro:see:`protocol_confirmation`. If it's false, the first
## occurrence of a packet with valid Teredo encapsulation causes a
- ## confirmation. Both cases are still subject to effects of
- ## :bro:see:`Tunnel::yielding_teredo_decapsulation`.
+ ## confirmation.
const delay_teredo_confirmation = T &redef;
## With this set, the GTP analyzer waits until the most-recent upflow
@@ -3703,7 +3694,6 @@ export {
## (includes GRE tunnels).
const ip_tunnel_timeout = 24hrs &redef;
} # end export
-module GLOBAL;
module Reporter;
export {
@@ -3722,10 +3712,18 @@ export {
## external harness and shouldn't output anything to the console.
const errors_to_stderr = T &redef;
}
-module GLOBAL;
-## Number of bytes per packet to capture from live interfaces.
-const snaplen = 8192 &redef;
+module Pcap;
+export {
+ ## Number of bytes per packet to capture from live interfaces.
+ const snaplen = 8192 &redef;
+
+ ## Number of Mbytes to provide as buffer space when capturing from live
+ ## interfaces.
+ const bufsize = 128 &redef;
+} # end export
+
+module GLOBAL;
## Seed for hashes computed internally for probabilistic data structures. Using
## the same value here will make the hashes compatible between independent Bro
diff --git a/scripts/base/protocols/conn/main.bro b/scripts/base/protocols/conn/main.bro
index 7ef204268b..015c5520db 100644
--- a/scripts/base/protocols/conn/main.bro
+++ b/scripts/base/protocols/conn/main.bro
@@ -87,7 +87,8 @@ export {
## f packet with FIN bit set
## r packet with RST bit set
## c packet with a bad checksum
- ## i inconsistent packet (e.g. SYN+RST bits both set)
+ ## i inconsistent packet (e.g. FIN+RST bits set)
+ ## q multi-flag packet (SYN+FIN or SYN+RST bits set)
## ====== ====================================================
##
## If the event comes from the originator, the letter is in
diff --git a/scripts/base/protocols/http/main.bro b/scripts/base/protocols/http/main.bro
index 916723ebcb..e70d166f11 100644
--- a/scripts/base/protocols/http/main.bro
+++ b/scripts/base/protocols/http/main.bro
@@ -41,6 +41,8 @@ export {
## misspelled like the standard declares, but the name used here
## is "referrer" spelled correctly.
referrer: string &log &optional;
+ ## Value of the version portion of the request.
+ version: string &log &optional;
## Value of the User-Agent header from the client.
user_agent: string &log &optional;
## Actual uncompressed content size of the data transferred from
@@ -222,6 +224,8 @@ event http_reply(c: connection, version: string, code: count, reason: string) &p
c$http$status_code = code;
c$http$status_msg = reason;
+ c$http$version = version;
+
if ( code_in_range(code, 100, 199) )
{
c$http$info_code = code;
@@ -270,7 +274,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
{
if ( /^[bB][aA][sS][iI][cC] / in value )
{
- local userpass = decode_base64(sub(value, /[bB][aA][sS][iI][cC][[:blank:]]/, ""));
+ local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]/, ""));
local up = split_string(userpass, /:/);
if ( |up| >= 2 )
{
diff --git a/scripts/base/protocols/sip/main.bro b/scripts/base/protocols/sip/main.bro
index 0f396b8f74..dbe3c54800 100644
--- a/scripts/base/protocols/sip/main.bro
+++ b/scripts/base/protocols/sip/main.bro
@@ -60,9 +60,9 @@ export {
## Contents of the Warning: header
warning: string &log &optional;
## Contents of the Content-Length: header from the client
- request_body_len: string &log &optional;
+ request_body_len: count &log &optional;
## Contents of the Content-Length: header from the server
- response_body_len: string &log &optional;
+ response_body_len: count &log &optional;
## Contents of the Content-Type: header from the server
content_type: string &log &optional;
};
@@ -80,7 +80,7 @@ export {
## that the SIP analyzer will only accept methods consisting solely
## of letters ``[A-Za-z]``.
const sip_methods: set[string] = {
- "REGISTER", "INVITE", "ACK", "CANCEL", "BYE", "OPTIONS"
+ "REGISTER", "INVITE", "ACK", "CANCEL", "BYE", "OPTIONS", "NOTIFY"
} &redef;
## Event that can be handled to access the SIP record as it is sent on
@@ -127,17 +127,6 @@ function set_state(c: connection, is_request: bool)
c$sip_state = s;
}
- # These deal with new requests and responses.
- if ( is_request && c$sip_state$current_request !in c$sip_state$pending )
- c$sip_state$pending[c$sip_state$current_request] = new_sip_session(c);
- if ( ! is_request && c$sip_state$current_response !in c$sip_state$pending )
- c$sip_state$pending[c$sip_state$current_response] = new_sip_session(c);
-
- if ( is_request )
- c$sip = c$sip_state$pending[c$sip_state$current_request];
- else
- c$sip = c$sip_state$pending[c$sip_state$current_response];
-
if ( is_request )
{
if ( c$sip_state$current_request !in c$sip_state$pending )
@@ -152,7 +141,6 @@ function set_state(c: connection, is_request: bool)
c$sip = c$sip_state$pending[c$sip_state$current_response];
}
-
}
function flush_pending(c: connection)
@@ -163,7 +151,9 @@ function flush_pending(c: connection)
for ( r in c$sip_state$pending )
{
# We don't use pending elements at index 0.
- if ( r == 0 ) next;
+ if ( r == 0 )
+ next;
+
Log::write(SIP::LOG, c$sip_state$pending[r]);
}
}
@@ -205,16 +195,39 @@ event sip_header(c: connection, is_request: bool, name: string, value: string) &
if ( c$sip_state$current_request !in c$sip_state$pending )
++c$sip_state$current_request;
set_state(c, is_request);
- if ( name == "CALL-ID" ) c$sip$call_id = value;
- else if ( name == "CONTENT-LENGTH" || name == "L" ) c$sip$request_body_len = value;
- else if ( name == "CSEQ" ) c$sip$seq = value;
- else if ( name == "DATE" ) c$sip$date = value;
- else if ( name == "FROM" || name == "F" ) c$sip$request_from = split_string1(value, /;[ ]?tag=/)[0];
- else if ( name == "REPLY-TO" ) c$sip$reply_to = value;
- else if ( name == "SUBJECT" || name == "S" ) c$sip$subject = value;
- else if ( name == "TO" || name == "T" ) c$sip$request_to = value;
- else if ( name == "USER-AGENT" ) c$sip$user_agent = value;
- else if ( name == "VIA" || name == "V" ) c$sip$request_path[|c$sip$request_path|] = split_string1(value, /;[ ]?branch/)[0];
+ switch ( name )
+ {
+ case "CALL-ID":
+ c$sip$call_id = value;
+ break;
+ case "CONTENT-LENGTH", "L":
+ c$sip$request_body_len = to_count(value);
+ break;
+ case "CSEQ":
+ c$sip$seq = value;
+ break;
+ case "DATE":
+ c$sip$date = value;
+ break;
+ case "FROM", "F":
+ c$sip$request_from = split_string1(value, /;[ ]?tag=/)[0];
+ break;
+ case "REPLY-TO":
+ c$sip$reply_to = value;
+ break;
+ case "SUBJECT", "S":
+ c$sip$subject = value;
+ break;
+ case "TO", "T":
+ c$sip$request_to = value;
+ break;
+ case "USER-AGENT":
+ c$sip$user_agent = value;
+ break;
+ case "VIA", "V":
+ c$sip$request_path[|c$sip$request_path|] = split_string1(value, /;[ ]?branch/)[0];
+ break;
+ }
c$sip_state$pending[c$sip_state$current_request] = c$sip;
}
@@ -222,13 +235,29 @@ event sip_header(c: connection, is_request: bool, name: string, value: string) &
{
if ( c$sip_state$current_response !in c$sip_state$pending )
++c$sip_state$current_response;
+
set_state(c, is_request);
- if ( name == "CONTENT-LENGTH" || name == "L" ) c$sip$response_body_len = value;
- else if ( name == "CONTENT-TYPE" || name == "C" ) c$sip$content_type = value;
- else if ( name == "WARNING" ) c$sip$warning = value;
- else if ( name == "FROM" || name == "F" ) c$sip$response_from = split_string1(value, /;[ ]?tag=/)[0];
- else if ( name == "TO" || name == "T" ) c$sip$response_to = value;
- else if ( name == "VIA" || name == "V" ) c$sip$response_path[|c$sip$response_path|] = split_string1(value, /;[ ]?branch/)[0];
+ switch ( name )
+ {
+ case "CONTENT-LENGTH", "L":
+ c$sip$response_body_len = to_count(value);
+ break;
+ case "CONTENT-TYPE", "C":
+ c$sip$content_type = value;
+ break;
+ case "WARNING":
+ c$sip$warning = value;
+ break;
+ case "FROM", "F":
+ c$sip$response_from = split_string1(value, /;[ ]?tag=/)[0];
+ break;
+ case "TO", "T":
+ c$sip$response_to = value;
+ break;
+ case "VIA", "V":
+ c$sip$response_path[|c$sip$response_path|] = split_string1(value, /;[ ]?branch/)[0];
+ break;
+ }
c$sip_state$pending[c$sip_state$current_response] = c$sip;
}
diff --git a/scripts/base/protocols/smtp/main.bro b/scripts/base/protocols/smtp/main.bro
index 5fb5cac4bc..6df9bddb54 100644
--- a/scripts/base/protocols/smtp/main.bro
+++ b/scripts/base/protocols/smtp/main.bro
@@ -29,6 +29,8 @@ export {
from: string &log &optional;
## Contents of the To header.
to: set[string] &log &optional;
+ ## Contents of the CC header.
+ cc: set[string] &log &optional;
## Contents of the ReplyTo header.
reply_to: string &log &optional;
## Contents of the MsgID header.
@@ -239,6 +241,16 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=5
add c$smtp$to[to_parts[i]];
}
+ else if ( h$name == "CC" )
+ {
+ if ( ! c$smtp?$cc )
+ c$smtp$cc = set();
+
+ local cc_parts = split_string(h$value, /[[:blank:]]*,[[:blank:]]*/);
+ for ( i in cc_parts )
+ add c$smtp$cc[cc_parts[i]];
+ }
+
else if ( h$name == "X-ORIGINATING-IP" )
{
local addresses = extract_ip_addresses(h$value);
diff --git a/scripts/base/protocols/ssl/dpd.sig b/scripts/base/protocols/ssl/dpd.sig
index e238575568..2ebe1cc634 100644
--- a/scripts/base/protocols/ssl/dpd.sig
+++ b/scripts/base/protocols/ssl/dpd.sig
@@ -1,7 +1,7 @@
signature dpd_ssl_server {
ip-proto == tcp
# Server hello.
- payload /^(\x16\x03[\x00\x01\x02\x03]..\x02...\x03[\x00\x01\x02\x03]|...?\x04..\x00\x02).*/
+ payload /^((\x15\x03[\x00\x01\x02\x03]....)?\x16\x03[\x00\x01\x02\x03]..\x02...\x03[\x00\x01\x02\x03]|...?\x04..\x00\x02).*/
requires-reverse-signature dpd_ssl_client
enable "ssl"
tcp-state responder
diff --git a/scripts/base/protocols/tunnels/dpd.sig b/scripts/base/protocols/tunnels/dpd.sig
index 0c66775f5d..9c4bddeffd 100644
--- a/scripts/base/protocols/tunnels/dpd.sig
+++ b/scripts/base/protocols/tunnels/dpd.sig
@@ -9,6 +9,6 @@ signature dpd_ayiya {
signature dpd_teredo {
ip-proto = udp
- payload /^(\x00\x00)|(\x00\x01)|([\x60-\x6f])/
+ payload /^(\x00\x00)|(\x00\x01)|([\x60-\x6f].{7}((\x20\x01\x00\x00)).{28})|([\x60-\x6f].{23}((\x20\x01\x00\x00))).{12}/
enable "teredo"
}
diff --git a/scripts/policy/frameworks/control/controller.bro b/scripts/policy/frameworks/control/controller.bro
index cc94767370..edef4149f9 100644
--- a/scripts/policy/frameworks/control/controller.bro
+++ b/scripts/policy/frameworks/control/controller.bro
@@ -4,7 +4,7 @@
##!
##! It's intended to be used from the command line like this::
##!
-##! bro frameworks/control/controller Control::host= Control::port= Control::cmd= [Control::arg=]
+##! bro frameworks/control/controller Control::host= Control::host_port= Control::cmd= [Control::arg=]
@load base/frameworks/control
@load base/frameworks/communication
diff --git a/scripts/policy/frameworks/files/hash-all-files.bro b/scripts/policy/frameworks/files/hash-all-files.bro
index 74bea47bb9..f076abdd91 100644
--- a/scripts/policy/frameworks/files/hash-all-files.bro
+++ b/scripts/policy/frameworks/files/hash-all-files.bro
@@ -1,5 +1,7 @@
##! Perform MD5 and SHA1 hashing on all files.
+@load base/files/hash
+
event file_new(f: fa_file)
{
Files::add_analyzer(f, Files::ANALYZER_MD5);
diff --git a/scripts/policy/frameworks/software/windows-version-detection.bro b/scripts/policy/frameworks/software/windows-version-detection.bro
index 0162dddf75..7ed1ab359e 100644
--- a/scripts/policy/frameworks/software/windows-version-detection.bro
+++ b/scripts/policy/frameworks/software/windows-version-detection.bro
@@ -53,7 +53,7 @@ export {
event HTTP::log_http(rec: HTTP::Info) &priority=5
{
- if ( rec?$host && rec?$user_agent && rec$host == "crl.microsoft.com" &&
+ if ( rec?$host && rec?$user_agent && /crl.microsoft.com/ in rec$host &&
/Microsoft-CryptoAPI\// in rec$user_agent )
{
if ( rec$user_agent !in crypto_api_mapping )
diff --git a/scripts/policy/protocols/conn/vlan-logging.bro b/scripts/policy/protocols/conn/vlan-logging.bro
index c4408bcf59..e0692c5ab5 100644
--- a/scripts/policy/protocols/conn/vlan-logging.bro
+++ b/scripts/policy/protocols/conn/vlan-logging.bro
@@ -15,7 +15,7 @@ redef record Info += {
# Add the VLAN information to the Conn::Info structure after the connection
# has been removed. This ensures it's only done once, and is done before the
# connection information is written to the log.
-event connection_state_remove(c: connection) &priority=5
+event connection_state_remove(c: connection)
{
if ( c?$vlan )
c$conn$vlan = c$vlan;
diff --git a/scripts/policy/protocols/conn/weirds.bro b/scripts/policy/protocols/conn/weirds.bro
index 9d6730819c..8710635418 100644
--- a/scripts/policy/protocols/conn/weirds.bro
+++ b/scripts/policy/protocols/conn/weirds.bro
@@ -19,12 +19,12 @@ export {
};
}
-event rexmit_inconsistency(c: connection, t1: string, t2: string)
+event rexmit_inconsistency(c: connection, t1: string, t2: string, tcp_flags: string)
{
NOTICE([$note=Retransmission_Inconsistency,
$conn=c,
- $msg=fmt("%s rexmit inconsistency (%s) (%s)",
- id_string(c$id), t1, t2),
+ $msg=fmt("%s rexmit inconsistency (%s) (%s) [%s]",
+ id_string(c$id), t1, t2, tcp_flags),
$identifier=fmt("%s", c$id)]);
}
diff --git a/scripts/policy/protocols/http/software-browser-plugins.bro b/scripts/policy/protocols/http/software-browser-plugins.bro
index ab4bb93b15..c43e19dca2 100644
--- a/scripts/policy/protocols/http/software-browser-plugins.bro
+++ b/scripts/policy/protocols/http/software-browser-plugins.bro
@@ -1,4 +1,4 @@
-##! Detect browser plugins as they leak through requests to Omniture
+##! Detect browser plugins as they leak through requests to Omniture
##! advertising servers.
@load base/protocols/http
@@ -10,8 +10,10 @@ export {
redef record Info += {
## Indicates if the server is an omniture advertising server.
omniture: bool &default=F;
+ ## The unparsed Flash version, if detected.
+ flash_version: string &optional;
};
-
+
redef enum Software::Type += {
## Identifier for browser plugins in the software framework.
BROWSER_PLUGIN
@@ -22,12 +24,20 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
{
if ( is_orig )
{
- if ( name == "X-FLASH-VERSION" )
+ switch ( name )
{
- # Flash doesn't include it's name so we'll add it here since it
- # simplifies the version parsing.
- value = cat("Flash/", value);
- Software::found(c$id, [$unparsed_version=value, $host=c$id$orig_h, $software_type=BROWSER_PLUGIN]);
+ case "X-FLASH-VERSION":
+ # Flash doesn't include it's name so we'll add it here since it
+ # simplifies the version parsing.
+ c$http$flash_version = cat("Flash/", value);
+ break;
+
+ case "X-REQUESTED-WITH":
+ # This header is usually used to indicate AJAX requests (XMLHttpRequest),
+ # but Chrome uses this header also to indicate the use of Flash.
+ if ( /Flash/ in value )
+ c$http$flash_version = value;
+ break;
}
}
else
@@ -38,9 +48,26 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
}
}
+event http_message_done(c: connection, is_orig: bool, stat: http_message_stat)
+ {
+ # If a Flash was detected, it has to be logged considering the user agent.
+ if ( is_orig && c$http?$flash_version )
+ {
+ # AdobeAIR contains a seperate Flash, which should be emphasized.
+ # Note: We assume that the user agent header was not reset by the app.
+ if( c$http?$user_agent )
+ {
+ if ( /AdobeAIR/ in c$http$user_agent )
+ c$http$flash_version = cat("AdobeAIR-", c$http$flash_version);
+ }
+
+ Software::found(c$id, [$unparsed_version=c$http$flash_version, $host=c$id$orig_h, $software_type=BROWSER_PLUGIN]);
+ }
+ }
+
event log_http(rec: Info)
{
- # We only want to inspect requests that were sent to omniture advertising
+ # We only want to inspect requests that were sent to omniture advertising
# servers.
if ( rec$omniture && rec?$uri )
{
@@ -48,11 +75,11 @@ event log_http(rec: Info)
local parts = split_string_n(rec$uri, /&p=([^&]{5,});&/, T, 1);
if ( 1 in parts )
{
- # We do sub_bytes here just to remove the extra extracted
+ # We do sub_bytes here just to remove the extra extracted
# characters from the regex split above.
local sw = sub_bytes(parts[1], 4, |parts[1]|-5);
local plugins = split_string(sw, /[[:blank:]]*;[[:blank:]]*/);
-
+
for ( i in plugins )
Software::found(rec$id, [$unparsed_version=plugins[i], $host=rec$id$orig_h, $software_type=BROWSER_PLUGIN]);
}
diff --git a/src/Attr.cc b/src/Attr.cc
index c3d9a2303f..ea2b946e6a 100644
--- a/src/Attr.cc
+++ b/src/Attr.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Attr.h"
#include "Expr.h"
diff --git a/src/Attr.h b/src/Attr.h
index f89fb9f119..7205e68249 100644
--- a/src/Attr.h
+++ b/src/Attr.h
@@ -94,7 +94,7 @@ public:
void RemoveAttr(attr_tag t);
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
void DescribeReST(ODesc* d) const;
attr_list* Attrs() { return attrs; }
diff --git a/src/Base64.cc b/src/Base64.cc
index e76621e634..3644740c7e 100644
--- a/src/Base64.cc
+++ b/src/Base64.cc
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "bro-config.h"
#include "Base64.h"
#include
@@ -82,7 +82,7 @@ int* Base64Converter::InitBase64Table(const string& alphabet)
return base64_table;
}
-Base64Converter::Base64Converter(analyzer::Analyzer* arg_analyzer, const string& arg_alphabet)
+Base64Converter::Base64Converter(Connection* arg_conn, const string& arg_alphabet)
{
if ( arg_alphabet.size() > 0 )
{
@@ -98,7 +98,7 @@ Base64Converter::Base64Converter(analyzer::Analyzer* arg_analyzer, const string&
base64_group_next = 0;
base64_padding = base64_after_padding = 0;
errored = 0;
- analyzer = arg_analyzer;
+ conn = arg_conn;
}
Base64Converter::~Base64Converter()
@@ -216,9 +216,9 @@ int Base64Converter::Done(int* pblen, char** pbuf)
}
-BroString* decode_base64(const BroString* s, const BroString* a)
+BroString* decode_base64(const BroString* s, const BroString* a, Connection* conn)
{
- if ( a && a->Len() != 64 )
+ if ( a && a->Len() != 0 && a->Len() != 64 )
{
reporter->Error("base64 decoding alphabet is not 64 characters: %s",
a->CheckString());
@@ -229,7 +229,7 @@ BroString* decode_base64(const BroString* s, const BroString* a)
int rlen2, rlen = buf_len;
char* rbuf2, *rbuf = new char[rlen];
- Base64Converter dec(0, a ? a->CheckString() : "");
+ Base64Converter dec(conn, a ? a->CheckString() : "");
if ( dec.Decode(s->Len(), (const char*) s->Bytes(), &rlen, &rbuf) == -1 )
goto err;
@@ -248,9 +248,9 @@ err:
return 0;
}
-BroString* encode_base64(const BroString* s, const BroString* a)
+BroString* encode_base64(const BroString* s, const BroString* a, Connection* conn)
{
- if ( a && a->Len() != 64 )
+ if ( a && a->Len() != 0 && a->Len() != 64 )
{
reporter->Error("base64 alphabet is not 64 characters: %s",
a->CheckString());
@@ -259,7 +259,7 @@ BroString* encode_base64(const BroString* s, const BroString* a)
char* outbuf = 0;
int outlen = 0;
- Base64Converter enc(0, a ? a->CheckString() : "");
+ Base64Converter enc(conn, a ? a->CheckString() : "");
enc.Encode(s->Len(), (const unsigned char*) s->Bytes(), &outlen, &outbuf);
return new BroString(1, (u_char*)outbuf, outlen);
diff --git a/src/Base64.h b/src/Base64.h
index d7e4384ac5..fb030915ef 100644
--- a/src/Base64.h
+++ b/src/Base64.h
@@ -8,15 +8,17 @@
#include "util.h"
#include "BroString.h"
#include "Reporter.h"
-#include "analyzer/Analyzer.h"
+#include "Conn.h"
// Maybe we should have a base class for generic decoders?
class Base64Converter {
public:
- // is used for error reporting, and it should be zero when
- // the decoder is called by the built-in function decode_base64() or encode_base64().
- // Empty alphabet indicates the default base64 alphabet.
- Base64Converter(analyzer::Analyzer* analyzer, const string& alphabet = "");
+ // is used for error reporting. If it is set to zero (as,
+ // e.g., done by the built-in functions decode_base64() and
+ // encode_base64()), encoding-errors will go to Reporter instead of
+ // Weird. Usage errors go to Reporter in any case. Empty alphabet
+ // indicates the default base64 alphabet.
+ Base64Converter(Connection* conn, const string& alphabet = "");
~Base64Converter();
// A note on Decode():
@@ -42,8 +44,8 @@ public:
void IllegalEncoding(const char* msg)
{
// strncpy(error_msg, msg, sizeof(error_msg));
- if ( analyzer )
- analyzer->Weird("base64_illegal_encoding", msg);
+ if ( conn )
+ conn->Weird("base64_illegal_encoding", msg);
else
reporter->Error("%s", msg);
}
@@ -63,11 +65,11 @@ protected:
int base64_after_padding;
int* base64_table;
int errored; // if true, we encountered an error - skip further processing
- analyzer::Analyzer* analyzer;
+ Connection* conn;
};
-BroString* decode_base64(const BroString* s, const BroString* a = 0);
-BroString* encode_base64(const BroString* s, const BroString* a = 0);
+BroString* decode_base64(const BroString* s, const BroString* a = 0, Connection* conn = 0);
+BroString* encode_base64(const BroString* s, const BroString* a = 0, Connection* conn = 0);
#endif /* base64_h */
diff --git a/src/BroString.cc b/src/BroString.cc
index 086a7f8dde..c86e14cf37 100644
--- a/src/BroString.cc
+++ b/src/BroString.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/CCL.cc b/src/CCL.cc
index 6c4ec5ea2e..a725257c75 100644
--- a/src/CCL.cc
+++ b/src/CCL.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "CCL.h"
#include "RE.h"
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index bdbd3839ce..9a807b3182 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -223,16 +223,16 @@ endmacro(COLLECT_HEADERS _var)
cmake_policy(POP)
-# define a command that's used to run the make_dbg_constants.pl script
+# define a command that's used to run the make_dbg_constants.py script
# building the bro binary depends on the outputs of this script
add_custom_command(OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/DebugCmdConstants.h
${CMAKE_CURRENT_BINARY_DIR}/DebugCmdInfoConstants.cc
- COMMAND ${PERL_EXECUTABLE}
- ARGS ${CMAKE_CURRENT_SOURCE_DIR}/make_dbg_constants.pl
+ COMMAND ${PYTHON_EXECUTABLE}
+ ARGS ${CMAKE_CURRENT_SOURCE_DIR}/make_dbg_constants.py
${CMAKE_CURRENT_SOURCE_DIR}/DebugCmdInfoConstants.in
- DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/make_dbg_constants.pl
+ DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/make_dbg_constants.py
${CMAKE_CURRENT_SOURCE_DIR}/DebugCmdInfoConstants.in
- COMMENT "[Perl] Processing debug commands"
+ COMMENT "[Python] Processing debug commands"
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
)
diff --git a/src/ChunkedIO.cc b/src/ChunkedIO.cc
index 1e581806d6..0c402dc2af 100644
--- a/src/ChunkedIO.cc
+++ b/src/ChunkedIO.cc
@@ -9,7 +9,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "ChunkedIO.h"
#include "NetVar.h"
#include "RemoteSerializer.h"
@@ -709,7 +709,7 @@ bool ChunkedIOSSL::Init()
{
SSL_load_error_strings();
- ctx = SSL_CTX_new(SSLv3_method());
+ ctx = SSL_CTX_new(SSLv23_method());
if ( ! ctx )
{
Log("can't create SSL context");
diff --git a/src/ChunkedIO.h b/src/ChunkedIO.h
index afb239b325..238bea5044 100644
--- a/src/ChunkedIO.h
+++ b/src/ChunkedIO.h
@@ -3,7 +3,7 @@
#ifndef CHUNKEDIO_H
#define CHUNKEDIO_H
-#include "config.h"
+#include "bro-config.h"
#include "List.h"
#include "util.h"
#include "Flare.h"
diff --git a/src/CompHash.cc b/src/CompHash.cc
index 5a972f6016..2e28bff78e 100644
--- a/src/CompHash.cc
+++ b/src/CompHash.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "CompHash.h"
#include "Val.h"
diff --git a/src/Conn.cc b/src/Conn.cc
index 47bd2b5a34..3f6757d89c 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/Conn.h b/src/Conn.h
index 7a4331f91d..11dbb11abe 100644
--- a/src/Conn.h
+++ b/src/Conn.h
@@ -201,7 +201,7 @@ public:
bool IsPersistent() { return persistent; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
void IDString(ODesc* d) const;
TimerMgr* GetTimerMgr() const;
@@ -336,7 +336,7 @@ public:
{ Init(arg_conn, arg_timer, arg_do_expire); }
virtual ~ConnectionTimer();
- void Dispatch(double t, int is_expire);
+ void Dispatch(double t, int is_expire) override;
protected:
ConnectionTimer() {}
diff --git a/src/ConvertUTF.h b/src/ConvertUTF.h
index 9be51e57f1..4eb7900e9f 100644
--- a/src/ConvertUTF.h
+++ b/src/ConvertUTF.h
@@ -91,6 +91,8 @@
targetEnd. Note: the end pointers are *after* the last item: e.g.
*(sourceEnd - 1) is the last item.
