Commit graph

3268 commits

Author SHA1 Message Date
Jon Siwek
0b32c980bf Update PacketFilter/Discarder code for IP version independence.
The signatures of script-layer functions 'discarder_check_ip',
'discarder_check_tcp', 'discarder_check_udp', and 'discarder_check_icmp'
were changed to use the more general 'pkt_hdr' type as a parameter
instead of individual header types.
2012-03-08 13:12:04 -06:00
Bernhard Amann
cd78005d09 Merge remote-tracking branch 'origin/master' into topic/bernhard/input-threads 2012-03-07 13:43:48 -08:00
Bernhard Amann
7076c64a5e Merge remote-tracking branch 'origin/topic/robin/log-threads' into topic/bernhard/input-threads
(and move a little bit of functionality from ascii reader to backend)

Conflicts:
	src/threading/Manager.cc
2012-03-07 13:42:49 -08:00
Jon Siwek
fef671e4a6 Fix a BRO_PROFILER_FILE/mkstemp portability issue. (addresses #794) 2012-03-02 12:40:25 -06:00
Jon Siwek
ef5e9caaf4 Changes to how script coverage integrates with test suites.
- BRO_PROFILER_FILE now passes .X* templated filenames to mkstemp
  for generating unique coverage state files.  All test suites
  now use this so each Bro instance writes to a unique coverage file.
- Rearranging Makefile targets.  The general rule is that if the
  all/brief target fails out due to a test failure, then the dependent
  coverage target won't run, but can still be invoked directly later.
  (e.g. make brief || make coverage)
2012-03-01 13:00:44 -06:00
Robin Sommer
92ed583ee7 Adding btest group "leaks" to leak tests.
This will make it easier to run just the leak tests.
2012-02-29 17:19:38 -08:00
Robin Sommer
9b83591374 Merge remote-tracking branch 'origin/topic/robin/parallel-btest'
* origin/topic/robin/parallel-btest:
  Updating submodule(s).
  Adding group "comm" to communication tests for parallelizing execution with new btest version.

This is in preparation for the merge with the parallel btest branch.

Conflicts:
	cmake
	testing/btest/istate/pybroccoli.py
	testing/btest/scripts/base/frameworks/control/configuration_update.bro
	testing/btest/scripts/base/frameworks/control/id_value.bro
	testing/btest/scripts/base/frameworks/control/shutdown.bro
	testing/btest/scripts/base/frameworks/metrics/basic-cluster.bro
2012-02-29 17:17:25 -08:00
Robin Sommer
bfeca444db Sorting all output for the external tests.
Let's see how this goes. The script keeps comments at the beginning.
2012-02-29 17:09:38 -08:00
Bernhard Amann
417542f283 Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads
Seems to work -- all test pass.
But there are thread-safety issues at the moment, because the constructors of IPAddr and IPPrefix are not thread-safe, but needed by workers.

Conflicts:
	src/logging/Manager.cc
2012-02-27 22:59:08 -08:00
Robin Sommer
36d46efa68 Merge remote-tracking branch 'origin/topic/jsiwek/broccoli-ipv6'
* origin/topic/jsiwek/broccoli-ipv6:
  Update/add tests for broccoli IPv6 addr/subnet support (addresses #448)
2012-02-27 21:15:41 -08:00
Jon Siwek
e07470c7f1 Remove connection compressor (addresses #559). 2012-02-27 11:35:25 -06:00
Robin Sommer
d2b2157454 Fixing merge relict. 2012-02-24 15:52:15 -08:00
Robin Sommer
2eeac54857 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Add to_subnet bif (fixes #782).
  Refactor IPAddr v4 initialization from string. (fixes #775)

Closes #782.
Closes #775.
Closes #784.
2012-02-24 15:26:18 -08:00
Robin Sommer
3323692771 Merge remote-tracking branch 'origin/topic/jsiwek/ipaddr-refactoring'
* origin/topic/jsiwek/ipaddr-refactoring:
  Refactoring various usages of new IPAddr class.

Conflicts:
	src/bro.bif

Closes #784.
2012-02-24 15:21:57 -08:00
Robin Sommer
4ef8607e60 Merge remote-tracking branch 'origin/topic/dnthayer/ftp-ipv6'
* origin/topic/dnthayer/ftp-ipv6:
  Add test case for FTP over IPv4
  Fix IPv6 URLs
  Add a test for FTP over IPv6
  Update FTP EPSV response processing for IPv6
  Fix parsing of FTP EPRT command and EPSV response

Conflicts:
	src/bro.bif

Closes #778.
2012-02-24 15:00:41 -08:00
Jon Siwek
32aabe8432 Add to_subnet bif (fixes #782).
Also fix IPAddr::Mask/ReverseMask not allowing argument of 0.

