Commit graph

203 commits

Author SHA1 Message Date
Johanna Amann
91dcefe104 Fix and extend behavior of HookLoadFile
This commit fixes and extends the behavior of HookLoadFile. Before this
change, HookLoadFile appended ".bro" to each path that was @loaded, even
if the path specified directory names. Furthermore it only gave the path
of the file as it was specified in the Bro script without revealing the
final path of the file that it was going to load.

This patch changes this behavior - in addition to giving the unmodified
path given in the @load command, the hook now returns the resolved path
of the file or directory it is going to load (if found). The hook is
furthermore raises for @load-sigs and @load-plugin; a enum specifies the
kind of load that is happening.
2017-11-16 12:31:27 -08:00
Johanna Amann
ed678dd72c Add -B scripts flag to allow debug output of script load order.
This patch adds a "scripts" option to -B, when Bro is enabled with
--enable-debug. This option will output information about the scripts
that are loaded to debug.log, showing their exact load order.
2017-09-19 09:38:08 -07:00
Daniel Thayer
520ed43eae Added another missing fclose in scan.l
If someone uses an "@unload" directive in a bro script, then Bro
was neglecting to close the file.
2016-08-31 16:30:10 -05:00
Daniel Thayer
b3a7d07e66 Added a missing fclose in scan.l
On OS X, Bro was failing to startup without first using the "ulimit -n"
command to increase the allowed number of open files (OS X has a much
lower default limit than Linux or FreeBSD).
2016-08-31 14:07:44 -05:00
Robin Sommer
e3be3c9e02 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1305'
* origin/topic/jsiwek/bit-1305:
  Deprecate &rotate_interval, &rotate_size, &encrypt, &mergeable.

BIT-1305 #merged
2015-03-17 09:24:13 -07:00
Jon Siwek
778b37b5d0 Deprecate &rotate_interval, &rotate_size, &encrypt, &mergeable.
Addresses BIT-1305.
2015-03-13 14:54:46 -05:00
Jon Siwek
062baefde0 Add 'while' statement to Bro language. 2015-02-13 11:26:54 -06:00
Jon Siwek
87962a48dd Add a new attribute: &deprecated.
While scripts are parsed, a warning is raised for each usage of an
identifier marked as &deprecated.  This also works for BIFs.

Addresses BIT-924, BIT-757.
2015-01-21 09:40:50 -06:00
Robin Sommer
bb7d94d9c5 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1296'
* origin/topic/jsiwek/bit-1296:
  Make using local IDs in @if directives an error.

BIT-1296 #merged
2014-12-03 14:14:23 -08:00
Jon Siwek
cdbe459f20 Make using local IDs in @if directives an error.
Addresses BIT-1296.
2014-12-02 12:30:46 -06:00
Jon Siwek
69b1ba653d Minor adjustments to plugin code/docs.
Mostly whitespace/typos.
Moved some Plugin methods out from public access.
2014-07-30 16:48:23 -05:00
Robin Sommer
bbd409d274 Merge remote-tracking branch 'origin/master' into topic/robin/dynamic-plugins-2.3
(Never good to name a branch after version anticipated to include it ...)
2014-05-14 16:23:04 -07:00
Jon Siwek
8b7d5a68b2 Fix reference counting for lookup_ID() usages.
That function refs the ID before returning it, but callers were never
assuming responsibility for that reference.
2014-05-01 15:00:03 -05:00
Robin Sommer
3f47c5bc87 Merge remote-tracking branch 'origin/master' into topic/robin/dynamic-plugins-2.3 2014-01-24 20:26:00 -08:00
Robin Sommer
a80dd10215 Updates of the dynamic plugin code.
Includes:

    - Cleanup of the plugin API, in particular generally changing
      const char* to std::string

    - Renaming environment variable BRO_PLUGINS to BRO_PLUGIN_PATH,
      defaulting to <prefix>/lib/bro/plugins

    - Reworking how dynamic plugins are searched and activated. See
      doc/devel/plugins.rst for details.

    - New @load-plugin directive to explicitly activate a plugin

    - Support for Darwin. (Linux untested right now)

    - The init-plugin updates come with support for "make test", "make
      sdist", and "make bdist" (see how-to).

    - Test updates.

Notes: The new hook mechanism, which allows plugins to hook into Bro's
core a well-defined points, is still essentially untested.
2013-12-16 11:57:56 -08:00
Robin Sommer
3abf626908 Merge remote-tracking branch 'origin/topic/jsiwek/broxygen'
BIT-1098