+ !!! NOTE: The source and end pointers must be aligned properly !!!
+
The return result indicates whether the conversion was successful,
and if not, whether the problem was in the source or target buffers.
(Only the first encountered problem is indicated.)
@@ -199,18 +201,22 @@ ConversionResult ConvertUTF8toUTF32(
const UTF8** sourceStart, const UTF8* sourceEnd,
UTF32** targetStart, UTF32* targetEnd, ConversionFlags flags);
+/* NOTE: The source and end pointers must be aligned properly. */
ConversionResult ConvertUTF16toUTF8 (
const UTF16** sourceStart, const UTF16* sourceEnd,
UTF8** targetStart, UTF8* targetEnd, ConversionFlags flags);
+/* NOTE: The source and end pointers must be aligned properly. */
ConversionResult ConvertUTF32toUTF8 (
const UTF32** sourceStart, const UTF32* sourceEnd,
UTF8** targetStart, UTF8* targetEnd, ConversionFlags flags);
+/* NOTE: The source and end pointers must be aligned properly. */
ConversionResult ConvertUTF16toUTF32 (
const UTF16** sourceStart, const UTF16* sourceEnd,
UTF32** targetStart, UTF32* targetEnd, ConversionFlags flags);
+/* NOTE: The source and end pointers must be aligned properly. */
ConversionResult ConvertUTF32toUTF16 (
const UTF32** sourceStart, const UTF32* sourceEnd,
UTF16** targetStart, UTF16* targetEnd, ConversionFlags flags);
diff --git a/src/DFA.cc b/src/DFA.cc
index 514183165a..e7b2279ed5 100644
--- a/src/DFA.cc
+++ b/src/DFA.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index 99947e3531..7040b9a882 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/DbgBreakpoint.cc b/src/DbgBreakpoint.cc
index 9000d89077..c573a8d3b8 100644
--- a/src/DbgBreakpoint.cc
+++ b/src/DbgBreakpoint.cc
@@ -1,6 +1,6 @@
// Implementation of breakpoints.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/DbgHelp.cc b/src/DbgHelp.cc
index accf7ce6f6..6bbf9c6ecb 100644
--- a/src/DbgHelp.cc
+++ b/src/DbgHelp.cc
@@ -1,5 +1,5 @@
// Bro Debugger Help
-#include "config.h"
+#include "bro-config.h"
#include "Debug.h"
diff --git a/src/DbgWatch.cc b/src/DbgWatch.cc
index 74ac26cb73..c34144dc1f 100644
--- a/src/DbgWatch.cc
+++ b/src/DbgWatch.cc
@@ -1,6 +1,6 @@
// Implementation of watches
-#include "config.h"
+#include "bro-config.h"
#include "Debug.h"
#include "DbgWatch.h"
diff --git a/src/Debug.cc b/src/Debug.cc
index 09e8810edb..7f1250cf49 100644
--- a/src/Debug.cc
+++ b/src/Debug.cc
@@ -1,6 +1,6 @@
// Debugging support for Bro policy files.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/DebugCmds.cc b/src/DebugCmds.cc
index bfb4d6ecc8..4e856b00f5 100644
--- a/src/DebugCmds.cc
+++ b/src/DebugCmds.cc
@@ -1,7 +1,7 @@
// Support routines to help deal with Bro debugging commands and
// implementation of most commands.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/Desc.cc b/src/Desc.cc
index ebe5fb616c..3cdc35bfe5 100644
--- a/src/Desc.cc
+++ b/src/Desc.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/Dict.cc b/src/Dict.cc
index cd7792b539..1d32eccde3 100644
--- a/src/Dict.cc
+++ b/src/Dict.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#ifdef HAVE_MEMORY_H
#include
diff --git a/src/Discard.cc b/src/Discard.cc
index edfeea1408..2a20c897aa 100644
--- a/src/Discard.cc
+++ b/src/Discard.cc
@@ -2,7 +2,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "Net.h"
#include "Var.h"
diff --git a/src/EquivClass.cc b/src/EquivClass.cc
index 6ab667b146..7f54f07060 100644
--- a/src/EquivClass.cc
+++ b/src/EquivClass.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "EquivClass.h"
diff --git a/src/Event.cc b/src/Event.cc
index 82ea80988e..89e745361f 100644
--- a/src/Event.cc
+++ b/src/Event.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Event.h"
#include "Func.h"
diff --git a/src/Expr.cc b/src/Expr.cc
index ba44149ec3..9927ca52ec 100644
--- a/src/Expr.cc
+++ b/src/Expr.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Expr.h"
#include "Event.h"
diff --git a/src/Expr.h b/src/Expr.h
index 97092c1315..fb533b1469 100644
--- a/src/Expr.h
+++ b/src/Expr.h
@@ -220,18 +220,18 @@ public:
ID* Id() const { return id; }
- Val* Eval(Frame* f) const;
- void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN);
- Expr* MakeLvalue();
- int IsPure() const;
+ Val* Eval(Frame* f) const override;
+ void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN) override;
+ Expr* MakeLvalue() override;
+ int IsPure() const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
NameExpr() { id = 0; }
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(NameExpr);
@@ -246,15 +246,15 @@ public:
Val* Value() const { return val; }
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
ConstExpr() { val = 0; }
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(ConstExpr);
Val* val;
@@ -267,11 +267,11 @@ public:
// UnaryExpr::Eval correctly handles vector types. Any child
// class that overrides Eval() should be modified to handle
// vectors correctly as necessary.
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
- int IsPure() const;
+ int IsPure() const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
@@ -280,7 +280,7 @@ protected:
UnaryExpr(BroExprTag arg_tag, Expr* arg_op);
virtual ~UnaryExpr();
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
// Returns the expression folded using the given constant.
virtual Val* Fold(Val* v) const;
@@ -295,14 +295,14 @@ public:
Expr* Op1() const { return op1; }
Expr* Op2() const { return op2; }
- int IsPure() const;
+ int IsPure() const override;
// BinaryExpr::Eval correctly handles vector types. Any child
// class that overrides Eval() should be modified to handle
// vectors correctly as necessary.
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
@@ -340,7 +340,7 @@ protected:
// operands and also set expression's type).
void PromoteType(TypeTag t, bool is_vector);
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(BinaryExpr);
@@ -351,13 +351,13 @@ protected:
class CloneExpr : public UnaryExpr {
public:
CloneExpr(Expr* op);
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
protected:
friend class Expr;
CloneExpr() { }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(CloneExpr);
};
@@ -366,9 +366,9 @@ class IncrExpr : public UnaryExpr {
public:
IncrExpr(BroExprTag tag, Expr* op);
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
Val* DoSingleEval(Frame* f, Val* v) const;
- int IsPure() const;
+ int IsPure() const override;
protected:
friend class Expr;
@@ -385,7 +385,7 @@ protected:
friend class Expr;
NotExpr() { }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(NotExpr);
};
@@ -398,7 +398,7 @@ protected:
friend class Expr;
PosExpr() { }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(PosExpr);
};
@@ -411,7 +411,7 @@ protected:
friend class Expr;
NegExpr() { }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(NegExpr);
};
@@ -419,20 +419,20 @@ protected:
class SizeExpr : public UnaryExpr {
public:
SizeExpr(Expr* op);
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
protected:
friend class Expr;
SizeExpr() { }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(SizeExpr);
};
class AddExpr : public BinaryExpr {
public:
AddExpr(Expr* op1, Expr* op2);
- void Canonicize();
+ void Canonicize() override;
protected:
friend class Expr;
@@ -445,7 +445,7 @@ protected:
class AddToExpr : public BinaryExpr {
public:
AddToExpr(Expr* op1, Expr* op2);
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
protected:
friend class Expr;
@@ -457,7 +457,7 @@ protected:
class RemoveFromExpr : public BinaryExpr {
public:
RemoveFromExpr(Expr* op1, Expr* op2);
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
protected:
friend class Expr;
@@ -481,7 +481,7 @@ protected:
class TimesExpr : public BinaryExpr {
public:
TimesExpr(Expr* op1, Expr* op2);
- void Canonicize();
+ void Canonicize() override;
protected:
friend class Expr;
@@ -499,7 +499,7 @@ protected:
friend class Expr;
DivideExpr() { }
- Val* AddrFold(Val* v1, Val* v2) const;
+ Val* AddrFold(Val* v1, Val* v2) const override;
DECLARE_SERIAL(DivideExpr);
@@ -520,7 +520,7 @@ class BoolExpr : public BinaryExpr {
public:
BoolExpr(BroExprTag tag, Expr* op1, Expr* op2);
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
Val* DoSingleEval(Frame* f, Val* v1, Expr* op2) const;
protected:
@@ -533,13 +533,13 @@ protected:
class EqExpr : public BinaryExpr {
public:
EqExpr(BroExprTag tag, Expr* op1, Expr* op2);
- void Canonicize();
+ void Canonicize() override;
protected:
friend class Expr;
EqExpr() { }
- Val* Fold(Val* v1, Val* v2) const;
+ Val* Fold(Val* v1, Val* v2) const override;
DECLARE_SERIAL(EqExpr);
};
@@ -547,7 +547,7 @@ protected:
class RelExpr : public BinaryExpr {
public:
RelExpr(BroExprTag tag, Expr* op1, Expr* op2);
- void Canonicize();
+ void Canonicize() override;
protected:
friend class Expr;
@@ -565,16 +565,16 @@ public:
const Expr* Op2() const { return op2; }
const Expr* Op3() const { return op3; }
- Val* Eval(Frame* f) const;
- int IsPure() const;
+ Val* Eval(Frame* f) const override;
+ int IsPure() const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
CondExpr() { op1 = op2 = op3 = 0; }
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(CondExpr);
@@ -587,8 +587,8 @@ class RefExpr : public UnaryExpr {
public:
RefExpr(Expr* op);
- void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN);
- Expr* MakeLvalue();
+ void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN) override;
+ Expr* MakeLvalue() override;
protected:
friend class Expr;
@@ -604,12 +604,12 @@ public:
AssignExpr(Expr* op1, Expr* op2, int is_init, Val* val = 0, attr_list* attrs = 0);
virtual ~AssignExpr() { Unref(val); }
- Val* Eval(Frame* f) const;
- void EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const;
- BroType* InitType() const;
- int IsRecordElement(TypeDecl* td) const;
- Val* InitVal(const BroType* t, Val* aggr) const;
- int IsPure() const;
+ Val* Eval(Frame* f) const override;
+ void EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const override;
+ BroType* InitType() const override;
+ int IsRecordElement(TypeDecl* td) const override;
+ Val* InitVal(const BroType* t, Val* aggr) const override;
+ int IsPure() const override;
protected:
friend class Expr;
@@ -628,28 +628,28 @@ class IndexExpr : public BinaryExpr {
public:
IndexExpr(Expr* op1, ListExpr* op2, bool is_slice = false);
- int CanAdd() const;
- int CanDel() const;
+ int CanAdd() const override;
+ int CanDel() const override;
- void Add(Frame* f);
- void Delete(Frame* f);
+ void Add(Frame* f) override;
+ void Delete(Frame* f) override;
- void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN);
- Expr* MakeLvalue();
+ void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN) override;
+ Expr* MakeLvalue() override;
// Need to override Eval since it can take a vector arg but does
// not necessarily return a vector.
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
IndexExpr() { }
- Val* Fold(Val* v1, Val* v2) const;
+ Val* Fold(Val* v1, Val* v2) const override;
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(IndexExpr);
};
@@ -662,20 +662,20 @@ public:
int Field() const { return field; }
const char* FieldName() const { return field_name; }
- int CanDel() const;
+ int CanDel() const override;
- void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN);
- void Delete(Frame* f);
+ void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN) override;
+ void Delete(Frame* f) override;
- Expr* MakeLvalue();
+ Expr* MakeLvalue() override;
protected:
friend class Expr;
FieldExpr() { field_name = 0; td = 0; }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(FieldExpr);
@@ -697,9 +697,9 @@ protected:
friend class Expr;
HasFieldExpr() { field_name = 0; }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(HasFieldExpr);
@@ -716,10 +716,10 @@ protected:
friend class Expr;
RecordConstructorExpr() { }
- Val* InitVal(const BroType* t, Val* aggr) const;
- Val* Fold(Val* v) const;
+ Val* InitVal(const BroType* t, Val* aggr) const override;
+ Val* Fold(Val* v) const override;
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(RecordConstructorExpr);
};
@@ -732,15 +732,15 @@ public:
Attributes* Attrs() { return attrs; }
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
protected:
friend class Expr;
TableConstructorExpr() { }
- Val* InitVal(const BroType* t, Val* aggr) const;
+ Val* InitVal(const BroType* t, Val* aggr) const override;
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(TableConstructorExpr);
@@ -755,15 +755,15 @@ public:
Attributes* Attrs() { return attrs; }
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
protected:
friend class Expr;
SetConstructorExpr() { }
- Val* InitVal(const BroType* t, Val* aggr) const;
+ Val* InitVal(const BroType* t, Val* aggr) const override;
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(SetConstructorExpr);
@@ -774,15 +774,15 @@ class VectorConstructorExpr : public UnaryExpr {
public:
VectorConstructorExpr(ListExpr* constructor_list, BroType* arg_type = 0);
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
protected:
friend class Expr;
VectorConstructorExpr() { }
- Val* InitVal(const BroType* t, Val* aggr) const;
+ Val* InitVal(const BroType* t, Val* aggr) const override;
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(VectorConstructorExpr);
};
@@ -793,14 +793,14 @@ public:
const char* FieldName() const { return field_name.c_str(); }
- void EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const;
- int IsRecordElement(TypeDecl* td) const;
+ void EvalIntoAggregate(const BroType* t, Val* aggr, Frame* f) const override;
+ int IsRecordElement(TypeDecl* td) const override;
protected:
friend class Expr;
FieldAssignExpr() { }
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(FieldAssignExpr);
@@ -816,7 +816,7 @@ protected:
ArithCoerceExpr() { }
Val* FoldSingleVal(Val* v, InternalTypeTag t) const;
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(ArithCoerceExpr);
};
@@ -830,8 +830,8 @@ protected:
friend class Expr;
RecordCoerceExpr() { map = 0; }
- Val* InitVal(const BroType* t, Val* aggr) const;
- Val* Fold(Val* v) const;
+ Val* InitVal(const BroType* t, Val* aggr) const override;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(RecordCoerceExpr);
@@ -850,7 +850,7 @@ protected:
friend class Expr;
TableCoerceExpr() { }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(TableCoerceExpr);
};
@@ -864,7 +864,7 @@ protected:
friend class Expr;
VectorCoerceExpr() { }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(VectorCoerceExpr);
};
@@ -879,7 +879,7 @@ protected:
friend class Expr;
FlattenExpr() { }
- Val* Fold(Val* v) const;
+ Val* Fold(Val* v) const override;
DECLARE_SERIAL(FlattenExpr);
@@ -907,20 +907,20 @@ public:
ScheduleExpr(Expr* when, EventExpr* event);
~ScheduleExpr();
- int IsPure() const;
+ int IsPure() const override;
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
Expr* When() const { return when; }
EventExpr* Event() const { return event; }
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
ScheduleExpr() { when = 0; event = 0; }
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(ScheduleExpr);
@@ -936,7 +936,7 @@ protected:
friend class Expr;
InExpr() { }
- Val* Fold(Val* v1, Val* v2) const;
+ Val* Fold(Val* v1, Val* v2) const override;
DECLARE_SERIAL(InExpr);
@@ -950,17 +950,17 @@ public:
Expr* Func() const { return func; }
ListExpr* Args() const { return args; }
- int IsPure() const;
+ int IsPure() const override;
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
CallExpr() { func = 0; args = 0; }
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(CallExpr);
@@ -977,15 +977,15 @@ public:
ListExpr* Args() const { return args; }
EventHandlerPtr Handler() const { return handler; }
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Expr;
EventExpr() { args = 0; }
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(EventExpr);
@@ -1006,24 +1006,24 @@ public:
expr_list& Exprs() { return exprs; }
// True if the entire list represents pure values.
- int IsPure() const;
+ int IsPure() const override;
// True if the entire list represents constant values.
int AllConst() const;
- Val* Eval(Frame* f) const;
+ Val* Eval(Frame* f) const override;
- BroType* InitType() const;
- Val* InitVal(const BroType* t, Val* aggr) const;
- Expr* MakeLvalue();
- void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN);
+ BroType* InitType() const override;
+ Val* InitVal(const BroType* t, Val* aggr) const override;
+ Expr* MakeLvalue() override;
+ void Assign(Frame* f, Val* v, Opcode op = OP_ASSIGN) override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
Val* AddSetInit(const BroType* t, Val* aggr) const;
- void ExprDescribe(ODesc* d) const;
+ void ExprDescribe(ODesc* d) const override;
DECLARE_SERIAL(ListExpr);
@@ -1035,7 +1035,7 @@ class RecordAssignExpr : public ListExpr {
public:
RecordAssignExpr(Expr* record, Expr* init_list, int is_init);
- Val* Eval(Frame* f) const { return ListExpr::Eval(f); }
+ Val* Eval(Frame* f) const override { return ListExpr::Eval(f); }
protected:
friend class Expr;
diff --git a/src/File.cc b/src/File.cc
index e62ca732cd..16d4259fe5 100644
--- a/src/File.cc
+++ b/src/File.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#ifdef TIME_WITH_SYS_TIME
diff --git a/src/File.h b/src/File.h
index dc56c5a3fe..f3fdf2f271 100644
--- a/src/File.h
+++ b/src/File.h
@@ -49,7 +49,7 @@ public:
// closed, not active, or whatever.
int Close();
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
void SetRotateInterval(double secs);
diff --git a/src/Frag.cc b/src/Frag.cc
index 8ada148750..6a8b901a73 100644
--- a/src/Frag.cc
+++ b/src/Frag.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "Hash.h"
diff --git a/src/Frame.cc b/src/Frame.cc
index 8754c02a9f..e97b948dbe 100644
--- a/src/Frame.cc
+++ b/src/Frame.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Frame.h"
#include "Stmt.h"
diff --git a/src/Func.cc b/src/Func.cc
index 82f73e1f19..e1eadb8c9f 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/Func.h b/src/Func.h
index 0e50d546f4..791f8b7135 100644
--- a/src/Func.h
+++ b/src/Func.h
@@ -92,15 +92,15 @@ public:
BroFunc(ID* id, Stmt* body, id_list* inits, int frame_size, int priority);
~BroFunc();
- int IsPure() const;
- Val* Call(val_list* args, Frame* parent) const;
+ int IsPure() const override;
+ Val* Call(val_list* args, Frame* parent) const override;
void AddBody(Stmt* new_body, id_list* new_inits, int new_frame_size,
- int priority);
+ int priority) override;
int FrameSize() const { return frame_size; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
protected:
BroFunc() : Func(BRO_FUNC) {}
@@ -118,11 +118,11 @@ public:
BuiltinFunc(built_in_func func, const char* name, int is_pure);
~BuiltinFunc();
- int IsPure() const;
- Val* Call(val_list* args, Frame* parent) const;
+ int IsPure() const override;
+ Val* Call(val_list* args, Frame* parent) const override;
built_in_func TheFunc() const { return func; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
protected:
BuiltinFunc() { func = 0; is_pure = 0; }
diff --git a/src/Hash.cc b/src/Hash.cc
index 7873e398c3..d723601635 100644
--- a/src/Hash.cc
+++ b/src/Hash.cc
@@ -15,7 +15,7 @@
// for the adversary to construct conflicts, though I do not know if
// HMAC/MD5 is provably universal.
-#include "config.h"
+#include "bro-config.h"
#include "Hash.h"
diff --git a/src/ID.cc b/src/ID.cc
index a308ffa81d..efc488449b 100644
--- a/src/ID.cc
+++ b/src/ID.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "ID.h"
#include "Expr.h"
diff --git a/src/ID.h b/src/ID.h
index 805a8e391b..2e0d5708a9 100644
--- a/src/ID.h
+++ b/src/ID.h
@@ -87,7 +87,7 @@ public:
void Error(const char* msg, const BroObj* o2 = 0);
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
// Adds type and value to description.
void DescribeExtended(ODesc* d) const;
// Produces a description that's reST-ready.
diff --git a/src/IP.h b/src/IP.h
index bfd3ce8a41..8be2d3e609 100644
--- a/src/IP.h
+++ b/src/IP.h
@@ -3,7 +3,7 @@
#ifndef ip_h
#define ip_h
-#include "config.h"
+#include "bro-config.h"
#include "net_util.h"
#include "IPAddr.h"
#include "Reporter.h"
diff --git a/src/IntSet.cc b/src/IntSet.cc
index fb198f0e25..f5b004666c 100644
--- a/src/IntSet.cc
+++ b/src/IntSet.cc
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "bro-config.h"
#ifdef HAVE_MEMORY_H
#include
diff --git a/src/List.cc b/src/List.cc
index 9a1af3fe4f..a2b4609975 100644
--- a/src/List.cc
+++ b/src/List.cc
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/NFA.cc b/src/NFA.cc
index 4849755941..def04d79a1 100644
--- a/src/NFA.cc
+++ b/src/NFA.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "NFA.h"
#include "EquivClass.h"
diff --git a/src/Net.cc b/src/Net.cc
index 2a368c47ef..0b0491719f 100644
--- a/src/Net.cc
+++ b/src/Net.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#ifdef TIME_WITH_SYS_TIME
diff --git a/src/Net.h b/src/Net.h
index d19bd9083c..370f08a3ca 100644
--- a/src/Net.h
+++ b/src/Net.h
@@ -70,9 +70,6 @@ extern bool terminating;
// True if the remote serializer is to be activated.
extern bool using_communication;
-// Snaplen passed to libpcap.
-extern int snaplen;
-
extern const Packet* current_pkt;
extern int current_dispatched;
extern double current_timestamp;
diff --git a/src/NetVar.cc b/src/NetVar.cc
index 5585cf8211..8a901842fd 100644
--- a/src/NetVar.cc
+++ b/src/NetVar.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Var.h"
#include "NetVar.h"
diff --git a/src/Obj.cc b/src/Obj.cc
index 99ddb1329c..5553674598 100644
--- a/src/Obj.cc
+++ b/src/Obj.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/OpaqueVal.h b/src/OpaqueVal.h
index 70ba48f8d1..df928dff60 100644
--- a/src/OpaqueVal.h
+++ b/src/OpaqueVal.h
@@ -48,9 +48,9 @@ public:
protected:
friend class Val;
- virtual bool DoInit() /* override */;
- virtual bool DoFeed(const void* data, size_t size) /* override */;
- virtual StringVal* DoGet() /* override */;
+ virtual bool DoInit() override;
+ virtual bool DoFeed(const void* data, size_t size) override;
+ virtual StringVal* DoGet() override;
DECLARE_SERIAL(MD5Val);
@@ -67,9 +67,9 @@ public:
protected:
friend class Val;
- virtual bool DoInit() /* override */;
- virtual bool DoFeed(const void* data, size_t size) /* override */;
- virtual StringVal* DoGet() /* override */;
+ virtual bool DoInit() override;
+ virtual bool DoFeed(const void* data, size_t size) override;
+ virtual StringVal* DoGet() override;
DECLARE_SERIAL(SHA1Val);
@@ -86,9 +86,9 @@ public:
protected:
friend class Val;
- virtual bool DoInit() /* override */;
- virtual bool DoFeed(const void* data, size_t size) /* override */;
- virtual StringVal* DoGet() /* override */;
+ virtual bool DoInit() override;
+ virtual bool DoFeed(const void* data, size_t size) override;
+ virtual StringVal* DoGet() override;
DECLARE_SERIAL(SHA256Val);
diff --git a/src/PacketDumper.cc b/src/PacketDumper.cc
index 84b22ff17c..1a53550dfd 100644
--- a/src/PacketDumper.cc
+++ b/src/PacketDumper.cc
@@ -1,7 +1,7 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/PolicyFile.cc b/src/PolicyFile.cc
index 5d0082c6a9..bd41c15e9d 100644
--- a/src/PolicyFile.cc
+++ b/src/PolicyFile.cc
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/PriorityQueue.cc b/src/PriorityQueue.cc
index 8db161b10a..75b731142e 100644
--- a/src/PriorityQueue.cc
+++ b/src/PriorityQueue.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/Queue.cc b/src/Queue.cc
index 28bcb92405..587e37063f 100644
--- a/src/Queue.cc
+++ b/src/Queue.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/RE.cc b/src/RE.cc
index f52eff47eb..6c1e80588f 100644
--- a/src/RE.cc
+++ b/src/RE.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/Reassem.cc b/src/Reassem.cc
index bfac7f7a07..54f27bd895 100644
--- a/src/Reassem.cc
+++ b/src/Reassem.cc
@@ -2,7 +2,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "Reassem.h"
#include "Serializer.h"
diff --git a/src/RemoteSerializer.cc b/src/RemoteSerializer.cc
index 44ec678a0f..16add7c9c5 100644
--- a/src/RemoteSerializer.cc
+++ b/src/RemoteSerializer.cc
@@ -159,7 +159,7 @@
#include
#include
-#include "config.h"
+#include "bro-config.h"
#ifdef TIME_WITH_SYS_TIME
# include
# include
@@ -3459,7 +3459,11 @@ void SocketComm::Run()
if ( io->CanWrite() )
++canwrites;
- int a = select(max_fd + 1, &fd_read, &fd_write, &fd_except, 0);
+ struct timeval timeout;
+ timeout.tv_sec = 1;
+ timeout.tv_usec = 0;
+
+ int a = select(max_fd + 1, &fd_read, &fd_write, &fd_except, &timeout);
if ( selects % 100000 == 0 )
Log(fmt("selects=%ld canwrites=%ld pending=%lu",
diff --git a/src/Reporter.cc b/src/Reporter.cc
index cd1aa09d4c..6020b6569c 100644
--- a/src/Reporter.cc
+++ b/src/Reporter.cc
@@ -4,7 +4,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "Reporter.h"
#include "Event.h"
#include "NetVar.h"
@@ -393,4 +393,3 @@ void Reporter::DoLog(const char* prefix, EventHandlerPtr event, FILE* out,
if ( alloced )
free(alloced);
}
-
diff --git a/src/Rule.cc b/src/Rule.cc
index c978b93177..c483527c63 100644
--- a/src/Rule.cc
+++ b/src/Rule.cc
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "bro-config.h"
#include "Rule.h"
#include "RuleMatcher.h"
diff --git a/src/RuleAction.cc b/src/RuleAction.cc
index a0f4e89010..bac38a1236 100644
--- a/src/RuleAction.cc
+++ b/src/RuleAction.cc
@@ -1,7 +1,7 @@
#include
using std::string;
-#include "config.h"
+#include "bro-config.h"
#include "RuleAction.h"
#include "RuleMatcher.h"
diff --git a/src/RuleCondition.cc b/src/RuleCondition.cc
index 36d8cba39d..68eb13121f 100644
--- a/src/RuleCondition.cc
+++ b/src/RuleCondition.cc
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "bro-config.h"
#include "RuleCondition.h"
#include "analyzer/protocol/tcp/TCP.h"
diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc
index 967c4e4e65..f40a5c4349 100644
--- a/src/RuleMatcher.cc
+++ b/src/RuleMatcher.cc
@@ -1,7 +1,7 @@
#include
#include
-#include "config.h"
+#include "bro-config.h"
#include "analyzer/Analyzer.h"
#include "RuleMatcher.h"
diff --git a/src/Scope.cc b/src/Scope.cc
index 4916cdbfce..091dbabb9b 100644
--- a/src/Scope.cc
+++ b/src/Scope.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "ID.h"
#include "Val.h"
diff --git a/src/SerialObj.h b/src/SerialObj.h
index 4794f2bf20..ca661db8af 100644
--- a/src/SerialObj.h
+++ b/src/SerialObj.h
@@ -37,7 +37,7 @@
#include "DebugLogger.h"
#include "Continuation.h"
#include "SerialTypes.h"
-#include "config.h"
+#include "bro-config.h"
#if SIZEOF_LONG_LONG < 8
# error "Serialization requires that sizeof(long long) is at least 8. (Remove this message only if you know what you're doing.)"
