Commit graph

3268 commits

Author SHA1 Message Date
Robin Sommer
dcd675280e Merge remote-tracking branch 'origin/topic/jsiwek/no-switch-fallthrough'
* origin/topic/jsiwek/no-switch-fallthrough:
  Add "fallthrough" keyword, require a flow statement to end case blocks.
  Disable automatic case fallthrough in switch stmts.  Addresses #754.

I've added a test for the error case where no break/fallthrough/return
is given.

Closes #754.
2013-01-23 14:41:23 -08:00
Scott Runnels
adfae5448f Tables with aggregate keys. 2013-01-22 23:37:43 -05:00
Scott Runnels
61e95e8d4e Reorganize to introduce sets, then tables, then vectors. Rewrite of the section on sets. Start of discussion on tables. 2013-01-21 00:19:29 -05:00
Scott Runnels
52eae050d8 documentation of Sets. 2013-01-20 00:27:04 -05:00
Scott Runnels
3fb24ff75c Merge remote-tracking branch 'origin/master' into topic/documentation 2013-01-19 19:40:32 -05:00
Jon Siwek
acafcfafd2 Revert "Trick for parallelizing input framework unit tests."
This reverts commit 43ed437daa.

The old way of doing the tests seems more reliable for now.
2013-01-18 13:15:34 -06:00
Jon Siwek
fdd11428c1 Change reporter messages to more reliably print to stderr.
Moved this functionality to be internal instead of in the script-layer
event handlers.  The issue with the later is that bad things can happen
between the time a reporter event handler is dispatched and the time it
is executed, and if bro crashes in that time, the message may never be
seen/logged.

Addressed #930 (and revisits #836).
2013-01-18 12:46:00 -06:00
Jon Siwek
0a69b87f03 Fix uninitialized locals in event/hook handlers from having a value.
Since values for local variables are referenced by offset within a Frame
(not by identifier name), and event/hook handler bodies share a common
Frame, the value offsets for local variables in different handlers may
overlap.  This meant locals in a handler without an initialization may
actually end up referring to the value of a previous handler's local
that has the same Frame offset.  When executing the body, that can
possibly result in a type-conflict error or give give unexpected
results instead of a "use of uninitialized value" error.

This patch makes it so uninitialized locals do always refer to a null
value before executing the body of a event/hook handler, so that using
them without assigning a value within the body will connsistently give
a "use of uninitialized value" error.

Addresses #932.
2013-01-17 15:21:50 -06:00
Bernhard Amann
0fcc3db9a0 start adding a different text for empty records for the sqlite writer.
Sadly there also seems to be another deadlock issue which I am currently
not really able to figure out - on shutdown sometimes (too often) the main
thread + all sqlite threads wait for semaphores or mutexes.
2013-01-16 18:13:39 -08:00
Jon Siwek
be71a42f4c Add "fallthrough" keyword, require a flow statement to end case blocks.
Case blocks in switch statements now must end in a break, return, or
fallthrough statement to give best mix of safety, readability, and
flexibility.

The new fallthrough keyword explicitly allows control to be passed to the
next case block in a switch statement.

Addresses #754.
2013-01-16 16:37:50 -06:00
Jon Siwek
69bd46b3af Fix coverage unit tests due to added file analysis scripts. 2013-01-16 12:08:09 -06:00
Bernhard Amann
8f71186bf7 no, you will never guess from where I copied this file... 2013-01-15 16:23:48 -08:00
Bernhard Amann
3415b5fcbe make sqlite support more or less work for logging and input
* add support for &type_column for reading
* add basic tests for logging & input
* clean up a bit
* add support for tables for reading (untested)
2013-01-15 16:01:30 -08:00
Jon Siwek
8695053e27 Disable automatic case fallthrough in switch stmts. Addresses #754.
Case bodies now don't require a "break" statement to prevent fallthrough
to case bodies below.  Empty case bodies generate an error message at
parse-time to help indicate the absence of automatic fallthrough; to
associate multiple values with a case, use "case 1, 2:" instead of
"case 1: case 2:".
2013-01-11 11:43:15 -06:00
Scott Runnels
546be58ded Merge remote-tracking branch 'origin/master' into topic/documentation 2013-01-09 13:32:00 -05:00
Scott Runnels
c453c228cb Iteration over vectors. 2013-01-08 15:31:56 -05:00
Scott Runnels
7d583b6b78 Vector declarations and explanations, including btests 2013-01-08 14:47:39 -05:00
Jon Siwek
8b46bbb1c0 Change substring index notation to use a colon (addresses #422).
String slice notation is written as `s[1:2]` instead of `s[1, 2]`
because the later is ambiguous with composite index types.
2013-01-07 13:29:05 -06:00
Seth Hall
89bc65f23c Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2013-01-04 20:49:37 -05:00
Scott Runnels
b8c31458ff Local variables. Baselines and data_type_local.bro btest-able script. 2013-01-03 17:03:45 -05:00
Robin Sommer
5e3c286490 Merge remote-tracking branch 'origin/topic/jsiwek/string-indexing'
* origin/topic/jsiwek/string-indexing:
  Add array-style index accessor for strings.  Addresses #422.