* origin/topic/jsiwek/broxygen:
  Fix Broxygen-related compile errors.
  Add a Broxygen coverage test.
  Internal Broxygen organization/documentation/polish.
  Add unit tests for Broxygen config file targets.
  Change Broxygen config file format.
  Broxygen doc-related test updates.  Fix two regressions.
  A couple documentation fixes.
  Integrate new Broxygen functionality into Sphinx.
  Implement majority of Broxygen features delegated to Bro.
  Broxygen can now read a config file specifying particular targets.
  Remove unneeded Broxygen comments in scan.bro.
  Replace safe_basename/safe_dirname w/ SafeBasename/SafeDirname.
  Add BIF interface for retrieving comments/docs.
  Quick optimization to Broxygen doc gathering.
  Flesh out Broxygen doc-gathering skeleton.
  Refactor search_for_file() util function.
  Initial skeleton of new Broxygen infrastructure.
2013-12-04 11:14:19 -08:00
Robin Sommer
bda0c29f66 Restructuring the plugin API to accomodate hooks.
I got rid of the earlier separate InterpreterPlugin class. Instead
Plugin now has a set of virtual methods HookSomething()... that
plugins can override. For efficiency purposes, they however need to
register first that they are interested in a hook, otherwise the
virtual method will never be called. The idea is to extend the set of
hooks over time as we figure out what's useful.

This is a checkpoint commit that's essentially untested and probably
broken. It compiles, though.
2013-11-26 14:04:29 -08:00
Robin Sommer
555df1e7ea Checkpointing the dynamic plugin code.
This is essentially the code from the dynamic-plugin branch except for
some pieces that I have split out into separate, earlier commits.

I'm going to updatre things in this branch going forward.
2013-11-26 14:04:29 -08:00
Jon Siwek
e58865af22 Internal Broxygen organization/documentation/polish. 2013-11-25 14:36:05 -06:00
Jon Siwek
4f6d01000a Implement majority of Broxygen features delegated to Bro.
Still have to update the Sphinx integration.
2013-11-14 14:00:51 -06:00
Jon Siwek
3046013d69 Replace safe_basename/safe_dirname w/ SafeBasename/SafeDirname.
So errors can be better handled.
2013-11-04 11:42:39 -06:00
Jon Siwek
3a99aaaf0a Add BIF interface for retrieving comments/docs.
The new BIFs:
    - get_identifier_comments
    - get_script_comments
    - get_package_readme
    - get_record_field_comments
2013-10-30 16:07:57 -05:00
Jon Siwek
f18436640e Flesh out Broxygen doc-gathering skeleton. 2013-10-22 14:45:47 -05:00
Jon Siwek
90477df973 Refactor search_for_file() util function.
It was getting too bloated and allocated memory in ways that were
difficult to understand how to manage.  Separated out primarily in to
new find_file() and open_file()/open_package() functions.

Also renamed other util functions for path-related things.
2013-10-07 15:01:03 -05:00
Jon Siwek
5a857a6dfc Initial skeleton of new Broxygen infrastructure.
Doesn't generate any docs, but it's hooked in to all places needed to
gather the necessary stuff w/ significantly less coupling than before.

The gathering now always occurs unconditionally to make documentation
available at runtime and a command line switch (-X) only toggles whether
to output docs to disk (reST format).

Should also improve the treatment of type name aliasing which wasn't a
big problem in practice before, but I think it's more correct now:
there's now a distinct BroType for each alias, but extensible types
(record/enum) will automatically update the types for aliases on redef.

Other misc refactoring of note:

    - Removed a redundant/unused way of declaring event types.

    - Changed type serialization format/process to preserve type name
      information and remove compatibility code (since broccoli will
      have be updated anyway).
2013-10-03 10:42:04 -05:00
Jon Siwek
6ad82ff263 Fix invalid/mismatched deallocators. 2013-09-04 14:45:09 -05:00
Robin Sommer
203df4fa6b Merge remote-tracking branch 'origin/topic/jsiwek/869'
* origin/topic/jsiwek/869:
  Change @PATH to @DIR for clarity.  Add @FILENAME.  Addresses #869.
  Make @PATH always return absolute path.  Addresses #869.
  Add @PATH bro script macro.  Addresses #869.

Closes #869.
2013-06-06 12:42:18 -07:00
Jon Siwek
022ce2505f Change @PATH to @DIR for clarity. Add @FILENAME. Addresses #869.
@DIR expands to directory path of the script, @FILENAME expands to just
the script file name without path.
2013-06-05 11:01:11 -05:00
Jon Siwek
7e8b504305 Make @PATH always return absolute path. Addresses #869. 2013-06-04 14:16:56 -05:00
Jon Siwek
307fc187c0 Add @PATH bro script macro. Addresses #869.
The macro expands to a string value containing the file system path
in which the script lives.
2013-06-04 10:53:10 -05:00
Robin Sommer
7b50f97d39 Removing Broxygen's dpd_config magic.
The table doesn't exist anymore. The functionality has been replaced
with a function call but I can't really see how to get it out of
there. We could get it from the analyzer manager, however then we
can't tie it back to a script anymore. What we could do eventually is
add this to the information about the analyzer plugin.
2013-05-16 21:09:44 -07:00
Robin Sommer
2002787c6e A set of interface changes in preparation for merging into BinPAC++
branch.
2013-04-09 17:16:27 -07:00
Robin Sommer
52cd02173d Removing event groups. 2013-04-09 16:49:47 -07:00
Robin Sommer
eef4858692 Fixes for non-OSX. 2013-03-26 13:08:03 -07:00
Robin Sommer
af1809aaa3 First prototype of new analyzer framework.
This is a larger internal change that moves the analyzer
infrastructure to a more flexible model where the available analyzers
don't need to be hardcoded at compile time anymore. While currently
they actually still are, this will in the future enable external
analyzer plugins. For now, it does already add the capability to
dynamically enable/disable analyzers from script-land, replacing the
old Analyzer::Available() methods.

