Commit graph

1621 commits

Author SHA1 Message Date
Jon Siwek
d2bf33ee19 Merge branch 'master' into topic/jsiwek/filter-rotation 2011-09-07 12:30:47 -05:00
Jon Siwek
95ed192088 More tweaks to generated script docs.
- The "private interface" section is still tracked, but no longer rendered.
  We can judge the usefulness of it later and add back if there's demand.

- Documentation of event handlers was being treated the same as event
  declarations.  Now handlers are tracked separately, but not currently
  rendered in the generated doc output since usefulness is questionable.
2011-09-07 11:33:08 -05:00
Jon Siwek
80e154ba3c Various changes to documentation framework.
- Reorganize top-level 'doc' Makefile target so submodules can easily
  add their own doc-generating routines to it.  e.g. the Bro project
  makes a placeholder 'doc' target, then adds 'restdoc', 'sphinxdoc';
  later Broccoli can add it's own target as a dependency for generating
  API docs.

- Fixed generated docs for BIFs not being organized under a base/
  subdirectory like the original source files.

- Fixed documentation style for function parameters not applying to
  functions declared as record fields.

- Misc. script documentation tweaks to address warnings given by Sphinx.
2011-09-07 10:02:15 -05:00
Seth Hall
eda2245e9e Merge remote-tracking branch 'origin/topic/seth/pf_ring_support'
* origin/topic/seth/pf_ring_support:
  Added pf_ring load balancing support to the scripting layer.
2011-09-06 15:20:22 -04:00
Gilbert Clark gc355804@ohio.edu
cff47dd98f Updating tests. 2011-09-05 12:12:09 -07:00
Gilbert Clark gc355804@ohio.edu
3953b851e5 Merge branch 'master' into topic/gilbert/rand-pool
Conflicts:
	testing/btest/Baseline/istate.events-ssl/receiver.http.log
	testing/btest/Baseline/istate.events-ssl/sender.http.log
	testing/btest/Baseline/istate.events/receiver.http.log
	testing/btest/Baseline/istate.events/sender.http.log
	testing/btest/Baseline/scripts.base.protocols.smtp.basic/smtp.log
2011-09-05 11:40:34 -07:00
Robin Sommer
33584ec721 Updating test baselines for new ASCII log header. 2011-09-04 13:27:46 -07:00
Robin Sommer
630c256a72 Merge remote branch 'origin/topic/gilbert/ascii-header'
* origin/topic/gilbert/ascii-header:
  Updated tests; removed net type from type conversion code.
  Updated header format (see #558)
  Header modification to LogWriterAscii to make it easier for scripts to understand bro log files.

Notes:

    - I've refactored the code a bit, also adapting the style a bit.
      Also edited the header format slightly.

    - I'm skipping the testing/btest/profiles directory, which seems
      unrelated.

    - I'm also skipping the baseline updates as they weren't
      up-to-date anymore. Will update them in a subsequent commit.
2011-09-04 12:12:08 -07:00
Robin Sommer
c03d034e49 Updating baselines for recent changes. 2011-09-04 10:18:56 -07:00
Seth Hall
31efa3d828 HTTP analyzer is now enabled with any of the HTTP events. 2011-09-04 09:51:16 -07:00
Gregor Maier
a9155aceb2 Fix missing format string that caused some segfaults (v2)
My previous fix wasn't enough.
2011-09-04 09:50:21 -07:00
Gregor Maier
b6923dc55a Fix missing format string that caused some segfaults.
Binpac exceptions caught in Analyzer.cc are passed to Reporter::Weird
and from there to Reporter::WeirdHelper. WeirdHelper has var args, to
support passing them on to DoLog, but there were no forced format
strings. Since the binpac exception can contain network data which can
contain %-characters, that caused segfaults.
2011-09-04 09:50:07 -07:00
Gregor Maier
5b6cc7fe0f Print time interval with 6 decimal places, same as we do for time vals. 2011-09-04 09:49:35 -07:00
Robin Sommer
8e5681d34a Updating submodule(s). 2011-09-04 09:46:04 -07:00
Robin Sommer
e49dc83de6 Merge remote branch 'origin/topic/jsiwek/findpcap_pfring'
* origin/topic/jsiwek/findpcap_pfring:
  FindPCAP now links against thread library when necessary (e.g. PF_RING's libpcap)

Closes #589.
2011-09-04 09:00:55 -07:00
Robin Sommer
fbe6356927 Install binaries with an RPATH.
Note, I didn't see the topic/jsiwek/cmake-rpath branch in the Bro
repository so I copied the change from the submodules, assuming it
applies in the same way.
2011-09-04 09:00:55 -07:00
Robin Sommer
29e9183f5b Merge remote branch 'origin/topic/jsiwek/nested-record-coerce-fix'
* origin/topic/jsiwek/nested-record-coerce-fix:
  Fix for a case where nested records weren't coerced even though possible.

