Commit graph

1002 commits

Author SHA1 Message Date
Robin Sommer
91a3ce9518 Additional test output canonification for ds2txt's timestamps. 2012-04-16 15:20:10 -07:00
Robin Sommer
7131feefbc Working on DataSeries support.
- The option to use integers insteads of double was ignored.

   - Renaming script-level options to remove the ds_ prefix.

   - Log rotation didn't work.

   - A set of simple unit tests.
2012-04-09 17:46:56 -07:00
Seth Hall
47f58e6340 Cluster support for the metrics framework returns and all tests work again. 2012-03-28 14:00:59 -04:00
Bernhard Amann
315948dbc8 add test for update functionality of tables where a predicate modifies values / indexes.
Seems to work fine for all cases...
2012-03-23 11:40:59 -07:00
Bernhard Amann
94d439b0cb enable predicate modification of index of value which is currently being added/removed
Todo: test if this works for removal ( I think it should ).
2012-03-22 17:17:41 -07:00
Bernhard Amann
14c6c40042 fix crash when all value fields of imported table are uninitialized. 2012-03-22 10:59:36 -07:00
Bernhard Amann
51ddc9f572 fix bug that crashed input framework when creating already existing stream (tried to free not yet alloccated data) + write twotables test 2012-03-21 15:51:21 -07:00
Bernhard Amann
d39a389201 make optional fields possible for input framework.
This do not have to be present in the input file and are marked as &optional in the record description.

Those can e.g. be used to create field values on the file in a predicate while reading a file - example:

	Input::add_table([$source="input.log", $name="input", $idx=Idx, $val=Val, $destination=servers,
				$pred(typ: Input::Event, left: Idx, right: Val) = { right$notb = !right$b; return T; }
2012-03-20 14:11:59 -07:00
Bernhard Amann
08e1771682 update to execute raw.
support reading from commands by adppending | to the filename.

support streaming reads from command.

Fix something to make rearead work better. (magically happened)
2012-03-20 12:07:37 -07:00
Bernhard Amann
88e0cea598 add execute-mode support to the raw reader - allows to directly call commands and read their output.
Note that fdstream.h is from boost and has a separate license:
 * (C) Copyright Nicolai M. Josuttis 2001.
 * Permission to copy, use, modify, sell and distribute this software
 * is granted provided this copyright notice appears in all copies.
 * This software is provided "as is" without express or implied
 * warranty, and with no claim as to its suitability for any purpose.
2012-03-18 15:31:47 -07:00
Bernhard Amann
bf597012f8 fix some stupid, not that easy to find bugs.
Functionality seems to work completely again - including all tests passing.
2012-03-18 10:50:10 -07:00
Bernhard Amann
29f56b4986 continue finetuning of interface + adjust tests.
streaming + re-reading do not seem to work completely correctly + there are still some strange random crashes.
2012-03-16 23:43:13 -07:00
Bernhard Amann
e59aed6ce3 for seth - reverse order of event arguments 2012-03-16 08:31:19 -07:00
Bernhard Amann
842f635695 give EventDescripion field back to events 2012-03-16 08:10:28 -07:00
Bernhard Amann
367c4b4a7e make raw reading work.
apparently there was a crash in the reader plugin, but main bro did not notice but waited for eternity for it do to something.
2012-03-16 07:53:29 -07:00
Bernhard Amann
57ffe1be77 completely change interface again.
compiles, not really tested.

basic test works 70% of the time, coredumps in the other 30 - but was not easy to debug on a first glance (most interestingly the crash happens in the logging framework - I wonder how that works).
Other tests are not adjusted to the new interface yet.
2012-03-15 18:41:51 -07:00
Bernhard Amann
cd78005d09 Merge remote-tracking branch 'origin/master' into topic/bernhard/input-threads 2012-03-07 13:43:48 -08:00
Robin Sommer
9b83591374 Merge remote-tracking branch 'origin/topic/robin/parallel-btest'
* origin/topic/robin/parallel-btest:
  Updating submodule(s).
  Adding group "comm" to communication tests for parallelizing execution with new btest version.

This is in preparation for the merge with the parallel btest branch.

Conflicts:
	cmake
	testing/btest/istate/pybroccoli.py
	testing/btest/scripts/base/frameworks/control/configuration_update.bro
	testing/btest/scripts/base/frameworks/control/id_value.bro
	testing/btest/scripts/base/frameworks/control/shutdown.bro
	testing/btest/scripts/base/frameworks/metrics/basic-cluster.bro
2012-02-29 17:17:25 -08:00
Bernhard Amann
417542f283 Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads
Seems to work -- all test pass.
But there are thread-safety issues at the moment, because the constructors of IPAddr and IPPrefix are not thread-safe, but needed by workers.