And clarified return value of to_addr bif when the input string
does not parse into a valid IP address.
2012-02-24 12:34:29 -06:00
Bernhard Amann
d553a3c6f6 fix strange bug when using predicates and events at the same time on a tablefilter.
Testcase is now more involved.
2012-02-23 15:30:39 -08:00
Jon Siwek
14ccd6436f Update/add tests for broccoli IPv6 addr/subnet support (addresses #448) 2012-02-23 16:55:19 -06:00
Jon Siwek
d7dafe2fe2 Refactoring various usages of new IPAddr class.
Reducing number of places that internal representation was exposed
via GetBytes/CopyIPv6.

Also fixed a bug in remask_addr bif.
2012-02-22 14:45:44 -06:00
Bernhard Amann
93fac7a4be fix one of the bugs seth found in the input framework.
(bug in PutTable when the table contained only one element and that element should not be wrapped into a record)
2012-02-22 10:46:35 -08:00
Bernhard Amann
7e5f733826 raw input reader for seth, which can simply read a file into string-events given a line separator. 2012-02-22 09:44:45 -08:00
Daniel Thayer
96df1bac40 Add test case for FTP over IPv4 2012-02-21 11:18:43 -06:00
Bernhard Amann
edd30da082 better testcase & fix a few bugs (that took way too long to find). 2012-02-20 15:30:21 -08:00
Bernhard Amann
fe5b376d28 ...and update for table event testcase after fix. 2012-02-20 13:23:25 -08:00
Bernhard Amann
4126b458ca Automatic file re-refresh and streaming works.
* simple testcase for file refresh (check for changes) and streaming reads
* add events for simple put and delete operations
* fix bugs in table filter events (type for first element was wrong)
* and I think a couple of other small bugs
2012-02-20 13:18:15 -08:00
Jon Siwek
b66b74e5dc Decrease strictness of parsing IPv4 strings into addrs. (fixes #775)
IPv4 strings in dotted-decimal format with decimal parts containing
leading zeroes now parse better.
2012-02-20 14:28:42 -06:00
Daniel Thayer
d61fad4f9e Fix IPv6 URLs 2012-02-17 10:55:17 -06:00
Bernhard Amann
91943c2655 * rework script interface, add autostart stream flag that starts up a stream automatically when first filter has been added ( probably the most common use case )
* change internal reader interface again
* remove some quite embarassing bugs that must have been in the interface for rather long
* add different read methods to script & internal interface (like normal, streaming, etc). Not implemented in ascii reader yet.
2012-02-16 15:03:20 -08:00
Daniel Thayer
278704f7a3 Add a test for FTP over IPv6 2012-02-16 15:17:55 -06:00
Bernhard Amann
88233efb2c It works. Even including all unit tests.
But: there are still a few places where I am sure that there are race conditions & memory leaks & I do not really like the current interface & I have to add a few more messages between the front and backend.

But - it works :)
2012-02-13 22:29:55 -08:00
Bernhard Amann
4e868d282d Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-13 02:37:02 -08:00
Jon Siwek
086f747bc1 Add counts_to_addr and addr_to_counts conversion BIFs. 2012-02-09 15:32:57 -06:00
Jon Siwek
f945f3c518 Change HashKey threshold for using H3 to 36 bytes.
This is enough to accommodate using H3 instead of HMAC/MD5 for IPv6
Conn::Key's and performs better since a hash happens for every packet.
2012-02-09 12:55:55 -06:00
Daniel Thayer
d3e432e8dd Add a test and baseline for addr_to_ptr_name BiF. 2012-02-08 11:23:02 -06:00
Seth Hall
161ad1a3df Adding a test and baseline for ptr_name_to_addr BiF. 2012-02-07 20:57:18 -05:00
Bernhard Amann
f6c6387c52 Merge branch 'topic/bernhard/input' into topic/bernhard/input-threads
most stuff is inplace, logging framework needs a few changes merged before continuing here...