There are three major parts going into this:

    - A new plugin infrastructure in src/plugin. This is independent
      of analyzers and will eventually support plugins for other parts
      of Bro as well (think: readers and writers). The goal is that
      plugins can be alternatively compiled in statically or loadead
      dynamically at runtime from a shared library. While the latter
      isn't there yet, there'll be almost no code change for a plugin
      to make it dynamic later (hopefully :)

    - New analyzer infrastructure in src/analyzer. I've moved a number
      of analyzer-related classes here, including Analyzer and DPM;
      the latter now renamed to Analyzer::Manager. More will move here
      later. Currently, there's only one plugin here, which provides
      *all* existing analyzers. We can modularize this further in the
      future (or not).

    - A new script interface in base/framework/analyzer. I think that
      this will eventually replace the dpm framework, but for now
      that's still there as well, though some parts have moved over.

I've also remove the dpd_config table; ports are now configured via
the analyzer framework. For exmaple, for SSH:

    const ports = { 22/tcp } &redef;

    event bro_init() &priority=5
        {
        ...
        Analyzer::register_for_ports(Analyzer::ANALYZER_SSH, ports);
        }

As you can see, the old ANALYZER_SSH constants have more into an enum
in the Analyzer namespace.

This is all hardly tested right now, and not everything works yet.
There's also a lot more cleanup to do (moving more classes around;
removing no longer used functionality; documenting script and C++
interfaces; regression tests). But it seems to generally work with a
small trace at least.

The debug stream "dpm" shows more about the loaded/enabled analyzers.

A new option -N lists loaded plugins and what they provide (including
those compiled in statically; i.e., right now it outputs all the
analyzers).

This is all not cast-in-stone yet, for some things we need to see if
they make sense this way. Feedback welcome.
2013-03-26 11:05:38 -07:00
Jon Siwek
be71a42f4c Add "fallthrough" keyword, require a flow statement to end case blocks.
Case blocks in switch statements now must end in a break, return, or
fallthrough statement to give best mix of safety, readability, and
flexibility.

The new fallthrough keyword explicitly allows control to be passed to the
next case block in a switch statement.

Addresses #754.
2013-01-16 16:37:50 -06:00
Matthias Vallentin
3ba85567f4 Merge branch 'master' into topic/matthias/opaque
Conflicts:
	aux/broctl
2012-12-13 11:03:17 -08:00
Matthias Vallentin
23ca1c90ef Adapt BiF & Bro parser to handle opaque types. 2012-12-10 18:29:06 -08:00
Daniel Thayer
cb7fd7c87c Remove unused attributes
Removed attributes &postprocessor and &match from documentation
and source code.  Removed undocumented attribute &attr from
source code.  Removed internal attribute (&tracked) from documentation.
2012-12-10 15:43:13 -06:00
Matthias Vallentin
622190b4ef More lexer/parser work. 2012-12-07 22:37:59 -10:00
Matthias Vallentin
aba8275346 Add opaque type to lexer, parser, and BroType. 2012-11-28 19:49:46 -08:00
Jon Siwek
e0fb9eb2b2 Add new function flavor called a "hook".
This new flavor of function behaves like a "synchronous event".
See documentation for more details on usage.
2012-11-15 13:45:13 -06:00
Jon Siwek
46d225cc5b Add parsing rules for IPv4/IPv6 subnet literal constants, addresses #888
This fixes specifying IPv4 subnets in IPv4-mapped-IPv6 format with a
mask length relative to the 128 bits of the mapped IPv6 address.
2012-10-22 15:57:21 -05:00
Daniel Thayer
254715eaaa Remove deprecated attribute &disable_print_hook 2012-09-26 16:47:51 -05:00
Daniel Thayer
5593f339bd Remove unused reserved keyword "this"
Removed unused reserved keyword "this" (a script using it would cause Bro to
segfault).
2012-09-26 13:09:54 -05:00
Daniel Thayer
6f45a8f4ef Fix parsing of integers
This bug was seen on 32-bit systems, where the range of recognized values
was less than the range of hexadecimal values.
2012-09-25 15:26:44 -05:00
Bernhard Amann
f6c9b69eda reorder a few statements in scan.l to make 1.5msecs etc work.
Adresses #872
2012-09-07 10:57:52 -07:00
Robin Sommer
22cf75dae5 Two fixes.
- Typo in recent scanner fix.

    - Make bif.identify_magic robust against FreeBSD's libmagic config.
2012-08-29 08:11:16 -07:00
Bernhard Amann
03f5795095 parse 64-bit consts correctly. 2012-08-28 07:33:05 -07:00
Jon Siwek
dd4dd0ca6e Add @load-sigs directive for loading signature files (addresses #551). 2012-06-01 14:10:23 -05:00