Commit graph

10798 commits

Author SHA1 Message Date
Robin Sommer
abb506ec63 Merge branch 'master' into topic/robin/log-threads 2012-02-12 08:50:47 -08:00
Daniel Thayer
74899e29fe Update FTP EPSV response processing for IPv6 2012-02-10 16:55:15 -06:00
Robin Sommer
357cdd3f8d Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix minor typos in the documentation
  Fix compiler warning about Brofiler ctor init list order.
2012-02-10 00:04:02 -08:00
Daniel Thayer
c0f05f57a7 Fix a minor typo in documentation 2012-02-09 18:50:21 -06:00
Daniel Thayer
42d6440bb2 Fix parsing of FTP EPRT command and EPSV response 2012-02-09 18:34:41 -06:00
Jon Siwek
086f747bc1 Add counts_to_addr and addr_to_counts conversion BIFs. 2012-02-09 15:32:57 -06:00
Jon Siwek
f945f3c518 Change HashKey threshold for using H3 to 36 bytes.
This is enough to accommodate using H3 instead of HMAC/MD5 for IPv6
Conn::Key's and performs better since a hash happens for every packet.
2012-02-09 12:55:55 -06:00
Jon Siwek
303f02d6f8 Inline some IPAddr methods. 2012-02-09 12:53:37 -06:00
Daniel Thayer
3ff0eed3fc Remove mention of --enable-brov6 in docs 2012-02-08 17:30:54 -06:00
Daniel Thayer
a28e671f8d Fix minor typos in the documentation 2012-02-08 14:16:29 -06:00
Seth Hall
d5107af1f3 Merge remote-tracking branch 'origin/topic/jsiwek/detect-webapps-fix'
* origin/topic/jsiwek/detect-webapps-fix:
  Fix missing optional field access in webapp signature_match handler.
2012-02-08 14:53:51 -05:00
Daniel Thayer
d3e432e8dd Add a test and baseline for addr_to_ptr_name BiF. 2012-02-08 11:23:02 -06:00
Jon Siwek
26731b1b58 Fix missing optional field access in webapp signature_match handler. 2012-02-08 10:37:00 -06:00
Seth Hall
161ad1a3df Adding a test and baseline for ptr_name_to_addr BiF. 2012-02-07 20:57:18 -05:00
Jon Siwek
9ab5180aa9 Fix compiler warning about Brofiler ctor init list order. 2012-02-07 16:25:28 -06:00
Daniel Thayer
31565d6987 Fix the ptr_name_to_addr BiF to work with IPv6 2012-02-07 16:15:13 -06:00
Jon Siwek
5ad0bab9b0 Fix a memory leak that perftools now complains about. 2012-02-07 14:27:40 -06:00
Jon Siwek
6c2351aa74 Merge branch 'topic/v6-addr' of git://git.bro-ids.org/bro into topic/v6-addr 2012-02-07 11:53:27 -06:00
Jon Siwek
4cb6a279f5 Add extra guard against non-IP, non-ARP packets being parsed as IPv6.
This would usually manifest in raising truncated_IP weirds, which is
misleading because it wasn't actually an IP packet in the first place.
Now unknown_packet_type weird is raised instead.
2012-02-07 11:42:55 -06:00
Bernhard Amann
8385d5bb2d it compiles :)
But that's all, not tested, don't expect it to do anything but crash.
2012-02-06 17:37:02 -08:00
Bernhard Amann
238e9545c0 Merge remote-tracking branch 'origin/topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-06 16:15:22 -08:00
Bernhard Amann
833e724400 way less compile errors. 2012-02-06 16:14:39 -08:00
Bernhard Amann
e22d396229 typo 2012-02-06 13:53:33 -08:00
Bernhard Amann
f76bbf01a4 fix CreateBackend function - the way that the right backend was chosen & backends were initialized did not make sense... 2012-02-06 13:15:01 -08:00
Seth Hall
eca3261077 Protocol field for NULL encapsulation was read big endian. 2012-02-06 15:49:03 -05:00
Bernhard Amann
e726bfe301 Merge branch 'topic/bernhard/log-threads' into topic/bernhard/input-threads 2012-02-06 12:16:55 -08:00
Bernhard Amann
115e6a18b4 Merge branch 'topic/bernhard/log-send-proto' into topic/bernhard/log-threads
Send protocol type to log writers - the ascii writer simply ignores this, but the input reader needs support for this.

Conflicts:
	src/LogMgr.h
	src/logging/Manager.cc
2012-02-06 11:08:32 -08:00
Jon Siwek
1f58ac875b Fix some hashing bugs resulting from adaptation of new IPAddr class. 2012-02-06 13:05:52 -06:00
Bernhard Amann
23b2c95644 backend does not need friend access to manager 2012-02-06 10:57:07 -08:00
Bernhard Amann
f6c6387c52 Merge branch 'topic/bernhard/input' into topic/bernhard/input-threads
most stuff is inplace, logging framework needs a few changes merged before continuing here...