Conflicts:
	src/logging/Manager.cc
2012-02-27 22:59:08 -08:00
Bernhard Amann
d553a3c6f6 fix strange bug when using predicates and events at the same time on a tablefilter.
Testcase is now more involved.
2012-02-23 15:30:39 -08:00
Bernhard Amann
93fac7a4be fix one of the bugs seth found in the input framework.
(bug in PutTable when the table contained only one element and that element should not be wrapped into a record)
2012-02-22 10:46:35 -08:00
Bernhard Amann
7e5f733826 raw input reader for seth, which can simply read a file into string-events given a line separator. 2012-02-22 09:44:45 -08:00
Daniel Thayer
96df1bac40 Add test case for FTP over IPv4 2012-02-21 11:18:43 -06:00
Bernhard Amann
edd30da082 better testcase & fix a few bugs (that took way too long to find). 2012-02-20 15:30:21 -08:00
Bernhard Amann
4126b458ca Automatic file re-refresh and streaming works.
* simple testcase for file refresh (check for changes) and streaming reads
* add events for simple put and delete operations
* fix bugs in table filter events (type for first element was wrong)
* and I think a couple of other small bugs
2012-02-20 13:18:15 -08:00
Bernhard Amann
91943c2655 * rework script interface, add autostart stream flag that starts up a stream automatically when first filter has been added ( probably the most common use case )
* change internal reader interface again
* remove some quite embarassing bugs that must have been in the interface for rather long
* add different read methods to script & internal interface (like normal, streaming, etc). Not implemented in ascii reader yet.
2012-02-16 15:03:20 -08:00
Daniel Thayer
278704f7a3 Add a test for FTP over IPv6 2012-02-16 15:17:55 -06:00
Bernhard Amann
88233efb2c It works. Even including all unit tests.
But: there are still a few places where I am sure that there are race conditions & memory leaks & I do not really like the current interface & I have to add a few more messages between the front and backend.

But - it works :)
2012-02-13 22:29:55 -08:00
Bernhard Amann
4e868d282d Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-13 02:37:02 -08:00
Seth Hall
2cd88ee4f6 Merge remote-tracking branch 'origin/topic/bernhard/software'
* origin/topic/bernhard/software:
  change software framework interface again. At the moment everything should worl.
  start reworking interface of software framework. working apart from detect-webapps.bro, which direcly manipulates a no longer available interface...
  after talking to seth - change host_a field in record back to host.
  forgotten policy files.
  Software framework stores ports for server software.
2012-02-03 16:17:04 -05:00
Bernhard Amann
eacdffff90 Merge remote-tracking branch 'origin/master' into topic/bernhard/software
Conflicts:
	scripts/base/frameworks/software/main.bro
	scripts/policy/protocols/ftp/software.bro
2012-01-20 12:51:58 -08:00
Bernhard Amann
92050af947 Merge remote-tracking branch 'origin/master' into topic/bernhard/input 2012-01-20 12:03:54 -08:00
Jon Siwek
ec6560a6ed Make communication log baseline test more reliable. 2012-01-13 16:06:44 -06:00
Bernhard Amann
5bef49d625 Merge remote-tracking branch 'origin/master' into topic/bernhard/input
Conflicts:
	src/parse.y
2012-01-05 01:11:13 -08:00
Seth Hall
f8ec98625d Merge remote-tracking branch 'origin/topic/robin/pp-alarms'
* origin/topic/robin/pp-alarms:
  The silliest, tiniest little whitespace fixes.
  Update missing in last commit to this branch.
  Adding test for alarm mail.
  Tuning the pretty-printed alarms output.
2012-01-04 13:41:28 -05:00
Jon Siwek
eeceb14c1a Merge branch 'master' into fastpath 2011-12-20 11:45:50 -06:00
Bernhard Amann
59967d40ac Merge remote-tracking branch 'origin/master' into topic/bernhard/input
Conflicts:
	src/LogMgr.cc
	src/LogMgr.h
2011-12-19 12:36:53 -08:00
Jon Siwek
578cd06176 Increase timeout interval of communication-related btests.
This may help clear up some transient test failures on the NMI testbed.
2011-12-19 13:12:02 -06:00
Robin Sommer
3220bbce55 Merge remote branch 'origin/topic/jsiwek/log-escaping'
* origin/topic/jsiwek/log-escaping:
  Add missing ascii writer options to log header.
  Escape the ASCII log's set separator (addresses #712)
  Rewrite ODesc character escaping functionality. (addresses #681)

Closes #712.
2011-12-19 06:37:54 -08:00
Bernhard Amann
dcc7fe3c38 start reworking interface of software framework. working apart from detect-webapps.bro, which direcly manipulates a no longer available interface... 2011-12-09 16:47:58 -08:00
Bernhard Amann
311cd1b116 after talking to seth - change host_a field in record back to host. 2011-12-08 14:25:46 -08:00
Bernhard Amann
7e3ebc1817 forgotten policy files. 2011-12-07 15:03:36 -08:00
Bernhard Amann
9f32f68a13 make test more robust. 2011-12-06 10:50:36 -08:00
Bernhard Amann
4a690484ec make port annotation work and ascii input reader way more rebust with better error messages. 2011-12-06 10:42:37 -08:00
Bernhard Amann
949ec6897a Merge remote-tracking branch 'origin/master' into topic/bernhard/localnet 2011-12-03 20:15:05 -08:00
Robin Sommer
f59c766858 Portability fix for new patch. 2011-12-02 17:00:08 -08:00
Robin Sommer
1e45910b25 Merge remote-tracking branch 'origin/topic/jsiwek/bro-log-suffix'
* origin/topic/jsiwek/bro-log-suffix:
  Teach LogWriterAscii to use BRO_LOG_SUFFIX env. var. (addresses #704)

Closes #704.
2011-12-02 16:52:18 -08:00
Jon Siwek
edc0a451f8 Teach LogWriterAscii to use BRO_LOG_SUFFIX env. var. (addresses #704) 2011-12-01 16:18:56 -06:00
Jon Siwek
0c8b5a712d Add a remote_log_peer event which contains an event_peer record param.
Addresses #493.
2011-12-01 14:07:08 -06:00
Robin Sommer
ebd15cf12e Fixing ASCII logger to escape the unset-field place-holder if written
out literally.
2011-11-29 17:01:47 -08:00