@@ -169,10 +169,10 @@ public:
#define DECLARE_SERIAL(classname) \
static classname* Instantiate(); \
static SerialTypeRegistrator register_type; \
- virtual bool DoSerialize(SerialInfo*) const; \
- virtual bool DoUnserialize(UnserialInfo*); \
- virtual const TransientID* GetTID() const { return &tid; } \
- virtual SerialType GetSerialType() const; \
+ virtual bool DoSerialize(SerialInfo*) const override; \
+ virtual bool DoUnserialize(UnserialInfo*) override; \
+ virtual const TransientID* GetTID() const override { return &tid; } \
+ virtual SerialType GetSerialType() const override; \
TransientID tid;
// Only needed (and usable) for non-abstract classes.
diff --git a/src/Sessions.cc b/src/Sessions.cc
index daa0a4d65e..b8bfe82b34 100644
--- a/src/Sessions.cc
+++ b/src/Sessions.cc
@@ -1,7 +1,7 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/SmithWaterman.cc b/src/SmithWaterman.cc
index 5f2786caa0..ae57bab00c 100644
--- a/src/SmithWaterman.cc
+++ b/src/SmithWaterman.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/Stmt.cc b/src/Stmt.cc
index 932943803c..d93e8ff14e 100644
--- a/src/Stmt.cc
+++ b/src/Stmt.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Expr.h"
#include "Event.h"
@@ -994,6 +994,9 @@ bool AddStmt::DoUnserialize(UnserialInfo* info)
DelStmt::DelStmt(Expr* arg_e) : ExprStmt(STMT_DELETE, arg_e)
{
+ if ( e->IsError() )
+ return;
+
if ( ! e->CanDel() )
Error("illegal delete statement");
}
diff --git a/src/Stmt.h b/src/Stmt.h
index 36fe624e68..1c3bef2984 100644
--- a/src/Stmt.h
+++ b/src/Stmt.h
@@ -124,7 +124,7 @@ protected:
friend class Stmt;
PrintStmt() {}
- Val* DoExec(val_list* vals, stmt_flow_type& flow) const;
+ Val* DoExec(val_list* vals, stmt_flow_type& flow) const override;
DECLARE_SERIAL(PrintStmt);
};
@@ -134,13 +134,13 @@ public:
ExprStmt(Expr* e);
virtual ~ExprStmt();
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
const Expr* StmtExpr() const { return e; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
@@ -149,7 +149,7 @@ protected:
virtual Val* DoExec(Frame* f, Val* v, stmt_flow_type& flow) const;
- int IsPure() const;
+ int IsPure() const override;
DECLARE_SERIAL(ExprStmt);
@@ -164,16 +164,16 @@ public:
const Stmt* TrueBranch() const { return s1; }
const Stmt* FalseBranch() const { return s2; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
IfStmt() { s1 = s2 = 0; }
- Val* DoExec(Frame* f, Val* v, stmt_flow_type& flow) const;
- int IsPure() const;
+ Val* DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
+ int IsPure() const override;
DECLARE_SERIAL(IfStmt);
@@ -192,7 +192,7 @@ public:
const Stmt* Body() const { return s; }
Stmt* Body() { return s; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
bool Serialize(SerialInfo* info) const;
static Case* Unserialize(UnserialInfo* info);
@@ -216,16 +216,16 @@ public:
const case_list* Cases() const { return cases; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
SwitchStmt() { cases = 0; default_case_idx = -1; comp_hash = 0; }
- Val* DoExec(Frame* f, Val* v, stmt_flow_type& flow) const;
- int IsPure() const;
+ Val* DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
+ int IsPure() const override;
DECLARE_SERIAL(SwitchStmt);
@@ -252,10 +252,10 @@ class AddStmt : public ExprStmt {
public:
AddStmt(Expr* e);
- int IsPure() const;
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ int IsPure() const override;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
@@ -268,10 +268,10 @@ class DelStmt : public ExprStmt {
public:
DelStmt(Expr* e);
- int IsPure() const;
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ int IsPure() const override;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
@@ -284,9 +284,9 @@ class EventStmt : public ExprStmt {
public:
EventStmt(EventExpr* e);
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
@@ -303,11 +303,11 @@ public:
WhileStmt(Expr* loop_condition, Stmt* body);
~WhileStmt();
- int IsPure() const;
+ int IsPure() const override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
@@ -315,7 +315,7 @@ protected:
WhileStmt()
{ loop_condition = 0; body = 0; }
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
DECLARE_SERIAL(WhileStmt);
@@ -334,17 +334,17 @@ public:
const Expr* LoopExpr() const { return e; }
const Stmt* LoopBody() const { return body; }
- int IsPure() const;
+ int IsPure() const override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
ForStmt() { loop_vars = 0; body = 0; }
- Val* DoExec(Frame* f, Val* v, stmt_flow_type& flow) const;
+ Val* DoExec(Frame* f, Val* v, stmt_flow_type& flow) const override;
DECLARE_SERIAL(ForStmt);
@@ -356,12 +356,12 @@ class NextStmt : public Stmt {
public:
NextStmt() : Stmt(STMT_NEXT) { }
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
- int IsPure() const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
+ int IsPure() const override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
DECLARE_SERIAL(NextStmt);
@@ -371,12 +371,12 @@ class BreakStmt : public Stmt {
public:
BreakStmt() : Stmt(STMT_BREAK) { }
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
- int IsPure() const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
+ int IsPure() const override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
DECLARE_SERIAL(BreakStmt);
@@ -386,12 +386,12 @@ class FallthroughStmt : public Stmt {
public:
FallthroughStmt() : Stmt(STMT_FALLTHROUGH) { }
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
- int IsPure() const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
+ int IsPure() const override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
DECLARE_SERIAL(FallthroughStmt);
@@ -401,9 +401,9 @@ class ReturnStmt : public ExprStmt {
public:
ReturnStmt(Expr* e);
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
protected:
friend class Stmt;
@@ -417,17 +417,17 @@ public:
StmtList();
~StmtList();
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
const stmt_list& Stmts() const { return stmts; }
stmt_list& Stmts() { return stmts; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
- int IsPure() const;
+ int IsPure() const override;
DECLARE_SERIAL(StmtList);
@@ -439,9 +439,9 @@ public:
EventBodyList() : StmtList()
{ topmost = false; tag = STMT_EVENT_BODY_LIST; }
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
// "Topmost" means that this is the main body of a function or event.
// void SetTopmost(bool is_topmost) { topmost = is_topmost; }
@@ -465,13 +465,13 @@ public:
~InitStmt();
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
const id_list* Inits() const { return inits; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
friend class Stmt;
@@ -486,12 +486,12 @@ class NullStmt : public Stmt {
public:
NullStmt() : Stmt(STMT_NULL) { }
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
- int IsPure() const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
+ int IsPure() const override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
DECLARE_SERIAL(NullStmt);
@@ -503,17 +503,17 @@ public:
WhenStmt(Expr* cond, Stmt* s1, Stmt* s2, Expr* timeout, bool is_return);
~WhenStmt();
- Val* Exec(Frame* f, stmt_flow_type& flow) const;
- int IsPure() const;
+ Val* Exec(Frame* f, stmt_flow_type& flow) const override;
+ int IsPure() const override;
const Expr* Cond() const { return cond; }
const Stmt* Body() const { return s1; }
const Expr* TimeoutExpr() const { return timeout; }
const Stmt* TimeoutBody() const { return s2; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- TraversalCode Traverse(TraversalCallback* cb) const;
+ TraversalCode Traverse(TraversalCallback* cb) const override;
protected:
WhenStmt() { cond = 0; s1 = s2 = 0; timeout = 0; is_return = 0; }
diff --git a/src/Tag.h b/src/Tag.h
index 2c76f253a5..a3d7197fa0 100644
--- a/src/Tag.h
+++ b/src/Tag.h
@@ -3,7 +3,7 @@
#ifndef TAG_H
#define TAG_H
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "Type.h"
diff --git a/src/Timer.cc b/src/Timer.cc
index b8871ee489..f4370ed735 100644
--- a/src/Timer.cc
+++ b/src/Timer.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "Timer.h"
diff --git a/src/TunnelEncapsulation.h b/src/TunnelEncapsulation.h
index 419a3000b4..b853fc01b3 100644
--- a/src/TunnelEncapsulation.h
+++ b/src/TunnelEncapsulation.h
@@ -3,7 +3,7 @@
#ifndef TUNNELS_H
#define TUNNELS_H
-#include "config.h"
+#include "bro-config.h"
#include "NetVar.h"
#include "IPAddr.h"
#include "Val.h"
diff --git a/src/Type.cc b/src/Type.cc
index 8aa32f6323..15e2564ad0 100644
--- a/src/Type.cc
+++ b/src/Type.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Type.h"
#include "Attr.h"
diff --git a/src/Type.h b/src/Type.h
index f902b0d907..e3d1167166 100644
--- a/src/Type.h
+++ b/src/Type.h
@@ -248,7 +248,7 @@ public:
BroType* Ref() { ::Ref(this); return this; }
- virtual void Describe(ODesc* d) const;
+ virtual void Describe(ODesc* d) const override;
virtual void DescribeReST(ODesc* d, bool roles_only = false) const;
virtual unsigned MemoryAllocation() const;
@@ -312,9 +312,9 @@ public:
void Append(BroType* t);
void AppendEvenIfNotPure(BroType* t);
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- unsigned int MemoryAllocation() const
+ unsigned int MemoryAllocation() const override
{
return BroType::MemoryAllocation()
+ padded_sizeof(*this) - padded_sizeof(BroType)
@@ -330,15 +330,15 @@ protected:
class IndexType : public BroType {
public:
- int MatchesIndex(ListExpr*& index) const;
+ int MatchesIndex(ListExpr*& index) const override;
TypeList* Indices() const { return indices; }
const type_list* IndexTypes() const { return indices->Types(); }
- BroType* YieldType();
+ BroType* YieldType() override;
const BroType* YieldType() const;
- void Describe(ODesc* d) const;
- void DescribeReST(ODesc* d, bool roles_only = false) const;
+ void Describe(ODesc* d) const override;
+ void DescribeReST(ODesc* d, bool roles_only = false) const override;
// Returns true if this table is solely indexed by subnet.
bool IsSubNetIndex() const;
@@ -397,7 +397,7 @@ public:
~FuncType();
RecordType* Args() const { return args; }
- BroType* YieldType();
+ BroType* YieldType() override;
const BroType* YieldType() const;
void SetYieldType(BroType* arg_yield) { yield = arg_yield; }
function_flavor Flavor() const { return flavor; }
@@ -407,13 +407,13 @@ public:
void ClearYieldType(function_flavor arg_flav)
{ Unref(yield); yield = 0; flavor = arg_flav; }
- int MatchesIndex(ListExpr*& index) const;
+ int MatchesIndex(ListExpr*& index) const override;
int CheckArgs(const type_list* args, bool is_init = false) const;
TypeList* ArgTypes() const { return arg_types; }
- void Describe(ODesc* d) const;
- void DescribeReST(ODesc* d, bool roles_only = false) const;
+ void Describe(ODesc* d) const override;
+ void DescribeReST(ODesc* d, bool roles_only = false) const override;
protected:
FuncType() { args = 0; arg_types = 0; yield = 0; flavor = FUNC_FLAVOR_FUNCTION; }
@@ -463,8 +463,8 @@ public:
~RecordType();
- int HasField(const char* field) const;
- BroType* FieldType(const char* field) const;
+ int HasField(const char* field) const override;
+ BroType* FieldType(const char* field) const override;
BroType* FieldType(int field) const;
Val* FieldDefault(int field) const; // Ref's the returned value; 0 if none.
@@ -487,8 +487,8 @@ public:
// Takes ownership of list.
const char* AddFields(type_decl_list* types, attr_list* attr);
- void Describe(ODesc* d) const;
- void DescribeReST(ODesc* d, bool roles_only = false) const;
+ void Describe(ODesc* d) const override;
+ void DescribeReST(ODesc* d, bool roles_only = false) const override;
void DescribeFields(ODesc* d) const;
void DescribeFieldsReST(ODesc* d, bool func_args) const;
@@ -504,7 +504,7 @@ protected:
class SubNetType : public BroType {
public:
SubNetType();
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
protected:
DECLARE_SERIAL(SubNetType)
};
@@ -514,9 +514,9 @@ public:
FileType(BroType* yield_type);
~FileType();
- BroType* YieldType();
+ BroType* YieldType() override;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
protected:
FileType() { yield = 0; }
@@ -533,8 +533,8 @@ public:
const string& Name() const { return name; }
- void Describe(ODesc* d) const;
- void DescribeReST(ODesc* d, bool roles_only = false) const;
+ void Describe(ODesc* d) const override;
+ void DescribeReST(ODesc* d, bool roles_only = false) const override;
protected:
OpaqueType() { }
@@ -569,7 +569,7 @@ public:
// will be fully qualified with their module name.
enum_name_list Names() const;
- void DescribeReST(ODesc* d, bool roles_only = false) const;
+ void DescribeReST(ODesc* d, bool roles_only = false) const override;
protected:
EnumType() { counter = 0; }
@@ -599,17 +599,17 @@ class VectorType : public BroType {
public:
VectorType(BroType* t);
virtual ~VectorType();
- BroType* YieldType();
+ BroType* YieldType() override;
const BroType* YieldType() const;
- int MatchesIndex(ListExpr*& index) const;
+ int MatchesIndex(ListExpr*& index) const override;
// Returns true if this table type is "unspecified", which is what one
// gets using an empty "vector()" constructor.
bool IsUnspecifiedVector() const;
- void Describe(ODesc* d) const;
- void DescribeReST(ODesc* d, bool roles_only = false) const;
+ void Describe(ODesc* d) const override;
+ void DescribeReST(ODesc* d, bool roles_only = false) const override;
protected:
VectorType() { yield_type = 0; }
diff --git a/src/Val.cc b/src/Val.cc
index f3825dc9da..01a849c639 100644
--- a/src/Val.cc
+++ b/src/Val.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/Val.h b/src/Val.h
index 58b24a3e5d..c418addd55 100644
--- a/src/Val.h
+++ b/src/Val.h
@@ -325,7 +325,7 @@ public:
return (MutableVal*) this;
}
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
virtual void DescribeReST(ODesc* d) const;
bool Serialize(SerialInfo* info) const;
@@ -443,7 +443,7 @@ public:
#endif
}
- virtual uint64 LastModified() const { return last_modified; }
+ virtual uint64 LastModified() const override { return last_modified; }
// Mark value as changed.
void Modified()
@@ -487,7 +487,7 @@ public:
protected:
IntervalVal() {}
- void ValDescribe(ODesc* d) const;
+ void ValDescribe(ODesc* d) const override;
DECLARE_SERIAL(IntervalVal);
};
@@ -509,7 +509,7 @@ public:
PortVal(uint32 p, TransportProto port_type);
PortVal(uint32 p); // used for already-massaged port value.
- Val* SizeVal() const { return new Val(val.uint_val, TYPE_INT); }
+ Val* SizeVal() const override { return new Val(val.uint_val, TYPE_INT); }
// Returns the port number in host order (not including the mask).
uint32 Port() const;
@@ -535,7 +535,7 @@ protected:
friend class Val;
PortVal() {}
- void ValDescribe(ODesc* d) const;
+ void ValDescribe(ODesc* d) const override;
DECLARE_SERIAL(PortVal);
};
@@ -545,14 +545,14 @@ public:
AddrVal(const char* text);
~AddrVal();
- Val* SizeVal() const;
+ Val* SizeVal() const override;
// Constructor for address already in network order.
AddrVal(uint32 addr); // IPv4.
AddrVal(const uint32 addr[4]); // IPv6.
AddrVal(const IPAddr& addr);
- unsigned int MemoryAllocation() const;
+ unsigned int MemoryAllocation() const override;
protected:
friend class Val;
@@ -573,7 +573,7 @@ public:
SubNetVal(const IPPrefix& prefix);
~SubNetVal();
- Val* SizeVal() const;
+ Val* SizeVal() const override;
const IPAddr& Prefix() const;
int Width() const;
@@ -581,13 +581,13 @@ public:
bool Contains(const IPAddr& addr) const;
- unsigned int MemoryAllocation() const;
+ unsigned int MemoryAllocation() const override;
protected:
friend class Val;
SubNetVal() {}
- void ValDescribe(ODesc* d) const;
+ void ValDescribe(ODesc* d) const override;
DECLARE_SERIAL(SubNetVal);
};
@@ -599,7 +599,7 @@ public:
StringVal(const string& s);
StringVal(int length, const char* s);
- Val* SizeVal() const
+ Val* SizeVal() const override
{ return new Val(val.string_val->Len(), TYPE_COUNT); }
int Len() { return AsString()->Len(); }
@@ -613,13 +613,13 @@ public:
StringVal* ToUpper();
- unsigned int MemoryAllocation() const;
+ unsigned int MemoryAllocation() const override;
protected:
friend class Val;
StringVal() {}
- void ValDescribe(ODesc* d) const;
+ void ValDescribe(ODesc* d) const override;
DECLARE_SERIAL(StringVal);
};
@@ -629,17 +629,17 @@ public:
PatternVal(RE_Matcher* re);
~PatternVal();
- int AddTo(Val* v, int is_first_init) const;
+ int AddTo(Val* v, int is_first_init) const override;
void SetMatcher(RE_Matcher* re);
- unsigned int MemoryAllocation() const;
+ unsigned int MemoryAllocation() const override;
protected:
friend class Val;
PatternVal() {}
- void ValDescribe(ODesc* d) const;
+ void ValDescribe(ODesc* d) const override;
DECLARE_SERIAL(PatternVal);
};
@@ -653,7 +653,7 @@ public:
TypeTag BaseTag() const { return tag; }
- Val* SizeVal() const { return new Val(vals.length(), TYPE_COUNT); }
+ Val* SizeVal() const override { return new Val(vals.length(), TYPE_COUNT); }
int Length() const { return vals.length(); }
Val* Index(const int n) { return vals[n]; }
@@ -677,9 +677,9 @@ public:
const val_list* Vals() const { return &vals; }
val_list* Vals() { return &vals; }
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
- unsigned int MemoryAllocation() const;
+ unsigned int MemoryAllocation() const override;
protected:
friend class Val;
@@ -760,14 +760,14 @@ public:
int Assign(Val* index, Val* new_val, Opcode op = OP_ASSIGN);
int Assign(Val* index, HashKey* k, Val* new_val, Opcode op = OP_ASSIGN);
- Val* SizeVal() const { return new Val(Size(), TYPE_COUNT); }
+ Val* SizeVal() const override { return new Val(Size(), TYPE_COUNT); }
// Add the entire contents of the table to the given value,
// which must also be a TableVal.
// Returns true if the addition typechecked, false if not.
// If is_first_init is true, then this is the *first* initialization
// (and so should be strictly adding new elements).
- int AddTo(Val* v, int is_first_init) const;
+ int AddTo(Val* v, int is_first_init) const override;
// Same but allows suppression of state operations.
int AddTo(Val* v, int is_first_init, bool propagate_ops) const;
@@ -778,7 +778,7 @@ public:
// Remove the entire contents of the table from the given value.
// which must also be a TableVal.
// Returns true if the addition typechecked, false if not.
- int RemoveFrom(Val* v) const;
+ int RemoveFrom(Val* v) const override;
// Expands any lists in the index into multiple initializations.
// Returns true if the initializations typecheck, false if not.
@@ -813,12 +813,12 @@ public:
int Size() const { return AsTable()->Length(); }
int RecursiveSize() const;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
void InitTimer(double delay);
void DoExpire(double t);
- unsigned int MemoryAllocation() const;
+ unsigned int MemoryAllocation() const override;
void ClearTimer(Timer* t)
{
@@ -840,8 +840,8 @@ protected:
int ExpandCompoundAndInit(val_list* vl, int k, Val* new_val);
int CheckAndAssign(Val* index, Val* new_val, Opcode op = OP_ASSIGN);
- bool AddProperties(Properties arg_state);
- bool RemoveProperties(Properties arg_state);
+ bool AddProperties(Properties arg_state) override;
+ bool RemoveProperties(Properties arg_state) override;
// Calculates default value for index. Returns 0 if none.
Val* Default(Val* index);
@@ -871,7 +871,7 @@ public:
RecordVal(RecordType* t);
~RecordVal();
- Val* SizeVal() const
+ Val* SizeVal() const override
{ return new Val(record_type->NumFields(), TYPE_COUNT); }
void Assign(int field, Val* new_val, Opcode op = OP_ASSIGN);
@@ -889,7 +889,7 @@ public:
*/
Val* Lookup(const char* field, bool with_default = false) const;
- void Describe(ODesc* d) const;
+ void Describe(ODesc* d) const override;
// This is an experiment to associate a BroObj within the
// event engine to a record value in bro script.
@@ -910,15 +910,15 @@ public:
RecordVal* CoerceTo(const RecordType* other, Val* aggr, bool allow_orphaning = false) const;
RecordVal* CoerceTo(RecordType* other, bool allow_orphaning = false);
- unsigned int MemoryAllocation() const;
- void DescribeReST(ODesc* d) const;
+ unsigned int MemoryAllocation() const override;
+ void DescribeReST(ODesc* d) const override;
protected:
friend class Val;
RecordVal() {}
- bool AddProperties(Properties arg_state);
- bool RemoveProperties(Properties arg_state);
+ bool AddProperties(Properties arg_state) override;
+ bool RemoveProperties(Properties arg_state) override;
DECLARE_SERIAL(RecordVal);
@@ -934,13 +934,13 @@ public:
type = t;
}
- Val* SizeVal() const { return new Val(val.int_val, TYPE_INT); }
+ Val* SizeVal() const override { return new Val(val.int_val, TYPE_INT); }
protected:
friend class Val;
EnumVal() {}
- void ValDescribe(ODesc* d) const;
+ void ValDescribe(ODesc* d) const override;
DECLARE_SERIAL(EnumVal);
};
@@ -951,7 +951,7 @@ public:
VectorVal(VectorType* t);
~VectorVal();
- Val* SizeVal() const
+ Val* SizeVal() const override
{ return new Val(uint32(val.vector_val->size()), TYPE_COUNT); }
// Returns false if the type of the argument was wrong.
@@ -996,9 +996,9 @@ protected:
friend class Val;
VectorVal() { }
- bool AddProperties(Properties arg_state);
- bool RemoveProperties(Properties arg_state);
- void ValDescribe(ODesc* d) const;
+ bool AddProperties(Properties arg_state) override;
+ bool RemoveProperties(Properties arg_state) override;
+ void ValDescribe(ODesc* d) const override;
DECLARE_SERIAL(VectorVal);
diff --git a/src/Var.cc b/src/Var.cc
index ed0f486875..e923e2ec37 100644
--- a/src/Var.cc
+++ b/src/Var.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Var.h"
#include "Func.h"
diff --git a/src/analyzer/Component.h b/src/analyzer/Component.h
index f538c17919..0704852145 100644
--- a/src/analyzer/Component.h
+++ b/src/analyzer/Component.h
@@ -7,7 +7,7 @@
#include "plugin/Component.h"
#include "plugin/TaggedComponent.h"
-#include "../config.h"
+#include "../bro-config.h"
#include "../util.h"
class Connection;
diff --git a/src/analyzer/Manager.cc b/src/analyzer/Manager.cc
index bc8fceaf39..67aa6a0d33 100644
--- a/src/analyzer/Manager.cc
+++ b/src/analyzer/Manager.cc
@@ -505,6 +505,8 @@ bool Manager::BuildInitialAnalyzerTree(Connection* conn)
if ( ! analyzed )
conn->SetLifetime(non_analyzed_lifetime);
+ PLUGIN_HOOK_VOID(HOOK_SETUP_ANALYZER_TREE, HookSetupAnalyzerTree(conn));
+
return true;
}
diff --git a/src/analyzer/Tag.h b/src/analyzer/Tag.h
index d01c8902ee..9ba04b2ef8 100644
--- a/src/analyzer/Tag.h
+++ b/src/analyzer/Tag.h
@@ -3,7 +3,7 @@
#ifndef ANALYZER_TAG_H
#define ANALYZER_TAG_H
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "../Tag.h"
#include "plugin/TaggedComponent.h"
diff --git a/src/analyzer/protocol/arp/ARP.h b/src/analyzer/protocol/arp/ARP.h
index 1778f5e200..c4deddee03 100644
--- a/src/analyzer/protocol/arp/ARP.h
+++ b/src/analyzer/protocol/arp/ARP.h
@@ -3,7 +3,7 @@
#ifndef ANALYZER_PROTOCOL_ARP_ARP_H
#define ANALYZER_PROTOCOL_ARP_ARP_H
-#include "config.h"
+#include "bro-config.h"
#include
#include
#include
diff --git a/src/analyzer/protocol/backdoor/BackDoor.cc b/src/analyzer/protocol/backdoor/BackDoor.cc
index 984b2a5dcf..4119b66121 100644
--- a/src/analyzer/protocol/backdoor/BackDoor.cc
+++ b/src/analyzer/protocol/backdoor/BackDoor.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "BackDoor.h"
#include "Event.h"
diff --git a/src/analyzer/protocol/dce-rpc/DCE_RPC.cc b/src/analyzer/protocol/dce-rpc/DCE_RPC.cc
index dd31cfa8a7..1d3b6ef0ef 100644
--- a/src/analyzer/protocol/dce-rpc/DCE_RPC.cc
+++ b/src/analyzer/protocol/dce-rpc/DCE_RPC.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/analyzer/protocol/dns/DNS.cc b/src/analyzer/protocol/dns/DNS.cc
index 0c5ef53000..b449589e6c 100644
--- a/src/analyzer/protocol/dns/DNS.cc
+++ b/src/analyzer/protocol/dns/DNS.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/analyzer/protocol/finger/Finger.cc b/src/analyzer/protocol/finger/Finger.cc
index bf9bdcc68a..6a5865383b 100644
--- a/src/analyzer/protocol/finger/Finger.cc
+++ b/src/analyzer/protocol/finger/Finger.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/analyzer/protocol/ftp/FTP.cc b/src/analyzer/protocol/ftp/FTP.cc
index 91afe6f8a4..70d1be5777 100644
--- a/src/analyzer/protocol/ftp/FTP.cc
+++ b/src/analyzer/protocol/ftp/FTP.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
@@ -206,7 +206,7 @@ void FTP_ADAT_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
{
line = skip_whitespace(line + cmd_len, end_of_line);
StringVal encoded(end_of_line - line, line);
- decoded_adat = decode_base64(encoded.AsString());
+ decoded_adat = decode_base64(encoded.AsString(), 0, Conn());
if ( first_token )
{
@@ -273,7 +273,7 @@ void FTP_ADAT_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
{
line += 5;
StringVal encoded(end_of_line - line, line);
- decoded_adat = decode_base64(encoded.AsString());
+ decoded_adat = decode_base64(encoded.AsString(), 0, Conn());
}
break;
diff --git a/src/analyzer/protocol/gnutella/Gnutella.cc b/src/analyzer/protocol/gnutella/Gnutella.cc
index 84a33381a0..60c5475d4a 100644
--- a/src/analyzer/protocol/gnutella/Gnutella.cc
+++ b/src/analyzer/protocol/gnutella/Gnutella.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc
index ff72c6f350..36c92ed6e6 100644
--- a/src/analyzer/protocol/http/HTTP.cc
+++ b/src/analyzer/protocol/http/HTTP.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
@@ -995,28 +995,9 @@ void HTTP_Analyzer::DeliverStream(int len, const u_char* data, bool is_orig)
HTTP_Reply();
- if ( connect_request && reply_code == 200 )
- {
- pia = new pia::PIA_TCP(Conn());
-
- if ( AddChildAnalyzer(pia) )
- {
- pia->FirstPacket(true, 0);
- pia->FirstPacket(false, 0);
-
- // This connection has transitioned to no longer
- // being http and the content line support analyzers
- // need to be removed.