Conflicts:
	src/CMakeLists.txt
	src/LogMgr.h
	src/logging/Manager.cc
	src/main.cc
2012-02-06 10:54:07 -08:00
Jon Siwek
2e2f8f5d06 Merge branch 'master' into topic/v6-addr
Conflicts:
	src/bro.bif
2012-02-06 11:06:55 -06:00
Jon Siwek
b3f1f45082 Remove --enable-brov6 flag, IPv6 now supported by default.
Internally, all BROv6 preprocessor switches were removed and
addr/subnet representations wrapped in the new IPAddr/IPPrefix classes.

Some script-layer changes of note:

- dns_AAAA_reply event signature changed: the string representation
  of an IPv6 addr is easily derived from the addr value, it doesn't
  need to be another parameter.  This event also now generated directly
  by the DNS analyzer instead of being "faked" into a dns_A_reply event.

- removed addr_to_count BIF.  It used to return the host-order
  count representation of IPv4 addresses only.  To make it more
  generic, we might later add a BIF to return a vector of counts
  in order to support IPv6.

- changed the result of enclosing addr variables in vertical pipes
  (e.g. |my_addr|) to return the bit-width of the address type which
  is 128 for IPv6 and 32 for IPv4.  It used to function the same
  way as addr_to_count mentioned above.

- remove bro_has_ipv6 BIF
2012-02-03 16:46:58 -06:00
Seth Hall
2cd88ee4f6 Merge remote-tracking branch 'origin/topic/bernhard/software'
* origin/topic/bernhard/software:
  change software framework interface again. At the moment everything should worl.
  start reworking interface of software framework. working apart from detect-webapps.bro, which direcly manipulates a no longer available interface...
  after talking to seth - change host_a field in record back to host.
  forgotten policy files.
  Software framework stores ports for server software.
2012-02-03 16:17:04 -05:00
Daniel Thayer
4a6a9fe9f2 Fix sorting of lines in Brofiler coverage.log
Lines with a range were being output with text "lines", and so were
being listed after all other lines belonging to the same Bro script
(e.g., "lines 123-125" was listed after "line 492").  Fixed by using
the text "line" instead of "lines".

Line numbers with fewer digits were being listed after line numbers
with more digits (e.g., "line 85" was listed after "line 237").
Fixed by sorting on a reformatted string (this string does not appear
in the output) where line numbers are right justified (padded on left
with spaces) so that sorting produces the expected results.
2012-01-30 17:35:19 -06:00
Jon Siwek
0065cf6148 Fix mktemp portability issue affecting test coverage. (addresses #752)
Also update Makefiles to behave better for brief targets and in absence
of external test repos.
2012-01-27 11:01:50 -06:00
Robin Sommer
f6f9dd952f Fixed for Brofiler merge. 2012-01-26 20:55:24 -08:00
Robin Sommer
d6767e1d83 Disalbing brofiling because of problem.
See #756.
2012-01-25 17:36:13 -08:00
Robin Sommer
6a6092daf8 Adding coverage to brief make target as well. 2012-01-25 17:35:25 -08:00
Robin Sommer
848ae2355e Merge remote-tracking branch 'origin/topic/jsiwek/brofiler'
* origin/topic/jsiwek/brofiler:
  Fix superfluous/duplicate data getting in to testing coverage log.
  Add "# @no-test" tag to blacklist statements from test coverage analysis.
  Test coverage integration for external tests and complete suite.
  Integrate Bro script coverage profiling with the btest suite.
  Add simple profiling class to accumulate Stmt usage stats across runs.

Renaming environment variable BROFILER_FILE to BRO_PROFILER_FILE for
consistency. Yeah, I know, such a nice name! :)
2012-01-25 17:12:37 -08:00
Robin Sommer
7a8c9b1c69 Merge remote-tracking branch 'origin/topic/jsiwek/local-table-init'
* origin/topic/jsiwek/local-table-init:
  Allow local table variables to be initialized with {} list expressions.

Closes #739.
2012-01-25 13:47:42 -08:00
Jon Siwek
1e4c3d8ea2 Teach CompHash to allow indexing by records with vector/table/set fields.
Addresses #464.
2012-01-20 16:54:48 -06:00
Bernhard Amann
eacdffff90 Merge remote-tracking branch 'origin/master' into topic/bernhard/software
Conflicts:
	scripts/base/frameworks/software/main.bro
	scripts/policy/protocols/ftp/software.bro
2012-01-20 12:51:58 -08:00
Bernhard Amann
92050af947 Merge remote-tracking branch 'origin/master' into topic/bernhard/input 2012-01-20 12:03:54 -08:00
Jon Siwek
0287f7adc2 Fix superfluous/duplicate data getting in to testing coverage log. 2012-01-18 11:45:53 -06:00