Commit graph

1825 commits

Author SHA1 Message Date
Robin Sommer
9f99a4a942 Merge remote-tracking branch 'origin/topic/jsiwek/local-container-init'
Closes #952.

* origin/topic/jsiwek/local-container-init:
  Fix init of local sets/vectors via curly brace initializer lists.
2013-03-06 15:11:10 -08:00
Robin Sommer
d931079021 Merge remote-tracking branch 'origin/topic/jsiwek/ticket946'
Closes #946.

* origin/topic/jsiwek/ticket946:
  Fix memory leaks resulting from 'when' and 'return when' statements.
  Fix three bugs with 'when' and 'return when' statements. Addresses #946
2013-03-06 15:09:24 -08:00
Robin Sommer
a15b630cac Merge remote-tracking branch 'origin/topic/jsiwek/gtp-enhancements'
* origin/topic/jsiwek/gtp-enhancements:
  Add parsing for GTPv1 extension headers and control messages.
2013-03-06 15:00:45 -08:00
Robin Sommer
c13eae3253 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix possible null pointer dereference in identify_data BIF.
  Fix build on OpenBSD 5.2.
2013-03-06 14:54:50 -08:00
Seth Hall
a2556642e6 Merge remote-tracking branch 'origin/topic/matthias/notary'
* origin/topic/matthias/notary:
  Small cosmetic changes.
  Give log buffer the correct name.
  Simplify delayed logging of SSL records.
  Implement delay-token style SSL logging.
  More style tweaks: replace spaces with tabs.
  Factor notary code into separte file.
  Adhere to Bro coding style guidelines.
  Enhance ssl.log with information from notary.

Closes #928
2013-02-05 02:06:33 -05:00
Robin Sommer
10d91fd1eb Merge remote-tracking branch 'origin/topic/bernhard/input-tests-exit-after-terminate'
* origin/topic/bernhard/input-tests-exit-after-terminate:
  update input tests to use exit_only_after_terminate
2013-02-04 09:46:01 -08:00
Robin Sommer
d3814594ff Updating submodule(s).
[nomail]
2013-02-01 08:03:18 -08:00
Robin Sommer
01c2bf4e0e Updating submodule(s).
[nomail]
2013-01-30 20:10:36 -08:00
Robin Sommer
b9518f4329 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix runaway reference counting bug in record coercion.
  Fix memory leak in some reporter messaging cases.
2013-01-25 13:51:16 -08:00
Robin Sommer
ed165f22a2 Making a test portable. 2013-01-23 19:43:52 -08:00
Robin Sommer
762c034ec2 Merge remote-tracking branch 'origin/topic/bernhard/input-logging-commmon-functions'
* origin/topic/bernhard/input-logging-commmon-functions:
  add the last of Robins suggestions (separate info-struct for constructors).
  port memory leak fix from master
  harmonize function naming
  move AsciiInputOutput over to threading
  and thinking about it, ascii-io doesn't need the separator
  change constructors
  and factor stuff out the input framework too.
  factor out ascii input/output.
  std::string accessors to escape_sequence functionality
  intermediate commit - it has been over a month since I touched this...

I cleaned up the AsciiInputOutput class somewhat, including renaming
it to AsciiFormatter, renaming some of its methods, and turning the
static methods into members for consistency.

Closes #929.
2013-01-23 16:51:54 -08:00
Robin Sommer
fdf79196c6 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fixing variable size issues (was uint, should be long) with http response code.
  Revert "Trick for parallelizing input framework unit tests."
  add opaque type-ignoring for the accept_unsupported_types input framework option.
2013-01-18 17:19:40 -08:00
Robin Sommer
564e27abb6 Merge remote-tracking branch 'origin/topic/jsiwek/string-indexing'
* origin/topic/jsiwek/string-indexing:
  Change substring index notation to use a colon (addresses #422).

Tweaked slightly to make it more generic, we may index other types
with slices eventually too.

Closes #422.
2013-01-08 10:20:12 -08:00
Robin Sommer
4488dce493 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix memory leak in OpaqueType::DoUnserialize.
2013-01-07 09:43:56 -08:00
Robin Sommer
5e3c286490 Merge remote-tracking branch 'origin/topic/jsiwek/string-indexing'
* origin/topic/jsiwek/string-indexing:
  Add array-style index accessor for strings.  Addresses #422.

Closes #422.
2012-12-20 17:43:26 -08:00
Robin Sommer
da90976170 Merge remote-tracking branch 'origin/topic/matthias/opaque'
* origin/topic/matthias/opaque:
  Add new unit test for opaque serialization.
  Migrate entropy testing to opaque.
  C++ify RandTest.*
  Fix a hard-to-spot bug.
  Use more descriptive error message.
  Fix the fix :-/.
  Fix initialization of hash values.
  Be clearer about delegation.
  Implement serialization of opaque types.
  Update hash BiF documentation.
  Migrate free SHA* functions to SHA*Val::digest().
  Add missing type name that caused failing tests.
  Update base scripts and unit tests.
  Simplify hash function BiFs.
  Add support for opaque hash values.
  Adapt BiF & Bro parser to handle opaque types.
  More lexer/parser work.
  Implement equivalence relation for opaque types.
  Support basic serialization of opaque.
  Add opaque type to lexer, parser, and BroType.