Closes #422.
2012-12-20 17:43:26 -08:00
Robin Sommer
da90976170 Merge remote-tracking branch 'origin/topic/matthias/opaque'
* origin/topic/matthias/opaque:
  Add new unit test for opaque serialization.
  Migrate entropy testing to opaque.
  C++ify RandTest.*
  Fix a hard-to-spot bug.
  Use more descriptive error message.
  Fix the fix :-/.
  Fix initialization of hash values.
  Be clearer about delegation.
  Implement serialization of opaque types.
  Update hash BiF documentation.
  Migrate free SHA* functions to SHA*Val::digest().
  Add missing type name that caused failing tests.
  Update base scripts and unit tests.
  Simplify hash function BiFs.
  Add support for opaque hash values.
  Adapt BiF & Bro parser to handle opaque types.
  More lexer/parser work.
  Implement equivalence relation for opaque types.
  Support basic serialization of opaque.
  Add opaque type to lexer, parser, and BroType.

Closes #925

Conflicts:
	aux/broccoli
2012-12-20 16:30:22 -08:00
Robin Sommer
037085605c Merge remote-tracking branch 'origin/topic/jsiwek/ticket-923'
* origin/topic/jsiwek/ticket-923:
  Improve error for invalid use of types as values (addresses #923).

Close 923.
2012-12-20 15:21:27 -08:00
Robin Sommer
9301589219 Merge remote-tracking branch 'origin/topic/jsiwek/switch-statement'
* origin/topic/jsiwek/switch-statement:
  Finish implementation of script-layer switch statement.  Addresses #754.

Closes #754.
2012-12-20 15:13:30 -08:00
Jon Siwek
55c515d50a Add array-style index accessor for strings. Addresses #422.
The index expression can take up to two indices for the start and end
index of the substring to return (e.g. "mystring[1,3]").  Negative
indices are allowed, with -1 representing the last character in the
string.  The indexing is not cyclic -- if the starting index is >= the
length of the string an empty string is returned, and if the ending
index is >= the length of the string then it's interpreted as the last
index of the string.  Assigning to substrings accessed like this isn't
allowed.
2012-12-20 17:13:06 -06:00
Robin Sommer
ca8a8b09fa Merge remote-tracking branch 'origin/topic/jsiwek/ticket-730'
* origin/topic/jsiwek/ticket-730:
  Fix a case where c$resp$size is misrepresented.  Addresses #730.

Closes #730.
2012-12-20 14:53:43 -08:00
Jon Siwek
939a64b73a Finish implementation of script-layer switch statement. Addresses #754.
They behave like C-style switches except case labels can be comprised
of multiple literal constants delimited by commas.  Only atomic types
are allowed for now.  Case label bodies that don't execute a "return"
or "break" statement will fall through to subsequent cases.  A default
case label is allowed.
2012-12-20 12:49:50 -06:00
Scott Runnels
cce5565d63 Merge remote-tracking branch 'origin/master' into topic/documentation 2012-12-19 23:20:52 -05:00
Scott Runnels
7dc4fd34d3 Merge remote-tracking branch 'origin/master' into topic/documentation 2012-12-19 22:54:23 -05:00
Jon Siwek
98663fd534 Fix return value of hook calls that have no handlers.
For this case, the return value is always true.
2012-12-18 15:31:50 -06:00
Jon Siwek
4a09c12882 Fix to_port() BIF for port strings with a port number of zero. 2012-12-18 15:08:18 -06:00
Jon Siwek
2f0c698ed5 Improve error for invalid use of types as values (addresses #923).
This scripting error can now generate an error message at parse-time
instead of run-time and also includes location information.
2012-12-18 14:31:39 -06:00
Seth Hall
69b7ce12d2 API updates for metrics framework.
- Removed default logging.  Now a function is available for the new
  $period_finished filter field to get the same behavior for logging
  named Metrics::write_log.