- RemoveSupportAnalyzer(content_line_orig);
- RemoveSupportAnalyzer(content_line_resp);
-
- return;
- }
-
- else
- // AddChildAnalyzer() will have deleted PIA.
- pia = 0;
- }
+ if ( connect_request && reply_code != 200 )
+ // Request failed, do not set up tunnel.
+ connect_request = false;
InitHTTPMessage(content_line,
reply_message, is_orig,
@@ -1036,6 +1017,30 @@ void HTTP_Analyzer::DeliverStream(int len, const u_char* data, bool is_orig)
case EXPECT_REPLY_MESSAGE:
reply_message->Deliver(len, line, 1);
+
+ if ( connect_request && len == 0 )
+ {
+ // End of message header reached, set up
+ // tunnel decapsulation.
+ pia = new pia::PIA_TCP(Conn());
+
+ if ( AddChildAnalyzer(pia) )
+ {
+ pia->FirstPacket(true, 0);
+ pia->FirstPacket(false, 0);
+
+ // This connection has transitioned to no longer
+ // being http and the content line support analyzers
+ // need to be removed.
+ RemoveSupportAnalyzer(content_line_orig);
+ RemoveSupportAnalyzer(content_line_resp);
+ }
+
+ else
+ // AddChildAnalyzer() will have deleted PIA.
+ pia = 0;
+ }
+
break;
case EXPECT_REPLY_TRAILER:
@@ -1244,6 +1249,12 @@ int HTTP_Analyzer::ParseRequest(const char* line, const char* end_of_line)
break;
}
+ if ( end_of_uri >= end_of_line && PrefixMatch(line, end_of_line, "HTTP/") )
+ {
+ Weird("missing_HTTP_uri");
+ end_of_uri = line; // Leave URI empty.
+ }
+
for ( version_start = end_of_uri; version_start < end_of_line; ++version_start )
{
end_of_uri = version_start;
diff --git a/src/analyzer/protocol/icmp/ICMP.cc b/src/analyzer/protocol/icmp/ICMP.cc
index 84df7ab0d2..6a42e064d7 100644
--- a/src/analyzer/protocol/icmp/ICMP.cc
+++ b/src/analyzer/protocol/icmp/ICMP.cc
@@ -2,7 +2,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "Net.h"
#include "NetVar.h"
diff --git a/src/analyzer/protocol/ident/Ident.cc b/src/analyzer/protocol/ident/Ident.cc
index 8e25775af8..8d57da3477 100644
--- a/src/analyzer/protocol/ident/Ident.cc
+++ b/src/analyzer/protocol/ident/Ident.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/analyzer/protocol/interconn/InterConn.cc b/src/analyzer/protocol/interconn/InterConn.cc
index eb529cbb6d..c1bf0f37f5 100644
--- a/src/analyzer/protocol/interconn/InterConn.cc
+++ b/src/analyzer/protocol/interconn/InterConn.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "InterConn.h"
#include "Event.h"
diff --git a/src/analyzer/protocol/irc/IRC.cc b/src/analyzer/protocol/irc/IRC.cc
index d621ce2cce..2ed04ee6b1 100644
--- a/src/analyzer/protocol/irc/IRC.cc
+++ b/src/analyzer/protocol/irc/IRC.cc
@@ -2,7 +2,6 @@
#include
#include "IRC.h"
-#include "analyzer/protocol/tcp/ContentLine.h"
#include "NetVar.h"
#include "Event.h"
#include "analyzer/protocol/zip/ZIP.h"
@@ -21,8 +20,11 @@ IRC_Analyzer::IRC_Analyzer(Connection* conn)
resp_status = WAIT_FOR_REGISTRATION;
orig_zip_status = NO_ZIP;
resp_zip_status = NO_ZIP;
- AddSupportAnalyzer(new tcp::ContentLine_Analyzer(conn, true));
- AddSupportAnalyzer(new tcp::ContentLine_Analyzer(conn, false));
+ starttls = false;
+ cl_orig = new tcp::ContentLine_Analyzer(conn, true);
+ AddSupportAnalyzer(cl_orig);
+ cl_resp = new tcp::ContentLine_Analyzer(conn, false);
+ AddSupportAnalyzer(cl_resp);
}
void IRC_Analyzer::Done()
@@ -34,6 +36,12 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
{
tcp::TCP_ApplicationAnalyzer::DeliverStream(length, line, orig);
+ if ( starttls )
+ {
+ ForwardStream(length, line, orig);
+ return;
+ }
+
// check line size
if ( length > 512 )
{
@@ -98,6 +106,11 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
}
else
{ // get command
+
+ // special case that has no arguments
+ if ( myline == "STARTTLS" )
+ return;
+
unsigned int pos = myline.find(' ');
if ( pos > (unsigned int) length )
{
@@ -556,6 +569,10 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
}
break;
+ case 670:
+ // StartTLS success reply to StartTLS
+ StartTLS();
+
// All other server replies.
default:
val_list* vl = new val_list;
@@ -1169,6 +1186,25 @@ void IRC_Analyzer::DeliverStream(int length, const u_char* line, bool orig)
return;
}
+void IRC_Analyzer::StartTLS()
+ {
+ // STARTTLS was succesful. Remove support analyzers, add SSL
+ // analyzer, and throw event signifying the change.
+ starttls = true;
+
+ RemoveSupportAnalyzer(cl_orig);
+ RemoveSupportAnalyzer(cl_resp);
+
+ Analyzer* ssl = analyzer_mgr->InstantiateAnalyzer("SSL", Conn());
+ if ( ssl )
+ AddChildAnalyzer(ssl);
+
+ val_list* vl = new val_list;
+ vl->append(BuildConnVal());
+
+ ConnectionEvent(irc_starttls, vl);
+ }
+
vector IRC_Analyzer::SplitWords(const string input, const char split)
{
vector words;
diff --git a/src/analyzer/protocol/irc/IRC.h b/src/analyzer/protocol/irc/IRC.h
index bce9cdf054..82a97a4d4d 100644
--- a/src/analyzer/protocol/irc/IRC.h
+++ b/src/analyzer/protocol/irc/IRC.h
@@ -3,6 +3,7 @@
#ifndef ANALYZER_PROTOCOL_IRC_IRC_H
#define ANALYZER_PROTOCOL_IRC_IRC_H
#include "analyzer/protocol/tcp/TCP.h"
+#include "analyzer/protocol/tcp/ContentLine.h"
namespace analyzer { namespace irc {
@@ -44,6 +45,8 @@ protected:
int resp_zip_status;
private:
+ void StartTLS();
+
/** \brief counts number of invalid IRC messages */
int invalid_msg_count;
@@ -60,6 +63,9 @@ private:
*/
vector SplitWords(const string input, const char split);
+ tcp::ContentLine_Analyzer* cl_orig;
+ tcp::ContentLine_Analyzer* cl_resp;
+ bool starttls; // if true, connection has been upgraded to tls
};
} } // namespace analyzer::*
diff --git a/src/analyzer/protocol/irc/events.bif b/src/analyzer/protocol/irc/events.bif
index 4e69b9ad33..be425817b2 100644
--- a/src/analyzer/protocol/irc/events.bif
+++ b/src/analyzer/protocol/irc/events.bif
@@ -797,3 +797,10 @@ event irc_user_message%(c: connection, is_orig: bool, user: string, host: string
## irc_nick_message irc_notice_message irc_oper_message irc_oper_response
## irc_part_message
event irc_password_message%(c: connection, is_orig: bool, password: string%);
+
+## Generated if an IRC connection switched to TLS using STARTTLS. After this
+## event no more IRC events will be raised for the connection. See the SSL
+## analyzer for related SSL events, which will now be generated.
+##
+## c: The connection.
+event irc_starttls%(c: connection%);
diff --git a/src/analyzer/protocol/login/Login.cc b/src/analyzer/protocol/login/Login.cc
index 8dcb7dba55..c39c4cf383 100644
--- a/src/analyzer/protocol/login/Login.cc
+++ b/src/analyzer/protocol/login/Login.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/analyzer/protocol/login/NVT.cc b/src/analyzer/protocol/login/NVT.cc
index 462cd42177..11952103bf 100644
--- a/src/analyzer/protocol/login/NVT.cc
+++ b/src/analyzer/protocol/login/NVT.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/analyzer/protocol/login/RSH.cc b/src/analyzer/protocol/login/RSH.cc
index f768f4bdc2..ff8e6bad3e 100644
--- a/src/analyzer/protocol/login/RSH.cc
+++ b/src/analyzer/protocol/login/RSH.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "NetVar.h"
#include "Event.h"
@@ -93,8 +93,7 @@ void Contents_Rsh_Analyzer::DoDeliver(int len, const u_char* data)
case RSH_LINE_MODE:
case RSH_UNKNOWN:
case RSH_PRESUMED_REJECTED:
- if ( state == RSH_LINE_MODE &&
- state == RSH_PRESUMED_REJECTED )
+ if ( state == RSH_PRESUMED_REJECTED )
{
Conn()->Weird("rsh_text_after_rejected");
state = RSH_UNKNOWN;
diff --git a/src/analyzer/protocol/login/Rlogin.cc b/src/analyzer/protocol/login/Rlogin.cc
index d90c9be123..6979148676 100644
--- a/src/analyzer/protocol/login/Rlogin.cc
+++ b/src/analyzer/protocol/login/Rlogin.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "NetVar.h"
#include "Event.h"
diff --git a/src/analyzer/protocol/login/Telnet.cc b/src/analyzer/protocol/login/Telnet.cc
index c22b2afc5e..78a3289931 100644
--- a/src/analyzer/protocol/login/Telnet.cc
+++ b/src/analyzer/protocol/login/Telnet.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "Telnet.h"
#include "NVT.h"
diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc
index cbc1abd17d..d968be09cf 100644
--- a/src/analyzer/protocol/mime/MIME.cc
+++ b/src/analyzer/protocol/mime/MIME.cc
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "bro-config.h"
#include "NetVar.h"
#include "MIME.h"
@@ -248,9 +248,7 @@ int MIME_get_field_name(int len, const char* data, data_chunk_t* name)
int MIME_is_tspecial (char ch, bool is_boundary = false)
{
if ( is_boundary )
- return ch == '(' || ch == ')' || ch == '@' ||
- ch == ',' || ch == ';' || ch == ':' || ch == '\\' || ch == '"' ||
- ch == '/' || ch == '[' || ch == ']' || ch == '?' || ch == '=';
+ return ch == '"';
else
return ch == '(' || ch == ')' || ch == '<' || ch == '>' || ch == '@' ||
ch == ',' || ch == ';' || ch == ':' || ch == '\\' || ch == '"' ||
@@ -272,7 +270,11 @@ int MIME_is_token_char (char ch, bool is_boundary = false)
int MIME_get_token(int len, const char* data, data_chunk_t* token,
bool is_boundary)
{
- int i = MIME_skip_lws_comments(len, data);
+ int i = 0;
+
+ if ( ! is_boundary )
+ i = MIME_skip_lws_comments(len, data);
+
while ( i < len )
{
int j;
@@ -366,7 +368,10 @@ int MIME_get_quoted_string(int len, const char* data, data_chunk_t* str)
int MIME_get_value(int len, const char* data, BroString*& buf, bool is_boundary)
{
- int offset = MIME_skip_lws_comments(len, data);
+ int offset = 0;
+
+ if ( ! is_boundary ) // For boundaries, simply accept everything.
+ offset = MIME_skip_lws_comments(len, data);
len -= offset;
data += offset;
@@ -876,6 +881,13 @@ int MIME_Entity::ParseFieldParameters(int len, const char* data)
// token or quoted-string (and some lenience for characters
// not explicitly allowed by the RFC, but encountered in the wild)
offset = MIME_get_value(len, data, val, true);
+
+ if ( ! val )
+ {
+ IllegalFormat("Could not parse multipart boundary");
+ continue;
+ }
+
data_chunk_t vd = get_data_chunk(val);
multipart_boundary = new BroString((const u_char*)vd.data,
vd.length, 1);
@@ -1122,7 +1134,15 @@ void MIME_Entity::StartDecodeBase64()
delete base64_decoder;
}
- base64_decoder = new Base64Converter(message->GetAnalyzer());
+ analyzer::Analyzer* analyzer = message->GetAnalyzer();
+
+ if ( ! analyzer )
+ {
+ reporter->InternalWarning("no analyzer associated with MIME message");
+ return;
+ }
+
+ base64_decoder = new Base64Converter(analyzer->Conn());
}
void MIME_Entity::FinishDecodeBase64()
diff --git a/src/analyzer/protocol/ncp/NCP.cc b/src/analyzer/protocol/ncp/NCP.cc
index 3858f0b2ad..4605ad2bca 100644
--- a/src/analyzer/protocol/ncp/NCP.cc
+++ b/src/analyzer/protocol/ncp/NCP.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/analyzer/protocol/netbios/NetbiosSSN.cc b/src/analyzer/protocol/netbios/NetbiosSSN.cc
index d65a152b2f..a75c23525c 100644
--- a/src/analyzer/protocol/netbios/NetbiosSSN.cc
+++ b/src/analyzer/protocol/netbios/NetbiosSSN.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/analyzer/protocol/ntp/NTP.cc b/src/analyzer/protocol/ntp/NTP.cc
index 5778da9a0e..d46972b8cb 100644
--- a/src/analyzer/protocol/ntp/NTP.cc
+++ b/src/analyzer/protocol/ntp/NTP.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "NetVar.h"
#include "NTP.h"
diff --git a/src/analyzer/protocol/pia/PIA.cc b/src/analyzer/protocol/pia/PIA.cc
index 1adeb54a2d..7d73624dd0 100644
--- a/src/analyzer/protocol/pia/PIA.cc
+++ b/src/analyzer/protocol/pia/PIA.cc
@@ -1,5 +1,6 @@
#include "PIA.h"
#include "RuleMatcher.h"
+#include "analyzer/protocol/tcp/TCP_Flags.h"
#include "analyzer/protocol/tcp/TCP_Reassembler.h"
#include "events.bif.h"
@@ -348,12 +349,16 @@ void PIA_TCP::ActivateAnalyzer(analyzer::Tag tag, const Rule* rule)
for ( DataBlock* b = pkt_buffer.head; b; b = b->next )
{
+ // We don't have the TCP flags here during replay. We could
+ // funnel them through, but it's non-trivial and doesn't seem
+ // worth the effort.
+
if ( b->is_orig )
reass_orig->DataSent(network_time, orig_seq = b->seq,
- b->len, b->data, true);
+ b->len, b->data, tcp::TCP_Flags(), true);
else
reass_resp->DataSent(network_time, resp_seq = b->seq,
- b->len, b->data, true);
+ b->len, b->data, tcp::TCP_Flags(), true);
}
// We also need to pass the current packet on.
@@ -363,11 +368,11 @@ void PIA_TCP::ActivateAnalyzer(analyzer::Tag tag, const Rule* rule)
if ( current->is_orig )
reass_orig->DataSent(network_time,
orig_seq = current->seq,
- current->len, current->data, true);
+ current->len, current->data, analyzer::tcp::TCP_Flags(), true);
else
reass_resp->DataSent(network_time,
resp_seq = current->seq,
- current->len, current->data, true);
+ current->len, current->data, analyzer::tcp::TCP_Flags(), true);
}
ClearBuffer(&pkt_buffer);
diff --git a/src/analyzer/protocol/pop3/POP3.cc b/src/analyzer/protocol/pop3/POP3.cc
index 07dce7a7a3..b7d6aa0dcb 100644
--- a/src/analyzer/protocol/pop3/POP3.cc
+++ b/src/analyzer/protocol/pop3/POP3.cc
@@ -1,7 +1,7 @@
// This code contributed to Bro by Florian Schimandl, Hugh Dollman and
// Robin Sommer.
-#include "config.h"
+#include "bro-config.h"
#include
#include
@@ -137,7 +137,7 @@ void POP3_Analyzer::ProcessRequest(int length, const char* line)
++authLines;
BroString encoded(line);
- BroString* decoded = decode_base64(&encoded);
+ BroString* decoded = decode_base64(&encoded, 0, Conn());
if ( ! decoded )
{
@@ -722,6 +722,8 @@ void POP3_Analyzer::ProcessReply(int length, const char* line)
case CAPA:
ProtocolConfirmation();
+ // Fall-through.
+
case UIDL:
case LIST:
if (requestForMultiLine == true)
diff --git a/src/analyzer/protocol/rdp/rdp-analyzer.pac b/src/analyzer/protocol/rdp/rdp-analyzer.pac
index a70d55fb7b..fdfb8c44fc 100644
--- a/src/analyzer/protocol/rdp/rdp-analyzer.pac
+++ b/src/analyzer/protocol/rdp/rdp-analyzer.pac
@@ -9,9 +9,8 @@ refine flow RDP_Flow += {
function utf16_to_utf8_val(utf16: bytestring): StringVal
%{
std::string resultstring;
- size_t widesize = utf16.length();
- size_t utf8size = 3 * widesize + 1;
+ size_t utf8size = (3 * utf16.length() + 1);
if ( utf8size > resultstring.max_size() )
{
@@ -20,8 +19,16 @@ refine flow RDP_Flow += {
}
resultstring.resize(utf8size, '\0');
- const UTF16* sourcestart = reinterpret_cast(utf16.begin());
- const UTF16* sourceend = sourcestart + widesize;
+
+ // We can't assume that the string data is properly aligned
+ // here, so make a copy.
+ UTF16 utf16_copy[utf16.length()]; // Twice as much memory than necessary.
+ memcpy(utf16_copy, utf16.begin(), utf16.length());
+
+ const char* utf16_copy_end = reinterpret_cast(utf16_copy) + utf16.length();
+ const UTF16* sourcestart = utf16_copy;
+ const UTF16* sourceend = reinterpret_cast(utf16_copy_end);
+
UTF8* targetstart = reinterpret_cast(&resultstring[0]);
UTF8* targetend = targetstart + utf8size;
@@ -37,6 +44,7 @@ refine flow RDP_Flow += {
}
*targetstart = 0;
+
// We're relying on no nulls being in the string.
return new StringVal(resultstring.c_str());
%}
diff --git a/src/analyzer/protocol/rpc/NFS.cc b/src/analyzer/protocol/rpc/NFS.cc
index 136491ec84..8a2620e2e5 100644
--- a/src/analyzer/protocol/rpc/NFS.cc
+++ b/src/analyzer/protocol/rpc/NFS.cc
@@ -2,7 +2,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "NetVar.h"
#include "XDR.h"
diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc
index f57d9a915c..5d7c980879 100644
--- a/src/analyzer/protocol/rpc/Portmap.cc
+++ b/src/analyzer/protocol/rpc/Portmap.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "NetVar.h"
#include "XDR.h"
diff --git a/src/analyzer/protocol/rpc/RPC.cc b/src/analyzer/protocol/rpc/RPC.cc
index 38ed229a10..aff6bfefc0 100644
--- a/src/analyzer/protocol/rpc/RPC.cc
+++ b/src/analyzer/protocol/rpc/RPC.cc
@@ -4,7 +4,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "NetVar.h"
#include "XDR.h"
diff --git a/src/analyzer/protocol/rpc/XDR.cc b/src/analyzer/protocol/rpc/XDR.cc
index 981a982716..9ae1ba1236 100644
--- a/src/analyzer/protocol/rpc/XDR.cc
+++ b/src/analyzer/protocol/rpc/XDR.cc
@@ -2,7 +2,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "XDR.h"
diff --git a/src/analyzer/protocol/sip/sip-protocol.pac b/src/analyzer/protocol/sip/sip-protocol.pac
index a9e03cf2c1..15f07df44a 100644
--- a/src/analyzer/protocol/sip/sip-protocol.pac
+++ b/src/analyzer/protocol/sip/sip-protocol.pac
@@ -1,14 +1,5 @@
-enum ExpectBody {
- BODY_EXPECTED,
- BODY_NOT_EXPECTED,
- BODY_MAYBE,
-};
-
type SIP_TOKEN = RE/[^()<>@,;:\\"\/\[\]?={} \t]+/;
type SIP_WS = RE/[ \t]*/;
-type SIP_COLON = RE/:/;
-type SIP_TO_EOL = RE/[^\r\n]*/;
-type SIP_EOL = RE/(\r\n){1,2}/;
type SIP_URI = RE/[[:alnum:]@[:punct:]]+/;
type SIP_PDU(is_orig: bool) = case is_orig of {
@@ -17,14 +8,12 @@ type SIP_PDU(is_orig: bool) = case is_orig of {
};
type SIP_Request = record {
- request: SIP_RequestLine;
- newline: padding[2];
+ request: SIP_RequestLine &oneline;
msg: SIP_Message;
};
type SIP_Reply = record {
- reply: SIP_ReplyLine;
- newline: padding[2];
+ reply: SIP_ReplyLine &oneline;
msg: SIP_Message;
};
@@ -33,7 +22,7 @@ type SIP_RequestLine = record {
: SIP_WS;
uri: SIP_URI;
: SIP_WS;
- version: SIP_Version;
+ version: SIP_Version &restofdata;
} &oneline;
type SIP_ReplyLine = record {
@@ -41,7 +30,7 @@ type SIP_ReplyLine = record {
: SIP_WS;
status: SIP_Status;
: SIP_WS;
- reason: SIP_TO_EOL;
+ reason: bytestring &restofdata;
} &oneline;
type SIP_Status = record {
@@ -51,7 +40,7 @@ type SIP_Status = record {
};
type SIP_Version = record {
- : "SIP/";
+ : "SIP/";
vers_str: RE/[0-9]+\.[0-9]+/;
} &let {
vers_num: double = bytestring_to_double(vers_str);
@@ -67,11 +56,11 @@ type SIP_Message = record {
type SIP_HEADER_NAME = RE/[^: \t]+/;
type SIP_Header = record {
name: SIP_HEADER_NAME;
- : SIP_COLON;
: SIP_WS;
- value: SIP_TO_EOL;
- : SIP_EOL;
-} &oneline &byteorder=bigendian;
+ : ":";
+ : SIP_WS;
+ value: bytestring &restofdata;
+} &oneline;
type SIP_Body = record {
body: bytestring &length = $context.flow.get_content_length();
diff --git a/src/analyzer/protocol/sip/sip.pac b/src/analyzer/protocol/sip/sip.pac
index f527a90117..15addb8c1e 100644
--- a/src/analyzer/protocol/sip/sip.pac
+++ b/src/analyzer/protocol/sip/sip.pac
@@ -21,7 +21,7 @@ connection SIP_Conn(bro_analyzer: BroAnalyzer) {
%include sip-protocol.pac
flow SIP_Flow(is_orig: bool) {
- datagram = SIP_PDU(is_orig) withcontext(connection, this);
+ flowunit = SIP_PDU(is_orig) withcontext(connection, this);
};
%include sip-analyzer.pac
diff --git a/src/analyzer/protocol/sip/sip_TCP.pac b/src/analyzer/protocol/sip/sip_TCP.pac
index 5546d28ece..2e51675dea 100644
--- a/src/analyzer/protocol/sip/sip_TCP.pac
+++ b/src/analyzer/protocol/sip/sip_TCP.pac
@@ -24,7 +24,7 @@ connection SIP_Conn(bro_analyzer: BroAnalyzer) {
%include sip-protocol.pac
flow SIP_Flow(is_orig: bool) {
- datagram = SIP_PDU(is_orig) withcontext(connection, this);
+ flowunit = SIP_PDU(is_orig) withcontext(connection, this);
};
%include sip-analyzer.pac
diff --git a/src/analyzer/protocol/smtp/SMTP.cc b/src/analyzer/protocol/smtp/SMTP.cc
index 614457dbca..6a19848d86 100644
--- a/src/analyzer/protocol/smtp/SMTP.cc
+++ b/src/analyzer/protocol/smtp/SMTP.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/analyzer/protocol/stepping-stone/SteppingStone.cc b/src/analyzer/protocol/stepping-stone/SteppingStone.cc
index b6473dcf6e..c85b34172f 100644
--- a/src/analyzer/protocol/stepping-stone/SteppingStone.cc
+++ b/src/analyzer/protocol/stepping-stone/SteppingStone.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
diff --git a/src/analyzer/protocol/tcp/TCP.cc b/src/analyzer/protocol/tcp/TCP.cc
index 72cad8a05c..8b3876c7ce 100644
--- a/src/analyzer/protocol/tcp/TCP.cc
+++ b/src/analyzer/protocol/tcp/TCP.cc
@@ -442,7 +442,7 @@ const struct tcphdr* TCP_Analyzer::ExtractTCP_Header(const u_char*& data,
}
if ( tcp_hdr_len > uint32(len) ||
- sizeof(struct tcphdr) > uint32(caplen) )
+ tcp_hdr_len > uint32(caplen) )
{
// This can happen even with the above test, due to TCP
// options.
