Commit graph

42 commits

Author SHA1 Message Date
Robin Sommer
b449d5652d Merge remote-tracking branch 'remotes/origin/topic/robin/broccoli-connrec'
* remotes/origin/topic/robin/broccoli-connrec:
  Adapting attribute serialization when talking to Broccoli.
2011-12-03 15:57:39 -08:00
Robin Sommer
df3ae4b30d Merge remote-tracking branch 'origin/topic/jsiwek/remote-log-peer'
* origin/topic/jsiwek/remote-log-peer:
  Add a remote_log_peer event which contains an event_peer record param.

Closes #493.
2011-12-01 16:02:11 -08:00
Jon Siwek
0c8b5a712d Add a remote_log_peer event which contains an event_peer record param.
Addresses #493.
2011-12-01 14:07:08 -06:00
Robin Sommer
18d968adcd Adapting attribute serialization when talking to Broccoli.
Broccoli doesn't support expressions, and we now no longer send them
when serializing attributes. This is the Bro change mentioned in #606.
It's needs a correspondinly modified Broccoli identifying itself as
such, and it isn't tested yet ...

Addresses #606.
2011-12-01 11:52:01 -08:00
Jon Siwek
d750c3ba74 Promote libz and libmagic to required dependencies. 2011-11-11 12:39:00 -06:00
Robin Sommer
3b1f13b861 Merge remote-tracking branch 'origin/topic/jsiwek/compiler-warnings'
* origin/topic/jsiwek/compiler-warnings:
  Fixing compiler warnings (addresses #388)
2011-11-03 15:18:11 -07:00
Jon Siwek
cec4600d2e Fixing compiler warnings (addresses #388) 2011-11-01 14:44:38 -05:00
Robin Sommer
c8dfdb4492 Merge remote-tracking branch 'origin/topic/robin/interpreter-exceptions'
* origin/topic/robin/interpreter-exceptions:
  Adding test for new error handling.
  Experimental code to better handle interpreter errors.

This seems to work fine and it catches some potentially nasty crashes
so I'm merging it in even though it's not the final word on error
handling yet. #646 tracks the work scheduled for later.
2011-10-21 10:35:32 -07:00
Robin Sommer
63b46a0ae2 Fixing a bunch of format strings.
Also leveraging GCC if available to check format specificier.

Closes #567.
2011-10-18 17:39:40 -07:00
Robin Sommer
15ab287436 Experimental code to better handle interpreter errors.
Currently, a lot of interpreter runtime errors, such as an access to
an unset optional record field, cause Bro to abort with an internal
error. This is an experimental branch that turns such errors into
non-fatal runtime errors by internally raising exceptions. These are
caught upstream and processing continues afterwards.

For now, not many errors actually raise exceptions (the example above
does though). We'll need to go through them eventually and adapt the
current Internal() calls (and potentially others). More generally, at
some point we should cleanup the interpreter error handling (unifying
errors reported at parse- and runtime; and switching to exceptions for
all Expr/Stmt/Vals). But that's a larger change and left for later.

The main question for now is if this code is already helpful enough to
go into 2.0. It will quite likely prevent a number of crashes due to
script errors.
2011-10-09 20:28:06 -07:00
Robin Sommer
f1ae48ea53 Remote logs are auto-flushed if the last write was longer than a
second ago. Addresses #498.
2011-10-06 17:40:35 -07:00
Robin Sommer
91ed9ffa8f Fixing a bunch of memory leaks.
Courtesy of perftools. Most are not really relevant but cleanup  the
perftools output. There was a big one in the logging code as well
though.
2011-09-29 22:53:07 -07:00
Robin Sommer
d289db34db Communication fix and extension.
- Removing unnecessary log flushing. Closes #498.

- Adding new BiF disconnect() that shuts a connection to a peer down.

- terminate_connection() now first flushes any still buffered log
  messages.
2011-09-24 21:23:25 -07:00
Robin Sommer
bd2e30f521 Merge remote-tracking branch 'origin/topic/dist-cleanup'
* origin/topic/dist-cleanup:
  Updating INSTALL
  Updating README
  Remove $Id$ tags
  Remove policy.old directory, adresses #511
2011-09-18 16:17:42 -07:00
Robin Sommer
103396f6d3 Communication must now be enabled explicitly.
The communication subsystem is now disabled until a new BiF,
enable_communication(), is called. The base scripts do this
automatically when either a Communication::Node is defined, or Bro is
asked to listen for incoming connections.
2011-08-08 13:49:50 -07:00
Jon Siwek
495e987938 Remove $Id$ tags 2011-08-04 15:21:18 -05:00
Jon Siwek
648e1bda26 Fix &raw_output and enable_raw_output interpretation of NUL characters
When using a `print` statement to write to a file that has raw output
enabled, NUL characters in string are no longer interpreted into "\0",
no newline is appended afterwards, and each argument to `print` is
written to the file without any additional separation.