Closes #925

Conflicts:
	aux/broccoli
2012-12-20 16:30:22 -08:00
Robin Sommer
037085605c Merge remote-tracking branch 'origin/topic/jsiwek/ticket-923'
* origin/topic/jsiwek/ticket-923:
  Improve error for invalid use of types as values (addresses #923).

Close 923.
2012-12-20 15:21:27 -08:00
Robin Sommer
9301589219 Merge remote-tracking branch 'origin/topic/jsiwek/switch-statement'
* origin/topic/jsiwek/switch-statement:
  Finish implementation of script-layer switch statement.  Addresses #754.

Closes #754.
2012-12-20 15:13:30 -08:00
Robin Sommer
40007d075c Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix return value of hook calls that have no handlers.
  Fix to_port() BIF for port strings with a port number of zero.
2012-12-20 12:12:44 -08:00
Robin Sommer
ea6b62f586 Merge remote-tracking branch 'origin/topic/jsiwek/const'
* origin/topic/jsiwek/const:
  Make const variables actually constant.  Addresses #922.

Closes #922.
2012-12-14 14:56:37 -08:00
Robin Sommer
7a2901ec6b Fixing checksums in test trace because Bro now reports them. :-) 2012-12-14 14:48:16 -08:00
Robin Sommer
3438a8d8f9 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Trick for parallelizing input framework unit tests.
  Maybe fix reliability of a unit test that relies on when statements.
  Remove unused attributes
2012-12-12 14:26:45 -08:00
Robin Sommer
b867333c2e Merge remote-tracking branch 'origin/topic/jsiwek/gtp'
* origin/topic/jsiwek/gtp:
  Change binpac exceptions in AYIYA/GTP analyzers to do protocol_violation
  Add GTP tunnel analyzer memory leak unit test.
  Add GPRS Tunnelling Protocol (GTPv1) decapsulation.

Closes #690.
2012-12-10 14:48:18 -08:00
Robin Sommer
e8482fef99 Updating CHANGES and VERSION. 2012-12-08 12:05:32 -08:00
Robin Sommer
57510464a1 Adapting the HTTP request line parsing to only accept methods
consisting of letters [A-Za-z].

I had some bogus HTTP sessions now with the test-suite that reported
data as HTTP because it started with "<!... ". Requiring letters seems
a reasonable constraint.
2012-12-05 16:56:54 -08:00
Robin Sommer
90fc5c97e5 Reporting warnings if kill/waitpid fail in communication system. Also
replace bzero with memset(). Patches from Bill Parker.
2012-12-05 15:50:15 -08:00
Robin Sommer
4877f8344d Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  ok, this one is a bit... embarrassing.
  Fix segfault: uninitialized identifiers w/ &synchronized (addresses #66)
  Bad record constructor initializers now give an error (addresses #34).
  Invalid vector indices now generate error message (addresses #24).
  Bump CPack RPM package requirement to python >= 2.6.0.
  Interpreter exceptions occurring in "when" blocks are now handled.
2012-12-05 14:39:26 -08:00
Robin Sommer
05e6289719 Catching out-of-memory in patricia tree code.
Based on patch by Bill Parker.
2012-12-03 15:42:43 -08:00
Robin Sommer
63d43e6545 Renaming ASCII writer filter option 'only_single_header_row' to 'tsv'.
Also clarifying usage.

Closes #912.
2012-12-03 14:40:38 -08:00
Robin Sommer
d9f90fcac0 Merge remote-tracking branch 'origin/topic/jsiwek/table-attribute-fixes'
* origin/topic/jsiwek/table-attribute-fixes:
  Fix various bugs with table/set attributes.

Closes #866.
2012-12-03 14:11:44 -08:00
Robin Sommer
d4792dc7fe Merge remote-tracking branch 'origin/topic/jsiwek/table-init-container-ctors'
* origin/topic/jsiwek/table-init-container-ctors:
  Add test of record() constructor to table initializer unit test.
  Fix table(), set(), vector() constructors in table initializer lists.

Closes #5.
2012-12-03 14:10:17 -08:00
Robin Sommer
1298f2e974 Merge remote-tracking branch 'origin/topic/jsiwek/hook'
* origin/topic/jsiwek/hook:
  Change hook calls to only be allowed when preceded by "hook" keyword.
  Clarification in hook documentation.
  Hook functions now directly callable instead of w/ "hook" statements.