@@ -946,23 +946,11 @@ void TCP_Analyzer::GeneratePacketEvent(
const u_char* data, int len, int caplen,
int is_orig, TCP_Flags flags)
{
- char tcp_flags[256];
- int tcp_flag_len = 0;
-
- if ( flags.SYN() ) tcp_flags[tcp_flag_len++] = 'S';
- if ( flags.FIN() ) tcp_flags[tcp_flag_len++] = 'F';
- if ( flags.RST() ) tcp_flags[tcp_flag_len++] = 'R';
- if ( flags.ACK() ) tcp_flags[tcp_flag_len++] = 'A';
- if ( flags.PUSH() ) tcp_flags[tcp_flag_len++] = 'P';
- if ( flags.URG() ) tcp_flags[tcp_flag_len++] = 'U';
-
- tcp_flags[tcp_flag_len] = '\0';
-
val_list* vl = new val_list();
vl->append(BuildConnVal());
vl->append(new Val(is_orig, TYPE_BOOL));
- vl->append(new StringVal(tcp_flags));
+ vl->append(new StringVal(flags.AsString()));
vl->append(new Val(rel_seq, TYPE_COUNT));
vl->append(new Val(flags.ACK() ? rel_ack : 0, TYPE_COUNT));
vl->append(new Val(len, TYPE_COUNT));
diff --git a/src/analyzer/protocol/tcp/TCP.h b/src/analyzer/protocol/tcp/TCP.h
index 608c06a5aa..e5589b01a3 100644
--- a/src/analyzer/protocol/tcp/TCP.h
+++ b/src/analyzer/protocol/tcp/TCP.h
@@ -8,6 +8,7 @@
#include "PacketDumper.h"
#include "IPAddr.h"
#include "TCP_Endpoint.h"
+#include "TCP_Flags.h"
#include "Conn.h"
// We define two classes here:
@@ -23,21 +24,6 @@ class TCP_Endpoint;
class TCP_ApplicationAnalyzer;
class TCP_Reassembler;
-class TCP_Flags {
-public:
- TCP_Flags(const struct tcphdr* tp) { flags = tp->th_flags; }
-
- bool SYN() { return flags & TH_SYN; }
- bool FIN() { return flags & TH_FIN; }
- bool RST() { return flags & TH_RST; }
- bool ACK() { return flags & TH_ACK; }
- bool URG() { return flags & TH_URG; }
- bool PUSH() { return flags & TH_PUSH; }
-
-protected:
- u_char flags;
-};
-
class TCP_Analyzer : public analyzer::TransportLayerAnalyzer {
public:
TCP_Analyzer(Connection* conn);
diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
index 846eb6d9d1..7c359623f3 100644
--- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc
+++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc
@@ -204,7 +204,7 @@ int TCP_Endpoint::DataSent(double t, uint64 seq, int len, int caplen,
if ( contents_processor )
{
if ( caplen >= len )
- status = contents_processor->DataSent(t, seq, len, data);
+ status = contents_processor->DataSent(t, seq, len, data, TCP_Flags(tp));
else
TCP()->Weird("truncated_tcp_payload");
}
diff --git a/src/analyzer/protocol/tcp/TCP_Flags.h b/src/analyzer/protocol/tcp/TCP_Flags.h
new file mode 100644
index 0000000000..cc3c1f5915
--- /dev/null
+++ b/src/analyzer/protocol/tcp/TCP_Flags.h
@@ -0,0 +1,55 @@
+#ifndef ANALYZER_PROTOCOL_TCP_TCP_FLAGS_H
+#define ANALYZER_PROTOCOL_TCP_TCP_FLAGS_H
+
+namespace analyzer { namespace tcp {
+
+class TCP_Flags {
+public:
+ TCP_Flags(const struct tcphdr* tp) { flags = tp->th_flags; }
+ TCP_Flags() { flags = 0; }
+
+ bool SYN() const { return flags & TH_SYN; }
+ bool FIN() const { return flags & TH_FIN; }
+ bool RST() const { return flags & TH_RST; }
+ bool ACK() const { return flags & TH_ACK; }
+ bool URG() const { return flags & TH_URG; }
+ bool PUSH() const { return flags & TH_PUSH; }
+
+ string AsString() const;
+
+protected:
+ u_char flags;
+};
+
+inline string TCP_Flags::AsString() const
+ {
+ char tcp_flags[10];
+ char* p = tcp_flags;
+
+ if ( SYN() )
+ *p++ = 'S';
+
+ if ( FIN() )
+ *p++ = 'F';
+
+ if ( RST() )
+ *p++ = 'R';
+
+ if ( ACK() )
+ *p++ = 'A';
+
+ if ( PUSH() )
+ *p++ = 'P';
+
+ if ( URG() )
+ *p++ = 'U';
+
+ *p++ = '\0';
+ return tcp_flags;
+ }
+}
+
+
+}
+
+#endif
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.cc b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
index bbcd9cb43a..5b88d2dafb 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.cc
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.cc
@@ -433,8 +433,13 @@ void TCP_Reassembler::Overlap(const u_char* b1, const u_char* b2, uint64 n)
{
BroString* b1_s = new BroString((const u_char*) b1, n, 0);
BroString* b2_s = new BroString((const u_char*) b2, n, 0);
- tcp_analyzer->Event(rexmit_inconsistency,
- new StringVal(b1_s), new StringVal(b2_s));
+
+ val_list* vl = new val_list(3);
+ vl->append(tcp_analyzer->BuildConnVal());
+ vl->append(new StringVal(b1_s));
+ vl->append(new StringVal(b2_s));
+ vl->append(new StringVal(flags.AsString()));
+ tcp_analyzer->ConnectionEvent(rexmit_inconsistency, vl);
}
}
@@ -461,7 +466,7 @@ void TCP_Reassembler::Deliver(uint64 seq, int len, const u_char* data)
}
int TCP_Reassembler::DataSent(double t, uint64 seq, int len,
- const u_char* data, bool replaying)
+ const u_char* data, TCP_Flags arg_flags, bool replaying)
{
uint64 ack = endp->ToRelativeSeqSpace(endp->AckSeq(), endp->AckWraps());
uint64 upper_seq = seq + len;
@@ -492,7 +497,9 @@ int TCP_Reassembler::DataSent(double t, uint64 seq, int len,
len -= amount_acked;
}
+ flags = arg_flags;
NewBlock(t, seq, len, data);
+ flags = TCP_Flags();
if ( Endpoint()->NoDataAcked() && tcp_max_above_hole_without_any_acks &&
NumUndeliveredBytes() > static_cast(tcp_max_above_hole_without_any_acks) )
diff --git a/src/analyzer/protocol/tcp/TCP_Reassembler.h b/src/analyzer/protocol/tcp/TCP_Reassembler.h
index c2ed0175ca..2e85e48e2f 100644
--- a/src/analyzer/protocol/tcp/TCP_Reassembler.h
+++ b/src/analyzer/protocol/tcp/TCP_Reassembler.h
@@ -3,6 +3,7 @@
#include "Reassem.h"
#include "TCP_Endpoint.h"
+#include "TCP_Flags.h"
class BroFile;
class Connection;
@@ -61,7 +62,7 @@ public:
void SkipToSeq(uint64 seq);
int DataSent(double t, uint64 seq, int len, const u_char* data,
- bool replaying=true);
+ analyzer::tcp::TCP_Flags flags, bool replaying=true);
void AckReceived(uint64 seq);
// Checks if we have delivered all contents that we can possibly
@@ -90,15 +91,15 @@ private:
DECLARE_SERIAL(TCP_Reassembler);
- void Undelivered(uint64 up_to_seq);
+ void Undelivered(uint64 up_to_seq) override;
void Gap(uint64 seq, uint64 len);
void RecordToSeq(uint64 start_seq, uint64 stop_seq, BroFile* f);
void RecordBlock(DataBlock* b, BroFile* f);
void RecordGap(uint64 start_seq, uint64 upper_seq, BroFile* f);
- void BlockInserted(DataBlock* b);
- void Overlap(const u_char* b1, const u_char* b2, uint64 n);
+ void BlockInserted(DataBlock* b) override;
+ void Overlap(const u_char* b1, const u_char* b2, uint64 n) override;
TCP_Endpoint* endp;
@@ -110,6 +111,7 @@ private:
uint64 seq_to_skip;
bool in_delivery;
+ analyzer::tcp::TCP_Flags flags;
BroFile* record_contents_file; // file on which to reassemble contents
diff --git a/src/analyzer/protocol/teredo/Teredo.cc b/src/analyzer/protocol/teredo/Teredo.cc
index 400f38839e..6ad00a82dc 100644
--- a/src/analyzer/protocol/teredo/Teredo.cc
+++ b/src/analyzer/protocol/teredo/Teredo.cc
@@ -189,36 +189,7 @@ void Teredo_Analyzer::DeliverPacket(int len, const u_char* data, bool orig,
else
valid_resp = true;
- if ( BifConst::Tunnel::yielding_teredo_decapsulation &&
- ! ProtocolConfirmed() )
- {
- // Only confirm the Teredo tunnel and start decapsulating packets
- // when no other sibling analyzer thinks it's already parsing the
- // right protocol.
- bool sibling_has_confirmed = false;
- if ( Parent() )
- {
- LOOP_OVER_GIVEN_CONST_CHILDREN(i, Parent()->GetChildren())
- {
- if ( (*i)->ProtocolConfirmed() )
- {
- sibling_has_confirmed = true;
- break;
- }
- }
- }
-
- if ( ! sibling_has_confirmed )
- Confirm();
- else
- {
- delete inner;
- return;
- }
- }
- else
- // Aggressively decapsulate anything with valid Teredo encapsulation.
- Confirm();
+ Confirm();
}
else
diff --git a/src/analyzer/protocol/udp/UDP.cc b/src/analyzer/protocol/udp/UDP.cc
index 36d5831a6a..3bd3736b2a 100644
--- a/src/analyzer/protocol/udp/UDP.cc
+++ b/src/analyzer/protocol/udp/UDP.cc
@@ -2,7 +2,7 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "Net.h"
#include "NetVar.h"
diff --git a/src/analyzer/protocol/zip/ZIP.h b/src/analyzer/protocol/zip/ZIP.h
index b284529d86..580235ec63 100644
--- a/src/analyzer/protocol/zip/ZIP.h
+++ b/src/analyzer/protocol/zip/ZIP.h
@@ -3,7 +3,7 @@
#ifndef ANALYZER_PROTOCOL_ZIP_ZIP_H
#define ANALYZER_PROTOCOL_ZIP_ZIP_H
-#include "config.h"
+#include "bro-config.h"
#include "zlib.h"
#include "analyzer/protocol/tcp/TCP.h"
diff --git a/src/bif_arg.cc b/src/bif_arg.cc
index 92e228032b..f5e25f3746 100644
--- a/src/bif_arg.cc
+++ b/src/bif_arg.cc
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/bro.bif b/src/bro.bif
index dea12ec69a..72e7067b92 100644
--- a/src/bro.bif
+++ b/src/bro.bif
@@ -2788,14 +2788,17 @@ function hexstr_to_bytestring%(hexstr: string%): string
## Encodes a Base64-encoded string.
##
-## s: The string to encode
+## s: The string to encode.
+##
+## a: An optional custom alphabet. The empty string indicates the default
+## alphabet. If given, the string must consist of 64 unique characters.
##
## Returns: The encoded version of *s*.
##
-## .. bro:see:: encode_base64_custom decode_base64
-function encode_base64%(s: string%): string
+## .. bro:see:: decode_base64
+function encode_base64%(s: string, a: string &default=""%): string
%{
- BroString* t = encode_base64(s->AsString());
+ BroString* t = encode_base64(s->AsString(), a->AsString());
if ( t )
return new StringVal(t);
else
@@ -2805,18 +2808,18 @@ function encode_base64%(s: string%): string
}
%}
+
## Encodes a Base64-encoded string with a custom alphabet.
##
-## s: The string to encode
+## s: The string to encode.
##
-## a: The custom alphabet. The empty string indicates the default alphabet. The
-## length of *a* must be 64. For example, a custom alphabet could be
-## ``"!#$%&/(),-.:;<>@[]^ `_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?"``.
+## a: The custom alphabet. The string must consist of 64 unique
+## characters. The empty string indicates the default alphabet.
##
## Returns: The encoded version of *s*.
##
-## .. bro:see:: encode_base64 decode_base64_custom
-function encode_base64_custom%(s: string, a: string%): string
+## .. bro:see:: encode_base64
+function encode_base64_custom%(s: string, a: string%): string &deprecated
%{
BroString* t = encode_base64(s->AsString(), a->AsString());
if ( t )
@@ -2832,12 +2835,48 @@ function encode_base64_custom%(s: string, a: string%): string
##
## s: The Base64-encoded string.
##
+## a: An optional custom alphabet. The empty string indicates the default
+## alphabet. If given, the string must consist of 64 unique characters.
+##
## Returns: The decoded version of *s*.
##
-## .. bro:see:: decode_base64_custom encode_base64
-function decode_base64%(s: string%): string
+## .. bro:see:: decode_base64_conn encode_base64
+function decode_base64%(s: string, a: string &default=""%): string
%{
- BroString* t = decode_base64(s->AsString());
+ BroString* t = decode_base64(s->AsString(), a->AsString());
+ if ( t )
+ return new StringVal(t);
+ else
+ {
+ reporter->Error("error in decoding string %s", s->CheckString());
+ return new StringVal("");
+ }
+ %}
+
+## Decodes a Base64-encoded string that was derived from processing a connection.
+## If an error is encountered decoding the string, that will be logged to
+## ``weird.log`` with the associated connection.
+##
+## cid: The identifier of the connection that the encoding originates from.
+##
+## s: The Base64-encoded string.
+##
+## a: An optional custom alphabet. The empty string indicates the default
+## alphabet. If given, the string must consist of 64 unique characters.
+##
+## Returns: The decoded version of *s*.
+##
+## .. bro:see:: decode_base64
+function decode_base64_conn%(cid: conn_id, s: string, a: string &default=""%): string
+ %{
+ Connection* conn = sessions->FindConnection(cid);
+ if ( ! conn )
+ {
+ builtin_error("connection ID not a known connection", cid);
+ return new StringVal("");
+ }
+
+ BroString* t = decode_base64(s->AsString(), a->AsString(), conn);
if ( t )
return new StringVal(t);
else
@@ -2851,14 +2890,13 @@ function decode_base64%(s: string%): string
##
## s: The Base64-encoded string.
##
-## a: The custom alphabet. The empty string indicates the default alphabet. The
-## length of *a* must be 64. For example, a custom alphabet could be
-## ``"!#$%&/(),-.:;<>@[]^ `_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?"``.
+## a: The custom alphabet. The string must consist of 64 unique characters.
+## The empty string indicates the default alphabet.
##
## Returns: The decoded version of *s*.
##
-## .. bro:see:: decode_base64 encode_base64_custom
-function decode_base64_custom%(s: string, a: string%): string
+## .. bro:see:: decode_base64 decode_base64_conn
+function decode_base64_custom%(s: string, a: string%): string &deprecated
%{
BroString* t = decode_base64(s->AsString(), a->AsString());
if ( t )
diff --git a/src/bsd-getopt-long.c b/src/bsd-getopt-long.c
index 7ecb064fc8..65a3d94093 100644
--- a/src/bsd-getopt-long.c
+++ b/src/bsd-getopt-long.c
@@ -54,7 +54,7 @@
#define IN_GETOPT_LONG_C 1
-#include
+#include
#include
#include
#include
diff --git a/src/const.bif b/src/const.bif
index 0ba168ca85..2d062d854a 100644
--- a/src/const.bif
+++ b/src/const.bif
@@ -19,7 +19,6 @@ const Tunnel::enable_ayiya: bool;
const Tunnel::enable_teredo: bool;
const Tunnel::enable_gtpv1: bool;
const Tunnel::enable_gre: bool;
-const Tunnel::yielding_teredo_decapsulation: bool;
const Tunnel::delay_teredo_confirmation: bool;
const Tunnel::delay_gtp_confirmation: bool;
const Tunnel::ip_tunnel_timeout: interval;
diff --git a/src/event.bif b/src/event.bif
index 456de20b3a..ff6ec059fb 100644
--- a/src/event.bif
+++ b/src/event.bif
@@ -305,8 +305,14 @@ event packet_contents%(c: connection, contents: string%);
##
## t2: The new payload.
##
+## tcp_flags: A string with the TCP flags of the packet triggering the
+## inconsistency. In the string, each character corresponds to one set flag,
+## as follows: ``S`` -> SYN; ``F`` -> FIN; ``R`` -> RST; ``A`` -> ACK; ``P`` ->
+## PUSH. This string will not always be set, only if the information is available;
+## it's "best effort".
+##
## .. bro:see:: tcp_rexmit tcp_contents
-event rexmit_inconsistency%(c: connection, t1: string, t2: string%);
+event rexmit_inconsistency%(c: connection, t1: string, t2: string, tcp_flags: string%);
## Generated when a TCP endpoint acknowledges payload that Bro never saw.
##
diff --git a/src/file_analysis/Component.h b/src/file_analysis/Component.h
index 1900369f10..6e282da205 100644
--- a/src/file_analysis/Component.h
+++ b/src/file_analysis/Component.h
@@ -9,7 +9,7 @@
#include "Val.h"
-#include "../config.h"
+#include "../bro-config.h"
#include "../util.h"
namespace file_analysis {
diff --git a/src/file_analysis/FileReassembler.h b/src/file_analysis/FileReassembler.h
index 396aa062e1..aa07a84d42 100644
--- a/src/file_analysis/FileReassembler.h
+++ b/src/file_analysis/FileReassembler.h
@@ -52,9 +52,9 @@ protected:
DECLARE_SERIAL(FileReassembler);
- void Undelivered(uint64 up_to_seq);
- void BlockInserted(DataBlock* b);
- void Overlap(const u_char* b1, const u_char* b2, uint64 n);
+ void Undelivered(uint64 up_to_seq) override;
+ void BlockInserted(DataBlock* b) override;
+ void Overlap(const u_char* b1, const u_char* b2, uint64 n) override;
File* the_file;
bool flushing;
diff --git a/src/file_analysis/Tag.h b/src/file_analysis/Tag.h
index aa38836403..c28183a07f 100644
--- a/src/file_analysis/Tag.h
+++ b/src/file_analysis/Tag.h
@@ -3,7 +3,7 @@
#ifndef FILE_ANALYZER_TAG_H
#define FILE_ANALYZER_TAG_H
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "../Tag.h"
#include "plugin/TaggedComponent.h"
diff --git a/src/file_analysis/analyzer/x509/X509.cc b/src/file_analysis/analyzer/x509/X509.cc
index 8c70597dca..e8ea5cb7b4 100644
--- a/src/file_analysis/analyzer/x509/X509.cc
+++ b/src/file_analysis/analyzer/x509/X509.cc
@@ -52,7 +52,8 @@ bool file_analysis::X509::EndOfFile()
X509Val* cert_val = new X509Val(ssl_cert); // cert_val takes ownership of ssl_cert
- RecordVal* cert_record = ParseCertificate(cert_val); // parse basic information into record
+ // parse basic information into record.
+ RecordVal* cert_record = ParseCertificate(cert_val, GetFile()->GetID().c_str());
// and send the record on to scriptland
val_list* vl = new val_list();
@@ -84,7 +85,7 @@ bool file_analysis::X509::EndOfFile()
return false;
}
-RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val)
+RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val, const char* fid)
{
::X509* ssl_cert = cert_val->GetCertificate();
@@ -131,8 +132,8 @@ RecordVal* file_analysis::X509::ParseCertificate(X509Val* cert_val)
pX509Cert->Assign(3, new StringVal(len, buf));
BIO_free(bio);
- pX509Cert->Assign(5, new Val(GetTimeFromAsn1(X509_get_notBefore(ssl_cert)), TYPE_TIME));
- pX509Cert->Assign(6, new Val(GetTimeFromAsn1(X509_get_notAfter(ssl_cert)), TYPE_TIME));
+ pX509Cert->Assign(5, new Val(GetTimeFromAsn1(X509_get_notBefore(ssl_cert), fid), TYPE_TIME));
+ pX509Cert->Assign(6, new Val(GetTimeFromAsn1(X509_get_notAfter(ssl_cert), fid), TYPE_TIME));
// we only read 255 bytes because byte 256 is always 0.
// if the string is longer than 255, that will be our null-termination,
@@ -515,54 +516,103 @@ unsigned int file_analysis::X509::KeyLength(EVP_PKEY *key)
reporter->InternalError("cannot be reached");
}
-double file_analysis::X509::GetTimeFromAsn1(const ASN1_TIME* atime)
+double file_analysis::X509::GetTimeFromAsn1(const ASN1_TIME* atime, const char* arg_fid)
{
+ const char *fid = arg_fid ? arg_fid : "";
time_t lResult = 0;
- char lBuffer[24];
+ char lBuffer[26];
char* pBuffer = lBuffer;
- size_t lTimeLength = atime->length;
- char * pString = (char *) atime->data;
+ const char *pString = (const char *) atime->data;
+ unsigned int remaining = atime->length;
if ( atime->type == V_ASN1_UTCTIME )
{
- if ( lTimeLength < 11 || lTimeLength > 17 )
+ if ( remaining < 11 || remaining > 17 )
+ {
+ reporter->Weird(fmt("Could not parse time in X509 certificate (fuid %s) -- UTCTime has wrong length", fid));
return 0;
+ }
+
+ if ( pString[remaining-1] != 'Z' )
+ {
+ // not valid according to RFC 2459 4.1.2.5.1
+ reporter->Weird(fmt("Could not parse UTC time in non-YY-format in X509 certificate (x509 %s)", fid));
+ return 0;
+ }
+
+ // year is first two digits in YY format. Buffer expects YYYY format.
+ if ( pString[0] - '0' < 50 ) // RFC 2459 4.1.2.5.1
+ {
+ *(pBuffer++) = '2';
+ *(pBuffer++) = '0';
+ }
+ else
+ {
+ *(pBuffer++) = '1';
+ *(pBuffer++) = '9';
+ }
memcpy(pBuffer, pString, 10);
pBuffer += 10;
pString += 10;
+ remaining -= 10;
}
-
- else
+ else if ( atime->type == V_ASN1_GENERALIZEDTIME )
{
- if ( lTimeLength < 13 )
+ // generalized time. We apparently ignore the YYYYMMDDHH case
+ // for now and assume we always have minutes and seconds.
+ // This should be ok because it is specified as a requirement in RFC 2459 4.1.2.5.2
+
+ if ( remaining < 12 || remaining > 23 )
+ {
+ reporter->Weird(fmt("Could not parse time in X509 certificate (fuid %s) -- Generalized time has wrong length", fid));
return 0;
+ }
memcpy(pBuffer, pString, 12);
pBuffer += 12;
pString += 12;
+ remaining -= 12;
+ }
+ else
+ {
+ reporter->Weird(fmt("Invalid time type in X509 certificate (fuid %s)", fid));
+ return 0;
}
- if ((*pString == 'Z') || (*pString == '-') || (*pString == '+'))
+ if ( (remaining == 0) || (*pString == 'Z') || (*pString == '-') || (*pString == '+') )
{
*(pBuffer++) = '0';
*(pBuffer++) = '0';
}
+ else if ( remaining >= 2 )
+ {
+ *(pBuffer++) = *(pString++);
+ *(pBuffer++) = *(pString++);
+
+ remaining -= 2;
+
+ // Skip any fractional seconds...
+ if ( (remaining > 0) && (*pString == '.') )
+ {
+ pString++;
+ remaining--;
+
+ while ( (remaining > 0) && (*pString >= '0') && (*pString <= '9') )
+ {
+ pString++;
+ remaining--;
+ }
+ }
+ }
+
else
{
- *(pBuffer++) = *(pString++);
- *(pBuffer++) = *(pString++);
-
- // Skip any fractional seconds...
- if (*pString == '.')
- {
- pString++;
- while ((*pString >= '0') && (*pString <= '9'))
- pString++;
- }
+ reporter->Weird(fmt("Could not parse time in X509 certificate (fuid %s) -- additional char after time", fid));
+ return 0;
}
*(pBuffer++) = 'Z';
@@ -570,31 +620,39 @@ double file_analysis::X509::GetTimeFromAsn1(const ASN1_TIME* atime)
time_t lSecondsFromUTC;
- if ( *pString == 'Z' )
+ if ( remaining == 0 || *pString == 'Z' )
lSecondsFromUTC = 0;
-
else
{
- if ((*pString != '+') && (pString[5] != '-'))
+ if ( remaining < 5 )
+ {
+ reporter->Weird(fmt("Could not parse time in X509 certificate (fuid %s) -- not enough bytes remaining for offset", fid));
return 0;
+ }
- lSecondsFromUTC = ((pString[1]-'0') * 10 + (pString[2]-'0')) * 60;
- lSecondsFromUTC += (pString[3]-'0') * 10 + (pString[4]-'0');
+ if ((*pString != '+') && (*pString != '-'))
+ {
+ reporter->Weird(fmt("Could not parse time in X509 certificate (fuid %s) -- unknown offset type", fid));
+ return 0;
+ }
+
+ lSecondsFromUTC = ((pString[1] - '0') * 10 + (pString[2] - '0')) * 60;
+ lSecondsFromUTC += (pString[3] - '0') * 10 + (pString[4] - '0');
if (*pString == '-')
lSecondsFromUTC = -lSecondsFromUTC;
}
tm lTime;
- lTime.tm_sec = ((lBuffer[10] - '0') * 10) + (lBuffer[11] - '0');
- lTime.tm_min = ((lBuffer[8] - '0') * 10) + (lBuffer[9] - '0');
- lTime.tm_hour = ((lBuffer[6] - '0') * 10) + (lBuffer[7] - '0');
- lTime.tm_mday = ((lBuffer[4] - '0') * 10) + (lBuffer[5] - '0');
- lTime.tm_mon = (((lBuffer[2] - '0') * 10) + (lBuffer[3] - '0')) - 1;
- lTime.tm_year = ((lBuffer[0] - '0') * 10) + (lBuffer[1] - '0');
+ lTime.tm_sec = ((lBuffer[12] - '0') * 10) + (lBuffer[13] - '0');
+ lTime.tm_min = ((lBuffer[10] - '0') * 10) + (lBuffer[11] - '0');
+ lTime.tm_hour = ((lBuffer[8] - '0') * 10) + (lBuffer[9] - '0');
+ lTime.tm_mday = ((lBuffer[6] - '0') * 10) + (lBuffer[7] - '0');
+ lTime.tm_mon = (((lBuffer[4] - '0') * 10) + (lBuffer[5] - '0')) - 1;
+ lTime.tm_year = (lBuffer[0] - '0') * 1000 + (lBuffer[1] - '0') * 100 + ((lBuffer[2] - '0') * 10) + (lBuffer[3] - '0');
- if ( lTime.tm_year < 50 )
- lTime.tm_year += 100; // RFC 2459
+ if ( lTime.tm_year > 1900)
+ lTime.tm_year -= 1900;
lTime.tm_wday = 0;
lTime.tm_yday = 0;
@@ -604,7 +662,7 @@ double file_analysis::X509::GetTimeFromAsn1(const ASN1_TIME* atime)
if ( lResult )
{
- if ( 0 != lTime.tm_isdst )
+ if ( lTime.tm_isdst != 0 )
lResult -= 3600; // mktime may adjust for DST (OS dependent)
lResult += lSecondsFromUTC;
diff --git a/src/file_analysis/analyzer/x509/X509.h b/src/file_analysis/analyzer/x509/X509.h
index bd4c8fc7a5..c671c68a99 100644
--- a/src/file_analysis/analyzer/x509/X509.h
+++ b/src/file_analysis/analyzer/x509/X509.h
@@ -29,10 +29,13 @@ public:
*
* @param cert_val The certificate to converts.
*
+ * @param fid A file ID associated with the certificate, if any
+ * (primarily for error reporting).
+ *
* @param Returns the new record value and passes ownership to
* caller.
*/
- static RecordVal* ParseCertificate(X509Val* cert_val);
+ static RecordVal* ParseCertificate(X509Val* cert_val, const char* fid = 0);
static file_analysis::Analyzer* Instantiate(RecordVal* args, File* file)
{ return new X509(args, file); }
@@ -59,7 +62,7 @@ private:
std::string cert_data;
// Helpers for ParseCertificate.