Closes #571.
2011-09-04 09:00:45 -07:00
Robin Sommer
0d202962bc Merge remote branch 'origin/topic/jsiwek/ascii-log-rotate-fix'
* origin/topic/jsiwek/ascii-log-rotate-fix:
  Change ASCII writer to delay creation of log after rotation until next write.

Closes #570.
2011-09-04 09:00:28 -07:00
Robin Sommer
ccad24b685 Merge remote branch 'origin/topic/jsiwek/snaplen'
* origin/topic/jsiwek/snaplen:
  Change default snaplen to 65535, add -l/--snaplen command line option.

Closes #447.
2011-09-04 08:59:48 -07:00
Robin Sommer
1c75cd5748 Merge remote branch 'origin/fastpath'
* origin/fastpath:
  Move the `make dist` target into a shell script.
  Update baselines for intervals now using constant 6 decimal place format.
2011-09-04 08:23:28 -07:00
Robin Sommer
d97297b6ce Small tweaks to recent commits. 2011-09-04 08:21:02 -07:00
Seth Hall
11c437faa3 Logging framework update and mass Log::ID renaming.
- Log path's are generated in the scripting land
  now.  The default Log stream ID to path string
  mapping works like this:
    - Notice::LOG -> "notice"
    - Notice::POLICY_LOG -> "notice_policy"
    - TestModule::LOG -> "test_module"

- Logging streams updated across all of the shipped
  scripts to be more user friendly.  Instead of
  the logging stream ID HTTP::HTTP, we now have
  HTTP::LOG, etc.

- The priorities on some bro_init handlers have
  been adjusted to make the process of applying
  filters or disabling streams easier for users.
2011-09-03 01:10:17 -04:00
Seth Hall
fe53091cd1 Merge commit '2e853a3'
* commit '2e853a3':
  Change presentation of enum val to include namespace.
2011-09-02 15:04:25 -04:00
Jon Siwek
4c8f1c4b62 FindPCAP now links against thread library when necessary (e.g. PF_RING's libpcap) 2011-09-02 13:01:02 -05:00
Seth Hall
771f8bc910 Added pf_ring load balancing support to the scripting layer.
- If the misc/pf-ring-load-balancing script is loaded, the correct
  environment variables will be set to enable automatic flow based
  load balancing used pf_ring if Bro is built against the pf_ring
  libpcap wrapper.  Loading the script on non-Linux OSs or when Bro
  isn't linked against the correct libpcap has no known side effects
  since the script just sets environment variables.

- Added a BiF named setenv for setting environment variables.
2011-09-02 10:43:32 -04:00
Jon Siwek
78512569e9 Move the make dist target into a shell script.
With the side effect of making `sudo make install` from the source
root work again (the $(PWD) in the Makefile didn't propagate w/ sudo)
2011-09-01 16:34:53 -05:00
Jon Siwek
9c0fc5fe48 Merge branch 'master' into fastpath 2011-09-01 16:32:29 -05:00
Gregor Maier
c680c31722 Merge branch 'master' into fastpath 2011-09-01 08:26:34 -07:00
Seth Hall
1726aee4e9 Merge remote-tracking branch 'origin/topic/jsiwek/reporter-fatal-bif'
* origin/topic/jsiwek/reporter-fatal-bif:
  Add a Reporter::fatal BIF.
2011-09-01 10:52:39 -04:00
Seth Hall
4a0fdbab71 Updating the broctl submodule. 2011-08-31 13:20:16 -04:00
Jon Siwek
02ce833c49 Update baselines for intervals now using constant 6 decimal place format. 2011-08-31 11:17:55 -05:00
Jon Siwek
2e853a3892 Change presentation of enum val to include namespace.
Enum vals now add their full identifier string, including module
namespace to ODescs.
2011-08-31 10:57:19 -05:00
Jon Siwek
a38c45b8bf Merge branch 'master' into fastpath 2011-08-31 10:41:07 -05:00
Seth Hall
c67c1e8ba6 Merge remote-tracking branch 'origin/topic/jsiwek/geoip-fixes'
* origin/topic/jsiwek/geoip-fixes:
  Fixes for GeoIP support (addresses #538).
2011-08-31 10:29:39 -04:00
Seth Hall
96c0a07027 Merge remote-tracking branch 'origin/topic/jsiwek/scp-log-pp'
* origin/topic/jsiwek/scp-log-pp:
  Add a log postprocessing function that can SCP rotated logs to remote hosts.
2011-08-31 10:22:08 -04:00
Seth Hall
0a6eb743fa Merge remote-tracking branch 'origin/topic/jsiwek/scp-log-pp'
* origin/topic/jsiwek/scp-log-pp:
  Add a log postprocessing function that can SCP rotated logs to remote hosts.
2011-08-31 09:24:14 -04:00
Seth Hall
203f00060c Merge remote-tracking branch 'origin/topic/jsiwek/mail-alarms'
* origin/topic/jsiwek/mail-alarms:
  Finish capability of emailing bulk alarm logs at a configurable interval.
2011-08-31 09:16:55 -04:00
Seth Hall
fed6d76488 HTTP analyzer is now enabled with any of the HTTP events. 2011-08-31 01:16:43 -04:00
Jon Siwek
13a09aa488 Fixes for GeoIP support (addresses #538).
- Missing GeoIP databases now generate warnings/errors that go through
  the reporter framework instead of hitting GeoIP's internal use of
  stderr