Closes #918.
2012-12-03 14:07:22 -08:00
Robin Sommer
a259155e0f Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Slightly fix up file name extraction from Content-Disposition headers.
  Quick pass over unit tests, adding -b flag to bro so they run faster.
  Fixed a DNS attribute issue (reported by Matt Thompson).
2012-12-03 14:00:48 -08:00
Robin Sommer
7245aa5977 Adding NEWS placeholder for hooks and CSV mode. 2012-11-23 19:40:12 -08:00
Robin Sommer
a5e237f50c The ASCII writer now supports a filter config option
'only_single_header_row' that turns the output into CSV format.

In that mode all meta data is skipped except for a single header line
with the fields names. Example:

    local my_filter: Log::Filter = [$name = "my-filter", $writer = Log::WRITER_ASCII, $config = table(["only_single_header_row"] = "T")];

Contributed by Carsten Langer.
2012-11-23 19:38:53 -08:00
Robin Sommer
3357746857 Merge remote-tracking branch 'origin/topic/jsiwek/composite-table-index-fix'
* origin/topic/jsiwek/composite-table-index-fix:
  Fix ambiguity between composite table index and record ctor expressions.

Cool.

Closes #80.
2012-11-23 18:25:04 -08:00
Robin Sommer
0096ebdd6b Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix some warnings from sphinx when building docs.
2012-11-23 18:21:41 -08:00
Robin Sommer
5508a5bb80 Merge remote-tracking branch 'origin/topic/dnthayer/bytes-to-double'
* origin/topic/dnthayer/bytes-to-double:
  Portability improvement (data alignment issues)
  Add test cases for the bytestring_to_double BIF
  Add a new BIF "bytestring_to_double"

Closes #908.
2012-11-14 13:20:46 -08:00
Robin Sommer
759faa255c Merge remote-tracking branch 'origin/topic/jsiwek/modbus-fixes'
* origin/topic/jsiwek/modbus-fixes:
  Remove byte count parameter from modbus events carrying register arrays
  Adjust modbus register array parsing.
  Adjustments to modbus test cases.

Closes #917.
2012-11-13 20:01:23 -08:00
Robin Sommer
590f764440 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix lookup_hostname BIF (and memory leak in it).

Thanks!
2012-11-08 16:22:34 -08:00
Robin Sommer
6c70b11cea Fixing/extending modbus tests. 2012-11-05 17:10:28 -08:00
Robin Sommer
a6216969e6 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Script in base for detecting cases of checksum offloading.
2012-11-05 13:59:30 -08:00
Robin Sommer
4fab70ecce Merge remote-tracking branch 'vlad/topic/vladg/dns_txt_queries'
* vlad/topic/vladg/dns_txt_queries:
  Add detection rate threshold for MHR.
  Make sure lookup_hostname_txt isn't checking lookup_hostname's cache for answers.
  A couple of lookup_hostname_txt fixes.

Reverting the earlier function-join during merging.
2012-11-05 13:40:24 -08:00
Robin Sommer
dfebb82238 Merge remote-tracking branch 'vlad/topic/vladg/dns_txt_queries'
* vlad/topic/vladg/dns_txt_queries:
  DNS TXT support

I've tweaked it a little bit, still seems to work ...

I'd like to add a test for this but I'n not quite sure how to do that.
We'd have to hardcode a destination server that then'd be contacted
each time the test-suite runs.
2012-11-01 10:38:36 -07:00
Robin Sommer
55006240ae Merge remote-tracking branch 'origin/topic/dnthayer/installing-bro'
* origin/topic/dnthayer/installing-bro:
  Add version-specific upgrade info
  Move upgrade instructions to INSTALL document
  Reorganize install documentation

Closes #910.
2012-10-31 14:32:00 -07:00
Robin Sommer
b85baed95e Merge remote-tracking branch 'origin/topic/dnthayer/alarms-mail'
* origin/topic/dnthayer/alarms-mail:
  Rename the alarm summary mail variable
  Change alarm summary email interval to 24hrs

Closes #824.
2012-10-31 14:28:49 -07:00
Robin Sommer
9ec2bfe59f Merge remote-tracking branch 'origin/topic/seth/pppoe'
Looks like the code in this function is getting ready for some
refactoring. Leaving that for another time though ...

Closes #909.

* origin/topic/seth/pppoe:
  Adding a test for PPPoE support.
  Adding PPPoE support to Bro.
2012-10-24 16:05:17 -07:00
Robin Sommer
ae38aad2bb Adding missing &redef for some TCP options.
Reported by Carsten Langer.

Closes #905.
Closes #906.
Closes #907.
2012-10-24 15:41:27 -07:00
Robin Sommer
7ddbca8b35 Merge remote-tracking branch 'origin/topic/jsiwek/subnet-literal-const'
* origin/topic/jsiwek/subnet-literal-const:
  Add parsing rules for IPv4/IPv6 subnet literal constants, addresses #888

Closes #888.
2012-10-24 15:37:49 -07:00
Robin Sommer
5716545cfa Merge remote-tracking branch 'origin/topic/seth/strptime'
* origin/topic/seth/strptime:
  Added a BiF to wrap the strptime function.

Closes #904.
2012-10-19 15:13:25 -07:00