- Added index rollups for getting multiple metrics result values
  as the same time.
2012-12-18 01:08:59 -05:00
Seth Hall
69030fdff3 Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-17 10:00:34 -05:00
Jon Siwek
81ae68be16 Fix a case where c$resp$size is misrepresented. Addresses #730.
That field is based on TCP sequence numbers and on seeing a SYN followed
by a failed RST injection response, the initial sequence number tracked
the value in the injection (most likely zero) instead of value in
subsequent SYN response.  This could make c$resp$size be set to large
values when it's not really.

Also removed some dead code paths.
2012-12-14 17:08:50 -06:00
Robin Sommer
ea6b62f586 Merge remote-tracking branch 'origin/topic/jsiwek/const'
* origin/topic/jsiwek/const:
  Make const variables actually constant.  Addresses #922.

Closes #922.
2012-12-14 14:56:37 -08:00
Robin Sommer
7a2901ec6b Fixing checksums in test trace because Bro now reports them. :-) 2012-12-14 14:48:16 -08:00
Matthias Vallentin
69d8d29fbd Add new unit test for opaque serialization.
One Bro begins a computation, another finishes it.

(This commit also fixes a problem with the serialization OpaqueVals.)
2012-12-14 13:05:31 -08:00
Matthias Vallentin
b9d05f56d0 Migrate entropy testing to opaque. 2012-12-13 19:28:19 -08:00
Jon Siwek
290c2a0b4d Make const variables actually constant. Addresses #922.
Both local and global variables declared with "const" could be modified,
but now expressions that would modify them should generate an error
message at parse-time.
2012-12-13 15:05:29 -06:00
Matthias Vallentin
3ba85567f4 Merge branch 'master' into topic/matthias/opaque
Conflicts:
	aux/broctl
2012-12-13 11:03:17 -08:00
Jon Siwek
f6d5da423c Fix record constructors in table initializer indices. Addresses #660.
For an index expression list, ListExpr::InitVal() passed the TypeList
to Expr::InitVal() for each expression element in the list instead of
the type for that element.  This made RecordConstructorExpr::InitVal()
complain since it expects a RecordType and not a TypeList with a
RecordType element as an argument.  In most other cases, Expr::InitVal()
worked because check_and_promote() "flattens" the list to a single type.
2012-12-12 14:52:08 -06:00
Matthias Vallentin
816965f3c7 Merge remote-tracking branch 'origin/master' into topic/matthias/opaque 2012-12-11 16:32:01 -08:00
Matthias Vallentin
30bab14dbf Update base scripts and unit tests. 2012-12-11 16:26:17 -08:00
Jon Siwek
43ed437daa Trick for parallelizing input framework unit tests.
Instead of loading listen.bro to block until files are read, just read
a pcap file in pseudo-realtime.  Seems to work well.
2012-12-11 17:06:54 -06:00
Jon Siwek
aff5898442 Maybe fix reliability of a unit test that relies on when statements. 2012-12-11 16:26:01 -06:00
Robin Sommer
b867333c2e Merge remote-tracking branch 'origin/topic/jsiwek/gtp'
* origin/topic/jsiwek/gtp:
  Change binpac exceptions in AYIYA/GTP analyzers to do protocol_violation
  Add GTP tunnel analyzer memory leak unit test.
  Add GPRS Tunnelling Protocol (GTPv1) decapsulation.

Closes #690.
2012-12-10 14:48:18 -08:00
Robin Sommer
e2d20cb7bc Changing the HTTP parser to accept methods that align with the RFC. 2012-12-07 19:42:03 -08:00
Seth Hall
dda36672ac Merge remote-tracking branch 'origin/master' into topic/seth/metrics-merge 2012-12-06 11:07:35 -05:00
Robin Sommer
57510464a1 Adapting the HTTP request line parsing to only accept methods
consisting of letters [A-Za-z].

I had some bogus HTTP sessions now with the test-suite that reported
data as HTTP because it started with "<!... ". Requiring letters seems
a reasonable constraint.
2012-12-05 16:56:54 -08:00