- lookup_location now just queries for country code if the city database
  was not loaded, which gets rid of invalid database type errors.

- lookup_location now leaves missing fields uninitialized in the
  returned geo_location record value.  Updated existing scripts to
  check for initialized fields in geo_location records before use.

- Fixed support for GeoIP's IPv6 API and databases
2011-08-30 17:02:07 -05:00
Gilbert Clark gc355804@ohio.edu
97b7140332 Merge remote-tracking branch 'origin/master' into topic/gilbert/rand-pool
Conflicts:
	testing/btest/Baseline/core.vlan-mpls/conn.log
	testing/btest/btest.cfg
2011-08-30 11:59:59 -07:00
Gilbert Clark gc355804@ohio.edu
728c0b5b35 Updated tests; removed net type from type conversion code. 2011-08-30 11:40:50 -07:00
Gilbert Clark gc355804@ohio.edu
5b6329577f Merge remote-tracking branch 'origin/master' into topic/gilbert/ascii-header
Conflicts:
	testing/btest/Baseline/core.print-bpf-filters-ipv4/conn.log
	testing/btest/Baseline/core.vlan-mpls/conn.log
	testing/btest/Baseline/policy.frameworks.logging.remote-types/receiver.test.log
	testing/btest/Baseline/policy.frameworks.logging.types/ssh.log
	testing/btest/btest.cfg
2011-08-30 11:25:55 -07:00
Gilbert Clark gc355804@ohio.edu
3b411b69f3 Updated header format (see #558) 2011-08-30 11:20:28 -07:00
Jon Siwek
0ae1d8a359 Change default snaplen to 65535, add -l/--snaplen command line option.
Addresses #447.
2011-08-29 15:47:48 -05:00
Jon Siwek
c8b2698754 Add a log postprocessing function that can SCP rotated logs to remote hosts. 2011-08-29 12:28:38 -05:00
Jon Siwek
263ef2bfc9 Add an optional Log::RotationControl to Log::Filter records.
This allows for the RotationControl to be automatically added to the
Log::rotation_control table for the filter's (writer, path) when it is
added to a stream via Log::add_filter.  Log::remove_filter now also
removes any RotationControl's associated with the filter from the
Log::rotation_control table.
2011-08-26 14:36:56 -05:00
Jon Siwek
f08ef8350a Fix for a case where nested records weren't coerced even though possible. 2011-08-26 13:59:51 -05:00
Seth Hall
005b1505b8 Fixing an accidently abandoned test. 2011-08-25 16:53:39 -04:00
Seth Hall
fc5f22cb5d Merge remote-tracking branch 'origin/topic/jsiwek/reorg-followup' 2011-08-25 16:44:31 -04:00
Jon Siwek
31e70e447d Add a Reporter::fatal BIF.
This can be used from a Bro script to cause Bro to exit with non-zero
status and a message to stderr.  Uses of the exit() BIF in scripts
for terminating Bro because of an error were replaced with this one,
which addresses #564.
2011-08-25 13:13:39 -05:00