(Re)Assigning to identifiers with the &raw_output attribute should also
now correctly apply the attribute to the file value being assigned.

Note that the write_file BiF should already be capable of raw string
data to a file, expect it bypasses the print_hook event.

Addresses #474
2011-08-03 10:51:40 -05:00
Robin Sommer
38bc560358 Fixing 0-chunk bug in remote logging. 2011-07-19 17:40:07 -07:00
Robin Sommer
8432258db0 Merge remote branch 'origin/topic/jsiwek/pybroccoli-fixes'
* origin/topic/jsiwek/pybroccoli-fixes:
  Move event arg. record coercion check; now only done for recv'd remote events
  Update istate.pybroccoli test.
2011-07-01 18:56:27 -07:00
Robin Sommer
4580bef3e6 Fixing bugs in communication.
- The reporter can't be used from the child process.

- Don't attempt to send a zero-sized chunk when remote print buffer is
  empty.
2011-07-01 18:49:15 -07:00
Robin Sommer
66e2c3b623 Renaming the Logger to Reporter.
Also changing output to not include timestamps when we haven't started
processing packets yet.
2011-07-01 09:22:33 -07:00
Jon Siwek
f24a67d662 Move event arg. record coercion check; now only done for recv'd remote events 2011-06-27 17:11:14 -05:00
Robin Sommer
93894eed9b Overhauling the internal reporting of messages to the user.
The Logger class is now in charge of reporting all errors, warnings,
informational messages, weirds, and syslogs. All other components
route their messages through the global bro_logger singleton.

The Logger class comes with these reporting methods:

    void Message(const char* fmt, ...);
    void Warning(const char* fmt, ...);
    void Error(const char* fmt, ...);
    void FatalError(const char* fmt, ...); // Terminate Bro.
    void Weird(const char* name);
    [ .. some more Weird() variants ... ]
    void Syslog(const char* fmt, ...);
    void InternalWarning(const char* fmt, ...);
    void InternalError(const char* fmt, ...); // Terminates Bro.

See Logger.h for more information on these.

Generally, the reporting now works as follows:

    - All non-fatal message are reported in one of two ways:

        (1) At startup (i.e., before we start processing packets),
            they are logged to stderr.

        (2) During processing, they turn into events:

            event log_message%(msg: string, location: string%);
            event log_warning%(msg: string, location: string%);
            event log_error%(msg: string, location: string%);

            The script level can then handle them as desired.

            If we don't have an event handler, we fall back to
            reporting on stderr.

    - All fatal errors are logged to stderr and Bro terminates
      immediately.

    - Syslog(msg) directly syslogs, but doesn't do anything else.

The three main types of messages can also be generated on the
scripting layer via new Log::* bifs:

    Log::error(msg: string);
    Log::warning(msg: string);
    Log::message(msg: string);

These pass through the bro_logger as well and thus are handled in the
same way. Their output includes location information.

More changes:

    - Removed the alarm statement and the alarm_hook event.

    - Adapted lots of locations to use the bro_logger, including some
      of the messages that were previously either just written to
      stdout, or even funneled through the alarm mechanism.

    - No distinction anymore between Error() and RunTime(). There's
      now only one class of errors; the line was quite blurred already
      anyway.

    - util.h: all the error()/warn()/message()/run_time()/pinpoint()
      functions are gone. Use the bro_logger instead now.

    - Script errors are formatted a bit differently due to the
      changes. What I've seen so far looks ok to me, but let me know
      if there's something odd.

Notes:

    - The default handlers for the new log_* events are just dummy
      implementations for now since we need to integrate all this into
      the new scripts anyway.

    - I'm not too happy with the names of the Logger class and its
      instance bro_logger. We now have a LogMgr as well, which makes
      this all a bit confusing. But I didn't have a good idea for
      better names so I stuck with them for now.

      Perhaps we should merge Logger and LogMgr?
2011-06-25 16:40:54 -07:00
Jon Siwek
35b7caf44f Fix compile errors possible on some platforms.
Include <algorithm> in some sources that require it; addresses #430

Places where STL's min() template function could get used with
arguments of differing types can fail to deduce the right template type.
These are fixed with some type tweaking of local variables and also
giving an explicit template argument for good measure.
2011-05-08 19:53:41 -05:00
Robin Sommer
714289bd13 Changing the HTTP's analyzers internals to use 64-bit integers.
(Gregor Maier).