- static double GetTimeFromAsn1(const ASN1_TIME * atime);
+ static double GetTimeFromAsn1(const ASN1_TIME * atime, const char* fid);
static StringVal* KeyCurve(EVP_PKEY *key);
static unsigned int KeyLength(EVP_PKEY *key);
};
diff --git a/src/input/Tag.h b/src/input/Tag.h
index 8188fbc294..c9e997f8e9 100644
--- a/src/input/Tag.h
+++ b/src/input/Tag.h
@@ -3,7 +3,7 @@
#ifndef INPUT_TAG_H
#define INPUT_TAG_H
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "../Tag.h"
#include "plugin/TaggedComponent.h"
diff --git a/src/input/readers/raw/Raw.cc b/src/input/readers/raw/Raw.cc
index 2aae96abf7..76d8958fea 100644
--- a/src/input/readers/raw/Raw.cc
+++ b/src/input/readers/raw/Raw.cc
@@ -302,8 +302,10 @@ bool Raw::OpenInput()
if ( offset )
{
- int whence = (offset > 0) ? SEEK_SET : SEEK_END;
- if ( fseek(file, offset, whence) < 0 )
+ int whence = (offset >= 0) ? SEEK_SET : SEEK_END;
+ int64_t pos = (offset >= 0) ? offset : offset + 1; // we want -1 to be the end of the file
+
+ if ( fseek(file, pos, whence) < 0 )
{
char buf[256];
strerror_r(errno, buf, sizeof(buf));
@@ -395,8 +397,6 @@ bool Raw::DoInit(const ReaderInfo& info, int num_fields, const Field* const* fie
{
string offset_s = it->second;
offset = strtoll(offset_s.c_str(), 0, 10);
- if ( offset < 0 )
- offset++; // we want -1 to be the end of the file
}
else if ( it != info.config.end() )
{
diff --git a/src/input/readers/sqlite/SQLite.cc b/src/input/readers/sqlite/SQLite.cc
index 3790e5919d..9352d04742 100644
--- a/src/input/readers/sqlite/SQLite.cc
+++ b/src/input/readers/sqlite/SQLite.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/input/readers/sqlite/SQLite.h b/src/input/readers/sqlite/SQLite.h
index 5d82bc55f1..5add678b16 100644
--- a/src/input/readers/sqlite/SQLite.h
+++ b/src/input/readers/sqlite/SQLite.h
@@ -3,7 +3,7 @@
#ifndef INPUT_READERS_SQLITE_H
#define INPUT_READERS_SQLITE_H
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/iosource/BPF_Program.cc b/src/iosource/BPF_Program.cc
index 70469c97e7..451a74bed3 100644
--- a/src/iosource/BPF_Program.cc
+++ b/src/iosource/BPF_Program.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "BPF_Program.h"
diff --git a/src/iosource/CMakeLists.txt b/src/iosource/CMakeLists.txt
index b1de9bddaf..27c42e9a40 100644
--- a/src/iosource/CMakeLists.txt
+++ b/src/iosource/CMakeLists.txt
@@ -17,8 +17,6 @@ set(iosource_SRCS
PktSrc.cc
)
-bif_target(pcap.bif)
-
bro_add_subdir_library(iosource ${iosource_SRCS})
add_dependencies(bro_iosource generate_outputs)
diff --git a/src/iosource/Packet.cc b/src/iosource/Packet.cc
index 396192562f..fbefd9c5d2 100644
--- a/src/iosource/Packet.cc
+++ b/src/iosource/Packet.cc
@@ -47,6 +47,12 @@ void Packet::Init(int arg_link_type, struct timeval *arg_ts, uint32 arg_caplen,
l2_valid = false;
+ if ( data && cap_len < hdr_size )
+ {
+ Weird("truncated_link_header");
+ return;
+ }
+
if ( data )
ProcessLayer2();
}
@@ -94,6 +100,7 @@ void Packet::ProcessLayer2()
bool have_mpls = false;
const u_char* pdata = data;
+ const u_char* end_of_data = data + cap_len;
switch ( link_type ) {
case DLT_NULL:
@@ -140,6 +147,12 @@ void Packet::ProcessLayer2()
// 802.1q / 802.1ad
case 0x8100:
case 0x9100:
+ if ( pdata + 4 >= end_of_data )
+ {
+ Weird("truncated_link_header");
+ return;
+ }
+
vlan = ((pdata[0] << 8) + pdata[1]) & 0xfff;
protocol = ((pdata[2] << 8) + pdata[3]);
pdata += 4; // Skip the vlan header
@@ -154,6 +167,12 @@ void Packet::ProcessLayer2()
// Check for double-tagged (802.1ad)
if ( protocol == 0x8100 || protocol == 0x9100 )
{
+ if ( pdata + 4 >= end_of_data )
+ {
+ Weird("truncated_link_header");
+ return;
+ }
+
inner_vlan = ((pdata[0] << 8) + pdata[1]) & 0xfff;
protocol = ((pdata[2] << 8) + pdata[3]);
pdata += 4; // Skip the vlan header
@@ -164,6 +183,12 @@ void Packet::ProcessLayer2()
// PPPoE carried over the ethernet frame.
case 0x8864:
+ if ( pdata + 8 >= end_of_data )
+ {
+ Weird("truncated_link_header");
+ return;
+ }
+
protocol = (pdata[6] << 8) + pdata[7];
pdata += 8; // Skip the PPPoE session and PPP header
@@ -230,6 +255,12 @@ void Packet::ProcessLayer2()
{
// Assume we're pointing at IP. Just figure out which version.
pdata += GetLinkHeaderSize(link_type);
+ if ( pdata + sizeof(struct ip) >= end_of_data )
+ {
+ Weird("truncated_link_header");
+ return;
+ }
+
const struct ip* ip = (const struct ip *)pdata;
if ( ip->ip_v == 4 )
@@ -254,18 +285,18 @@ void Packet::ProcessLayer2()
while ( ! end_of_stack )
{
- end_of_stack = *(pdata + 2) & 0x01;
- pdata += 4;
-
- if ( pdata >= pdata + cap_len )
+ if ( pdata + 4 >= end_of_data )
{
- Weird("no_mpls_payload");
+ Weird("truncated_link_header");
return;
}
+
+ end_of_stack = *(pdata + 2) & 0x01;
+ pdata += 4;
}
// We assume that what remains is IP
- if ( pdata + sizeof(struct ip) >= data + cap_len )
+ if ( pdata + sizeof(struct ip) >= end_of_data )
{
Weird("no_ip_in_mpls_payload");
return;
@@ -288,13 +319,14 @@ void Packet::ProcessLayer2()
else if ( encap_hdr_size )
{
// Blanket encapsulation. We assume that what remains is IP.
- pdata += encap_hdr_size;
- if ( pdata + sizeof(struct ip) >= data + cap_len )
+ if ( pdata + encap_hdr_size + sizeof(struct ip) >= end_of_data )
{
Weird("no_ip_left_after_encap");
return;
}
+ pdata += encap_hdr_size;
+
const struct ip* ip = (const struct ip *)pdata;
if ( ip->ip_v == 4 )
@@ -310,9 +342,8 @@ void Packet::ProcessLayer2()
}
- // We've now determined (a) L3_IPV4 vs (b) L3_IPV6 vs
- // (c) L3_ARP vs (d) L3_UNKNOWN.
- l3_proto = l3_proto;
+ // We've now determined (a) L3_IPV4 vs (b) L3_IPV6 vs (c) L3_ARP vs
+ // (d) L3_UNKNOWN.
// Calculate how much header we've used up.
hdr_size = (pdata - data);
diff --git a/src/iosource/PktDumper.cc b/src/iosource/PktDumper.cc
index a4bc3a82f8..10c95e8021 100644
--- a/src/iosource/PktDumper.cc
+++ b/src/iosource/PktDumper.cc
@@ -4,7 +4,7 @@
#include
#include
-#include "config.h"
+#include "bro-config.h"
#include "PktDumper.h"
diff --git a/src/iosource/PktSrc.cc b/src/iosource/PktSrc.cc
index 8012f79f1b..8db9db6ef1 100644
--- a/src/iosource/PktSrc.cc
+++ b/src/iosource/PktSrc.cc
@@ -3,7 +3,7 @@
#include
#include
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "PktSrc.h"
@@ -11,6 +11,8 @@
#include "Net.h"
#include "Sessions.h"
+#include "pcap/const.bif.h"
+
using namespace iosource;
PktSrc::Properties::Properties()
@@ -34,9 +36,7 @@ PktSrc::PktSrc()
PktSrc::~PktSrc()
{
- BPF_Program* code;
- IterCookie* cookie = filters.InitForIteration();
- while ( (code = filters.NextEntry(cookie)) )
+ for ( auto code : filters )
delete code;
}
@@ -66,11 +66,6 @@ bool PktSrc::IsError() const
return ErrorMsg();
}
-int PktSrc::SnapLen() const
- {
- return snaplen; // That's a global. Change?
- }
-
bool PktSrc::IsLive() const
{
return props.is_live;
@@ -112,7 +107,7 @@ void PktSrc::Opened(const Properties& arg_props)
}
if ( props.is_live )
- Info(fmt("listening on %s, capture length %d bytes\n", props.path.c_str(), SnapLen()));
+ Info(fmt("listening on %s\n", props.path.c_str()));
DBG_LOG(DBG_PKTIO, "Opened source %s", props.path.c_str());
}
@@ -325,7 +320,7 @@ bool PktSrc::PrecompileBPFFilter(int index, const std::string& filter)
// Compile filter.
BPF_Program* code = new BPF_Program();
- if ( ! code->Compile(SnapLen(), LinkType(), filter.c_str(), Netmask(), errbuf, sizeof(errbuf)) )
+ if ( ! code->Compile(BifConst::Pcap::snaplen, LinkType(), filter.c_str(), Netmask(), errbuf, sizeof(errbuf)) )
{
string msg = fmt("cannot compile BPF filter \"%s\"", filter.c_str());
@@ -338,16 +333,16 @@ bool PktSrc::PrecompileBPFFilter(int index, const std::string& filter)
return 0;
}
- // Store it in hash.
- HashKey* hash = new HashKey(HashKey(bro_int_t(index)));
- BPF_Program* oldcode = filters.Lookup(hash);
- if ( oldcode )
- delete oldcode;
+ // Store it in vector.
+ if ( index >= static_cast(filters.size()) )
+ filters.resize(index + 1);
- filters.Insert(hash, code);
- delete hash;
+ if ( auto old = filters[index] )
+ delete old;
- return 1;
+ filters[index] = code;
+
+ return true;
}
BPF_Program* PktSrc::GetBPFFilter(int index)
@@ -355,10 +350,7 @@ BPF_Program* PktSrc::GetBPFFilter(int index)
if ( index < 0 )
return 0;
- HashKey* hash = new HashKey(HashKey(bro_int_t(index)));
- BPF_Program* code = filters.Lookup(hash);
- delete hash;
- return code;
+ return (static_cast(filters.size()) > index ? filters[index] : 0);
}
bool PktSrc::ApplyBPFFilter(int index, const struct pcap_pkthdr *hdr, const u_char *pkt)
diff --git a/src/iosource/PktSrc.h b/src/iosource/PktSrc.h
index bf4c811dca..25a743dc53 100644
--- a/src/iosource/PktSrc.h
+++ b/src/iosource/PktSrc.h
@@ -3,6 +3,8 @@
#ifndef IOSOURCE_PKTSRC_PKTSRC_H
#define IOSOURCE_PKTSRC_PKTSRC_H
+#include
+
#include "IOSource.h"
#include "BPF_Program.h"
#include "Dict.h"
@@ -95,11 +97,6 @@ public:
*/
int HdrSize() const;
- /**
- * Returns the snap length for this source.
- */
- int SnapLen() const;
-
/**
* In pseudo-realtime mode, returns the logical timestamp of the
* current packet. Undefined if not running pseudo-realtime mode.
@@ -367,7 +364,7 @@ private:
Packet current_packet;
// For BPF filtering support.
- PDict(BPF_Program) filters;
+ std::vector filters;
// Only set in pseudo-realtime mode.
double first_timestamp;
diff --git a/src/iosource/pcap/CMakeLists.txt b/src/iosource/pcap/CMakeLists.txt
index 1c57bb6ac9..cf9f577760 100644
--- a/src/iosource/pcap/CMakeLists.txt
+++ b/src/iosource/pcap/CMakeLists.txt
@@ -5,4 +5,6 @@ include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DI
bro_plugin_begin(Bro Pcap)
bro_plugin_cc(Source.cc Dumper.cc Plugin.cc)
+bif_target(functions.bif)
+bif_target(const.bif)
bro_plugin_end()
diff --git a/src/iosource/pcap/Dumper.cc b/src/iosource/pcap/Dumper.cc
index 5bea6231f7..20e36420c6 100644
--- a/src/iosource/pcap/Dumper.cc
+++ b/src/iosource/pcap/Dumper.cc
@@ -7,6 +7,8 @@
#include "../PktSrc.h"
#include "../../Net.h"
+#include "const.bif.h"
+
using namespace iosource::pcap;
PcapDumper::PcapDumper(const std::string& path, bool arg_append)
@@ -25,7 +27,8 @@ void PcapDumper::Open()
{
int linktype = -1;
- pd = pcap_open_dead(DLT_EN10MB, snaplen);
+ pd = pcap_open_dead(DLT_EN10MB, BifConst::Pcap::snaplen);
+
if ( ! pd )
{
Error("error for pcap_open_dead");
diff --git a/src/iosource/pcap/Source.cc b/src/iosource/pcap/Source.cc
index bebe02c018..8158266f1c 100644
--- a/src/iosource/pcap/Source.cc
+++ b/src/iosource/pcap/Source.cc
@@ -2,11 +2,13 @@
#include
-#include "config.h"
+#include "bro-config.h"
#include "Source.h"
#include "iosource/Packet.h"
+#include "const.bif.h"
+
#ifdef HAVE_PCAP_INT_H
#include
#endif
@@ -84,32 +86,64 @@ void PcapSource::OpenLive()
props.netmask = PktSrc::NETMASK_UNKNOWN;
#endif
- // We use the smallest time-out possible to return almost immediately if
- // no packets are available. (We can't use set_nonblocking() as it's
- // broken on FreeBSD: even when select() indicates that we can read
- // something, we may get nothing if the store buffer hasn't filled up
- // yet.)
- pd = pcap_open_live(props.path.c_str(), SnapLen(), 1, 1, tmp_errbuf);
+ pd = pcap_create(props.path.c_str(), errbuf);
if ( ! pd )
{
- Error(tmp_errbuf);
+ PcapError("pcap_create");
return;
}
- // ### This needs autoconf'ing.
-#ifdef HAVE_PCAP_INT_H
- Info(fmt("pcap bufsize = %d\n", ((struct pcap *) pd)->bufsize));
-#endif
+ if ( pcap_set_snaplen(pd, BifConst::Pcap::snaplen) )
+ {
+ PcapError("pcap_set_snaplen");
+ return;
+ }
+
+ if ( pcap_set_promisc(pd, 1) )
+ {
+ PcapError("pcap_set_promisc");
+ return;
+ }
+
+ // We use the smallest time-out possible to return almost immediately
+ // if no packets are available. (We can't use set_nonblocking() as
+ // it's broken on FreeBSD: even when select() indicates that we can
+ // read something, we may get nothing if the store buffer hasn't
+ // filled up yet.)
+ //
+ // TODO: The comment about FreeBSD is pretty old and may not apply
+ // anymore these days.
+ if ( pcap_set_timeout(pd, 1) )
+ {
+ PcapError("pcap_set_timeout");
+ return;
+ }
+
+ if ( pcap_set_buffer_size(pd, BifConst::Pcap::bufsize * 1024 * 1024) )
+ {
+ PcapError("pcap_set_buffer_size");
+ return;
+ }
+
+ if ( pcap_activate(pd) )
+ {
+ PcapError("pcap_activate");
+ return;
+ }
#ifdef HAVE_LINUX
if ( pcap_setnonblock(pd, 1, tmp_errbuf) < 0 )
{
- PcapError();
+ PcapError("pcap_setnonblock");
return;
}
#endif
+#ifdef HAVE_PCAP_INT_H
+ Info(fmt("pcap bufsize = %d\n", ((struct pcap *) pd)->bufsize));
+#endif
+
props.selectable_fd = pcap_fileno(pd);
SetHdrSize();
@@ -257,12 +291,17 @@ void PcapSource::Statistics(Stats* s)
s->dropped = 0;
}
-void PcapSource::PcapError()
+void PcapSource::PcapError(const char* where)
{
+ string location;
+
+ if ( where )
+ location = fmt(" (%s)", where);
+
if ( pd )
- Error(fmt("pcap_error: %s", pcap_geterr(pd)));
+ Error(fmt("pcap_error: %s%s", pcap_geterr(pd), location.c_str()));
else
- Error("pcap_error: not open");
+ Error(fmt("pcap_error: not open%s", location.c_str()));
Close();
}
diff --git a/src/iosource/pcap/Source.h b/src/iosource/pcap/Source.h
index f627e30afa..f3c193d855 100644
--- a/src/iosource/pcap/Source.h
+++ b/src/iosource/pcap/Source.h
@@ -28,7 +28,7 @@ protected:
private:
void OpenLive();
void OpenOffline();
- void PcapError();
+ void PcapError(const char* where = 0);
void SetHdrSize();
Properties props;
diff --git a/src/iosource/pcap/const.bif b/src/iosource/pcap/const.bif
new file mode 100644
index 0000000000..877dccef74
--- /dev/null
+++ b/src/iosource/pcap/const.bif
@@ -0,0 +1,4 @@
+
+
+const Pcap::snaplen: count;
+const Pcap::bufsize: count;
diff --git a/src/iosource/pcap.bif b/src/iosource/pcap/functions.bif
similarity index 89%
rename from src/iosource/pcap.bif
rename to src/iosource/pcap/functions.bif
index ee4e1e6c06..4465510987 100644
--- a/src/iosource/pcap.bif
+++ b/src/iosource/pcap/functions.bif
@@ -1,4 +1,6 @@
+module Pcap;
+
## Precompiles a PCAP filter and binds it to a given identifier.
##
## id: The PCAP identifier to reference the filter *s* later on.
@@ -19,6 +21,15 @@
## pcap_error
function precompile_pcap_filter%(id: PcapFilterID, s: string%): bool
%{
+ if ( id->AsEnum() >= 100 )
+ {
+ // We use a vector as underlying data structure for fast
+ // lookups and limit the ID space so that that doesn't grow too
+ // large.
+ builtin_error(fmt("PCAP filter ids must remain below 100 (is %" PRId64 ")", id->AsInt()));
+ return new Val(false, TYPE_BOOL);
+ }
+
bool success = true;
const iosource::Manager::PktSrcList& pkt_srcs(iosource_mgr->GetPktSrcs());
@@ -86,7 +97,7 @@ function install_pcap_filter%(id: PcapFilterID%): bool
## install_dst_net_filter
## uninstall_dst_addr_filter
## uninstall_dst_net_filter
-function pcap_error%(%): string
+function error%(%): string
%{
const iosource::Manager::PktSrcList& pkt_srcs(iosource_mgr->GetPktSrcs());
diff --git a/src/logging/Tag.h b/src/logging/Tag.h
index b5b235154a..ae75487664 100644
--- a/src/logging/Tag.h
+++ b/src/logging/Tag.h
@@ -3,7 +3,7 @@
#ifndef LOGGING_TAG_H
#define LOGGING_TAG_H
-#include "config.h"
+#include "bro-config.h"
#include "util.h"
#include "../Tag.h"
#include "plugin/TaggedComponent.h"
diff --git a/src/logging/writers/sqlite/SQLite.cc b/src/logging/writers/sqlite/SQLite.cc
index 090810055d..ce04839337 100644
--- a/src/logging/writers/sqlite/SQLite.cc
+++ b/src/logging/writers/sqlite/SQLite.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/logging/writers/sqlite/SQLite.h b/src/logging/writers/sqlite/SQLite.h
index a820530456..cce87da2ef 100644
--- a/src/logging/writers/sqlite/SQLite.h
+++ b/src/logging/writers/sqlite/SQLite.h
@@ -5,7 +5,7 @@
#ifndef LOGGING_WRITER_SQLITE_H
#define LOGGING_WRITER_SQLITE_H
-#include "config.h"
+#include "bro-config.h"
#include "logging/WriterBackend.h"
#include "threading/formatters/Ascii.h"
diff --git a/src/main.cc b/src/main.cc
index 425269b713..73181c82f2 100644
--- a/src/main.cc
+++ b/src/main.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
@@ -121,7 +121,6 @@ char* command_line_policy = 0;
vector params;
set requested_plugins;
char* proc_status_file = 0;
-int snaplen = 0; // this gets set from the scripting-layer's value
OpaqueType* md5_type = 0;
OpaqueType* sha1_type = 0;
@@ -762,9 +761,6 @@ int main(int argc, char** argv)
// DEBUG_MSG("HMAC key: %s\n", md5_digest_print(shared_hmac_md5_key));
init_hash_function();
- // Must come after hash initialization.
- binpac::init();
-
ERR_load_crypto_strings();
OPENSSL_add_all_algorithms_conf();
SSL_library_init();
@@ -864,6 +860,10 @@ int main(int argc, char** argv)
if ( events_file )
event_player = new EventPlayer(events_file);
+ // Must come after plugin activation (and also after hash
+ // initialization).
+ binpac::init();
+
init_event_handlers();
md5_type = new OpaqueType("md5");
@@ -989,8 +989,6 @@ int main(int argc, char** argv)
}
}
- snaplen = internal_val("snaplen")->AsCount();
-
if ( dns_type != DNS_PRIME )
net_init(interfaces, read_files, writefile, do_watchdog);
diff --git a/src/make_dbg_constants.pl b/src/make_dbg_constants.pl
deleted file mode 100644
index 29efac8050..0000000000
--- a/src/make_dbg_constants.pl
+++ /dev/null
@@ -1,143 +0,0 @@
-# Build the DebugCmdConstants.h and DebugCmdInfoConstants.h files from the
-# DebugCmdInfoConstants.in file.
-#
-# We do this via a script rather than maintaining them directly because
-# the struct is a little complicated, so has to be initialized from code,
-# plus we want to make adding new constants somewhat less painful.
-#
-# The input filename should be supplied as an argument
-#
-# DebugCmds are printed to DebugCmdConstants.h
-# DebugCmdInfos are printed to DebugCmdInfoConstants.h
-#
-# The input format is:
-#
-# cmd: [DebugCmd]
-# names: [space delimited names of cmd]
-# resume: ['true' or 'false': should execution resume after this command?]
-# help: [some help text]
-#
-# Blank lines are skipped.
-# Comments should start with // and should be on a line by themselves.
-
-use strict;
-
-open INPUT, $ARGV[0] or die "Input file $ARGV[0] not found.";
-open DEBUGCMDS, ">DebugCmdConstants.h"
- or die "Unable to open DebugCmdConstants.h";
-open DEBUGCMDINFOS, ">DebugCmdInfoConstants.cc"
- or die "Unable to open DebugCmdInfoConstants.cc";
-
-my $init_tmpl =
-'
- {
- DebugCmdInfo* info;
- @@name_init
- info = new DebugCmdInfo (@@cmd, names, @@num_names, @@resume, "@@help",
- @@repeatable);
- g_DebugCmdInfos.push_back(info);
- }
-';
-
-my $enum_str = "
-//
-// This file was automatically generated from $ARGV[0]
-// DO NOT EDIT.
-//
-enum DebugCmd {
-";
-
-my $init_str = "
-//
-// This file was automatically generated from $ARGV[0]
-// DO NOT EDIT.
-//
-
-#include \"util.h\"
-void init_global_dbg_constants () {
-";
-
-my %dbginfo;
-# { cmd, num_names, \@names, name_init, resume, help, repeatable }
-
-no strict "refs";
-sub OutputRecord {
- $dbginfo{name_init} .= "const char * const names[] = {\n\t";
- $_ = "\"$_\"" foreach @{$dbginfo{names}}; # put quotes around the strings
- my $name_strs = join ",\n\t", @{$dbginfo{names}};
- $dbginfo{name_init} .= "$name_strs\n };\n";
-
- $dbginfo{num_names} = scalar @{$dbginfo{names}};
-
- # substitute into template
- my $init = $init_tmpl;
- $init =~ s/(\@\@(\w+))/defined $dbginfo{$2} ? $dbginfo{$2} : ""/eg;
-
- $init_str .= $init;
-
- $enum_str .= "\t$dbginfo{cmd},\n";
-}
-use strict "refs";
-
-sub InitDbginfo
- {
- my $dbginfo = shift;
- %$dbginfo = ( num_names => 0, names => [], resume => 'false', help => '',
- repeatable => 'false' );
- }
-
-
-InitDbginfo(\%dbginfo);
-
-while () {
- chomp ($_);
- next if $_ =~ /^\s*$/; # skip blank
- next if $_ =~ /^\s*\/\//; # skip comments
-
- $_ =~ /^\s*([a-z]+):\s*(.*)$/ or
- die "Error in debug constant file on line: $_";
-
- if ($1 eq 'cmd')
- {
- my $newcmd = $2;
- if (defined $dbginfo{cmd}) { # output the previous record
- OutputRecord();
- InitDbginfo(\%dbginfo);
- }
-
- $dbginfo{cmd} = $newcmd;
- }
- elsif ($1 eq 'names')
- {
- my @names = split / /, $2;
- $dbginfo{names} = \@names;
- }
- elsif ($1 eq 'resume')
- {
- $dbginfo{resume} = $2;
- }
- elsif ($1 eq 'help')
- {
- $dbginfo{help} = $2;
- $dbginfo{help} =~ s{\"}{\\\"}g; # escape quotation marks
- }
- elsif ($1 eq 'repeatable')
- {
- $dbginfo{repeatable} = $2;
- }
- else {
- die "Unknown command: $_\n";
- }
-}
-
-# output the last record
-OutputRecord();
-
-$init_str .= " \n}\n";
-$enum_str .= " dcLast\n};\n";
-
-print DEBUGCMDS $enum_str;
-close DEBUGCMDS;
-
-print DEBUGCMDINFOS $init_str;
-close DEBUGCMDINFOS;
diff --git a/src/make_dbg_constants.py b/src/make_dbg_constants.py
new file mode 100644
index 0000000000..e18330db87
--- /dev/null
+++ b/src/make_dbg_constants.py
@@ -0,0 +1,114 @@
+# Build the DebugCmdConstants.h and DebugCmdInfoConstants.cc files from the
+# DebugCmdInfoConstants.in file.
+#
+# We do this via a script rather than maintaining them directly because
+# the struct is a little complicated, so has to be initialized from code,
+# plus we want to make adding new constants somewhat less painful.
+#
+# The input filename should be supplied as an argument.
+#
+# DebugCmds are printed to DebugCmdConstants.h
+# DebugCmdInfos are printed to DebugCmdInfoConstants.cc
+#
+# The input format is:
+#
+# cmd: [DebugCmd]
+# names: [space delimited names of cmd]
+# resume: ['true' or 'false': should execution resume after this command?]
+# help: [some help text]
+#
+# Blank lines are skipped.
+# Comments should start with // and should be on a line by themselves.
+
+import sys
+
+inputfile = sys.argv[1]
+
+init_tmpl = '''
+ {
+ DebugCmdInfo* info;
+ %(name_init)s
+ info = new DebugCmdInfo (%(cmd)s, names, %(num_names)s, %(resume)s, "%(help)s",
+ %(repeatable)s);
+ g_DebugCmdInfos.push_back(info);
+ }
+'''
+
+enum_str = '''
+//
+// This file was automatically generated from %s
+// DO NOT EDIT.
+//
+enum DebugCmd {
+''' % inputfile
+
+init_str = '''
+//
+// This file was automatically generated from %s
+// DO NOT EDIT.
+//
+
+#include "util.h"
+void init_global_dbg_constants () {
+''' % inputfile
+
+def outputrecord():
+ global init_str, enum_str
+
+ dbginfo["name_init"] = "const char * const names[] = {\n\t%s\n };\n" % ",\n\t".join(dbginfo["names"])
+
+ dbginfo["num_names"] = len(dbginfo["names"])
+
+ # substitute into template
+ init_str += init_tmpl % dbginfo
+
+ enum_str += "\t%s,\n" % dbginfo["cmd"]
+
+def initdbginfo():
+ return {"cmd": "", "name_init": "", "num_names": 0, "names": [],
+ "resume": "false", "help": "", "repeatable": "false"}
+
+dbginfo = initdbginfo()
+
+inputf = open(inputfile, "r")
+for line in inputf:
+ line = line.strip()
+ if not line or line.startswith("//"): # skip empty lines and comments
+ continue
+
+ fields = line.split(":", 1)
+ if len(fields) != 2:
+ raise RuntimeError("Error in debug constant file on line: %s" % line)
+
+ f1, f2 = fields
+ f2 = f2.strip()
+
+ if f1 == "cmd":
+ if dbginfo[f1]: # output the previous record
+ outputrecord()
+ dbginfo = initdbginfo()
+
+ dbginfo[f1] = f2
+ elif f1 == "names":
+ # put quotes around the strings
+ dbginfo[f1] = [ '"%s"' % n for n in f2.split() ]
+ elif f1 == "help":
+ dbginfo[f1] = f2.replace('"', '\\"') # escape quotation marks
+ elif f1 in ("resume", "repeatable"):
+ dbginfo[f1] = f2
+ else:
+ raise RuntimeError("Unknown command: %s" % line)
+
+# output the last record
+outputrecord()
+
+init_str += " \n}\n"
+enum_str += " dcLast\n};\n"
+
+debugcmds = open("DebugCmdConstants.h", "w")
+debugcmds.write(enum_str)
+debugcmds.close()
+
+debugcmdinfos = open("DebugCmdInfoConstants.cc", "w")
+debugcmdinfos.write(init_str)
+debugcmdinfos.close()
diff --git a/src/nb_dns.c b/src/nb_dns.c
index 33a00837e4..1e5d427924 100644
--- a/src/nb_dns.c
+++ b/src/nb_dns.c
@@ -11,7 +11,7 @@
* crack reply buffers is private.
