Commit graph

77 commits

Author SHA1 Message Date
Johanna Amann
44b3ece440 Fix coverity error (uninitialized variable) 2016-06-06 13:19:17 -07:00
Robin Sommer
3581ead0d9 Ignoring packets with negative timestamps.
These used to stall Bro. Addresses BIT-1562 and BIT-1443.
2016-05-23 13:22:22 -07:00
Vitaly Repin
cd2ec7c495 Unknown data link type error message printed out props.link_type instead of arg_props.link_type. It lead to the meaningless and misleading output (E.g.: 'unknown data link type 0xffffffff') 2016-04-28 11:10:52 +03:00
Robin Sommer
c22a6f67d2 Use better data structure for storing BPF filters. 2015-11-23 19:55:02 -08:00
Robin Sommer
36b5a4db08 Merge branch 'master' of https://github.com/knielander/bro
I reworked this a bit:

    - Moved the globals into a new Pcap::* namespace, and renamed them
      slightly.

    - Moved the definitions of the globals into pcap/const.bif.

    - Also moved the existing 'snaplen' into Pcap::* and removed
      SnapLen() from the PktSrc API (it's really a pcap thing).

    - Likewise moved the existing functions precompile_pcap_filter,
      install_pcap_filter, and pcap_error, into Pcap::*.

    - Did some more refactoring for the pcap code.

* 'master' of https://github.com/knielander/bro:
  Refactored patch (removed options, less ambiguous name)
  Allow Bro to run in fanout mode.
  Allow libpcap buffer size to be set manually.
  Allow Bro to run in fanout mode.
  Allowed libpcap buffer size to be set via configuration.
2015-08-30 22:09:32 -07:00
Kris Nielander
d8c9b7255e Allow Bro to run in fanout mode. 2015-08-09 22:45:23 +02:00
Kris Nielander
f5429ee794 Allow libpcap buffer size to be set manually. 2015-08-09 22:45:09 +02:00
Robin Sommer
3957091e1b Renaming config.h to bro-config.h.
A couple times now I had this conflicting with files of the same name
in other projects.
2015-07-28 11:57:04 -07:00
Robin Sommer
c72d191ab5 Refactoring L2 parsing code to reside in the Packet class.
That way it can be reused more easily. This also avoid having to
change the serialization structure for packets, which is a problem as
external sources of packets (via Broccoli) wouldn't have the new
attributes available to send.

Also moving Packet.{h,cc} and Layer2.{h,cc} into iosource/, and
removing header size from properties that packet sources have to
provide, as we can now compute that easily from the link type.

Plus some more cleanup.
2015-07-20 16:21:34 -07:00
Robin Sommer
64a478dbd5 Determining final L3 layer protocol right inside PktSrc. 2015-07-17 21:44:42 -07:00
Robin Sommer
86440e44fc Adding more cross-checks for IP.
This prevents a few more packets from reaching raw_events(), see
baseline update for the corresponding test.
2015-07-17 13:59:12 -07:00
Robin Sommer
fe3579f1b4 Merge branch 'topic/rework-packets' of https://github.com/jsbarber/bro
* 'topic/rework-packets' of https://github.com/jsbarber/bro:
  One more tinker to Packet -- ensure no uninitialized values
  Packet::IP()-created IP_Hdr should not free
  Make enums work for non-C++11 config
  Refactor to make bro use a common Packet object. Do a better job of parsing layer 2 and keeping track of layer 3 proto. Add support for raw packet event, including Layer2 headers.

Conflicts:
	aux/plugins
2015-07-17 12:56:04 -07:00
Robin Sommer
476a5dbc34 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1408'
BIT-1408 #merged

* origin/topic/jsiwek/bit-1408:
  BIT-1408: improve I/O loop and Broker IOSource.
2015-06-04 14:46:30 -07:00
Jon Siwek
58ea1ff458 BIT-1408: improve I/O loop and Broker IOSource. 2015-06-03 08:25:49 -05:00
Jeff Barber
30fdc37479 Refactor to make bro use a common Packet object.
Do a better job of parsing layer 2 and keeping track of layer 3 proto.
Add support for raw packet event, including Layer2 headers.
2015-05-29 10:37:39 -04:00
Robin Sommer
d29679484d Removing dependency on PCAP_NETMASK_UNKNOWN to compile with libpcap <
1.1.1.
2015-02-20 13:49:58 -08:00
Jon Siwek
dec96234e3 Fix some minor Coverity Scan complaints. 2014-10-30 13:26:34 -05:00
Jon Siwek
31b7e984d1 Fix packet sources being treated as idle when a packet is available.
Addresses BIT-1266.
2014-10-02 12:16:33 -05:00
Jon Siwek
59c54a0fc6 Add a simple FD_Set wrapper/helper class. 2014-09-09 16:28:04 -05:00
Jon Siwek
cf66bd8b69 Merge branch 'master' into topic/jsiwek/improve_comm_loop
Conflicts:
	src/CMakeLists.txt
	src/FlowSrc.cc
	src/FlowSrc.h
	src/IOSource.h
	src/PktSrc.cc
	src/PktSrc.h
	src/iosource/Manager.cc
2014-09-09 14:19:43 -05:00
Robin Sommer
5c6dfb2408 Fixing link-layer handling.
Something had gotten mixed up here.
2014-09-06 12:31:25 -07:00
Robin Sommer
4a66a8e341 Bugfixes and test updates. 2014-09-05 18:20:23 -07:00
Robin Sommer
569853444f A set of smaller API tweaks, and polishing. 2014-09-03 12:45:38 -07:00
Robin Sommer
3e669daa05 Interface tweaks for PktSrc, plus docs for PktSrc and PktDumper. 2014-08-28 00:52:36 -04:00
Robin Sommer
5f817513d0 A set of various fixes and smaller API tweaks, plus tests.
Also moving PCAP-related bifs to iosource/pcap.bif.
2014-08-24 19:55:26 -07:00
Robin Sommer
ce9f16490c Moving some of the BPF filtering code into base class.
This will allow packet sources that don't support BPF natively to
emulate the filtering via libpcap.
2014-08-22 17:50:03 -07:00
Robin Sommer
caa55ad352 Moving Pkt{Src,Dumper} a directory level up.
Also renaming PktSourceComponent to PktSrcComponent.
2014-08-22 16:46:15 -07:00
Renamed from src/iosource/pktsrc/PktSrc.cc (Browse further)