This is the patch from #326, plus some cleanup.
2011-04-27 21:25:51 -07:00
Robin Sommer
13a492091f Merge remote branch 'origin/topic/robin/logging-internals'
Includes some additional cleanup.
2011-04-20 21:30:41 -07:00
Robin Sommer
c132506203 Merge branch 'topic/robin/record-table-default' into topic/robin/logging-internals
Includes additional fixes for the &default attribute's type checking.
2011-04-17 12:03:58 -07:00
Robin Sommer
4677174aa4 Merge remote branch 'origin/topic/robin/comm-ssl'
The merge does not include the hack to switch back to 32-bit for
Broccoli. It does contain a version of the SSL tests converted to
btest, which however doesn't pass yet (as some of the others as well)

* origin/topic/robin/comm-ssl:
  Fixing crashes when SSL is not configured correctly.
  Adding a test for SSL-based communciation to the istate testsuite.
2011-04-01 15:57:07 -07:00
Robin Sommer
3f413a2539 Remote logging for the new logging framework.
It works with a simple example, but that's as much testing as it has
seen so far.

Remote::Destination has a new attribute "request_logs: bool"
indicating whether we are interested in the peer's log. Default is
false. If true, Bro will send an explicit "I want your logs" message
over to the other side, which will then start sending log records
back.

When such log records are received, they will be recorded exactly in
the same way as on the remote side, i.e., same fields/writer/path. All
filtering is already performed on the remote side.

Log::Filter has two new attributes, "log_local: bool" and
"log_remote: bool" (both true by default). If log_local is false, this
filter will not record anything locally but still process everything
normally otherwise and potentially forward to remote. If log_remote is
false, this filter will never send anything to remote even if a peer
has requested logs. (Note that with the defaults, requesting logs will
mean getting everything.)

Note that with log forwarding, *both* sides must create the
Filter::Stream. If the remote sends log records for a specific stream,
but the local side hasn't created it, the data will be discarded.
Filtes on the other hand shouldn't created locally; and if they are,
they are ignored for records received from remote).
2011-03-03 16:45:29 -08:00
Gregor Maier
fc6fcded07 Fixing compiler warnings 2011-02-25 21:15:22 -08:00
Robin Sommer
ff740f153c Fixing file detector leak in remote communication module.
This addresses #400.
2011-02-25 17:04:29 -08:00
Robin Sommer
2f7fa3470b Merge remote branch 'origin/topic/seth/fix-compiler-warnings'
* origin/topic/seth/fix-compiler-warnings:
  Fixed problem with PRI macros.
  PRI macros are currently not working for some reason.
  Two more small compile time error fixes.
  Cleaned up the output from running binpac.
  Added line to expect shift/reduce errors in parse.in
  Cleaned up g++ warnings.

Addition: I fixed a few more warnings I was getting, and tweaked some
of the existing changes slightly.
2011-02-09 08:10:41 -08:00
Seth Hall
b54445b725 Fixed problem with PRI macros.
Thanks Gregor!
2011-02-08 20:28:56 -05:00
Seth Hall
275c6e64cc PRI macros are currently not working for some reason. 2011-02-08 12:47:10 -05:00
Robin Sommer
7f4e13248d Fixing crashes when SSL is not configured correctly. 2011-02-07 22:13:29 -08:00
Robin Sommer
4d12ac861d Smarter way to increase the parent/child pipe's socket buffer. (Craig
Leres).

This is from #383.
2011-02-04 17:58:19 -08:00
Seth Hall
05f27c5441 Fixed a small problem in the remote serialization code.
This is from ticket #86.  It needs verified, but everything
seemed to work the same (except for the bug!) with the
change.
2011-01-20 16:30:16 -05:00
Seth Hall
ef1650f6a2 Cleaned up g++ warnings. 2011-01-20 15:07:24 -05:00
Robin Sommer
dc5d3560f7 Merge with Subversion repository as of r7137. Incorporated change:
* Fix for packet processing resumption when a remote Bro dies
      during state synchronization (Robin Sommer).
2010-12-08 04:10:26 -08:00
Jon Siwek
2bd8f42c15 Changes to make OpenSSL a requirement.
Preprocessor conditionals dependent on definition of USE_OPENSSL have been
straightened out.
2010-11-17 20:38:33 -06:00
Jon Siwek
59aaaf7ed5 Changed some autoconf-dependent preprocessor directives from #if to #ifdef.
Because it just results in less typing in CMake when not having to configure
a preprocessor definition to a specific value.
2010-11-17 20:38:32 -06:00
Robin Sommer
61757ac78b Initial import of svn+ssh:://svn.icir.org/bro/trunk/bro as of r7088 2010-09-27 20:42:30 -07:00