*/
-#include "config.h" /* must appear before first ifdef */
+#include "bro-config.h" /* must appear before first ifdef */
#include
#include
diff --git a/src/net_util.cc b/src/net_util.cc
index aa88903a8a..95be1f8b0c 100644
--- a/src/net_util.cc
+++ b/src/net_util.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/net_util.h b/src/net_util.h
index d68a7110ce..ebdd0cbb88 100644
--- a/src/net_util.h
+++ b/src/net_util.h
@@ -3,7 +3,7 @@
#ifndef netutil_h
#define netutil_h
-#include "config.h"
+#include "bro-config.h"
// Define first.
typedef enum {
diff --git a/src/plugin/Manager.cc b/src/plugin/Manager.cc
index 8e58c1296b..a449fb34e4 100644
--- a/src/plugin/Manager.cc
+++ b/src/plugin/Manager.cc
@@ -182,9 +182,17 @@ bool Manager::ActivateDynamicPluginInternal(const std::string& name, bool ok_if_
add_to_bro_path(scripts);
}
- // Load {bif,scripts}/__load__.bro automatically.
+ // First load {scripts}/__preload__.bro automatically.
+ string init = dir + "scripts/__preload__.bro";
- string init = dir + "lib/bif/__load__.bro";
+ if ( is_file(init) )
+ {
+ DBG_LOG(DBG_PLUGINS, " Loading %s", init.c_str());
+ scripts_to_load.push_back(init);
+ }
+
+ // Load {bif,scripts}/__load__.bro automatically.
+ init = dir + "lib/bif/__load__.bro";
if ( is_file(init) )
{
@@ -660,6 +668,33 @@ void Manager::HookDrainEvents() const
}
+void Manager::HookSetupAnalyzerTree(Connection *conn) const
+ {
+ HookArgumentList args;
+
+ if ( HavePluginForHook(META_HOOK_PRE) )
+ {
+ args.push_back(conn);
+ MetaHookPre(HOOK_SETUP_ANALYZER_TREE, args);
+ }
+
+ hook_list *l = hooks[HOOK_SETUP_ANALYZER_TREE];
+
+ if ( l )
+ {
+ for (hook_list::iterator i = l->begin() ; i != l->end(); ++i)
+ {
+ Plugin *p = (*i).second;
+ p->HookSetupAnalyzerTree(conn);
+ }
+ }
+
+ if ( HavePluginForHook(META_HOOK_POST) )
+ {
+ MetaHookPost(HOOK_SETUP_ANALYZER_TREE, args, HookArgument());
+ }
+ }
+
void Manager::HookUpdateNetworkTime(double network_time) const
{
HookArgumentList args;
diff --git a/src/plugin/Manager.h b/src/plugin/Manager.h
index db812b6a8c..04c632d61a 100644
--- a/src/plugin/Manager.h
+++ b/src/plugin/Manager.h
@@ -264,6 +264,15 @@ public:
*/
void HookUpdateNetworkTime(double network_time) const;
+ /**
+ * Hook that executes when a connection's initial analyzer tree
+ * has been fully set up. The hook can manipulate the tree at this time,
+ * for example by adding further analyzers.
+ *
+ * @param conn The connection.
+ */
+ void HookSetupAnalyzerTree(Connection *conn) const;
+
/**
* Hook that informs plugins that the event queue is being drained.
*/
diff --git a/src/plugin/Plugin.cc b/src/plugin/Plugin.cc
index f05378eb84..190ae02cde 100644
--- a/src/plugin/Plugin.cc
+++ b/src/plugin/Plugin.cc
@@ -23,6 +23,7 @@ const char* plugin::hook_name(HookType h)
"DrainEvents",
"UpdateNetworkTime",
"BroObjDtor",
+ "SetupAnalyzerTree",
// MetaHooks
"MetaHookPre",
"MetaHookPost",
@@ -310,6 +311,10 @@ void Plugin::HookUpdateNetworkTime(double network_time)
{
}
+void Plugin::HookSetupAnalyzerTree(Connection *conn)
+ {
+ }
+
void Plugin::HookBroObjDtor(void* obj)
{
}
diff --git a/src/plugin/Plugin.h b/src/plugin/Plugin.h
index 3562891e84..e23173f726 100644
--- a/src/plugin/Plugin.h
+++ b/src/plugin/Plugin.h
@@ -7,14 +7,14 @@
#include
#include
-#include "config.h"
+#include "bro-config.h"
#include "analyzer/Component.h"
#include "file_analysis/Component.h"
#include "iosource/Component.h"
// We allow to override this externally for testing purposes.
#ifndef BRO_PLUGIN_API_VERSION
-#define BRO_PLUGIN_API_VERSION 3
+#define BRO_PLUGIN_API_VERSION 4
#endif
class ODesc;
@@ -39,6 +39,7 @@ enum HookType {
HOOK_DRAIN_EVENTS, //< Activates Plugin::HookDrainEvents()
HOOK_UPDATE_NETWORK_TIME, //< Activates Plugin::HookUpdateNetworkTime.
HOOK_BRO_OBJ_DTOR, //< Activates Plugin::HookBroObjDtor.
+ HOOK_SETUP_ANALYZER_TREE, //< Activates Plugin::HookAddToAnalyzerTree
// Meta hooks.
META_HOOK_PRE, //< Activates Plugin::MetaHookPre().
@@ -636,6 +637,8 @@ protected:
*/
virtual void HookUpdateNetworkTime(double network_time);
+ virtual void HookSetupAnalyzerTree(Connection *conn);
+
/**
* Hook for destruction of objects registered with
* RequestBroObjDtor(). When Bro's reference counting triggers the
diff --git a/src/probabilistic/BloomFilter.h b/src/probabilistic/BloomFilter.h
index 53b66c377e..7fc32a9442 100644
--- a/src/probabilistic/BloomFilter.h
+++ b/src/probabilistic/BloomFilter.h
@@ -158,11 +158,11 @@ public:
static size_t K(size_t cells, size_t capacity);
// Overridden from BloomFilter.
- virtual bool Empty() const;
- virtual void Clear();
- virtual bool Merge(const BloomFilter* other);
- virtual BasicBloomFilter* Clone() const;
- virtual string InternalState() const;
+ virtual bool Empty() const override;
+ virtual void Clear() override;
+ virtual bool Merge(const BloomFilter* other) override;
+ virtual BasicBloomFilter* Clone() const override;
+ virtual string InternalState() const override;
protected:
DECLARE_SERIAL(BasicBloomFilter);
@@ -173,8 +173,8 @@ protected:
BasicBloomFilter();
// Overridden from BloomFilter.
- virtual void Add(const HashKey* key);
- virtual size_t Count(const HashKey* key) const;
+ virtual void Add(const HashKey* key) override;
+ virtual size_t Count(const HashKey* key) const override;
private:
BitVector* bits;
@@ -203,11 +203,11 @@ public:
~CountingBloomFilter();
// Overridden from BloomFilter.
- virtual bool Empty() const;
- virtual void Clear();
- virtual bool Merge(const BloomFilter* other);
- virtual CountingBloomFilter* Clone() const;
- virtual string InternalState() const;
+ virtual bool Empty() const override;
+ virtual void Clear() override;
+ virtual bool Merge(const BloomFilter* other) override;
+ virtual CountingBloomFilter* Clone() const override;
+ virtual string InternalState() const override;
protected:
DECLARE_SERIAL(CountingBloomFilter);
@@ -218,8 +218,8 @@ protected:
CountingBloomFilter();
// Overridden from BloomFilter.
- virtual void Add(const HashKey* key);
- virtual size_t Count(const HashKey* key) const;
+ virtual void Add(const HashKey* key) override;
+ virtual size_t Count(const HashKey* key) const override;
private:
CounterVector* cells;
diff --git a/src/probabilistic/Hasher.h b/src/probabilistic/Hasher.h
index 6128f3e04e..6ce13c6302 100644
--- a/src/probabilistic/Hasher.h
+++ b/src/probabilistic/Hasher.h
@@ -191,9 +191,9 @@ public:
DefaultHasher(size_t k, size_t seed);
// Overridden from Hasher.
- virtual digest_vector Hash(const void* x, size_t n) const /* final */;
- virtual DefaultHasher* Clone() const /* final */;
- virtual bool Equals(const Hasher* other) const /* final */;
+ virtual digest_vector Hash(const void* x, size_t n) const final;
+ virtual DefaultHasher* Clone() const final;
+ virtual bool Equals(const Hasher* other) const final;
DECLARE_SERIAL(DefaultHasher);
@@ -219,9 +219,9 @@ public:
DoubleHasher(size_t k, size_t seed);
// Overridden from Hasher.
- virtual digest_vector Hash(const void* x, size_t n) const /* final */;
- virtual DoubleHasher* Clone() const /* final */;
- virtual bool Equals(const Hasher* other) const /* final */;
+ virtual digest_vector Hash(const void* x, size_t n) const final;
+ virtual DoubleHasher* Clone() const final;
+ virtual bool Equals(const Hasher* other) const final;
DECLARE_SERIAL(DoubleHasher);
diff --git a/src/rule-parse.y b/src/rule-parse.y
index b0e00d10ed..32ada02cb3 100644
--- a/src/rule-parse.y
+++ b/src/rule-parse.y
@@ -2,7 +2,7 @@
#include
#include
#include
-#include "config.h"
+#include "bro-config.h"
#include "RuleMatcher.h"
#include "Reporter.h"
#include "IPAddr.h"
diff --git a/src/setsignal.c b/src/setsignal.c
index b49f0784e9..6344820398 100644
--- a/src/setsignal.c
+++ b/src/setsignal.c
@@ -2,7 +2,7 @@
* See the file "COPYING" in the main distribution directory for copyright.
*/
-#include "config.h" /* must appear before first ifdef */
+#include "bro-config.h" /* must appear before first ifdef */
#include
diff --git a/src/strings.bif b/src/strings.bif
index 80b60a57d0..ebee7d9cf7 100644
--- a/src/strings.bif
+++ b/src/strings.bif
@@ -216,7 +216,13 @@ function join_string_vec%(vec: string_vec, sep: string%): string
if ( i > 0 )
d.Add(sep->CheckString(), 0);
- v->Lookup(i)->Describe(&d);
+ Val* e = v->Lookup(i);
+
+ // If the element is empty, skip it.
+ if ( ! e )
+ continue;
+
+ e->Describe(&d);
}
BroString* s = new BroString(1, d.TakeBytes(), d.Len());
diff --git a/src/strsep.c b/src/strsep.c
index 15a750885d..8540ac3688 100644
--- a/src/strsep.c
+++ b/src/strsep.c
@@ -31,7 +31,7 @@
* SUCH DAMAGE.
*/
-#include "config.h"
+#include "bro-config.h"
#ifndef HAVE_STRSEP
diff --git a/src/threading/BasicThread.cc b/src/threading/BasicThread.cc
index ffee21bc16..86d7d7b560 100644
--- a/src/threading/BasicThread.cc
+++ b/src/threading/BasicThread.cc
@@ -2,7 +2,7 @@
#include
#include
-#include "config.h"
+#include "bro-config.h"
#include "BasicThread.h"
#include "Manager.h"
diff --git a/src/threading/Formatter.cc b/src/threading/Formatter.cc
index f003f37d29..3f366de90a 100644
--- a/src/threading/Formatter.cc
+++ b/src/threading/Formatter.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/threading/formatters/Ascii.cc b/src/threading/formatters/Ascii.cc
index 6c114ff3fd..07ec05ca8b 100644
--- a/src/threading/formatters/Ascii.cc
+++ b/src/threading/formatters/Ascii.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include
#include
diff --git a/src/threading/formatters/JSON.cc b/src/threading/formatters/JSON.cc
index e1a5713461..3558baee5c 100644
--- a/src/threading/formatters/JSON.cc
+++ b/src/threading/formatters/JSON.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#ifndef __STDC_LIMIT_MACROS
#define __STDC_LIMIT_MACROS
@@ -35,7 +35,12 @@ bool JSON::Describe(ODesc* desc, int num_fields, const Field* const * fields,
const u_char* bytes = desc->Bytes();
int len = desc->Len();
- if ( i > 0 && len > 0 && bytes[len-1] != ',' && vals[i]->present )
+ if ( i > 0 &&
+ len > 0 &&
+ bytes[len-1] != ',' &&
+ bytes[len-1] != '{' &&
+ bytes[len-1] != '[' &&
+ vals[i]->present )
desc->AddRaw(",");
if ( ! Describe(desc, vals[i], fields[i]->name) )
diff --git a/src/util.cc b/src/util.cc
index a76ba84de3..6a03859a3c 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -1,6 +1,6 @@
// See the file "COPYING" in the main distribution directory for copyright.
-#include "config.h"
+#include "bro-config.h"
#include "util-config.h"
#ifdef TIME_WITH_SYS_TIME
diff --git a/src/util.h b/src/util.h
index f65e0fb7d0..901bb44d1c 100644
--- a/src/util.h
+++ b/src/util.h
@@ -23,7 +23,7 @@
#include
#include
#include
-#include "config.h"
+#include "bro-config.h"
#if __STDC__
#define myattribute __attribute__
diff --git a/testing/btest/Baseline/bifs.decode_base64/out b/testing/btest/Baseline/bifs.decode_base64/out
index af0d32fbb8..aa265d2148 100644
--- a/testing/btest/Baseline/bifs.decode_base64/out
+++ b/testing/btest/Baseline/bifs.decode_base64/out
@@ -4,3 +4,11 @@ bro
bro
bro
bro
+bro
+bro
+bro
+bro
+bro
+bro
+bro
+bro
diff --git a/testing/btest/Baseline/bifs.decode_base64_conn/weird.log b/testing/btest/Baseline/bifs.decode_base64_conn/weird.log
new file mode 100644
index 0000000000..e263a05ccc
--- /dev/null
+++ b/testing/btest/Baseline/bifs.decode_base64_conn/weird.log
@@ -0,0 +1,12 @@
+#separator \x09
+#set_separator ,
+#empty_field (empty)
+#unset_field -
+#path weird
+#open 2015-08-31-03-09-20
+#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
+#types time string addr port addr port string string bool string
+1254722767.875996 CjhGID4nQcgTWjvg4c 10.10.1.4 1470 74.53.140.153 25 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
+1437831787.861602 CPbrpk1qSsw6ESzHV4 192.168.133.100 49648 192.168.133.102 25 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
+1437831799.610433 C7XEbhP654jzLoe3a 192.168.133.100 49655 17.167.150.73 443 base64_illegal_encoding incomplete base64 group, padding with 12 bits of 0 F bro
+#close 2015-08-31-03-09-20
diff --git a/testing/btest/Baseline/bifs.encode_base64/out b/testing/btest/Baseline/bifs.encode_base64/out
index 84c2c98264..3008115853 100644
--- a/testing/btest/Baseline/bifs.encode_base64/out
+++ b/testing/btest/Baseline/bifs.encode_base64/out
@@ -1,5 +1,9 @@
YnJv
YnJv
+YnJv
+}n-v
+YnJv
+YnJv
}n-v
cGFkZGluZw==
cGFkZGluZzE=
diff --git a/testing/btest/Baseline/bifs.join_string/out b/testing/btest/Baseline/bifs.join_string/out
index f1640a57ee..e916fc304a 100644
--- a/testing/btest/Baseline/bifs.join_string/out
+++ b/testing/btest/Baseline/bifs.join_string/out
@@ -4,3 +4,4 @@ mytest
this__is__another__test
thisisanothertest
Test
+...hi..there
diff --git a/testing/btest/Baseline/core.reassembly/output b/testing/btest/Baseline/core.reassembly/output
index 79922b43c4..5e0ef35929 100644
--- a/testing/btest/Baseline/core.reassembly/output
+++ b/testing/btest/Baseline/core.reassembly/output
@@ -23,10 +23,10 @@ net_weird, truncated_IP
net_weird, truncated_IP
net_weird, truncated_IP
net_weird, truncated_IP
-rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliidlhd
-rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], dgphrodofqhq, orgmmpelofil
-rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], lenhfdqhqfgs, dfpqssidkpdg
-rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliislrr
-rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], iokgedlsdkjkiefgmeqkfjoh, ggdeolssksemrhedoledddml
+rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliidlhd, A
+rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], dgphrodofqhq, orgmmpelofil, A
+rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], lenhfdqhqfgs, dfpqssidkpdg, A
+rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfOOOOOOOOOOOOOOOOOOOOOOOOOOOO, nlkmlpjfjjnoomfnqmdqgrdsgpefslhjrdjghsshrmosrkosidknnieiggpmnggelfhlkflfqojpjrsmeqghklmjlkdskjollmensjiqosemknoehellhlsspjfjpddfgqkemghskqosrksmkpsdomfoghllfokilshsisgpjhjoosidirlnmespjhdogdidoemejrnjjrookfrmiqllllqhlqfgolfqssfjrhrjhgfkpdnigiilrmnespjspeqjfedjhrkisjdhoofqdfeqnmihrelmildkngirkqorjslhmglripdojfedjjngjnpikoliqhdipgpshenekqiphmrsqmemghklodqnqoeggfkdqngrfollhjmddjreeghdqflohgrhqhelqsmdghgihpifpnikrddpmdfejhrhgfdfdlepmmhlhrnrslepqgmkopmdfogpoljeepqoemisfeksdeddiplnkfjddjioqhojlnmlirehidipdhqlddssssgpgikieeldsmfrkidpldsngdkidkoshkrofnonrrehghlmgmqshkedgpkpgjjkoneigsfjdlgjsngepfkndqoefqmsssrgegspromqepdpdeglmmegjljlmljeeorhhfmrohjeregpfshqjsqkekrihjdpfdjflgspepqjrqfemsjffmjfkhejdkrokmgdrhojgmgjpldjeiphroeheipolfmshoglkfnllfnhlflhlpddjflekhiqilefjpfqepdrrdokkjiekmelkhdpjlqjdlnfjemqdrksirdnjlrhrdijgqjhdqlidpfdisgrmnlfnsdlishlpfkshhglpdiqhpgmhpjdrpednjljfsqknsiqpfeqhlphgqdphflglpmqfkkhdjeodkelinkfpmfedidhphldmqjqggrljlhriehqqemeimkjhoqnsrdgengmgjokpeiijgrseppeoiflngggomdfjkndpqedhgnkiqlodkpjfkqoifidjmrdhhmglledkomllhpehdfjfdspmklkjdnhkdgpgqephfdfdrfplmepoegsekmrnikknelnprdpslmfkhghhooknieksjjhdeelidikndedijqqhfmphdondndpehmfoqelqigdpgioeljhedhfoeqlinriemqjigerkphgepqmiiidqlhriqioimpglonlsgomeloipndiihqqfiekkeriokrsjlmsjqiehqsrqkhdjlddjrrllirqkidqiggdrjpjirssgqepnqmhigfsqlekiqdddllnsjmroiofkieqnghddpjnhdjkfloilheljofddrkherkrieeoijrlfghiikmhpfdhekdjloejlmpperkgrhomedpfqkrodjdmrqfpiodgphidfliislrr, A
+rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], iokgedlsdkjkiefgmeqkfjoh, ggdeolssksemrhedoledddml, A
net_weird, truncated_IP
-rexmit_inconsistency, [orig_h=63.193.213.194, orig_p=2564/tcp, resp_h=128.3.97.175, resp_p=80/tcp], OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO HTTP/1.1\x0d\x0aHost: 127.0.0.1\x0d\x0aContent-Type: text/xml\x0d\x0aContent-length: 1\x0d\x0a\x0d\x0aO\x0d\x0a\x0d\x0a - - - (empty) - - - Fp32SIJztq0Szn5Qc text/plain - -
-1210953061.585996 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - - - FNFYdH11h5iQcoD3a2 text/html
-1210953073.381474 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - - - FHD5nv1iSVFZVM0aH7 text/html
-1210953074.674817 Cab0vO1xNYSS2hJkle 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - - - FS7lUf2cJFAVBCu6w6 text/html
-#close 2015-03-14-01-46-26
+#open 2016-01-15-18-40-16
+#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
+#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
+1210953057.917183 C7XEbhP654jzLoe3a 192.168.2.16 1578 75.126.203.78 80 1 POST download913.avast.com /cgi-bin/iavs4stats.cgi - 1.1 Syncer/4.80 (av_pro-1169;f) 589 0 204 - - - (empty) - - - Fp32SIJztq0Szn5Qc text/plain - -
+1210953061.585996 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - - - FNFYdH11h5iQcoD3a2 text/html
+1210953073.381474 CwSkQu4eWZCH7OONC1 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - - - FHD5nv1iSVFZVM0aH7 text/html
+1210953074.674817 Cab0vO1xNYSS2hJkle 192.168.2.16 1580 67.228.110.120 80 1 GET www.wireshark.org / http://ipv6.google.com/search?hl=en&q=Wireshark+%21&btnG=Google+Search 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 11845 200 OK - - - (empty) - - - - - FS7lUf2cJFAVBCu6w6 text/html
+#close 2016-01-15-18-40-16
diff --git a/testing/btest/Baseline/core.tunnels.teredo/tunnel.log b/testing/btest/Baseline/core.tunnels.teredo/tunnel.log
index e611eeb679..57ec542b6c 100644
--- a/testing/btest/Baseline/core.tunnels.teredo/tunnel.log
+++ b/testing/btest/Baseline/core.tunnels.teredo/tunnel.log
@@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path tunnel
-#open 2013-08-26-19-02-19
+#open 2016-01-15-18-40-16
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
#types time string addr port addr port enum enum
1210953052.202579 CsRx2w45OKnoww6xl4 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
@@ -12,4 +12,4 @@
1210953076.058333 CsRx2w45OKnoww6xl4 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
1210953076.058333 C3SfNE4BWaU4aSuwkc 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
1210953076.058333 CPbrpk1qSsw6ESzHV4 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
-#close 2013-08-26-19-02-19
+#close 2016-01-15-18-40-16
diff --git a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/conn.log b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/conn.log
index 91bcfdf170..41177e178d 100644
--- a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/conn.log
+++ b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/conn.log
@@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path conn
-#open 2015-02-23-21-33-21
+#open 2016-01-15-18-40-17
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1340127577.354166 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 tcp http 0.052829 1675 10467 S1 - - 0 ShADad 10 2279 12 11191 CRJuHdVW0XPVINV8a
@@ -13,4 +13,4 @@
1340127577.339015 CsRx2w45OKnoww6xl4 fe80::8000:f227:bec8:61af 134 fe80::8000:ffff:ffff:fffd 133 icmp - - - - OTH - - 0 - 1 88 0 0 CCvvfg3TEfuqmmG4bh
1340127577.343969 CPbrpk1qSsw6ESzHV4 2001:0:4137:9e50:8000:f12a:b9c8:2815 128 2001:4860:0:2001::68 129 icmp - 0.007778 4 4 OTH - - 0 - 1 52 1 52 CXWv6p3arKYeMETxOg,CRJuHdVW0XPVINV8a
1340127577.336558 CjhGID4nQcgTWjvg4c fe80::8000:ffff:ffff:fffd 133 ff02::2 134 icmp - - - - OTH - - 0 - 1 64 0 0 CXWv6p3arKYeMETxOg
-#close 2015-02-23-21-33-21
+#close 2016-01-15-18-40-17
diff --git a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/http.log b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/http.log
index eff4b8ff36..00a710a5b0 100644
--- a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/http.log
+++ b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/http.log
@@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path http
-#open 2014-04-01-22-57-27
-#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
-#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
-1340127577.361683 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - - - FWSTWv4EZLVlc2Zywi text/html
-1340127577.379360 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - - - FGKV3B3jz083xhGO13 text/html
-#close 2014-04-01-22-57-27
+#open 2016-01-15-18-40-17
+#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
+#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
+1340127577.361683 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 1 GET ipv6.google.com / - 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 6640 200 OK - - - (empty) - - - - - FWSTWv4EZLVlc2Zywi text/html
+1340127577.379360 C6pKV8GSxOnSLghOa 2001:0:4137:9e50:8000:f12a:b9c8:2815 1286 2001:4860:0:2001::68 80 2 GET ipv6.google.com /search?hl=en&q=Wireshark+!&btnG=Google+Search http://ipv6.google.com/ 1.1 Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9b5) Gecko/2008032620 Firefox/3.0b5 0 25119 200 OK - - - (empty) - - - - - FGKV3B3jz083xhGO13 text/html
+#close 2016-01-15-18-40-17
diff --git a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/tunnel.log b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/tunnel.log
index f988a996f8..2c041b6c59 100644
--- a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/tunnel.log
+++ b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/tunnel.log
@@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path tunnel
-#open 2013-08-26-19-02-20
+#open 2016-01-15-18-40-17
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
#types time string addr port addr port enum enum
1340127577.336558 CXWv6p3arKYeMETxOg 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::DISCOVER
@@ -12,4 +12,4 @@
1340127577.406995 CXWv6p3arKYeMETxOg 192.168.2.16 3797 65.55.158.80 3544 Tunnel::TEREDO Tunnel::CLOSE
1340127577.406995 CRJuHdVW0XPVINV8a 192.168.2.16 3797 83.170.1.38 32900 Tunnel::TEREDO Tunnel::CLOSE
1340127577.406995 CCvvfg3TEfuqmmG4bh 192.168.2.16 3797 65.55.158.81 3544 Tunnel::TEREDO Tunnel::CLOSE
-#close 2013-08-26-19-02-20
+#close 2016-01-15-18-40-17
diff --git a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/weird.log b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/weird.log
index bec4732a8f..81c7bb0cf0 100644
--- a/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/weird.log
+++ b/testing/btest/Baseline/core.tunnels.teredo_bubble_with_payload/weird.log
@@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path weird
-#open 2013-08-26-19-46-43
+#open 2016-01-15-18-40-17
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer
#types time string addr port addr port string string bool string
1340127577.341510 CRJuHdVW0XPVINV8a 192.168.2.16 3797 83.170.1.38 32900 Teredo_bubble_with_payload - F bro
1340127577.346849 CXWv6p3arKYeMETxOg 192.168.2.16 3797 65.55.158.80 3544 Teredo_bubble_with_payload - F bro
-#close 2013-08-26-19-46-43
+#close 2016-01-15-18-40-17
diff --git a/testing/btest/Baseline/core.x509-generalizedtime/output b/testing/btest/Baseline/core.x509-generalizedtime/output
new file mode 100644
index 0000000000..349551efe5
--- /dev/null
+++ b/testing/btest/Baseline/core.x509-generalizedtime/output
@@ -0,0 +1,16 @@
+----- x509_certificate ----
+serial: 03E8
+not_valid_before: 2015-09-01-13:33:37.000000000 (epoch: 1441114417.0)
+not_valid_after : 2025-09-01-13:33:37.000000000 (epoch: 1756733617.0)
+----- x509_certificate ----
+serial: 99FAA8037A4EB2FAEF84EB5E55D5B8C8
+not_valid_before: 2011-05-04-00:00:00.000000000 (epoch: 1304467200.0)
+not_valid_after : 2016-07-04-23:59:59.000000000 (epoch: 1467676799.0)
+----- x509_certificate ----
+serial: 1690C329B6780607511F05B0344846CB
+not_valid_before: 2010-04-16-00:00:00.000000000 (epoch: 1271376000.0)
+not_valid_after : 2020-05-30-10:48:38.000000000 (epoch: 1590835718.0)
+----- x509_certificate ----
+serial: 01
+not_valid_before: 2000-05-30-10:48:38.000000000 (epoch: 959683718.0)
+not_valid_after : 2020-05-30-10:48:38.000000000 (epoch: 1590835718.0)
diff --git a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
index 6d9df86baa..4d1f2037a4 100644
--- a/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path loaded_scripts
-#open 2015-04-21-22-29-19
+#open 2015-08-31-04-50-43
#fields name
#types string
scripts/base/init-bare.bro
@@ -46,7 +46,7 @@ scripts/base/init-bare.bro
scripts/base/frameworks/files/magic/__load__.bro
build/scripts/base/bif/__load__.bro
build/scripts/base/bif/broxygen.bif.bro
- build/scripts/base/bif/pcap.bif.bro
+ build/scripts/base/bif/functions.bif.bro
build/scripts/base/bif/bloom-filter.bif.bro
build/scripts/base/bif/cardinality-counter.bif.bro
build/scripts/base/bif/top-k.bif.bro
@@ -128,4 +128,4 @@ scripts/base/init-bare.bro
build/scripts/base/bif/plugins/Bro_SQLiteWriter.sqlite.bif.bro
scripts/policy/misc/loaded-scripts.bro
scripts/base/utils/paths.bro
-#close 2015-04-21-22-29-19
+#close 2015-08-31-04-50-43
diff --git a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
index 5e2f3b9f4f..6a240c88ad 100644
--- a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
#empty_field (empty)
#unset_field -
#path loaded_scripts
-#open 2015-04-21-22-29-27
+#open 2015-08-31-05-07-15
#fields name
#types string
scripts/base/init-bare.bro
@@ -46,7 +46,7 @@ scripts/base/init-bare.bro
scripts/base/frameworks/files/magic/__load__.bro
build/scripts/base/bif/__load__.bro
build/scripts/base/bif/broxygen.bif.bro
- build/scripts/base/bif/pcap.bif.bro
+ build/scripts/base/bif/functions.bif.bro
build/scripts/base/bif/bloom-filter.bif.bro
build/scripts/base/bif/cardinality-counter.bif.bro
build/scripts/base/bif/top-k.bif.bro
@@ -273,4 +273,4 @@ scripts/base/init-default.bro
scripts/base/misc/find-checksum-offloading.bro
scripts/base/misc/find-filtered-trace.bro
scripts/policy/misc/loaded-scripts.bro
-#close 2015-04-21-22-29-27
+#close 2015-08-31-05-07-15
diff --git a/testing/btest/Baseline/doc.sphinx.connection-record-02/btest-doc.sphinx.connection-record-02#1 b/testing/btest/Baseline/doc.sphinx.connection-record-02/btest-doc.sphinx.connection-record-02#1
index 461c3411d1..398fe5db94 100644
--- a/testing/btest/Baseline/doc.sphinx.connection-record-02/btest-doc.sphinx.connection-record-02#1
+++ b/testing/btest/Baseline/doc.sphinx.connection-record-02/btest-doc.sphinx.connection-record-02#1
@@ -9,7 +9,7 @@
}, history=ShADadFf, uid=CXWv6p3arKYeMETxOg, tunnel=, vlan=, inner_vlan=, conn=[ts=1362692526.869344, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents={
- }], extract_orig=F, extract_resp=F, thresholds=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={
+ }], extract_orig=F, extract_resp=F, thresholds=, http=[ts=1362692526.939527, uid=CXWv6p3arKYeMETxOg, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=/download/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, filename=, tags={