Conflicts:
	src/CMakeLists.txt
	src/LogMgr.h
	src/logging/Manager.cc
	src/main.cc
2012-02-06 10:54:07 -08:00
Jon Siwek
2e2f8f5d06 Merge branch 'master' into topic/v6-addr
Conflicts:
	src/bro.bif
2012-02-06 11:06:55 -06:00
Daniel Thayer
fe5d865e64 Remove --enable-brov6 from configure usage text 2012-02-03 18:06:02 -06:00
Jon Siwek
b3f1f45082 Remove --enable-brov6 flag, IPv6 now supported by default.
Internally, all BROv6 preprocessor switches were removed and
addr/subnet representations wrapped in the new IPAddr/IPPrefix classes.

Some script-layer changes of note:

- dns_AAAA_reply event signature changed: the string representation
  of an IPv6 addr is easily derived from the addr value, it doesn't
  need to be another parameter.  This event also now generated directly
  by the DNS analyzer instead of being "faked" into a dns_A_reply event.

- removed addr_to_count BIF.  It used to return the host-order
  count representation of IPv4 addresses only.  To make it more
  generic, we might later add a BIF to return a vector of counts
  in order to support IPv6.

- changed the result of enclosing addr variables in vertical pipes
  (e.g. |my_addr|) to return the bit-width of the address type which
  is 128 for IPv6 and 32 for IPv4.  It used to function the same
  way as addr_to_count mentioned above.

- remove bro_has_ipv6 BIF
2012-02-03 16:46:58 -06:00
Bernhard Amann
a0487ecb30 move Value and Field from the logging namespace to the threading namespace, because other modules using threading will need them. 2012-02-03 14:12:29 -08:00
Seth Hall
600d015dab One more very minor change I forgot to commit. 2012-02-03 16:27:51 -05:00
Seth Hall
0fbe925dc5 Fixed a misspelling. 2012-02-03 16:25:30 -05:00
Seth Hall
44bb4d0320 Updates for CHANGES and VERSION files. 2012-02-03 16:17:45 -05:00
Seth Hall
2cd88ee4f6 Merge remote-tracking branch 'origin/topic/bernhard/software'
* origin/topic/bernhard/software:
  change software framework interface again. At the moment everything should worl.
  start reworking interface of software framework. working apart from detect-webapps.bro, which direcly manipulates a no longer available interface...
  after talking to seth - change host_a field in record back to host.
  forgotten policy files.
  Software framework stores ports for server software.
2012-02-03 16:17:04 -05:00
Robin Sommer
819cb57952 Updating submodule(s).
[nomail]
2012-02-03 04:05:34 -08:00
Robin Sommer
70fe7876a1 Updating thread naming.
Also includes experimental code to adapt the thread name as shown by
top, but it's untested.
2012-02-03 04:04:38 -08:00
Robin Sommer
cf6a346b86 Fixing prof.log output.
The queue Size() method was not yet atomic.
2012-02-03 04:04:38 -08:00
Robin Sommer
4879cb7b0d Improved signal handling.
Sending SIGTERM triggers a normal shutdown of all threads that waits
until they have processed their remaining data. However, sending a 2nd
SIGTERM while waiting for them to finish will immediately kill them
all.
2012-02-03 04:04:38 -08:00
Robin Sommer
ffb4094d36 Bugfixes 2012-02-03 04:04:38 -08:00
Robin Sommer
29fc56105d Documenting logging API. 2012-02-03 04:04:37 -08:00
Robin Sommer
1058e11ffb Adding thread statistics to prof.log 2012-02-03 04:04:37 -08:00
Robin Sommer
4f0fc571ef Doing bulkd writes instead of individual writes now.
Also slight change to Writer API, going back to how the rotate methods
were before.
2012-02-03 04:04:37 -08:00
Robin Sommer
a428645b2a Documenting the threading/* classes.
Also switching from semaphores to mutexes as the former don't seem to
be fully supported on MacOS.
2012-02-03 04:04:37 -08:00
Robin Sommer
396e8c901c Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix minor typos in documentation
2012-02-03 01:56:30 -08:00
Daniel Thayer
1d417a3e23 Fix minor typos in documentation 2012-02-02 18:48:23 -06:00
Robin Sommer
9c9b72a1b8 Merge remote-tracking branch 'origin/fastpath'
* origin/fastpath:
  Fix sorting of lines in Brofiler coverage.log
2012-01-31 11:51:25 -08:00