}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_mime_types=, resp_fuids=[FakNcS1Jfe01uljb3], resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={
diff --git a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_connecting-connector_bro/output b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_connecting-connector_bro/output
index 0953d88a3e..042b8999f3 100644
--- a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_connecting-connector_bro/output
+++ b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_connecting-connector_bro/output
@@ -2,7 +2,6 @@
connecting-connector.bro
-
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef BrokerComm::endpoint_name = "connector";
diff --git a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_connecting-listener_bro/output b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_connecting-listener_bro/output
index 2879beb396..33e3df2330 100644
--- a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_connecting-listener_bro/output
+++ b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_connecting-listener_bro/output
@@ -2,7 +2,6 @@
connecting-listener.bro
-
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef BrokerComm::endpoint_name = "listener";
diff --git a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_events-listener_bro/output b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_events-listener_bro/output
index 59e697601b..9f004692cb 100644
--- a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_events-listener_bro/output
+++ b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_events-listener_bro/output
@@ -2,7 +2,6 @@
events-listener.bro
-
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef BrokerComm::endpoint_name = "listener";
diff --git a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_printing-listener_bro/output b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_printing-listener_bro/output
index 9cb48a0528..fb416612ab 100644
--- a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_printing-listener_bro/output
+++ b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_printing-listener_bro/output
@@ -2,7 +2,6 @@
printing-listener.bro
-
const broker_port: port = 9999/tcp &redef;
redef exit_only_after_terminate = T;
redef BrokerComm::endpoint_name = "listener";
diff --git a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_testlog_bro/output b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_testlog_bro/output
index da2261ebc4..c87fc3cd6f 100644
--- a/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_testlog_bro/output
+++ b/testing/btest/Baseline/doc.sphinx.include-doc_frameworks_broker_testlog_bro/output
@@ -2,7 +2,6 @@
testlog.bro
-
module Test;
export {
diff --git a/testing/btest/Baseline/doc.sphinx.include-doc_scripting_data_struct_record_01_bro/output b/testing/btest/Baseline/doc.sphinx.include-doc_scripting_data_struct_record_01_bro/output
index ea390412f6..e67783fdeb 100644
--- a/testing/btest/Baseline/doc.sphinx.include-doc_scripting_data_struct_record_01_bro/output
+++ b/testing/btest/Baseline/doc.sphinx.include-doc_scripting_data_struct_record_01_bro/output
@@ -8,7 +8,7 @@ type Service: record {
rfc: count;
};
-function print_service(serv: Service): string
+function print_service(serv: Service)
{
print fmt("Service: %s(RFC%d)",serv$name, serv$rfc);
diff --git a/testing/btest/Baseline/doc.sphinx.include-doc_scripting_data_struct_record_02_bro/output b/testing/btest/Baseline/doc.sphinx.include-doc_scripting_data_struct_record_02_bro/output
index 143e6c5672..04da3522f2 100644
--- a/testing/btest/Baseline/doc.sphinx.include-doc_scripting_data_struct_record_02_bro/output
+++ b/testing/btest/Baseline/doc.sphinx.include-doc_scripting_data_struct_record_02_bro/output
@@ -13,7 +13,7 @@ type System: record {
services: set[Service];
};
-function print_service(serv: Service): string
+function print_service(serv: Service)
{
print fmt(" Service: %s(RFC%d)",serv$name, serv$rfc);
@@ -21,7 +21,7 @@ function print_service(serv: Service): string
print fmt(" port: %s", p);
}
-function print_system(sys: System): string
+function print_system(sys: System)
{
print fmt("System: %s", sys$name);
diff --git a/testing/btest/Baseline/istate.events-ssl/receiver.http.log b/testing/btest/Baseline/istate.events-ssl/receiver.http.log
index b19aa4e229..ef4b7d5e14 100644
--- a/testing/btest/Baseline/istate.events-ssl/receiver.http.log
+++ b/testing/btest/Baseline/istate.events-ssl/receiver.http.log
@@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path http
-#open 2014-04-01-23-00-17
-#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
-#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
-1396393217.023534 CjhGID4nQcgTWjvg4c 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - - - - -
-#close 2014-04-01-23-00-19
+#open 2016-01-15-18-40-35
+#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
+#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
+1452883233.962989 CjhGID4nQcgTWjvg4c 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - 1.1 Wget/1.10 0 9130 200 OK - - - (empty) - - - - - - -
+#close 2016-01-15-18-40-36
diff --git a/testing/btest/Baseline/istate.events-ssl/sender.http.log b/testing/btest/Baseline/istate.events-ssl/sender.http.log
index b19aa4e229..ef4b7d5e14 100644
--- a/testing/btest/Baseline/istate.events-ssl/sender.http.log
+++ b/testing/btest/Baseline/istate.events-ssl/sender.http.log
@@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path http
-#open 2014-04-01-23-00-17
-#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
-#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
-1396393217.023534 CjhGID4nQcgTWjvg4c 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - - - - -
-#close 2014-04-01-23-00-19
+#open 2016-01-15-18-40-35
+#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
+#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
+1452883233.962989 CjhGID4nQcgTWjvg4c 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - 1.1 Wget/1.10 0 9130 200 OK - - - (empty) - - - - - - -
+#close 2016-01-15-18-40-36
diff --git a/testing/btest/Baseline/istate.events/receiver.http.log b/testing/btest/Baseline/istate.events/receiver.http.log
index 50de2e7aa5..829797e69a 100644
--- a/testing/btest/Baseline/istate.events/receiver.http.log
+++ b/testing/btest/Baseline/istate.events/receiver.http.log
@@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path http
-#open 2014-04-01-22-59-59
-#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
-#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
-1396393198.822094 CjhGID4nQcgTWjvg4c 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - - - - -
-#close 2014-04-01-23-00-00
+#open 2016-01-15-18-40-24
+#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
+#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
+1452883223.630311 CjhGID4nQcgTWjvg4c 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - 1.1 Wget/1.10 0 9130 200 OK - - - (empty) - - - - - - -
+#close 2016-01-15-18-40-26
diff --git a/testing/btest/Baseline/istate.events/sender.http.log b/testing/btest/Baseline/istate.events/sender.http.log
index 50de2e7aa5..bca3ed980f 100644
--- a/testing/btest/Baseline/istate.events/sender.http.log
+++ b/testing/btest/Baseline/istate.events/sender.http.log
@@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path http
-#open 2014-04-01-22-59-59
-#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
-#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
-1396393198.822094 CjhGID4nQcgTWjvg4c 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - Wget/1.10 0 9130 200 OK - - - (empty) - - - - - - -
-#close 2014-04-01-23-00-00
+#open 2016-01-15-18-40-24
+#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
+#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
+1452883223.630311 CjhGID4nQcgTWjvg4c 141.42.64.125 56730 125.190.109.199 80 1 GET www.icir.org / - 1.1 Wget/1.10 0 9130 200 OK - - - (empty) - - - - - - -
+#close 2016-01-15-18-40-25
diff --git a/testing/btest/Baseline/language.init-in-anon-function/http.log b/testing/btest/Baseline/language.init-in-anon-function/http.log
index 2f4bbbb8e4..24ee094c15 100644
--- a/testing/btest/Baseline/language.init-in-anon-function/http.log
+++ b/testing/btest/Baseline/language.init-in-anon-function/http.log
@@ -3,21 +3,21 @@
#empty_field (empty)
#unset_field -
#path http
-#open 2014-04-01-23-12-50
-#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
-#types time string addr port addr port count string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
-1300475168.784020 CRJuHdVW0XPVINV8a 141.142.0.0 48649 208.80.152.118 80 1 GET bits.wikimedia.org /skins-1.5/monobook/main.css http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.916018 CJ3xTn1c4Zw9TmAE05 141.142.0.0 49997 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/6/63/Wikipedia-logo.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.916183 C7XEbhP654jzLoe3a 141.142.0.0 49996 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/b/bb/Wikipedia_wordmark.svg/174px-Wikipedia_wordmark.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.918358 C3SfNE4BWaU4aSuwkc 141.142.0.0 49998 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/b/bd/Bookshelf-40x201_6.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.952307 CyAhVIzHqb7t7kv28 141.142.0.0 50000 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/8/8a/Wikinews-logo.png/35px-Wikinews-logo.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.952296 CzA03V1VcgagLjnO92 141.142.0.0 49999 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/4/4a/Wiktionary-logo-en-35px.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.954820 CkDsfG2YIeWJmXWNWj 141.142.0.0 50001 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/f/fa/Wikiquote-logo.svg/35px-Wikiquote-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.962687 Cn78a440HlxuyZKs6f 141.142.0.0 35642 208.80.152.2 80 1 GET meta.wikimedia.org /images/wikimedia-button.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.975934 CJ3xTn1c4Zw9TmAE05 141.142.0.0 49997 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/f/fa/Wikibooks-logo.svg/35px-Wikibooks-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.976436 C7XEbhP654jzLoe3a 141.142.0.0 49996 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/d/df/Wikispecies-logo.svg/35px-Wikispecies-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475168.979264 C3SfNE4BWaU4aSuwkc 141.142.0.0 49998 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/4/4c/Wikisource-logo.svg/35px-Wikisource-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475169.014619 CyAhVIzHqb7t7kv28 141.142.0.0 50000 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/4/4a/Commons-logo.svg/35px-Commons-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475169.014593 CzA03V1VcgagLjnO92 141.142.0.0 49999 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/9/91/Wikiversity-logo.svg/35px-Wikiversity-logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-1300475169.014927 CkDsfG2YIeWJmXWNWj 141.142.0.0 50001 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/7/75/Wikimedia_Community_Logo.svg/35px-Wikimedia_Community_Logo.svg.png http://www.wikipedia.org/ Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
-#close 2014-04-01-23-12-50
+#open 2016-01-15-18-40-39
+#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth method host uri referrer version user_agent request_body_len response_body_len status_code status_msg info_code info_msg filename tags username password proxied orig_fuids orig_mime_types resp_fuids resp_mime_types
+#types time string addr port addr port count string string string string string string count count count string count string string set[enum] string string set[string] vector[string] vector[string] vector[string] vector[string]
+1300475168.784020 CRJuHdVW0XPVINV8a 141.142.0.0 48649 208.80.152.118 80 1 GET bits.wikimedia.org /skins-1.5/monobook/main.css http://www.wikipedia.org/ 1.1 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.916018 CJ3xTn1c4Zw9TmAE05 141.142.0.0 49997 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/6/63/Wikipedia-logo.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.916183 C7XEbhP654jzLoe3a 141.142.0.0 49996 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/b/bb/Wikipedia_wordmark.svg/174px-Wikipedia_wordmark.svg.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.918358 C3SfNE4BWaU4aSuwkc 141.142.0.0 49998 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/b/bd/Bookshelf-40x201_6.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.952307 CyAhVIzHqb7t7kv28 141.142.0.0 50000 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/8/8a/Wikinews-logo.png/35px-Wikinews-logo.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.952296 CzA03V1VcgagLjnO92 141.142.0.0 49999 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/4/4a/Wiktionary-logo-en-35px.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.954820 CkDsfG2YIeWJmXWNWj 141.142.0.0 50001 208.80.152.3 80 1 GET upload.wikimedia.org /wikipedia/commons/thumb/f/fa/Wikiquote-logo.svg/35px-Wikiquote-logo.svg.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.962687 Cn78a440HlxuyZKs6f 141.142.0.0 35642 208.80.152.2 80 1 GET meta.wikimedia.org /images/wikimedia-button.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.975934 CJ3xTn1c4Zw9TmAE05 141.142.0.0 49997 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/f/fa/Wikibooks-logo.svg/35px-Wikibooks-logo.svg.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.976436 C7XEbhP654jzLoe3a 141.142.0.0 49996 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/d/df/Wikispecies-logo.svg/35px-Wikispecies-logo.svg.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475168.979264 C3SfNE4BWaU4aSuwkc 141.142.0.0 49998 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/4/4c/Wikisource-logo.svg/35px-Wikisource-logo.svg.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475169.014619 CyAhVIzHqb7t7kv28 141.142.0.0 50000 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/4/4a/Commons-logo.svg/35px-Commons-logo.svg.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475169.014593 CzA03V1VcgagLjnO92 141.142.0.0 49999 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/9/91/Wikiversity-logo.svg/35px-Wikiversity-logo.svg.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+1300475169.014927 CkDsfG2YIeWJmXWNWj 141.142.0.0 50001 208.80.152.3 80 2 GET upload.wikimedia.org /wikipedia/commons/thumb/7/75/Wikimedia_Community_Logo.svg/35px-Wikimedia_Community_Logo.svg.png http://www.wikipedia.org/ 1.0 Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.15) Gecko/20110303 Ubuntu/10.04 (lucid) Firefox/3.6.15 0 0 304 Not Modified - - - (empty) - - - - - - -
+#close 2016-01-15-18-40-39
diff --git a/testing/btest/Baseline/language.undefined-delete-field/output b/testing/btest/Baseline/language.undefined-delete-field/output
new file mode 100644
index 0000000000..bd0fb99289
--- /dev/null
+++ b/testing/btest/Baseline/language.undefined-delete-field/output
@@ -0,0 +1,2 @@
+error in /Users/johanna/bro/master/testing/btest/.tmp/language.undefined-delete-field/undefined-delete-field.bro, line 14: no such field in record (x$c)
+1
diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output
index 9239f2d40d..7a5718b1db 100644
--- a/testing/btest/Baseline/plugins.hooks/output
+++ b/testing/btest/Baseline/plugins.hooks/output
@@ -220,7 +220,7 @@
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) ->
-0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1429655378.868621, node=bro, filter=ip or not ip, init=T, success=T])) ->
+0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1452883249.168544, node=bro, filter=ip or not ip, init=T, success=T])) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Communication::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Conn::LOG)) ->
@@ -326,11 +326,13 @@
0.000000 MetaHookPost CallFunction(Log::create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) ->
-0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1429655378.868621, node=bro, filter=ip or not ip, init=T, success=T])) ->
+0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1452883249.168544, node=bro, filter=ip or not ip, init=T, success=T])) ->
0.000000 MetaHookPost CallFunction(Notice::want_pp, , ()) ->
0.000000 MetaHookPost CallFunction(PacketFilter::build, , ()) ->
0.000000 MetaHookPost CallFunction(PacketFilter::combine_filters, , (ip or not ip, and, )) ->
0.000000 MetaHookPost CallFunction(PacketFilter::install, , ()) ->
+0.000000 MetaHookPost CallFunction(Pcap::install_pcap_filter, , (PacketFilter::DefaultPcapFilter)) ->
+0.000000 MetaHookPost CallFunction(Pcap::precompile_pcap_filter, , (PacketFilter::DefaultPcapFilter, ip or not ip)) ->
0.000000 MetaHookPost CallFunction(SumStats::add_observe_plugin_dependency, , (SumStats::STD_DEV, SumStats::VARIANCE)) ->
0.000000 MetaHookPost CallFunction(SumStats::add_observe_plugin_dependency, , (SumStats::VARIANCE, SumStats::AVERAGE)) ->
0.000000 MetaHookPost CallFunction(SumStats::register_observe_plugin, , (SumStats::AVERAGE, anonymous-function{ if (!SumStats::rv?$average) SumStats::rv$average = SumStats::valelseSumStats::rv$average += (SumStats::val - SumStats::rv$average) / (coerce SumStats::rv$num to double)})) ->
@@ -351,9 +353,7 @@
0.000000 MetaHookPost CallFunction(current_time, , ()) ->
0.000000 MetaHookPost CallFunction(filter_change_tracking, , ()) ->
0.000000 MetaHookPost CallFunction(getenv, , (CLUSTER_NODE)) ->
-0.000000 MetaHookPost CallFunction(install_pcap_filter, , (PacketFilter::DefaultPcapFilter)) ->
0.000000 MetaHookPost CallFunction(network_time, , ()) ->
-0.000000 MetaHookPost CallFunction(precompile_pcap_filter, , (PacketFilter::DefaultPcapFilter, ip or not ip)) ->
0.000000 MetaHookPost CallFunction(reading_live_traffic, , ()) ->
0.000000 MetaHookPost CallFunction(reading_traces, , ()) ->
0.000000 MetaHookPost CallFunction(set_to_regex, , ({}, (^\.?|\.)(~~)$)) ->
@@ -453,6 +453,7 @@
0.000000 MetaHookPost LoadFile(./exec) -> -1
0.000000 MetaHookPost LoadFile(./file_analysis.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(./files) -> -1
+0.000000 MetaHookPost LoadFile(./functions.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(./gridftp) -> -1
0.000000 MetaHookPost LoadFile(./hll_unique) -> -1
0.000000 MetaHookPost LoadFile(./hooks.bif.bro) -> -1
@@ -473,7 +474,6 @@
0.000000 MetaHookPost LoadFile(./netstats) -> -1
0.000000 MetaHookPost LoadFile(./non-cluster) -> -1
0.000000 MetaHookPost LoadFile(./patterns) -> -1
-0.000000 MetaHookPost LoadFile(./pcap.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(./plugins) -> -1
0.000000 MetaHookPost LoadFile(./polling) -> -1
0.000000 MetaHookPost LoadFile(./postprocessors) -> -1
@@ -490,6 +490,7 @@
0.000000 MetaHookPost LoadFile(./top-k.bif.bro) -> -1
0.000000 MetaHookPost LoadFile(./topk) -> -1
0.000000 MetaHookPost LoadFile(./types.bif.bro) -> -1
+0.000000 MetaHookPost LoadFile(./types.bro) -> -1
0.000000 MetaHookPost LoadFile(./unique) -> -1
0.000000 MetaHookPost LoadFile(./utils) -> -1
0.000000 MetaHookPost LoadFile(./utils-commands) -> -1
@@ -509,6 +510,7 @@
0.000000 MetaHookPost LoadFile(.<...>/raw) -> -1
0.000000 MetaHookPost LoadFile(.<...>/sqlite) -> -1
0.000000 MetaHookPost LoadFile(<...>/__load__.bro) -> -1
+0.000000 MetaHookPost LoadFile(<...>/__preload__.bro) -> -1
0.000000 MetaHookPost LoadFile(<...>/hooks.bro) -> -1
0.000000 MetaHookPost LoadFile(base/bif) -> -1
0.000000 MetaHookPost LoadFile(base/init-default.bro) -> -1
@@ -810,7 +812,7 @@
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql]))
-0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1429655378.868621, node=bro, filter=ip or not ip, init=T, success=T]))
+0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1452883249.168544, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Communication::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Conn::LOG))
@@ -916,11 +918,13 @@
0.000000 MetaHookPre CallFunction(Log::create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql]))
-0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1429655378.868621, node=bro, filter=ip or not ip, init=T, success=T]))
+0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1452883249.168544, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Notice::want_pp, , ())
0.000000 MetaHookPre CallFunction(PacketFilter::build, , ())
0.000000 MetaHookPre CallFunction(PacketFilter::combine_filters, , (ip or not ip, and, ))
0.000000 MetaHookPre CallFunction(PacketFilter::install, , ())
+0.000000 MetaHookPre CallFunction(Pcap::install_pcap_filter, , (PacketFilter::DefaultPcapFilter))
+0.000000 MetaHookPre CallFunction(Pcap::precompile_pcap_filter, , (PacketFilter::DefaultPcapFilter, ip or not ip))
0.000000 MetaHookPre CallFunction(SumStats::add_observe_plugin_dependency, , (SumStats::STD_DEV, SumStats::VARIANCE))
0.000000 MetaHookPre CallFunction(SumStats::add_observe_plugin_dependency, , (SumStats::VARIANCE, SumStats::AVERAGE))
0.000000 MetaHookPre CallFunction(SumStats::register_observe_plugin, , (SumStats::AVERAGE, anonymous-function{ if (!SumStats::rv?$average) SumStats::rv$average = SumStats::valelseSumStats::rv$average += (SumStats::val - SumStats::rv$average) / (coerce SumStats::rv$num to double)}))
@@ -941,9 +945,7 @@
0.000000 MetaHookPre CallFunction(current_time, , ())
0.000000 MetaHookPre CallFunction(filter_change_tracking, , ())
0.000000 MetaHookPre CallFunction(getenv, , (CLUSTER_NODE))
-0.000000 MetaHookPre CallFunction(install_pcap_filter, , (PacketFilter::DefaultPcapFilter))
0.000000 MetaHookPre CallFunction(network_time, , ())
-0.000000 MetaHookPre CallFunction(precompile_pcap_filter, , (PacketFilter::DefaultPcapFilter, ip or not ip))
0.000000 MetaHookPre CallFunction(reading_live_traffic, , ())
0.000000 MetaHookPre CallFunction(reading_traces, , ())
0.000000 MetaHookPre CallFunction(set_to_regex, , ({}, (^\.?|\.)(~~)$))
@@ -1043,6 +1045,7 @@
0.000000 MetaHookPre LoadFile(./exec)
0.000000 MetaHookPre LoadFile(./file_analysis.bif.bro)
0.000000 MetaHookPre LoadFile(./files)
+0.000000 MetaHookPre LoadFile(./functions.bif.bro)
0.000000 MetaHookPre LoadFile(./gridftp)
0.000000 MetaHookPre LoadFile(./hll_unique)
0.000000 MetaHookPre LoadFile(./hooks.bif.bro)
@@ -1063,7 +1066,6 @@
0.000000 MetaHookPre LoadFile(./netstats)
0.000000 MetaHookPre LoadFile(./non-cluster)
0.000000 MetaHookPre LoadFile(./patterns)
-0.000000 MetaHookPre LoadFile(./pcap.bif.bro)
0.000000 MetaHookPre LoadFile(./plugins)
0.000000 MetaHookPre LoadFile(./polling)
0.000000 MetaHookPre LoadFile(./postprocessors)
@@ -1080,6 +1082,7 @@
0.000000 MetaHookPre LoadFile(./top-k.bif.bro)
0.000000 MetaHookPre LoadFile(./topk)
0.000000 MetaHookPre LoadFile(./types.bif.bro)
+0.000000 MetaHookPre LoadFile(./types.bro)
0.000000 MetaHookPre LoadFile(./unique)
0.000000 MetaHookPre LoadFile(./utils)
0.000000 MetaHookPre LoadFile(./utils-commands)
@@ -1099,6 +1102,7 @@
0.000000 MetaHookPre LoadFile(.<...>/raw)
0.000000 MetaHookPre LoadFile(.<...>/sqlite)
0.000000 MetaHookPre LoadFile(<...>/__load__.bro)
+0.000000 MetaHookPre LoadFile(<...>/__preload__.bro)
0.000000 MetaHookPre LoadFile(<...>/hooks.bro)
0.000000 MetaHookPre LoadFile(base/bif)
0.000000 MetaHookPre LoadFile(base/init-default.bro)
@@ -1399,7 +1403,7 @@
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])
-0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1429655378.868621, node=bro, filter=ip or not ip, init=T, success=T])
+0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1452883249.168544, node=bro, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Communication::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Conn::LOG)
@@ -1505,11 +1509,13 @@
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])
-0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1429655378.868621, node=bro, filter=ip or not ip, init=T, success=T])
+0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1452883249.168544, node=bro, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Notice::want_pp()
0.000000 | HookCallFunction PacketFilter::build()
0.000000 | HookCallFunction PacketFilter::combine_filters(ip or not ip, and, )
0.000000 | HookCallFunction PacketFilter::install()
+0.000000 | HookCallFunction Pcap::install_pcap_filter(PacketFilter::DefaultPcapFilter)
+0.000000 | HookCallFunction Pcap::precompile_pcap_filter(PacketFilter::DefaultPcapFilter, ip or not ip)
0.000000 | HookCallFunction SumStats::add_observe_plugin_dependency(SumStats::STD_DEV, SumStats::VARIANCE)
0.000000 | HookCallFunction SumStats::add_observe_plugin_dependency(SumStats::VARIANCE, SumStats::AVERAGE)
0.000000 | HookCallFunction SumStats::register_observe_plugin(SumStats::AVERAGE, anonymous-function{ if (!SumStats::rv?$average) SumStats::rv$average = SumStats::valelseSumStats::rv$average += (SumStats::val - SumStats::rv$average) / (coerce SumStats::rv$num to double)})
@@ -1530,9 +1536,7 @@
0.000000 | HookCallFunction current_time()
0.000000 | HookCallFunction filter_change_tracking()
0.000000 | HookCallFunction getenv(CLUSTER_NODE)
-0.000000 | HookCallFunction install_pcap_filter(PacketFilter::DefaultPcapFilter)
0.000000 | HookCallFunction network_time()
-0.000000 | HookCallFunction precompile_pcap_filter(PacketFilter::DefaultPcapFilter, ip or not ip)
0.000000 | HookCallFunction reading_live_traffic()
0.000000 | HookCallFunction reading_traces()
0.000000 | HookCallFunction set_to_regex({}, (^\.?|\.)(~~)$)
@@ -1601,14 +1605,14 @@
1362692526.939527 MetaHookPost CallFunction(HTTP::new_http_session, , ([id=[orig_h=141.142.228.5, orig_p=59856<...>/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0], start_time=1362692526.869344, duration=0.070183, service={HTTP}, history=ShAD, uid=CXWv6p3arKYeMETxOg, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=[pending={}, current_request=1, current_response=0, trans_depth=0], irc=, krb=, modbus=, mysql=, radius=, rdp=, sip=, sip_state=, snmp=, smtp=, smtp_state=, socks=, ssh=, syslog=